Edit tour

Windows Analysis Report
PyIsvSahWy.exe

Overview

General Information

Sample name:	PyIsvSahWy.exe renamed because original name is a hash value
Original sample name:	ae601b5d146625e57ed192f334882823.exe
Analysis ID:	1577609
MD5:	ae601b5d146625e57ed192f334882823
SHA1:	882a2f15960cacbe612a73170b2d577e6476730f
SHA256:	8a50b6a8a1aaf1304c853d1ff3f6e93d65172b1f0381e2b86cef8d550100627a
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains an invalid checksum

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Classification

Process Tree

System is w10x64

PyIsvSahWy.exe (PID: 3840 cmdline: "C:\Users\user\Desktop\PyIsvSahWy.exe" MD5: AE601B5D146625E57ED192F334882823)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: PyIsvSahWy.exe

ReversingLabs: Detection: 28%

Source: PyIsvSahWy.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B90785A0 FindFirstFileExW,FindClose,	0_2_00007FF6B90785A0
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B90779B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF6B90779B0
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B9090B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF6B9090B84

Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B9095C74	0_2_00007FF6B9095C74
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B9071000	0_2_00007FF6B9071000
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B9098A38	0_2_00007FF6B9098A38
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B9080A60	0_2_00007FF6B9080A60
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B9081280	0_2_00007FF6B9081280
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B9087AAC	0_2_00007FF6B9087AAC
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B9078B20	0_2_00007FF6B9078B20
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B909518C	0_2_00007FF6B909518C
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B90891B0	0_2_00007FF6B90891B0
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B908D200	0_2_00007FF6B908D200
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B9080C64	0_2_00007FF6B9080C64
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B9081484	0_2_00007FF6B9081484
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B9082CC4	0_2_00007FF6B9082CC4
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B9090B84	0_2_00007FF6B9090B84
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B90933BC	0_2_00007FF6B90933BC
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B90873F4	0_2_00007FF6B90873F4
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B908FBD8	0_2_00007FF6B908FBD8
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B9080E70	0_2_00007FF6B9080E70
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B9094F10	0_2_00007FF6B9094F10
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B908FBD8	0_2_00007FF6B908FBD8
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B9095728	0_2_00007FF6B9095728
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B9081F30	0_2_00007FF6B9081F30
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B9092F20	0_2_00007FF6B9092F20
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B908CD6C	0_2_00007FF6B908CD6C
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B90795FB	0_2_00007FF6B90795FB
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B9085040	0_2_00007FF6B9085040
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B9081074	0_2_00007FF6B9081074
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B908D880	0_2_00007FF6B908D880
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B90828C0	0_2_00007FF6B90828C0
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B907979B	0_2_00007FF6B907979B
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B9079FCD	0_2_00007FF6B9079FCD

Source: C:\Users\user\Desktop\PyIsvSahWy.exe

Code function: String function: 00007FF6B90725F0 appears 50 times

Source: PyIsvSahWy.exe	Binary or memory string: OriginalFilename vs PyIsvSahWy.exe
Source: PyIsvSahWy.exe, 00000000.00000000.2172877691.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamewusa.exej% vs PyIsvSahWy.exe
Source: PyIsvSahWy.exe	Binary or memory string: OriginalFilenamewusa.exej% vs PyIsvSahWy.exe

Source: classification engine

Classification label: mal48.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\PyIsvSahWy.exe

Code function: 0_2_00007FF6B90729E0 GetLastError,FormatMessageW,MessageBoxW,

0_2_00007FF6B90729E0

Source: PyIsvSahWy.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PyIsvSahWy.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PyIsvSahWy.exe

ReversingLabs: Detection: 28%

Source: C:\Users\user\Desktop\PyIsvSahWy.exe

File read: C:\Users\user\Desktop\PyIsvSahWy.exe

Jump to behavior

Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Section loaded: wintypes.dll	Jump to behavior

Source: PyIsvSahWy.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: PyIsvSahWy.exe

Static file information: File size 1803264 > 1048576

Source: PyIsvSahWy.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: PyIsvSahWy.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: PyIsvSahWy.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: PyIsvSahWy.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: PyIsvSahWy.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: PyIsvSahWy.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: PyIsvSahWy.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: PyIsvSahWy.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: PyIsvSahWy.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: PyIsvSahWy.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: PyIsvSahWy.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: PyIsvSahWy.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: PyIsvSahWy.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: PyIsvSahWy.exe

Static PE information: real checksum: 0x8c8069 should be: 0x1be994

Source: C:\Users\user\Desktop\PyIsvSahWy.exe

Code function: 0_2_00007FF6B9076EA0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF6B9076EA0

Source: C:\Users\user\Desktop\PyIsvSahWy.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-17488

Source: C:\Users\user\Desktop\PyIsvSahWy.exe

API coverage: 6.4 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B90785A0 FindFirstFileExW,FindClose,	0_2_00007FF6B90785A0
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B90779B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF6B90779B0
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B9090B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF6B9090B84

Source: C:\Users\user\Desktop\PyIsvSahWy.exe

Code function: 0_2_00007FF6B907C44C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6B907C44C

Source: C:\Users\user\Desktop\PyIsvSahWy.exe

Code function: 0_2_00007FF6B9092790 GetProcessHeap,

0_2_00007FF6B9092790

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B907C44C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6B907C44C
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B907BBC0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6B907BBC0
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B907C62C SetUnhandledExceptionFilter,	0_2_00007FF6B907C62C
Source: C:\Users\user\Desktop\PyIsvSahWy.exe	Code function: 0_2_00007FF6B9089924 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6B9089924

Source: C:\Users\user\Desktop\PyIsvSahWy.exe

Code function: 0_2_00007FF6B9098880 cpuid

0_2_00007FF6B9098880

Source: C:\Users\user\Desktop\PyIsvSahWy.exe

Code function: 0_2_00007FF6B907C330 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6B907C330

Source: C:\Users\user\Desktop\PyIsvSahWy.exe

Code function: 0_2_00007FF6B909518C _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF6B909518C

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 DLL Side-Loading	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PyIsvSahWy.exe	29%	ReversingLabs	Win64.Trojan.Etset

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
ax-0001.ax-msedge.net	150.171.27.10	true	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577609
Start date and time:	2024-12-18 15:53:53 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PyIsvSahWy.exe renamed because original name is a hash value
Original Sample Name:	ae601b5d146625e57ed192f334882823.exe
Detection:	MAL
Classification:	mal48.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 20 Number of non-executed functions: 83
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.95.31.18, 92.122.16.236, 13.107.246.63, 20.190.177.148, 20.223.35.26, 2.16.158.33, 4.245.163.56, 150.171.27.10, 2.16.158.176
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, tse1.mm.bing.net, ctldl.windowsupdate.com, g.bing.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, login.live.com, e16604.g.akamaiedge.net, glb.cws.prod.dcat.dsp.trafficmanager.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net
VT rate limit hit for: PyIsvSahWy.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ax-0001.ax-msedge.net	bandwidth_monitor.exe	Get hash	malicious	Unknown	Browse	150.171.27.10
	Ball - Temp.data for GCMs.doc	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10
	https://launch.app/plainsart	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10
	random.exe.2.exe	Get hash	malicious	LummaC	Browse	150.171.27.10
	stail.exe.3.exe	Get hash	malicious	Socks5Systemz	Browse	150.171.28.10
	file.exe	Get hash	malicious	Unknown	Browse	150.171.27.10
	R0SkdJNujW.exe	Get hash	malicious	Unknown	Browse	150.171.28.10
	index.html.docx	Get hash	malicious	Unknown	Browse	150.171.27.10
	99awhy8l.exe	Get hash	malicious	LummaC	Browse	150.171.28.10
	Opdxdyeul.exe	Get hash	malicious	SystemBC	Browse	150.171.27.10
bg.microsoft.map.fastly.net	PkContent.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://launch.app/plainsart	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	ji2xlo1f.exe	Get hash	malicious	LummaC	Browse	199.232.210.172
	Order_948575494759.xls	Get hash	malicious	Unknown	Browse	199.232.214.172
	DocuStream_Scan_l8obgs3v.pdf	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	stail.exe.3.exe	Get hash	malicious	Socks5Systemz	Browse	199.232.214.172
	22TxDBB1.bat	Get hash	malicious	Unknown	Browse	199.232.214.172
	sxVHUOSqVC.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	pyld611114.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	Lu4421.exe	Get hash	malicious	AsyncRAT, DcRat, Stealerium	Browse	199.232.214.172

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.924314180370906
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PyIsvSahWy.exe
File size:	1'803'264 bytes
MD5:	ae601b5d146625e57ed192f334882823
SHA1:	882a2f15960cacbe612a73170b2d577e6476730f
SHA256:	8a50b6a8a1aaf1304c853d1ff3f6e93d65172b1f0381e2b86cef8d550100627a
SHA512:	b78edaeebaf3a206729f528a0bd6e73003a5650ec8f01d0bbd0c87c328fedd865f9443f8302008442d6fd90e20967d33ede942dfd70d3cd78b563c4208b2b876
SSDEEP:	49152:6riCrSsBav5PTa1cluR79QyQsb8QBFO89B:6TSiUlux9XQsb8QzpB
TLSH:	BC851298B3E50EE5FDB7513EC8528607D7B2BC220760DA9F03B046670F136E59D2A792
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Xhc.Xhc.Xhc...`._hc...f..hc...g.Rhc.....[hc...`.Qhc...g.Ihc...f.phc...b.Shc.Xhb..hc.K.g.Ahc.K.a.Yhc.RichXhc.........PE..d..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14000c0d0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x669909F2 [Thu Jul 18 12:26:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	456e8615ad4320c9f54e50319a19df9c

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FB20CAD3AACh
dec eax
add esp, 28h
jmp 00007FB20CAD36CFh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007FB20CAD3E78h
test eax, eax
je 00007FB20CAD3873h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007FB20CAD3857h
dec eax
cmp ecx, eax
je 00007FB20CAD3866h
xor eax, eax
dec eax
cmpxchg dword ptr [0003843Ch], ecx
jne 00007FB20CAD3840h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007FB20CAD3849h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007FB20CAD3859h
mov byte ptr [00038425h], 00000001h
call 00007FB20CAD2FA5h
call 00007FB20CAD4290h
test al, al
jne 00007FB20CAD3856h
xor al, al
jmp 00007FB20CAD3866h
call 00007FB20CAE0D9Fh
test al, al
jne 00007FB20CAD385Bh
xor ecx, ecx
call 00007FB20CAD42A0h
jmp 00007FB20CAD383Ch
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [000383ECh], 00000000h
mov ebx, ecx
jne 00007FB20CAD38B9h
cmp ecx, 01h
jnbe 00007FB20CAD38BCh
call 00007FB20CAD3DEEh
test eax, eax
je 00007FB20CAD387Ah
test ebx, ebx
jne 00007FB20CAD3876h
dec eax
lea ecx, dword ptr [000383D6h]
call 00007FB20CAE0B92h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3c76c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x49000	0x94c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x46000	0x2208	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x8beba3	0x2448
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4a000	0x768	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x39dc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39c80	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x450	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29210	0x29400	aca64598002ecff9eefbc96554edf015	False	0.5511067708333334	data	6.4784482217419175	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12642	0x12800	707f62f07c15d947659847c2c167585f	False	0.524585620777027	data	5.750842204545925	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x73d8	0xe00	d0a288978c66419b180b35f625b6dce7	False	0.13532366071428573	data	1.8378139998458343	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x46000	0x2208	0x2400	74cf3ea22e0a1756984435d6f80f7da5	False	0.4671223958333333	data	5.259201915045256	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x49000	0x94c	0xa00	c1b8b9c35bd90af92121f3e7dc8cea02	False	0.428515625	data	5.096629753028753	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x4a000	0x768	0x800	71de9271648326ec88350e903470cf3e	False	0.5576171875	data	5.283119454571673	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x490a0	0x39c	data			0.45670995670995673
RT_MANIFEST	0x4943c	0x50d	XML 1.0 document, ASCII text			0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, GetLastError, FormatMessageW, GetModuleFileNameW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, CreateDirectoryW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, GetEnvironmentStringsW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, WaitForSingleObject, Sleep, GetCurrentProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, DeleteFileW, IsProcessorFeaturePresent, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Network Behavior

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 15:55:14.254487038 CET	1.1.1.1	192.168.2.6	0x1998	No error (0)	g-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 15:55:14.254487038 CET	1.1.1.1	192.168.2.6	0x1998	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:55:14.254487038 CET	1.1.1.1	192.168.2.6	0x1998	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:55:37.865242958 CET	1.1.1.1	192.168.2.6	0xb3e9	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:55:37.865242958 CET	1.1.1.1	192.168.2.6	0xb3e9	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	09:54:49
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\PyIsvSahWy.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\PyIsvSahWy.exe"
Imagebase:	0x7ff6b9070000
File size:	1'803'264 bytes
MD5 hash:	AE601B5D146625E57ED192F334882823
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	23

Executed Functions

Function 00007FF6B9071000 Relevance: 40.6, APIs: 5, Strings: 18, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

pyi-contents-directory, xrefs: 00007FF6B90735F8
bye-runtime-tmpdir, xrefs: 00007FF6B90735D3
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF6B907378C
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF6B90736FC
Could not create temporary directory!, xrefs: 00007FF6B9073838
Failed to convert DLL search path!, xrefs: 00007FF6B90738A3
pkg, xrefs: 00007FF6B90737CF
Failed to start splash screen!, xrefs: 00007FF6B9073933
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF6B907391A
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF6B9073820
ERROR: failed to remove temporary directory: %s, xrefs: 00007FF6B9073A12
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF6B9073653
pyi-disable-windowed-traceback, xrefs: 00007FF6B907361D
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF6B90737EF
_MEIPASS2, xrefs: 00007FF6B90736A2, 00007FF6B90736AE, 00007FF6B90739AC
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF6B9073905
MEI, xrefs: 00007FF6B907374E
WARNING: failed to remove temporary directory: %s, xrefs: 00007FF6B9073A31

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: FileModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$ERROR: failed to remove temporary directory: %s$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$MEI$PYINSTALLER_STRICT_UNPACK_MODE$Path exceeds PYI_PATH_MAX limit.$WARNING: failed to remove temporary directory: %s$_MEIPASS2$bye-runtime-tmpdir$pkg$pyi-contents-directory$pyi-disable-windowed-traceback
API String ID: 514040917-1099759049
Opcode ID: ec9c6756989ef5fd9ea5977df3e9171bdd9129db5db0c6cc95fad3a29ce92e3f
Instruction ID: 8555319f143c1c809de93393045b31b83dd8a0d2983c65f2aa7e42a6d00691a8
Opcode Fuzzy Hash: ec9c6756989ef5fd9ea5977df3e9171bdd9129db5db0c6cc95fad3a29ce92e3f
Instruction Fuzzy Hash: ADF14B22B08683A2FA19DF2DE5552F96361AF947A0F84403ADB5DC36D7EF2CE558C300

Function 00007FF6B9095C74 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6B90959A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B90959E9
Part of subcall function 00007FF6B90959A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B9095A67
Part of subcall function 00007FF6B90959A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B9095AB8

CreateFileW.KERNELBASE ref: 00007FF6B9095D7A
CreateFileW.KERNEL32 ref: 00007FF6B9095DCA
GetLastError.KERNEL32 ref: 00007FF6B9095DFA
GetFileType.KERNELBASE ref: 00007FF6B9095E0F
GetLastError.KERNEL32 ref: 00007FF6B9095E19
CloseHandle.KERNEL32 ref: 00007FF6B9095E4C
CloseHandle.KERNEL32 ref: 00007FF6B9095FAF
CreateFileW.KERNEL32 ref: 00007FF6B9095FE4
GetLastError.KERNEL32 ref: 00007FF6B9095FF3

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
Instruction ID: 2459e239f82df1881487f74244d1ea0d590648262fb8a422e6242ec1f8474693
Opcode Fuzzy Hash: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
Instruction Fuzzy Hash: B9C1B036B28A4186EB14CF6DC4946AD3761FB89BA8F011239DF2E97795DF38E451C300

Function 00007FF6B90785A0 Relevance: 3.0, APIs: 2, Instructions: 29
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF6B90785D3
FindClose.KERNELBASE ref: 00007FF6B90785E2

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
Instruction ID: 460ff9f58614ebdb91519e1e078c09ef6aeec9346a754e29b501c0220d7e81de
Opcode Fuzzy Hash: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
Instruction Fuzzy Hash: 5DF06262A1D64286F7A08F68B4997667390AB84778F44033DDB6D426D4DF3CE059CA04

Function 00007FF6B90718F0 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6B90776A0: _fread_nolock.LIBCMT ref: 00007FF6B907774A

_fread_nolock.LIBCMT ref: 00007FF6B90719B4

Part of subcall function 00007FF6B9072760: MessageBoxW.USER32 ref: 00007FF6B907283B

Strings

Failed to seek to cookie position!, xrefs: 00007FF6B9071989
Could not allocate memory for archive structure!, xrefs: 00007FF6B90719EE
fseek, xrefs: 00007FF6B9071990
MEI, xrefs: 00007FF6B9071931
fread, xrefs: 00007FF6B90719C6, 00007FF6B9071ADB
Could not allocate buffer for TOC!, xrefs: 00007FF6B9071AA1
malloc, xrefs: 00007FF6B9071AA8
calloc, xrefs: 00007FF6B90719F5
Could not read full TOC!, xrefs: 00007FF6B9071AD4
Error on file., xrefs: 00007FF6B9071B0A
Failed to read cookie!, xrefs: 00007FF6B90719BF

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: _fread_nolock$Message
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 677216364-3497178890
Opcode ID: 13a0f64d29e36a252706f5b53b21b28111f50ffc545313b1ad9e8f0af8fc9de4
Instruction ID: 42f6834947983353e92386b79311691b9deb8846b529beb1dda3c6854d3cf922
Opcode Fuzzy Hash: 13a0f64d29e36a252706f5b53b21b28111f50ffc545313b1ad9e8f0af8fc9de4
Instruction Fuzzy Hash: 58718371B1868699EB60DF2CE4502B92391FF487A4F548039DB8DC779AEE2CE545C740

Function 00007FF6B908AD6C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B908B199

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 68a47ba86f230bb5d63a3bd262fc543bc7d5861b4e9f61d57eff9af495398285
Instruction ID: a0336df4598d71e1c5fdf415765924a0028c95221b6e35fd5d63c4585f5c2e4c
Opcode Fuzzy Hash: 68a47ba86f230bb5d63a3bd262fc543bc7d5861b4e9f61d57eff9af495398285
Instruction Fuzzy Hash: 13C1F422B0C68791EB699F6D94803BE3B94FB90B80F550139DB5D87B92CE7CE855D700

Function 00007FF6B90733E0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF6B9073534), ref: 00007FF6B9073411

Part of subcall function 00007FF6B90729E0: GetLastError.KERNEL32(?,?,?,00007FF6B907342E,?,00007FF6B9073534), ref: 00007FF6B9072A14
Part of subcall function 00007FF6B90729E0: FormatMessageW.KERNEL32(?,?,?,00007FF6B907342E), ref: 00007FF6B9072A7D
Part of subcall function 00007FF6B90729E0: MessageBoxW.USER32 ref: 00007FF6B9072ACF

Strings

Failed to convert executable path to UTF-8., xrefs: 00007FF6B90734B8
Failed to resolve full path to executable %ls., xrefs: 00007FF6B9073461
GetModuleFileNameW, xrefs: 00007FF6B9073422
Failed to obtain executable path., xrefs: 00007FF6B907341B
\\?\, xrefs: 00007FF6B9073482

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: Message$ErrorFileFormatLastModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 517058245-2863816727
Opcode ID: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
Instruction ID: c9065bd7497164a44ed5b8b08ed7ef310d65d006c72d29e4c7430bd13a099dfe
Opcode Fuzzy Hash: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
Instruction Fuzzy Hash: BB216061F1C54392FE25AF2DE8513B96250BF487A4F80423AD75DC65E6EE2CE504C710

Function 00007FF6B90725F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6B90786B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6B9073FA4,00000000,00007FF6B9071925), ref: 00007FF6B90786E9

MessageBoxW.USER32 ref: 00007FF6B9072686
MessageBoxA.USER32 ref: 00007FF6B907269A

Strings

Error, xrefs: 00007FF6B9072677
Error/warning (ANSI fallback), xrefs: 00007FF6B907268E

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error$Error/warning (ANSI fallback)
API String ID: 1878133881-653037927
Opcode ID: f4c9aea142df8fc367965a88b37001c6795115f60fce42f8f88369c54fa23369
Instruction ID: 9d44f25912e9b12e26f2196d137dc64ef786954429fc977ed7c8f95290c13f38
Opcode Fuzzy Hash: f4c9aea142df8fc367965a88b37001c6795115f60fce42f8f88369c54fa23369
Instruction Fuzzy Hash: 5911BFB2628B8581FB208F18F461BA93364FB84B84F90513ADB9C97685CF3CD605C740

Function 00007FF6B907BF5C Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6B907C12C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6B907C140

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6B907BF80
__scrt_release_startup_lock.LIBCMT ref: 00007FF6B907BFEE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6B907C041

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
Instruction ID: a8003789a3846950d6d25a2bca999c7ee39a437caeff97c0f425b601e55604f9
Opcode Fuzzy Hash: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
Instruction Fuzzy Hash: 71313921E0D66385FA68AF6C94523B92391AF417A4F44443CEB0ECB7D3DE2DF9458291

Function 00007FF6B9088D48 Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6B9088D44), ref: 00007FF6B9088D59
TerminateProcess.KERNEL32(?,?,?,00007FF6B9088D44), ref: 00007FF6B9088D64
ExitProcess.KERNEL32 ref: 00007FF6B9088D73

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 824606f6feba241c18d37bd9947fb033388d99e3127919417550cde66a1966b4
Instruction ID: 025da981a46ec56b6d139ba0bdd0bcab75799f19804e867d77f5e964d8422756
Opcode Fuzzy Hash: 824606f6feba241c18d37bd9947fb033388d99e3127919417550cde66a1966b4
Instruction Fuzzy Hash: C9D06C10B2870A87EA686F78689917A13616FA8B11B50183CDA5A8A3A3DE2CE8094240

Function 00007FF6B907F45C Relevance: 3.2, APIs: 2, Instructions: 177
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B907F4A0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B907F597

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9ca15b9002a87b72fd1966d073ee072d8ab2af6885046d3198ed673a4b76404c
Instruction ID: af3804b7854f1b99896f053226ef5a1a2562063e12dc657f2ba86eff36301699
Opcode Fuzzy Hash: 9ca15b9002a87b72fd1966d073ee072d8ab2af6885046d3198ed673a4b76404c
Instruction Fuzzy Hash: 2A519561B0968246FA689E3E940067A6691BF44BB8F24873CDF7DC77DACE3CE4418610

Function 00007FF6B908B444 Relevance: 3.0, APIs: 2, Instructions: 46
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF6B908B5DD), ref: 00007FF6B908B490
GetLastError.KERNEL32(?,?,?,?,?,00007FF6B908B5DD), ref: 00007FF6B908B49A

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
Instruction ID: 9164f6953b99addcacc667d88876d535aa993e6b467a594ae9d0ea3e76e660b0
Opcode Fuzzy Hash: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
Instruction Fuzzy Hash: 7B11C161B18A8181DA148F2DA8841697361AB84BF4F585339EF7D877EACF7CD0548700

Function 00007FF6B9089E68 Relevance: 2.6, APIs: 2, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF6B9089CE5,?,?,00000000,00007FF6B9089D9A), ref: 00007FF6B9089ED6
GetLastError.KERNEL32(?,?,?,00007FF6B9089CE5,?,?,00000000,00007FF6B9089D9A), ref: 00007FF6B9089EE0

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
Instruction ID: c14b8cf252d70207ff94c7fbfd3f04324e4ac033df343d68db82b8e0554e9ef6
Opcode Fuzzy Hash: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
Instruction Fuzzy Hash: 83214F21B2864281EE98AF69A5D037D36919F84BA4F14423DDB7ED76D7DE6CE4418300

Function 00007FF6B908B1BC Relevance: 1.6, APIs: 1, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B908B1E4

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: aa739a885bc1dd54b6575df94a709b393c0322d321e92581108345db9e2bb901
Instruction ID: e9746b4a08d6a7e8f4370220a8f08378e27fe948ac5fb929b8b8918243e950b0
Opcode Fuzzy Hash: aa739a885bc1dd54b6575df94a709b393c0322d321e92581108345db9e2bb901
Instruction Fuzzy Hash: 1241CF32A0860287EA28EF6DA98127D77A4EB56B80F140139DB9EC7691CF3CE542C751

Function 00007FF6B90776A0 Relevance: 1.6, APIs: 1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fread_nolock.LIBCMT ref: 00007FF6B907774A

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 3d01016cc9a5f4d9cb71fb7abf1551689f881e3384e479ff43f26caf71626a79
Instruction ID: cf45673204eedb2502e46ab071ab254d67c7ae174c025675b71606f4234bd58d
Opcode Fuzzy Hash: 3d01016cc9a5f4d9cb71fb7abf1551689f881e3384e479ff43f26caf71626a79
Instruction Fuzzy Hash: 0A21B221B0C65256FA149F1EA9057FAA681BF85BE4F9C4438EF0D8B796DE7DE081C700

Function 00007FF6B908AC4C Relevance: 1.6, APIs: 1, Instructions: 79
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B908ACD2

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 49c1b702f419c8ad0ef71248902cf9a0cc608428026b1214a1a74e14a7199740
Instruction ID: da712047489d7fc85a757c789e18669d097b1802f4271df9ee2b787835c12c5b
Opcode Fuzzy Hash: 49c1b702f419c8ad0ef71248902cf9a0cc608428026b1214a1a74e14a7199740
Instruction Fuzzy Hash: F2318F22F1864286F759AF1D98C137D3654AB50BA1F52023DDB2D937D2CFBCE442A720

Function 00007FF6B9088C79 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6B9088CA7

Part of subcall function 00007FF6B9088DA0: GetModuleHandleExW.KERNEL32 ref: 00007FF6B9088DC5
Part of subcall function 00007FF6B9088DA0: GetProcAddress.KERNEL32 ref: 00007FF6B9088DDB
Part of subcall function 00007FF6B9088DA0: FreeLibrary.KERNEL32 ref: 00007FF6B9088E02

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: ce8bbb5f42c0c70f8d6cb0f644a2b9beff4cd55938d93e86477bcb8353de4fc0
Instruction ID: 958583e044ed0e899c7cd5d0d26baf566cb59d4cdc890129103584135006467f
Opcode Fuzzy Hash: ce8bbb5f42c0c70f8d6cb0f644a2b9beff4cd55938d93e86477bcb8353de4fc0
Instruction Fuzzy Hash: 09218E32B297458AEB689F68C4842EC33A0FB44718F54463ADB2C86AD9EF38D544CB40

Function 00007FF6B90852A4 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B9085209

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
Instruction ID: 1cdb225546123e26c9e2086c566e9516e3746d773d627bda933dc83faf6fea4d
Opcode Fuzzy Hash: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
Instruction Fuzzy Hash: 2C11B421F1C68181EE68AF59948027EB3A4BF96B80F444079EF4CD7B96EF3CE4408740

Function 00007FF6B9095664 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B9095687

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
Instruction ID: 1d8ea8eddde0e97bfb397bbb5980daee6167ceb8f1bf815592a0f7a06374bdd6
Opcode Fuzzy Hash: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
Instruction Fuzzy Hash: F4219672A18A8287DB658F1DE48437976A0FB94B94F144238EB5DC76EADF3CD541CB00

Function 00007FF6B907F6DC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B907F730

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
Instruction ID: c63b9192cc7443840d207c3baf7d76d1206a2d0a55bb7c7471b8f22030770ea8
Opcode Fuzzy Hash: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
Instruction Fuzzy Hash: A501C421B0878241EA04DF5A9900069B6A5BF95FF0F584639DF6C97BD6DE3CE4528300

Function 00007FF6B908C90C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF6B907FFB0,?,?,?,00007FF6B908161A,?,?,?,?,?,00007FF6B9082E09), ref: 00007FF6B908C94A

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
Instruction ID: f4c5f278e540e79863d61cdde89c0405340ceb1f14f8464b3b6543a69f4af3b4
Opcode Fuzzy Hash: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
Instruction Fuzzy Hash: 82F08201F1925744FF5D6F7D589937911E05F55B60F084A78DFBEC52C2DE1CE4408110

Non-executed Functions

Function 00007FF6B9076EA0 Relevance: 119.3, APIs: 33, Strings: 35, Instructions: 280libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6B9076EB7
GetProcAddress.KERNEL32 ref: 00007FF6B9076EFD
GetProcAddress.KERNEL32 ref: 00007FF6B9076F22
GetProcAddress.KERNEL32 ref: 00007FF6B9076F47
GetProcAddress.KERNEL32 ref: 00007FF6B9076F6F
GetProcAddress.KERNEL32 ref: 00007FF6B9076F97
GetProcAddress.KERNEL32 ref: 00007FF6B9076FBF
GetProcAddress.KERNEL32 ref: 00007FF6B9076FE7
GetProcAddress.KERNEL32 ref: 00007FF6B907700F

Strings

Tcl_Free, xrefs: 00007FF6B9077375, 00007FF6B9077391
Tcl_GetVar2, xrefs: 00007FF6B9077195, 00007FF6B90771B1
Tcl_Finalize, xrefs: 00007FF6B9076F65, 00007FF6B9076F81
Tcl_SetVar2Ex, xrefs: 00007FF6B9077285, 00007FF6B90772A1
Tcl_NewStringObj, xrefs: 00007FF6B9077235, 00007FF6B9077251
Tcl_MutexLock, xrefs: 00007FF6B9077055, 00007FF6B9077071
Tcl_NewByteArrayObj, xrefs: 00007FF6B907725D, 00007FF6B9077279
Tcl_EvalObjv, xrefs: 00007FF6B9077325, 00007FF6B9077341
Tcl_Alloc, xrefs: 00007FF6B907734D, 00007FF6B9077369
Tcl_ThreadAlert, xrefs: 00007FF6B907716D, 00007FF6B9077189
Tcl_DeleteInterp, xrefs: 00007FF6B9076FB5, 00007FF6B9076FD1
Tcl_GetCurrentThread, xrefs: 00007FF6B9077005, 00007FF6B9077021
Tk_GetNumMainWindows, xrefs: 00007FF6B90773C5, 00007FF6B90773E1
GetProcAddress, xrefs: 00007FF6B9076ED7
Tcl_JoinThread, xrefs: 00007FF6B907702D, 00007FF6B9077049
Tcl_CreateInterp, xrefs: 00007FF6B9076EF3, 00007FF6B9076F0F
Tcl_Init, xrefs: 00007FF6B9076EB0, 00007FF6B9076EC9
Tcl_EvalFile, xrefs: 00007FF6B90772D5, 00007FF6B90772F1
Tcl_FinalizeThread, xrefs: 00007FF6B9076F8D, 00007FF6B9076FA9
Tcl_MutexFinalize, xrefs: 00007FF6B90770A5, 00007FF6B90770C1
Tcl_CreateObjCommand, xrefs: 00007FF6B90771E5, 00007FF6B9077201
Tcl_CreateThread, xrefs: 00007FF6B9076FDD, 00007FF6B9076FF9
Tcl_ThreadQueueEvent, xrefs: 00007FF6B9077145, 00007FF6B9077161
Tcl_ConditionNotify, xrefs: 00007FF6B90770F5, 00007FF6B9077111
Tcl_GetString, xrefs: 00007FF6B907720D, 00007FF6B9077229
Tcl_GetObjResult, xrefs: 00007FF6B90772AD, 00007FF6B90772C9
Tcl_SetVar2, xrefs: 00007FF6B90771BD, 00007FF6B90771D9
Tcl_MutexUnlock, xrefs: 00007FF6B907707D, 00007FF6B9077099
Tcl_ConditionFinalize, xrefs: 00007FF6B90770CD, 00007FF6B90770E9
Tcl_DoOneEvent, xrefs: 00007FF6B9076F3D, 00007FF6B9076F59
Tcl_EvalEx, xrefs: 00007FF6B90772FD, 00007FF6B9077319
Tcl_ConditionWait, xrefs: 00007FF6B907711D, 00007FF6B9077139
Tcl_FindExecutable, xrefs: 00007FF6B9076F18, 00007FF6B9076F34
Tk_Init, xrefs: 00007FF6B907739D, 00007FF6B90773B9
Failed to get address for %hs, xrefs: 00007FF6B9076ED0

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-3427451314
Opcode ID: ea7dfca1e90abb6d4d8c6eb1b798acaf406610e772db9aaa2d8df727af0780f5
Instruction ID: c4e981dcb9d9b5cfd27f92a5db32ea96956678ad07660bfd9d26138f774b6c50
Opcode Fuzzy Hash: ea7dfca1e90abb6d4d8c6eb1b798acaf406610e772db9aaa2d8df727af0780f5
Instruction Fuzzy Hash: 3FE1C364A4EB03E1FA59DF5DA8501B423B5AF947A4F94103EDB1E823A5EF3CF548C221

Function 00007FF6B90933BC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF6B909340A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B9093A76
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B9093BEC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B9093EAA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B90940CA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B9094307
memcpy_s.LIBCPMT ref: 00007FF6B90943E2
memcpy_s.LIBCPMT ref: 00007FF6B909448D
memcpy_s.LIBCPMT ref: 00007FF6B909455C

Strings

1#INF, xrefs: 00007FF6B9093533
1#SNAN, xrefs: 00007FF6B909351A
1#QNAN, xrefs: 00007FF6B9093523
1#IND, xrefs: 00007FF6B90934F7

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 006b587dceb6a8e5448b800068f928c3aefb42c20130fc8eaa47f3b19415637c
Instruction ID: e01dce10623fe9cd9c2928a826fa2352148275a3bb643f7ae92617a1b2662626
Opcode Fuzzy Hash: 006b587dceb6a8e5448b800068f928c3aefb42c20130fc8eaa47f3b19415637c
Instruction Fuzzy Hash: 9DB2B172A182928BE7658F6DD5407FD77A1FB94788F405139DB0E97A86DF38EA00CB40

Function 00007FF6B90779B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00007FF6B9077EF9,00007FF6B90739E6), ref: 00007FF6B9077A1B
RemoveDirectoryW.KERNEL32(?,00007FF6B9077EF9,00007FF6B90739E6), ref: 00007FF6B9077A9E
DeleteFileW.KERNEL32(?,00007FF6B9077EF9,00007FF6B90739E6), ref: 00007FF6B9077ABD
FindNextFileW.KERNEL32(?,00007FF6B9077EF9,00007FF6B90739E6), ref: 00007FF6B9077ACB
FindClose.KERNEL32(?,00007FF6B9077EF9,00007FF6B90739E6), ref: 00007FF6B9077ADC
RemoveDirectoryW.KERNEL32(?,00007FF6B9077EF9,00007FF6B90739E6), ref: 00007FF6B9077AE5

Strings

%s\*, xrefs: 00007FF6B90779E2

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 37c75c647de740c4d03e434983ba542f23ef98c0d39288f6f50529afbb256bed
Instruction ID: 3398955f71d08e4c17737debba785e6fbbb0fe8bba6f9ed532e63effcc33b8db
Opcode Fuzzy Hash: 37c75c647de740c4d03e434983ba542f23ef98c0d39288f6f50529afbb256bed
Instruction Fuzzy Hash: DD415221A0C942A5FA209F2CE4585B96361FBD47B4F84063ADB9DC36E5DF3CE64AC740

Function 00007FF6B9079FCD Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

invalid code -- missing end-of-block, xrefs: 00007FF6B907A3E6
invalid literal/length code, xrefs: 00007FF6B907A702
invalid distances set, xrefs: 00007FF6B907A4C0
too many length or distance symbols, xrefs: 00007FF6B907A166
invalid code lengths set, xrefs: 00007FF6B907A14D
invalid literal/lengths set, xrefs: 00007FF6B907A453
invalid bit length repeat, xrefs: 00007FF6B907A3B9
invalid distance code, xrefs: 00007FF6B907A8D4
invalid distance too far back, xrefs: 00007FF6B907A990

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 7289e34dee421d23927a0f8f8a094fde9ef8b8d5e9feb20e52711e481e6fcba8
Instruction ID: a1bc9d068b62d686f6875c5461a0f1d235a7ec01af1bbf5407169852913a00be
Opcode Fuzzy Hash: 7289e34dee421d23927a0f8f8a094fde9ef8b8d5e9feb20e52711e481e6fcba8
Instruction Fuzzy Hash: 9752B272A186A68BE7948F18C558B7E3BA9FB84350F52413DE74A87780DF3DD844DB40

Function 00007FF6B907C44C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6B907C468
RtlCaptureContext.KERNEL32 ref: 00007FF6B907C495
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6B907C4AF
RtlVirtualUnwind.KERNEL32 ref: 00007FF6B907C4F0
IsDebuggerPresent.KERNEL32 ref: 00007FF6B907C544
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6B907C561
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6B907C56C

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
Instruction ID: 3475e4637dd384cdccf2c1a36c8c915ade73c2656d0bc75a11bb7385b3231e17
Opcode Fuzzy Hash: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
Instruction Fuzzy Hash: AD310A72609B8186EB649F68E8807EE73A4FB84754F44403ADB4E87B99DF3CD648C714

Function 00007FF6B90729E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6B907342E,?,00007FF6B9073534), ref: 00007FF6B9072A14
FormatMessageW.KERNEL32(?,?,?,00007FF6B907342E), ref: 00007FF6B9072A7D
MessageBoxW.USER32 ref: 00007FF6B9072ACF

Strings

Error, xrefs: 00007FF6B9072ABE
%ls%ls: %ls, xrefs: 00007FF6B9072A96
<FormatMessageW failed.>, xrefs: 00007FF6B9072A83

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: Message$ErrorFormatLast
String ID: %ls%ls: %ls$<FormatMessageW failed.>$Error
API String ID: 3971115935-1149178304
Opcode ID: 0ded6d4e5eeb2df7dd6c32992adf891535d6bffb348d119068df09e90069f5ad
Instruction ID: 2ddd0b3955a3143de0b0d6b67db32a1ac41a9aa19e34f3e315a8065534646d5e
Opcode Fuzzy Hash: 0ded6d4e5eeb2df7dd6c32992adf891535d6bffb348d119068df09e90069f5ad
Instruction Fuzzy Hash: 01214172618B8582E7209F29F4506EA73A4FB88794F40013AEBCD93A99DF7CD546CB40

Function 00007FF6B9094F10 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6B9094F55

Part of subcall function 00007FF6B90948A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B90948BC

Part of subcall function 00007FF6B9089C58: HeapFree.KERNEL32(?,?,?,00007FF6B9092032,?,?,?,00007FF6B909206F,?,?,00000000,00007FF6B9092535,?,?,?,00007FF6B9092467), ref: 00007FF6B9089C6E
Part of subcall function 00007FF6B9089C58: GetLastError.KERNEL32(?,?,?,00007FF6B9092032,?,?,?,00007FF6B909206F,?,?,00000000,00007FF6B9092535,?,?,?,00007FF6B9092467), ref: 00007FF6B9089C78

Part of subcall function 00007FF6B9089C10: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6B9089BEF,?,?,?,?,?,00007FF6B9089ADA), ref: 00007FF6B9089C19
Part of subcall function 00007FF6B9089C10: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6B9089BEF,?,?,?,?,?,00007FF6B9089ADA), ref: 00007FF6B9089C3E

_get_daylight.LIBCMT ref: 00007FF6B9094F44

Part of subcall function 00007FF6B9094908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B909491C

_get_daylight.LIBCMT ref: 00007FF6B90951BA
_get_daylight.LIBCMT ref: 00007FF6B90951CB
_get_daylight.LIBCMT ref: 00007FF6B90951DC
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6B909541C), ref: 00007FF6B9095203

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: ec3da476d7abf2ffb0f6397319154e28f094a84f5b0708b50d9998a811af1003
Instruction ID: 870ef6feced2fee6b1a307e915cdab376d6c19a45580aecd886f71f4cc1f12ba
Opcode Fuzzy Hash: ec3da476d7abf2ffb0f6397319154e28f094a84f5b0708b50d9998a811af1003
Instruction Fuzzy Hash: 6FD1AD26A1825286E724AF2ED8941B977A1FF85B84F44813DEF1D87A97EF3CE441C740

Function 00007FF6B9089924 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6B908999D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6B90899B5
RtlVirtualUnwind.KERNEL32 ref: 00007FF6B90899F0
IsDebuggerPresent.KERNEL32 ref: 00007FF6B9089A29
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6B9089A33
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6B9089A3E

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
Instruction ID: d7e7a1b156011b2651dab22a8a415b45be3fa6cf6cb17403ad2a42dbb382a095
Opcode Fuzzy Hash: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
Instruction Fuzzy Hash: C7315236618B8185DB64DF6DE8802AE73A4FB88764F540139EB9D83B56DF3CD145CB00

Function 00007FF6B9090B84 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B9090BD0
FindFirstFileExW.KERNEL32 ref: 00007FF6B9090CDA

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 537ca4dcf685df196dbb745ebf7a8e3eb288cf6b089b90446fc853c3fde494ee
Instruction ID: 9f1946445f692b5282e862ee5302ebc684d394571547584d2e60f5559bb8b85b
Opcode Fuzzy Hash: 537ca4dcf685df196dbb745ebf7a8e3eb288cf6b089b90446fc853c3fde494ee
Instruction Fuzzy Hash: CEB1C262B1969281EA64DF2E98102B963A1EF46BE4F445139EF5E87BC6DF3CE441C300

Function 00007FF6B909518C Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6B90951BA

Part of subcall function 00007FF6B9094908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B909491C

_get_daylight.LIBCMT ref: 00007FF6B90951CB

Part of subcall function 00007FF6B90948A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B90948BC

_get_daylight.LIBCMT ref: 00007FF6B90951DC

Part of subcall function 00007FF6B90948D8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B90948EC

Part of subcall function 00007FF6B9089C58: HeapFree.KERNEL32(?,?,?,00007FF6B9092032,?,?,?,00007FF6B909206F,?,?,00000000,00007FF6B9092535,?,?,?,00007FF6B9092467), ref: 00007FF6B9089C6E
Part of subcall function 00007FF6B9089C58: GetLastError.KERNEL32(?,?,?,00007FF6B9092032,?,?,?,00007FF6B909206F,?,?,00000000,00007FF6B9092535,?,?,?,00007FF6B9092467), ref: 00007FF6B9089C78

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6B909541C), ref: 00007FF6B9095203

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 246ddfbbe37c4787f9720b27dc9f743496b3bb1ed6dcb5155dd6029a6c9a153e
Instruction ID: d9804ad026583a5496472b9e67a50bb4aa82e8383ba598179e4719e8c69d75f3
Opcode Fuzzy Hash: 246ddfbbe37c4787f9720b27dc9f743496b3bb1ed6dcb5155dd6029a6c9a153e
Instruction Fuzzy Hash: 9B517B32A1864286E760EF2EE8811A97760FB89784F44413EEB5DC7697DF3CE441C740

Function 00007FF6B907C330 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6B907C35C
GetCurrentThreadId.KERNEL32 ref: 00007FF6B907C36A
GetCurrentProcessId.KERNEL32 ref: 00007FF6B907C376
QueryPerformanceCounter.KERNEL32 ref: 00007FF6B907C386

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
Instruction ID: 6e6d91c5c14297f3e00c625ab4f38eda3ad689023f54593df103470e1b2d7f50
Opcode Fuzzy Hash: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
Instruction Fuzzy Hash: D5113022B14F058AEB00CF78E8552B933A4FB59768F441E35EB6D867A4DF7CD1948340

Function 00007FF6B9092F20 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF6B9092F86
memcpy_s.LIBCPMT ref: 00007FF6B9092FB1

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: b41cb84a548d2e61bdeb7bb10330278f5fecde395d7a0ce6ff99175555b28b3c
Instruction ID: 40a1517500771881e4f3164b1afd9cbb4d2f14224492770585386b3061a40b88
Opcode Fuzzy Hash: b41cb84a548d2e61bdeb7bb10330278f5fecde395d7a0ce6ff99175555b28b3c
Instruction Fuzzy Hash: B2C1C172B1868787EB248F5DA04866EB7A1F7D4B84F448139DB4A87785DF3DE841CB00

Function 00007FF6B907979B Relevance: 4.1, Strings: 3, Instructions: 397COMMON

Download Yara Rule

Strings

header crc mismatch, xrefs: 00007FF6B9079C41
unknown header flags set, xrefs: 00007FF6B90797E5
, xrefs: 00007FF6B907987B

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: 6a55f11302ef793728786adf415505d571280719f8ef56880a9f0a37636d8ec0
Instruction ID: 83af9b3443324226053316f734a8396b28b47d9c41235836f9bb9c5d67d261bb
Opcode Fuzzy Hash: 6a55f11302ef793728786adf415505d571280719f8ef56880a9f0a37636d8ec0
Instruction Fuzzy Hash: 1EF15B72A182D58BEBA58F1DC088A3A7AA9EF44760F164538DB5987792CF3CE940C740

Function 00007FF6B9098A38 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF6B9098C87
RaiseException.KERNEL32 ref: 00007FF6B9098C98

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 4367feba8b0fb5a89db2d79700bffb7903d016d74ce2a4ac284103265cf95646
Instruction ID: 7b3efbc1d86b8b1adbc6594602b8771c6c9f1b0ea7d6320dfa3f8b5510ee9f7c
Opcode Fuzzy Hash: 4367feba8b0fb5a89db2d79700bffb7903d016d74ce2a4ac284103265cf95646
Instruction Fuzzy Hash: 29B11777609B898BEB19CF2DC8463683BA1F744B48F198929DB5E837A5CF39D851C700

Function 00007FF6B9082CC4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF6B9083074
, xrefs: 00007FF6B9082E32

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 25965de2e6678be5c8c686b25b3b835ec4bf2bfab2b797158b347abdb642f747
Instruction ID: f624e1c988708a89e5fff2d32508e32d71ea768a0567d1bdfaeced7e24695ebd
Opcode Fuzzy Hash: 25965de2e6678be5c8c686b25b3b835ec4bf2bfab2b797158b347abdb642f747
Instruction Fuzzy Hash: 57E16A72B1864686EB6C8E2DC19013D37A0FF85B88F245239DB4E87795DF2AE852C744

Function 00007FF6B90795FB Relevance: 2.7, Strings: 2, Instructions: 218COMMON

Download Yara Rule

Strings

incorrect header check, xrefs: 00007FF6B9079782
invalid window size, xrefs: 00007FF6B9079769

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: 226024973a440a2a6261c5f164d8bafa30541a105b972a390c392a8354fe07a0
Instruction ID: e04f60680891c412139569d2b8b0bd9af3a9400ef8d1c591995bcc7e64558f71
Opcode Fuzzy Hash: 226024973a440a2a6261c5f164d8bafa30541a105b972a390c392a8354fe07a0
Instruction Fuzzy Hash: 7B917372A182C697E7A58F18D498A3E3AADFB44764F16413DDB5A86781CF3CE540CB40

Function 00007FF6B908D200 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF6B908D38A
e+000, xrefs: 00007FF6B908D30D

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 1324d18368fb7be0dec1b44ace24e6b174879433860390047f5d35653063db2a
Instruction ID: 90bdad54dd699f228b9e8828bb86d2a6b6a129046cf4e71e76db40ce934be096
Opcode Fuzzy Hash: 1324d18368fb7be0dec1b44ace24e6b174879433860390047f5d35653063db2a
Instruction Fuzzy Hash: 6A513722B186C546E728CE39988176D7B91F754B94F489339CBA8C7AD2CE3DD4448720

Function 00007FF6B908FBD8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 5b606b63c70e86b5db4eecb07275e8e9c3e0e1f08e56a2b99ea5de7f73ebbe88
Instruction ID: a46594567c6de031be75f4d50ebf962baa38cc33eca8a7e08170a12a5c44f66b
Opcode Fuzzy Hash: 5b606b63c70e86b5db4eecb07275e8e9c3e0e1f08e56a2b99ea5de7f73ebbe88
Instruction Fuzzy Hash: 9802C021B1D68380FE59AF2EA88527926E4AF42BA0F55463DDF6DC67D3DE3DE4018340

Function 00007FF6B908CD6C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF6B908D0AE

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: ee332c23296b8dd3ed29fdb42bef122adb490463d0c8b601810d73b835641fc7
Instruction ID: e1162ccd039fa8e8fd0b4a358bde5e5b256c14f1e1a055508ac7ef980e81b11c
Opcode Fuzzy Hash: ee332c23296b8dd3ed29fdb42bef122adb490463d0c8b601810d73b835641fc7
Instruction Fuzzy Hash: ECA13462B0879686EB29CF29A0807BE7BA1AB50B84F048136DB8D877C2DE3DD501C711

Function 00007FF6B9087AAC Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF6B9087ACB

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: fa9fc3ba0f2a0ca574b62e3049f007bc07c74431d5877200bfd71a39e50ac507
Instruction ID: 87d0764c8d1e3c139cc1551b7e0d5c712226e956938cefdac0cef30c9217607b
Opcode Fuzzy Hash: fa9fc3ba0f2a0ca574b62e3049f007bc07c74431d5877200bfd71a39e50ac507
Instruction Fuzzy Hash: 7D51A411F0964241FA6CAF2E59952BA6296AF91BC4F48443CDF1DC77EAEE3CF4418204

Function 00007FF6B9092790 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6B9092794

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: fe1a72d78314f5032ff6e3f3402ce84269ae1386cefa971ca0fc6f511f9bbc55
Instruction ID: 63cbe0011ab77c92ad012a7a1eda5af2fb95ac2e2e3bbdf41a456d9345153ba9
Opcode Fuzzy Hash: fe1a72d78314f5032ff6e3f3402ce84269ae1386cefa971ca0fc6f511f9bbc55
Instruction Fuzzy Hash: 7CB09220E07A86C2EA482F296C8621822A87F98B10FA4807CC60C81330EE2C60A58700

Function 00007FF6B90828C0 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b05403af9c31de739a9311cbf741df56ce5de8bb6a66a9cc9bcf40cf40427d0b
Instruction ID: c3a94bfee4f4448bf51a42be08942f4bac505dab0f6439b806790e054fd9630a
Opcode Fuzzy Hash: b05403af9c31de739a9311cbf741df56ce5de8bb6a66a9cc9bcf40cf40427d0b
Instruction Fuzzy Hash: 40D1AB22B08A4286EB7C8E2D859427E27A1EF45BC8F24523DCF4E87695DF39E845C740

Function 00007FF6B9078B20 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6de572fc7ea0867e481f021e98a3cee959a95ba6dd1d6718a656c0f39a4e480
Instruction ID: e697cdcec797e243d090355cf47612a50d4dfb254bc65bb0029aca437dcc53f5
Opcode Fuzzy Hash: b6de572fc7ea0867e481f021e98a3cee959a95ba6dd1d6718a656c0f39a4e480
Instruction Fuzzy Hash: 1CC1C1722142F14FD289EB29E4995BA73E1F798319BD4402AEF8787B85CA3CE414D790

Function 00007FF6B9081F30 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54646038064d7a6353eabae39e6447674b1691c16f4822fec46df2a19c6da082
Instruction ID: c974ca7554231a69b6abea171b6ad26a6bdefc52fdce3cc9495817ad46f18530
Opcode Fuzzy Hash: 54646038064d7a6353eabae39e6447674b1691c16f4822fec46df2a19c6da082
Instruction Fuzzy Hash: 72B15B72A18B9595EB698F3DC09423C3BA4FB59B88F284239CB4E87395CF39E451C710

Function 00007FF6B908D880 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5cf27518f3756e107451e616d5c43acfc5497bdc9406be32d6656a2e3ee85f8
Instruction ID: 76245c6652454129f25365e15dd09ee5064464adb2cdb7c1c824c8ac7eafc508
Opcode Fuzzy Hash: c5cf27518f3756e107451e616d5c43acfc5497bdc9406be32d6656a2e3ee85f8
Instruction Fuzzy Hash: 4E81C172B1C78186EB78CF1D948036A7A91FB89794F144339DB8D87B89CE3DE5408B20

Function 00007FF6B9095728 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7a9558e86fa8b462753dac68b64cf5067dc6b1cda5ab5f882eee36bb89ede29b
Instruction ID: e3efdf7ce3565dd0c9dfe77139ef62b025b91dbeaa29ff45dc2c36532dcb6fa3
Opcode Fuzzy Hash: 7a9558e86fa8b462753dac68b64cf5067dc6b1cda5ab5f882eee36bb89ede29b
Instruction Fuzzy Hash: 4561D422F1C29286FB688E2E945877D66C1AF44770F14423EDF6DC6AD6EE7DE8418700

Function 00007FF6B9080C64 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: c046fabc22b27ad56ef0d66d426473fe6a2bf054451fcb855f213e290549c891
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: 8B516F76B18A5186E7288F2DC0842B937B1EB56B68F244139CF4D977A5CF3AE843C740

Function 00007FF6B9081484 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: 18e5d9547302bef2fa196154b73fc6117d65e70ff8b305043d2722f482fb7a50
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: 26516576B18651C6E7688F2DD08423833A1EF45F68F249139CB8D97794CF3AE852C740

Function 00007FF6B9081074 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: 3d632aa1d6385ca153f39d9473dd05f3e869bf045c7ba62f5f5f363396ed2bf4
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: E5516136B2865182EBA88F2DD48023833A5EF55B68F248139CB4D877D4CF7AE853C740

Function 00007FF6B9080A60 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction ID: d006333c050b974fff909b0dd015d75fa9bfef03ae8a0fcc390cc5c39a080215
Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction Fuzzy Hash: 02517E36B18A5186E7688F2DC0842B937B5EB46B58F284139CF4D97795DF3AE843C740

Function 00007FF6B9081280 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction ID: cd82e9dcbb4fdbd72ad49f4cbe036f4642dad7bbd0a4cd551ee5d0ae284d3aee
Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction Fuzzy Hash: 6A517D76B1865186E7A98F2DC08063837A1EF45B58F249139CF4D977A9CF3AE853C740

Function 00007FF6B9080E70 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction ID: 58c4ce3dd8fb5a5d80ffa237edf81d40745bfa928de6c17b6b412d1d7f53d5ee
Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction Fuzzy Hash: F5518236B18A5585E7688F2DC08027D37B1EB46B58F248139CF4D97B95CF3AE852CB40

Function 00007FF6B9085040 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: ec6f6eb1fbefa5aee00a133038aa5ac6548f139d0431940d76772ccdeb68da72
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: F041A452F5974A04ED5D8D1C05946B46AD4AF23BA0D6853FCDFA9D33C2ED0DED868240

Function 00007FF6B90891B0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4c2069438db7bd6821668209f3bed185f6ed925e7f6c63ba07488e81febeb59c
Instruction ID: 055dc0d6c7c5310d52f1ec0e58ce5876d25b00e061e1751a0a9e33bb46d680de
Opcode Fuzzy Hash: 4c2069438db7bd6821668209f3bed185f6ed925e7f6c63ba07488e81febeb59c
Instruction Fuzzy Hash: 6141E062714A5582EF08CF2ED9645A9B3A1BB58FD0B09903AEF1DD7B98DE3CD0428304

Function 00007FF6B90873F4 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6955196b928ea369f318f1367a91d651b99cb7ed2675060227c8542cf7a82c4a
Instruction ID: 4aa049443a61182d5d571d3d506ce93f5e72f2344b7e7a39dfdefd60870e9cec
Opcode Fuzzy Hash: 6955196b928ea369f318f1367a91d651b99cb7ed2675060227c8542cf7a82c4a
Instruction Fuzzy Hash: 38318432B19B8241E7289F2964C017E7AD5EF85BA0F14523CEB5D97BAADF3CD0124704

Function 00007FF6B9098880 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b45f31a2a70b9ba878c3a12fffa6905b3575b51dadbfc3a0cbe7f45b87496cea
Instruction ID: 2a9e0b50080529e752d9bf8d15af980bc9d5557774e26b7b1b4201234333bddb
Opcode Fuzzy Hash: b45f31a2a70b9ba878c3a12fffa6905b3575b51dadbfc3a0cbe7f45b87496cea
Instruction Fuzzy Hash: 5AF06272B182958EDBA48F2DA84262E77E0F708380F84807DE78DC3B14DA7CD0609F04

Function 00007FF6B907C62C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84fb9023dc3cd78644239ae856a17877a0dfc2a7c85af1c48b0789cc2cde0ccb
Instruction ID: 9a2d8c80f0b9d6f67a2e951fa37d7ea8d2153dda09befa1519cb5d323bf69e58
Opcode Fuzzy Hash: 84fb9023dc3cd78644239ae856a17877a0dfc2a7c85af1c48b0789cc2cde0ccb
Instruction Fuzzy Hash: 21A0022191CC76D0E64C9F1CF8901393370FB60F20B401039D20DC11A19F3CE600C310

Function 00007FF6B90750B0 Relevance: 157.9, APIs: 44, Strings: 46, Instructions: 364libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF6B9075C57,?,00007FF6B907308E), ref: 00007FF6B90750C0
GetProcAddress.KERNEL32(?,00007FF6B9075C57,?,00007FF6B907308E), ref: 00007FF6B9075101
GetProcAddress.KERNEL32(?,00007FF6B9075C57,?,00007FF6B907308E), ref: 00007FF6B9075126
GetProcAddress.KERNEL32(?,00007FF6B9075C57,?,00007FF6B907308E), ref: 00007FF6B907514B
GetProcAddress.KERNEL32(?,00007FF6B9075C57,?,00007FF6B907308E), ref: 00007FF6B9075173
GetProcAddress.KERNEL32(?,00007FF6B9075C57,?,00007FF6B907308E), ref: 00007FF6B907519B
GetProcAddress.KERNEL32(?,00007FF6B9075C57,?,00007FF6B907308E), ref: 00007FF6B90751C3
GetProcAddress.KERNEL32(?,00007FF6B9075C57,?,00007FF6B907308E), ref: 00007FF6B90751EB
GetProcAddress.KERNEL32(?,00007FF6B9075C57,?,00007FF6B907308E), ref: 00007FF6B9075213

Strings

Py_IsInitialized, xrefs: 00007FF6B9075191, 00007FF6B90751AD
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF6B90755C9, 00007FF6B90755E5
PyImport_ExecCodeModule, xrefs: 00007FF6B9075411, 00007FF6B907542D
PyErr_Clear, xrefs: 00007FF6B90752D1, 00007FF6B90752ED
PyObject_Str, xrefs: 00007FF6B90755A1, 00007FF6B90755BD
PySys_SetObject, xrefs: 00007FF6B9075669, 00007FF6B9075685
PyObject_CallFunctionObjArgs, xrefs: 00007FF6B9075529, 00007FF6B9075545
PyObject_SetAttrString, xrefs: 00007FF6B9075579, 00007FF6B9075595
Py_InitializeFromConfig, xrefs: 00007FF6B9075169, 00007FF6B9075185
PyErr_NormalizeException, xrefs: 00007FF6B9075321, 00007FF6B907533D
PyErr_Print, xrefs: 00007FF6B9075371, 00007FF6B907538D
PyConfig_Clear, xrefs: 00007FF6B90751E1, 00007FF6B90751FD
PyObject_CallFunction, xrefs: 00007FF6B9075501, 00007FF6B907551D
PyConfig_InitIsolatedConfig, xrefs: 00007FF6B9075209, 00007FF6B9075225
Py_Finalize, xrefs: 00007FF6B9075141, 00007FF6B907515D
PyRun_SimpleStringFlags, xrefs: 00007FF6B90755F1, 00007FF6B907560D
PyUnicode_Replace, xrefs: 00007FF6B9075781, 00007FF6B907579D
PyConfig_Read, xrefs: 00007FF6B9075231, 00007FF6B907524D
GetProcAddress, xrefs: 00007FF6B90750E0
PySys_GetObject, xrefs: 00007FF6B9075641, 00007FF6B907565D
PyUnicode_DecodeFSDefault, xrefs: 00007FF6B90756E1, 00007FF6B90756FD
PyMem_RawFree, xrefs: 00007FF6B90754B1, 00007FF6B90754CD
PyErr_Fetch, xrefs: 00007FF6B90752F9, 00007FF6B9075315
PyUnicode_Decode, xrefs: 00007FF6B90756B9, 00007FF6B90756D5
PyMarshal_ReadObjectFromString, xrefs: 00007FF6B9075489, 00007FF6B90754A5
PyConfig_SetString, xrefs: 00007FF6B9075281, 00007FF6B907529D
PyErr_Occurred, xrefs: 00007FF6B9075349, 00007FF6B9075365
Py_ExitStatusException, xrefs: 00007FF6B907511C, 00007FF6B9075138
PyList_Append, xrefs: 00007FF6B9075461, 00007FF6B907547D
PyEval_EvalCode, xrefs: 00007FF6B90753C1, 00007FF6B90753DD
PyObject_GetAttrString, xrefs: 00007FF6B9075551, 00007FF6B907556D
Py_PreInitialize, xrefs: 00007FF6B90751B9, 00007FF6B90751D5
Py_DecodeLocale, xrefs: 00007FF6B90750F7, 00007FF6B9075113
PyUnicode_Join, xrefs: 00007FF6B9075759, 00007FF6B9075775
PyUnicode_AsUTF8, xrefs: 00007FF6B9075691, 00007FF6B90756AD
PyImport_ImportModule, xrefs: 00007FF6B9075439, 00007FF6B9075455
PyModule_GetDict, xrefs: 00007FF6B90754D9, 00007FF6B90754F5
PyImport_AddModule, xrefs: 00007FF6B90753E9, 00007FF6B9075405
PyUnicode_FromString, xrefs: 00007FF6B9075731, 00007FF6B907574D
PyConfig_SetWideStringList, xrefs: 00007FF6B90752A9, 00007FF6B90752C5
PyErr_Restore, xrefs: 00007FF6B9075399, 00007FF6B90753B5
Failed to get address for %hs, xrefs: 00007FF6B90750D9
Py_DecRef, xrefs: 00007FF6B90750B6, 00007FF6B90750D2
PyStatus_Exception, xrefs: 00007FF6B9075619, 00007FF6B9075635
PyConfig_SetBytesString, xrefs: 00007FF6B9075259, 00007FF6B9075275
PyUnicode_FromFormat, xrefs: 00007FF6B9075709, 00007FF6B9075725

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 190572456-2007157414
Opcode ID: 3c804ccaf4812c993b4970aca99c844c8aa25bcf6244ab31ff714926eb913965
Instruction ID: 67707435c347dab98fc9c28fabab90e180fa932bba652c42fd96412b20bc2268
Opcode Fuzzy Hash: 3c804ccaf4812c993b4970aca99c844c8aa25bcf6244ab31ff714926eb913965
Instruction Fuzzy Hash: 42128C64E0EB5391FA55DF5DB8511B423B0AF59760BA4143ECA2ED23A1EF7CF588C280

Function 00007FF6B90715C0 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 137COMMON

Download Yara Rule

Strings

fwrite, xrefs: 00007FF6B907177C
Failed to create symbolic link %s!, xrefs: 00007FF6B90715E2
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF6B9071775
fseek, xrefs: 00007FF6B9071695
fread, xrefs: 00007FF6B907178C
malloc, xrefs: 00007FF6B90716F6
fopen, xrefs: 00007FF6B907161E
Failed to extract %s: failed to open target file!, xrefs: 00007FF6B9071617
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6B9071785
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6B907165B
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6B907168E
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF6B90716EF

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: Message
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2030045667-1550345328
Opcode ID: 63e7821261bdbcd545cb89ff9d6ef705dc686717b2c5037f278b81823427e60c
Instruction ID: c38b3aba885fd589cf7990298152e1d3b27ee06e7b75d1302704fc734288d558
Opcode Fuzzy Hash: 63e7821261bdbcd545cb89ff9d6ef705dc686717b2c5037f278b81823427e60c
Instruction Fuzzy Hash: 67518C61B08643A2EA109F2DA9401BA63A0FF44BA4F948139EF1CC76D6EF3CE595C700

Function 00007FF6B90777D0 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B90786B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6B9073FA4,00000000,00007FF6B9071925), ref: 00007FF6B90786E9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF6B9077C97,?,?,FFFFFFFF,00007FF6B9073834), ref: 00007FF6B907782C

Part of subcall function 00007FF6B90726C0: MessageBoxW.USER32 ref: 00007FF6B9072736

Strings

LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF6B907789D
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF6B9077840
%.*s, xrefs: 00007FF6B907790C
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF6B90778D9
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF6B907796D
CreateDirectory, xrefs: 00007FF6B9077974
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF6B9077803
\, xrefs: 00007FF6B9077861

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 5adf1a7b4f365c991e592d6daa758356e56cb82b092043d5b28c068608273831
Instruction ID: 7627a2887c29f075e6b29d7179534ceca8481f54d5078e0da5e8cee5544d92f0
Opcode Fuzzy Hash: 5adf1a7b4f365c991e592d6daa758356e56cb82b092043d5b28c068608273831
Instruction Fuzzy Hash: 3441A311B2D64381FB50AF2DE8516BA63A1EF947E4F44443EEB4EC26A6FE2CE104C750

Function 00007FF6B90720F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6B907211B
SelectObject.GDI32 ref: 00007FF6B9072162
DrawTextW.USER32 ref: 00007FF6B9072185
SelectObject.GDI32 ref: 00007FF6B907219B
ReleaseDC.USER32 ref: 00007FF6B90721AB
MoveWindow.USER32 ref: 00007FF6B90721FB
MoveWindow.USER32 ref: 00007FF6B907223B
MoveWindow.USER32 ref: 00007FF6B907228E
MoveWindow.USER32 ref: 00007FF6B90722D6

Strings

P%, xrefs: 00007FF6B907216F

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: d5dd136cfe9f7ccbcb0fe4cae99cf14dfe1cc9f89db7d8019ba122c6a34f6d98
Instruction ID: 8862ca1c290a4c6f7fc42890a0fcc7703cd4862e413db109c231bbe23eca47b7
Opcode Fuzzy Hash: d5dd136cfe9f7ccbcb0fe4cae99cf14dfe1cc9f89db7d8019ba122c6a34f6d98
Instruction Fuzzy Hash: 9351DB266147A186D6349F3AE4181BAB7A1FB98B61F004135EFDE83795DF3CD085D710

Function 00007FF6B90855A0 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 493COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B90855E3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B90859D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B9085C6C

Strings

p, xrefs: 00007FF6B9085695
f, xrefs: 00007FF6B9085705
-, xrefs: 00007FF6B9085679
p, xrefs: 00007FF6B908570D
:, xrefs: 00007FF6B908579C

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 21cbc72c7e6dc269be11e21f83bf2085e3383c5e1ad4ae35147280bf7774980f
Instruction ID: 5401528a7cc885df54ea0510590eb6da273b215b0d429736cd3768b8a17f713a
Opcode Fuzzy Hash: 21cbc72c7e6dc269be11e21f83bf2085e3383c5e1ad4ae35147280bf7774980f
Instruction Fuzzy Hash: 7612AF62F0C24386FB289E19E0D46B97696FB50750F94407AE7DA876C4FF3CE9948B04

Function 00007FF6B90802E8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B9080328
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B90806F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B908098F

Strings

f, xrefs: 00007FF6B90803C0
p, xrefs: 00007FF6B9080432
f, xrefs: 00007FF6B9080575
p, xrefs: 00007FF6B90803CD
f, xrefs: 00007FF6B908042A

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 1ce7302e2fd45bb0c0c54093c0ec2c5d292275181cf657796836d36714c503ba
Instruction ID: 2a297813db4b38d67847cb0febd39fc81f5e9174791972e6d95f35f4702c8f39
Opcode Fuzzy Hash: 1ce7302e2fd45bb0c0c54093c0ec2c5d292275181cf657796836d36714c503ba
Instruction Fuzzy Hash: 4B128272F0D14386FB289E18E0947FA76B1FB82B54F884439E799866C4DF7DE4809B50

Function 00007FF6B9071050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 111COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6B90710F5
fseek, xrefs: 00007FF6B90710CC
fread, xrefs: 00007FF6B90711D7
malloc, xrefs: 00007FF6B90710FC
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6B90711D0
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6B9071097
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6B90710C5

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: eb8929c7a717523ea7c5dbdd2b8df762904df810c2407b2455a08332a40905b2
Instruction ID: f23966efbfb8f8d55b550d75dfd8b7789c3ae77a8cae88f7e19c1088db9edd80
Opcode Fuzzy Hash: eb8929c7a717523ea7c5dbdd2b8df762904df810c2407b2455a08332a40905b2
Instruction Fuzzy Hash: 6C418121B0864252EA549F1EA9405BAA395FF44BE4F548039DF4DCB7D6EE3CE445C340

Function 00007FF6B9071440 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 100COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6B90714D9
fseek, xrefs: 00007FF6B90714B0
fread, xrefs: 00007FF6B90715A1
malloc, xrefs: 00007FF6B90714E0
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6B907159A
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6B907146F
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6B90714A9

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: ab735088dece392ba015fe9887ac25182eb0ff937d9945326d1deb4be678b5f1
Instruction ID: 62cf7e8745f5814126af0e7aa6091a612618b8d8284807dae38c3e4adbd7f98f
Opcode Fuzzy Hash: ab735088dece392ba015fe9887ac25182eb0ff937d9945326d1deb4be678b5f1
Instruction Fuzzy Hash: 51417322B0864381EA649F2DA9405BA63A1FF48BF4F548039DF4EC7AD6EE3CE545C700

Function 00007FF6B9077FC0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 89processsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B90786B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6B9073FA4,00000000,00007FF6B9071925), ref: 00007FF6B90786E9

SetConsoleCtrlHandler.KERNEL32(?,00007FF6B90739C0), ref: 00007FF6B907800A
GetStartupInfoW.KERNEL32(?,00007FF6B90739C0), ref: 00007FF6B907802B

Part of subcall function 00007FF6B908978C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B90897A0

Part of subcall function 00007FF6B9087A2C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B9087A93

GetCommandLineW.KERNEL32(?,00007FF6B90739C0), ref: 00007FF6B90780CD
CreateProcessW.KERNEL32 ref: 00007FF6B907810F
WaitForSingleObject.KERNEL32(?,00007FF6B90739C0), ref: 00007FF6B9078123
GetExitCodeProcess.KERNEL32 ref: 00007FF6B9078133

Strings

CreateProcessW, xrefs: 00007FF6B9078146
Failed to create child process!, xrefs: 00007FF6B907813F

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Failed to create child process!
API String ID: 2895956056-699529898
Opcode ID: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
Instruction ID: ab4651c4876259af628d8ed2e4de0d7ab5fcd6e708a5b219608083146230a369
Opcode Fuzzy Hash: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
Instruction Fuzzy Hash: 52410231A18B8181DA209F68F4952AA7395FBC5374F500739E7AD877D6DF7CD1448B40

Function 00007FF6B907DD28 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF6B907DD85

Part of subcall function 00007FF6B907ECDC: __GetUnwindTryBlock.LIBCMT ref: 00007FF6B907ED1F
Part of subcall function 00007FF6B907ECDC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF6B907ED44

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6B907DE5D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF6B907E0AB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6B907E1B8

Strings

csm, xrefs: 00007FF6B907DD9F
csm, xrefs: 00007FF6B907DE80
csm, xrefs: 00007FF6B907DE06

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 9e3578d2910a1de3a92e15cd58e24121979594cfb80c91fc1a566261b89881c5
Instruction ID: 825ee304de480a9eb71588aed5a0a36dfd60d5dc75912498e88ba1f4e6c6de8a
Opcode Fuzzy Hash: 9e3578d2910a1de3a92e15cd58e24121979594cfb80c91fc1a566261b89881c5
Instruction Fuzzy Hash: 74D19E32A09B418AEB209F69D4413AD3BA4FB557A8F104139EF4D97BA6DF3CE490C741

Function 00007FF6B90711F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 154COMMON

Download Yara Rule

Strings

1.3.1, xrefs: 00007FF6B9071229
malloc, xrefs: 00007FF6B907129C, 00007FF6B90712CA
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF6B90712C3
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF6B9071256
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF6B9071295
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF6B90713EE

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: Message
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-2813020118
Opcode ID: 5f86db0b88a8597635f99d5b4cac90fa4f731a3afe8888101c8cea5847f0d3ec
Instruction ID: 708a042ca0fb6c24e617e1bc6eed11f319742b3567759b51d45571ab226e89f1
Opcode Fuzzy Hash: 5f86db0b88a8597635f99d5b4cac90fa4f731a3afe8888101c8cea5847f0d3ec
Instruction Fuzzy Hash: 8F51B562A0C64241EAA09F1EA8503BA6291FF85BA4F54813DEF4DC7BD6EF3CE545C700

Function 00007FF6B908E020 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF6B908E3BA,?,?,-00000018,00007FF6B908A063,?,?,?,00007FF6B9089F5A,?,?,?,00007FF6B908524E), ref: 00007FF6B908E19C
GetProcAddress.KERNEL32(?,?,?,00007FF6B908E3BA,?,?,-00000018,00007FF6B908A063,?,?,?,00007FF6B9089F5A,?,?,?,00007FF6B908524E), ref: 00007FF6B908E1A8

Strings

api-ms-, xrefs: 00007FF6B908E0E6
ext-ms-, xrefs: 00007FF6B908E0F9

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
Instruction ID: c6f6dea597a92945ab64e6a9a1bb67554ece2c620086ea056a7ce1ab7c33ca7c
Opcode Fuzzy Hash: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
Instruction Fuzzy Hash: 4A41CF31B19A1281FB1ADF2EA880675269ABF55BA0F48453DDF1DC7784EE3CE4458340

Function 00007FF6B9077C40 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 116COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,?,FFFFFFFF,00007FF6B9073834), ref: 00007FF6B9077CE4
CreateDirectoryW.KERNEL32(?,?,FFFFFFFF,00007FF6B9073834), ref: 00007FF6B9077D2C

Part of subcall function 00007FF6B9077E10: GetEnvironmentVariableW.KERNEL32(00007FF6B907365F), ref: 00007FF6B9077E47
Part of subcall function 00007FF6B9077E10: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6B9077E69

Part of subcall function 00007FF6B9087548: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B9087561

Part of subcall function 00007FF6B90726C0: MessageBoxW.USER32 ref: 00007FF6B9072736

Strings

_MEI%d, xrefs: 00007FF6B9077CF2
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF6B9077D5E
LOADER: failed to set the TMP environment variable., xrefs: 00007FF6B9077CBC
TMP, xrefs: 00007FF6B9077CA2
TMP, xrefs: 00007FF6B9077C7C, 00007FF6B9077D83

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: Environment$CreateDirectoryExpandMessagePathStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 740614611-1339014028
Opcode ID: 11860e683bfeec2df00dcc2c56da5dbb6591d5702bb717516bbb2bb41ff9b0e3
Instruction ID: d4357ffa65ef5231f702890967954cd1563d3507cef4b655f4075d9590c37d07
Opcode Fuzzy Hash: 11860e683bfeec2df00dcc2c56da5dbb6591d5702bb717516bbb2bb41ff9b0e3
Instruction Fuzzy Hash: F5418011B0D64240FA25EF6DA9952F922A5AF89BE0F444039EF1DC77A7EE3CE9408340

Function 00007FF6B907CFE8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF6B907D29A,?,?,?,00007FF6B907CF8C,?,?,?,00007FF6B907CB89), ref: 00007FF6B907D06D
GetLastError.KERNEL32(?,?,?,00007FF6B907D29A,?,?,?,00007FF6B907CF8C,?,?,?,00007FF6B907CB89), ref: 00007FF6B907D07B
LoadLibraryExW.KERNEL32(?,?,?,00007FF6B907D29A,?,?,?,00007FF6B907CF8C,?,?,?,00007FF6B907CB89), ref: 00007FF6B907D0A5
FreeLibrary.KERNEL32(?,?,?,00007FF6B907D29A,?,?,?,00007FF6B907CF8C,?,?,?,00007FF6B907CB89), ref: 00007FF6B907D113
GetProcAddress.KERNEL32(?,?,?,00007FF6B907D29A,?,?,?,00007FF6B907CF8C,?,?,?,00007FF6B907CB89), ref: 00007FF6B907D11F

Strings

api-ms-, xrefs: 00007FF6B907D08D

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
Instruction ID: f624db00a801eb2548a677fe5b1f9c1e31931ee7fb227265055baa2b5f094c15
Opcode Fuzzy Hash: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
Instruction Fuzzy Hash: 9131C221B1BB4291EE119F5EA8006752394BF49BB4F591639DF1D87380EF3CE442C350

Function 00007FF6B9077B50 Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6B9077B70
OpenProcessToken.ADVAPI32 ref: 00007FF6B9077B83
GetTokenInformation.ADVAPI32 ref: 00007FF6B9077BA8
GetLastError.KERNEL32 ref: 00007FF6B9077BB2
GetTokenInformation.ADVAPI32 ref: 00007FF6B9077BF2
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6B9077C0E
CloseHandle.KERNEL32 ref: 00007FF6B9077C26

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 8356e17e6427c03366acad688ef96df5430cd8c67dfe58d52091e88c81740b7d
Instruction ID: 14fc0ea0c7c03776f65a21d4831bb7e450644b8369015ad196bfecc461a04522
Opcode Fuzzy Hash: 8356e17e6427c03366acad688ef96df5430cd8c67dfe58d52091e88c81740b7d
Instruction Fuzzy Hash: E5212E21B0CA4642EB209F6DA48422AA3A5FFC57F4F50023DEB6D83AE5DF7CD4458700

Function 00007FF6B908A460 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6B908A46F
FlsGetValue.KERNEL32 ref: 00007FF6B908A484
FlsSetValue.KERNEL32 ref: 00007FF6B908A4A5
FlsSetValue.KERNEL32 ref: 00007FF6B908A4D2
FlsSetValue.KERNEL32 ref: 00007FF6B908A4E3
FlsSetValue.KERNEL32 ref: 00007FF6B908A4F4
SetLastError.KERNEL32 ref: 00007FF6B908A50F

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f1009f36f4b7e41e642a617816a0843c7a4fdcae41be86a1245b23186b7dd2e
Instruction ID: bcf3e30493ba16ebe9e58b71c1aaee558a0ff50b341874606ccf7c79de1b9046
Opcode Fuzzy Hash: 4f1009f36f4b7e41e642a617816a0843c7a4fdcae41be86a1245b23186b7dd2e
Instruction Fuzzy Hash: 08214920B0C65242FA6C6F2E5AC913965825F987B0F15573CEB3EC6ADADE2CF8416701

Function 00007FF6B909707C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF6B90970AD
GetLastError.KERNEL32 ref: 00007FF6B90970B9
CloseHandle.KERNEL32 ref: 00007FF6B90970D1
CreateFileW.KERNEL32 ref: 00007FF6B90970FC
WriteConsoleW.KERNEL32 ref: 00007FF6B909711B

Strings

CONOUT$, xrefs: 00007FF6B90970DD

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 274174309ff0e3cf7757a3f5c883333dff1858e51aae267b9afc88cc39a62d3b
Instruction ID: 96a5ffe56f42bde0a9add1244c51652ca4a690bdda0c431328c47728bc60e6f7
Opcode Fuzzy Hash: 274174309ff0e3cf7757a3f5c883333dff1858e51aae267b9afc88cc39a62d3b
Instruction Fuzzy Hash: 1D118B22A18A4286E7508F5EE85432966A4FB98FE8F404238EB1DC77A5DF3CD804C780

Function 00007FF6B90781F0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00000000,?,00007FF6B90739F2), ref: 00007FF6B907821D
K32EnumProcessModules.KERNEL32(?,00000000,?,00007FF6B90739F2), ref: 00007FF6B907827A

Part of subcall function 00007FF6B90786B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6B9073FA4,00000000,00007FF6B9071925), ref: 00007FF6B90786E9

K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF6B90739F2), ref: 00007FF6B9078305
K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF6B90739F2), ref: 00007FF6B9078364
FreeLibrary.KERNEL32(?,00000000,?,00007FF6B90739F2), ref: 00007FF6B9078375
FreeLibrary.KERNEL32(?,00000000,?,00007FF6B90739F2), ref: 00007FF6B907838A

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: c116373e2a09e68fc95a37a35a910f387ed59b49a7d0ab4690c2b7d3ff367989
Instruction ID: f7cb0e1d95d29b4c8ce5f99d25e4dd5b89bd14d38881e6f9c0df2c959db719d1
Opcode Fuzzy Hash: c116373e2a09e68fc95a37a35a910f387ed59b49a7d0ab4690c2b7d3ff367989
Instruction Fuzzy Hash: 7041C162B1D68281EA319F2AA4802BA77A4FF84BE4F444139DF9D97789DF3CE401C710

Function 00007FF6B9078400 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B9077B50: GetCurrentProcess.KERNEL32 ref: 00007FF6B9077B70
Part of subcall function 00007FF6B9077B50: OpenProcessToken.ADVAPI32 ref: 00007FF6B9077B83
Part of subcall function 00007FF6B9077B50: GetTokenInformation.ADVAPI32 ref: 00007FF6B9077BA8
Part of subcall function 00007FF6B9077B50: GetLastError.KERNEL32 ref: 00007FF6B9077BB2
Part of subcall function 00007FF6B9077B50: GetTokenInformation.ADVAPI32 ref: 00007FF6B9077BF2
Part of subcall function 00007FF6B9077B50: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6B9077C0E
Part of subcall function 00007FF6B9077B50: CloseHandle.KERNEL32 ref: 00007FF6B9077C26

LocalFree.KERNEL32(?,00007FF6B9073814), ref: 00007FF6B907848C
LocalFree.KERNEL32(?,00007FF6B9073814), ref: 00007FF6B9078495

Strings

Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF6B90784A3
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF6B9078462
S-1-3-4, xrefs: 00007FF6B9078441
D:(A;;FA;;;%s), xrefs: 00007FF6B9078477

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 795f95526d0a951be163d7ee57e77295e71c5006ab84a191c0455a0dace466c7
Instruction ID: 826ba196b3c391c41210253f074b92fd1fee26b8550c26021a88d797e9a9292d
Opcode Fuzzy Hash: 795f95526d0a951be163d7ee57e77295e71c5006ab84a191c0455a0dace466c7
Instruction Fuzzy Hash: 76216032A0C64282F650AF28E9553EA63A5FF88790F84403AEB4DC3796DF3CE445C750

Function 00007FF6B908A5D8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6B90843FD,?,?,?,?,00007FF6B908979A,?,?,?,?,00007FF6B908649F), ref: 00007FF6B908A5E7
FlsSetValue.KERNEL32(?,?,?,00007FF6B90843FD,?,?,?,?,00007FF6B908979A,?,?,?,?,00007FF6B908649F), ref: 00007FF6B908A61D
FlsSetValue.KERNEL32(?,?,?,00007FF6B90843FD,?,?,?,?,00007FF6B908979A,?,?,?,?,00007FF6B908649F), ref: 00007FF6B908A64A
FlsSetValue.KERNEL32(?,?,?,00007FF6B90843FD,?,?,?,?,00007FF6B908979A,?,?,?,?,00007FF6B908649F), ref: 00007FF6B908A65B
FlsSetValue.KERNEL32(?,?,?,00007FF6B90843FD,?,?,?,?,00007FF6B908979A,?,?,?,?,00007FF6B908649F), ref: 00007FF6B908A66C
SetLastError.KERNEL32(?,?,?,00007FF6B90843FD,?,?,?,?,00007FF6B908979A,?,?,?,?,00007FF6B908649F), ref: 00007FF6B908A687

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 5dcac91248c0014d458aec840eea87d8b317a92cf5de5997ea3edf93bd94a031
Instruction ID: 93da5a115dd277f5e39ec6a56e6a780abe6649ec1e2b4176f103245120e5d5d5
Opcode Fuzzy Hash: 5dcac91248c0014d458aec840eea87d8b317a92cf5de5997ea3edf93bd94a031
Instruction Fuzzy Hash: 94115C60F0C65242FA5C6F3D5AC513926829F68BB0F05473CDB3E86ADADE2CF8116701

Function 00007FF6B9072300 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6B9072338
DialogBoxIndirectParamW.USER32 ref: 00007FF6B90723FE
DeleteObject.GDI32 ref: 00007FF6B9072431
DestroyIcon.USER32 ref: 00007FF6B9072443

Strings

Unhandled exception in script, xrefs: 00007FF6B9072368

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 43e0e9fc7257205e5ba4956726e7fb7afbd4954ec96d29d9005c09c1dc537ba6
Instruction ID: 606c8f6f38cdf302591baf798a83245d4f9a1e2f8a59aa9dedfb1f16243e0f23
Opcode Fuzzy Hash: 43e0e9fc7257205e5ba4956726e7fb7afbd4954ec96d29d9005c09c1dc537ba6
Instruction Fuzzy Hash: B5315032A09A8289EB24DF69E8952F97360FF89794F440139EB4D8BB5ADF3CD144C700

Function 00007FF6B9072760 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B90786B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6B9073FA4,00000000,00007FF6B9071925), ref: 00007FF6B90786E9

MessageBoxW.USER32 ref: 00007FF6B907283B
MessageBoxA.USER32 ref: 00007FF6B907284F

Strings

Error, xrefs: 00007FF6B907282C
%s%s: %s, xrefs: 00007FF6B90727EC
Error/warning (ANSI fallback), xrefs: 00007FF6B9072843

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Error$Error/warning (ANSI fallback)
API String ID: 1878133881-640379615
Opcode ID: c7e22cebafa3b4081381e7f20538df90bc3c47857982eb0ae5879fef5a553f49
Instruction ID: 9a707069d042c63bca6ab6072296127ef82c31fc83f10da9d2595067e736b02c
Opcode Fuzzy Hash: c7e22cebafa3b4081381e7f20538df90bc3c47857982eb0ae5879fef5a553f49
Instruction Fuzzy Hash: FC218372628AC691E620DF18F4517EA7364FF84B94F40413AEB8C93699DF7CD645C740

Function 00007FF6B9088DA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6B9088DC5
GetProcAddress.KERNEL32 ref: 00007FF6B9088DDB
FreeLibrary.KERNEL32 ref: 00007FF6B9088E02

Strings

mscoree.dll, xrefs: 00007FF6B9088DBC
CorExitProcess, xrefs: 00007FF6B9088DD4

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f1eb0c22b123c1cdb2873c61f44d146b1d21622817f8dd4d6a21f18b4a6e3d93
Instruction ID: c9b94ce0ba56cacd043c6bd0a6f6fcdb137c0d84957729b1ca220947ec25aef9
Opcode Fuzzy Hash: f1eb0c22b123c1cdb2873c61f44d146b1d21622817f8dd4d6a21f18b4a6e3d93
Instruction Fuzzy Hash: A1F06221B19B0282EA148F2CE4843795360AF85B75F94063DCB7E865F4CF2CD449D300

Function 00007FF6B9098678 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6B90986A0
_set_statfp.LIBCMT ref: 00007FF6B90986BB
_set_statfp.LIBCMT ref: 00007FF6B90986D7
_set_statfp.LIBCMT ref: 00007FF6B9098713

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: ac8969f58b0ca72f7b8f8dd5cfba690e9802b066f1c972c5a4d553d97839eb0d
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 3C11A032E5CA0341F6A85F2CE46637951406F59774F19063CEFAE8A7EBCE6CE8818210

Function 00007FF6B908A6A0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF6B90898B3,?,?,00000000,00007FF6B9089B4E,?,?,?,?,?,00007FF6B9089ADA), ref: 00007FF6B908A6BF
FlsSetValue.KERNEL32(?,?,?,00007FF6B90898B3,?,?,00000000,00007FF6B9089B4E,?,?,?,?,?,00007FF6B9089ADA), ref: 00007FF6B908A6DE
FlsSetValue.KERNEL32(?,?,?,00007FF6B90898B3,?,?,00000000,00007FF6B9089B4E,?,?,?,?,?,00007FF6B9089ADA), ref: 00007FF6B908A706
FlsSetValue.KERNEL32(?,?,?,00007FF6B90898B3,?,?,00000000,00007FF6B9089B4E,?,?,?,?,?,00007FF6B9089ADA), ref: 00007FF6B908A717
FlsSetValue.KERNEL32(?,?,?,00007FF6B90898B3,?,?,00000000,00007FF6B9089B4E,?,?,?,?,?,00007FF6B9089ADA), ref: 00007FF6B908A728

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 25d361a094b2c99e262beff41eaee06ac9464b6f74968b1c14d3cfe42ff85be4
Instruction ID: db7a6cb234e1531ae3fd9d974682529449902569a151a10d8b6da29372000059
Opcode Fuzzy Hash: 25d361a094b2c99e262beff41eaee06ac9464b6f74968b1c14d3cfe42ff85be4
Instruction Fuzzy Hash: 09114C60B0D64242FA5CAB2D5DC517925915FA87B0F05433CEB3E86AD6DE2CF841A701

Function 00007FF6B908A534 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF6B908A545
FlsSetValue.KERNEL32 ref: 00007FF6B908A564
FlsSetValue.KERNEL32 ref: 00007FF6B908A58C
FlsSetValue.KERNEL32 ref: 00007FF6B908A59D
FlsSetValue.KERNEL32 ref: 00007FF6B908A5AE

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: a853173f6999e7d5ef833d9e4f06cbd56a904a1eb1d6261c936ae8f95b9bedb9
Instruction ID: 4835a6acb40467acd0603cb86a70105a3e170d346ea9729f470ce391a4198d57
Opcode Fuzzy Hash: a853173f6999e7d5ef833d9e4f06cbd56a904a1eb1d6261c936ae8f95b9bedb9
Instruction Fuzzy Hash: 2111E560F0860742FA6CBE2D58D517926824F69370F59473CDB3ECAAD2ED2CF881A251

Function 00007FF6B90852B0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B90852EC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B9085416
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B90854CC

Strings

verbose, xrefs: 00007FF6B90852C0

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
Instruction ID: 95875deaae6f235529e10cd46e540f06a2c09d08fdf1d7d68c0c7435ab5e65be
Opcode Fuzzy Hash: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
Instruction Fuzzy Hash: C691AF32B0CA4681E7299E29D4903BD3791AF44B99F88417ADB5EC63D5FF3CE4458301

Function 00007FF6B908EED8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B908F1B7

Part of subcall function 00007FF6B9086D4C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B9086D69

Strings

ccs, xrefs: 00007FF6B908F0F2
UTF-8, xrefs: 00007FF6B908F136
UTF-16LEUNICODE, xrefs: 00007FF6B908F155

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: f2afffe6052eb22f88312eb2a9052de40cf8af355caad6dfb5a285a3356e609b
Instruction ID: 08ab2bac34062cbb0beb18a283ff60c56169ca59609c3fd15872136ab373c22c
Opcode Fuzzy Hash: f2afffe6052eb22f88312eb2a9052de40cf8af355caad6dfb5a285a3356e609b
Instruction Fuzzy Hash: 9F81A172F1825389FB6C5F3DC1902783AA1AB11B48F65803DDB09D72D6DF2DE9419B81

Function 00007FF6B907C968 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6B907C993
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6B907CA2A
RtlUnwindEx.KERNEL32 ref: 00007FF6B907CA84

Strings

csm, xrefs: 00007FF6B907CA11

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
Instruction ID: c9bff5aedcec2610f06cbaac998d57ee1469a125d515e45b9fc1fad59ce18f81
Opcode Fuzzy Hash: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
Instruction Fuzzy Hash: 6F51B232B196629ADB14CF2DE444A797792FB44BA8F108139EB4D83788EF7DE841C700

Function 00007FF6B907E1F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6B907E257
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6B907E2A3

Strings

MOC, xrefs: 00007FF6B907E26B
RCC, xrefs: 00007FF6B907E273

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 7372cc8c5436f01c7c5bf562e068c966f7e5f7c30121bdd0ddd9e56561cf3a97
Instruction ID: 380e7e85393959455665d61a712fee400751174243444b4277e4fcf52ae66290
Opcode Fuzzy Hash: 7372cc8c5436f01c7c5bf562e068c966f7e5f7c30121bdd0ddd9e56561cf3a97
Instruction Fuzzy Hash: B2619332909BC581D7219F19E4407AEBBA0FB957A4F044229EB9C43BA5DF7CE190CB01

Function 00007FF6B907E5A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6B907E5D0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF6B907E6B8

Strings

csm, xrefs: 00007FF6B907E70A
csm, xrefs: 00007FF6B907E5F2

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 35f1ba398413474562c31f87a28067be7b3dedf2abf1bb91a394967b9293af31
Instruction ID: c1bcd94370580c350aa456b7c4096596ff35e39e38ba4545694263f933a0ac78
Opcode Fuzzy Hash: 35f1ba398413474562c31f87a28067be7b3dedf2abf1bb91a394967b9293af31
Instruction Fuzzy Hash: 48519236A0934296EB748F2994483787B94FB64BA4F144139DB5D87BE5CF3CE490C702

Function 00007FF6B9077530 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF6B907324C,?,?,00007FF6B9073964), ref: 00007FF6B9077642

Strings

%s%c, xrefs: 00007FF6B90775B4
\, xrefs: 00007FF6B90775A7
%.*s, xrefs: 00007FF6B90775FB

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 1156698ca0d33aa8d2468b4f0fdefbfa17a3fd1640f2d1a941dba21d9585616c
Instruction ID: 80f07b45099d3c91f2c2292108c9a43efbbd37654dc99bf2de02c16f3818c7d0
Opcode Fuzzy Hash: 1156698ca0d33aa8d2468b4f0fdefbfa17a3fd1640f2d1a941dba21d9585616c
Instruction Fuzzy Hash: 1731C421B19AC595EA219F29E8107AA6355FB84BF0F444239EF6DC37D9EE2CD2458700

Function 00007FF6B9072870 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B90786B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6B9073FA4,00000000,00007FF6B9071925), ref: 00007FF6B90786E9

MessageBoxW.USER32 ref: 00007FF6B9072906
MessageBoxA.USER32 ref: 00007FF6B907291A

Strings

Error/warning (ANSI fallback), xrefs: 00007FF6B907290E
Warning, xrefs: 00007FF6B90728F7

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error/warning (ANSI fallback)$Warning
API String ID: 1878133881-2698358428
Opcode ID: bedc3c020f71ec751042cc21f49bee78fdd2451348ef76e59aa444c99166d18b
Instruction ID: b282b15bac1b5fae7933953c7393ec8b88a44a3430e49961e0d3ddd643d56e0b
Opcode Fuzzy Hash: bedc3c020f71ec751042cc21f49bee78fdd2451348ef76e59aa444c99166d18b
Instruction Fuzzy Hash: 0A11BF72628B8591FB208F18F451BA933A4FF84B84F90513ADB9C87685CF3CD604C740

Function 00007FF6B908B8B0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF6B908B92F
WriteFile.KERNEL32 ref: 00007FF6B908BBF7
WriteFile.KERNEL32 ref: 00007FF6B908BC3D
GetLastError.KERNEL32 ref: 00007FF6B908BCF3

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: ce0c3b3fbf9f468b37350500bd40f597e2424e9246c9b6d769e6af97d5ebe549
Instruction ID: 87143afbe1efd4ca773eec998f2d7051a53cee44c3d7d9c75a0eab1c7a82e27d
Opcode Fuzzy Hash: ce0c3b3fbf9f468b37350500bd40f597e2424e9246c9b6d769e6af97d5ebe549
Instruction Fuzzy Hash: 80D1E172B18A818AE715CF79D4842BC3BB6FB44798B14423ACF5E97B99DE38D416C340

Function 00007FF6B908C270 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6B908C25B), ref: 00007FF6B908C38C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6B908C25B), ref: 00007FF6B908C417

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 1f18d30cb6731d2276149ea46625d8d438ffcaf3b5eb5be8e43e25f336112fa7
Instruction ID: 861d58fd62227fdaf381de944b21b1e065cf18d0783c8e120870ac151e15b0a9
Opcode Fuzzy Hash: 1f18d30cb6731d2276149ea46625d8d438ffcaf3b5eb5be8e43e25f336112fa7
Instruction Fuzzy Hash: E8918F62F0866285FB689F6D94C02BD2BB0BF54B98F54513DDF0EA6AD5DE38D482C700

Function 00007FF6B908EC9C Relevance: 6.2, APIs: 4, Instructions: 161COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6B908ED8C
_get_daylight.LIBCMT ref: 00007FF6B908ED9D
_get_daylight.LIBCMT ref: 00007FF6B908EDAE
_isindst.LIBCMT ref: 00007FF6B908EE79

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: fe74ad9a1dfbf97a60779a6b4eb4e3da65874cecf87de461c354fefb5b69a27d
Instruction ID: 4bdef2fe55239f9407a16c270b75e9f5f91cd4c2d391c05f4665cd635f0a3124
Opcode Fuzzy Hash: fe74ad9a1dfbf97a60779a6b4eb4e3da65874cecf87de461c354fefb5b69a27d
Instruction Fuzzy Hash: 1E51D972F042218AFB18EF6C99956BC3BA5AB60359F50013DDF1D96AE5DF38E442C700

Function 00007FF6B9084A8C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF6B9084ABF
GetFileInformationByHandle.KERNEL32 ref: 00007FF6B9084B21
GetLastError.KERNEL32 ref: 00007FF6B9084BB2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6B90849C4), ref: 00007FF6B9084BFE

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 1ec8bf387a2241cb1ee0019bb6bb5a321e30a3d38cbcbe421edb0c1d83f6d5d9
Instruction ID: 90ab951794114ec68b375f6dadd4f377f1bf0619017e77997333f8fe1213a4e0
Opcode Fuzzy Hash: 1ec8bf387a2241cb1ee0019bb6bb5a321e30a3d38cbcbe421edb0c1d83f6d5d9
Instruction Fuzzy Hash: FC515822F086518AFB58CFB9D4943BD37AAEB48B98F108539DF0997689DF3CD4818740

Function 00007FF6B9084938 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B9084965
CreateFileW.KERNEL32 ref: 00007FF6B90849A4
CloseHandle.KERNEL32 ref: 00007FF6B90849D9

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: ebea2a15e315379b7438f17c06ac6f564ef77e5ce815d722b4931623952d3bd6
Instruction ID: bf06ebaec9d9b745cde1b2c818a6e0c2d7a834526ad5cefca3c507823c378c01
Opcode Fuzzy Hash: ebea2a15e315379b7438f17c06ac6f564ef77e5ce815d722b4931623952d3bd6
Instruction Fuzzy Hash: 61418322E1878283E7589F6995903797260FBA4764F109339E79C87AD6EF7CE5E08700

Function 00007FF6B9072030 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF6B9072064
SetWindowLongPtrW.USER32 ref: 00007FF6B9072086
GetWindowLongPtrW.USER32 ref: 00007FF6B90720B0
InvalidateRect.USER32 ref: 00007FF6B90720D0

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 4b9e5de1fbcf843bc779a4d54dee57f94c26a540a6e6e96758728fc1cf1e39ca
Instruction ID: 549654dc95d13b2bed8e8a5215da8550f564a41b1fd16c74d3f869c59fa06b21
Opcode Fuzzy Hash: 4b9e5de1fbcf843bc779a4d54dee57f94c26a540a6e6e96758728fc1cf1e39ca
Instruction Fuzzy Hash: 8E11C821F0814242FA549F6EF5443B91292EF88BA0F84C039DF4987B9FCD3CD4D19650

Function 00007FF6B9094E2C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B9090A70: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B9090AA3

_get_daylight.LIBCMT ref: 00007FF6B9094F44
_get_daylight.LIBCMT ref: 00007FF6B9094F55

Strings

?, xrefs: 00007FF6B9094ED5

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 03a08327e3a10131aa5bb8fa3ef37a2eed6d70488736d84a243644e572cc7fb3
Instruction ID: b346b41b07edd7034e529c69dfc17dd63d71464df5bcfd04a93b03c886267d54
Opcode Fuzzy Hash: 03a08327e3a10131aa5bb8fa3ef37a2eed6d70488736d84a243644e572cc7fb3
Instruction Fuzzy Hash: 77411612B0869286FB249F2DD45537A77A0EF81BA4F10423DEF9C86AD6DF3CD4418700

Function 00007FF6B908832C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B908835E

Part of subcall function 00007FF6B9089C58: HeapFree.KERNEL32(?,?,?,00007FF6B9092032,?,?,?,00007FF6B909206F,?,?,00000000,00007FF6B9092535,?,?,?,00007FF6B9092467), ref: 00007FF6B9089C6E
Part of subcall function 00007FF6B9089C58: GetLastError.KERNEL32(?,?,?,00007FF6B9092032,?,?,?,00007FF6B909206F,?,?,00000000,00007FF6B9092535,?,?,?,00007FF6B9092467), ref: 00007FF6B9089C78

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6B907BEC5), ref: 00007FF6B908837C

Strings

C:\Users\user\Desktop\PyIsvSahWy.exe, xrefs: 00007FF6B908836A

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\PyIsvSahWy.exe
API String ID: 3580290477-1588841854
Opcode ID: 53ad205ea1c6cb2f7bb7661613e3da0ecc1c0905bf47b453e04b3a6da8a19941
Instruction ID: 0c39f050dc5399c80bc37488540e27749db160f52a688fe2d60b2a689b5d7188
Opcode Fuzzy Hash: 53ad205ea1c6cb2f7bb7661613e3da0ecc1c0905bf47b453e04b3a6da8a19941
Instruction Fuzzy Hash: A4417C32B1CB5286EB18DF29A8800BD37A5EF45790B555039EF6E83B96DE3DE4858300

Function 00007FF6B908F8E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B908F916

Part of subcall function 00007FF6B908E8C8: GetCurrentDirectoryW.KERNEL32 ref: 00007FF6B908E908

Strings

., xrefs: 00007FF6B908F967
:, xrefs: 00007FF6B908F956

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: CurrentDirectory_invalid_parameter_noinfo
String ID: .$:
API String ID: 2020911589-4202072812
Opcode ID: 02917ae70002487e25aaa57807b70e18839398bc457e7bd9011200fb9d4eab61
Instruction ID: a101b0ca0a4672c3072aa2bd694594285a700955ea5ae87820124f6f0eaa409b
Opcode Fuzzy Hash: 02917ae70002487e25aaa57807b70e18839398bc457e7bd9011200fb9d4eab61
Instruction Fuzzy Hash: 11417C22F08B5298FB159FB998902FC3AB4AF14758F64043DDF4DA7A89EF38D4468350

Function 00007FF6B908BF48 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF6B908C05F
GetLastError.KERNEL32 ref: 00007FF6B908C081

Strings

U, xrefs: 00007FF6B908C00B

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 0b7df1583adeec31525a7cba2b12c3ee68d62bc9877546cbea7757f0bce6ed29
Instruction ID: db4ac3cfc1544538e21460ea2022e4a8eec093df0d119f81931ffdc106197b26
Opcode Fuzzy Hash: 0b7df1583adeec31525a7cba2b12c3ee68d62bc9877546cbea7757f0bce6ed29
Instruction Fuzzy Hash: 71419122B28A9581DB208F29E8847B97761FB98794F944139EF4DC7798DF7CD441CB40

Function 00007FF6B908E8C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF6B908E908
GetCurrentDirectoryW.KERNEL32 ref: 00007FF6B908E95A

Strings

:, xrefs: 00007FF6B908E91E

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: e37c33f8f2befd5fbd3c49cdc0b6d52123385b6fd944ea7372e41dd3f6ca63dc
Instruction ID: dd238d2b9054a8a70d51537668f4ef5bb26e90f8b96c8f4145d29f3213c8be69
Opcode Fuzzy Hash: e37c33f8f2befd5fbd3c49cdc0b6d52123385b6fd944ea7372e41dd3f6ca63dc
Instruction Fuzzy Hash: B021E122B0868182EB68AF19D48427E77E1FB94B44F45443DDB8C83685DFBCE945C740

Function 00007FF6B907F068 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF6B907F0B8
RaiseException.KERNEL32 ref: 00007FF6B907F0F9

Strings

csm, xrefs: 00007FF6B907F0E6

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 353d784395b77eefcba7ec404c7e4e47dbaba59ece92a9373595b893a828088a
Instruction ID: d259b894affb706b9c901e291070fbb79128917d51f7ae48c453b795ca7d1d63
Opcode Fuzzy Hash: 353d784395b77eefcba7ec404c7e4e47dbaba59ece92a9373595b893a828088a
Instruction Fuzzy Hash: 79112B36618B8582EB218F29F440269B7E4FB88B94F688235DB8D47769DF3CD551CB40

Function 00007FF6B908FA4C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B908FA7C
GetDriveTypeW.KERNEL32 ref: 00007FF6B908FABC

Strings

:, xrefs: 00007FF6B908FAA5

Memory Dump Source

Source File: 00000000.00000002.2228493500.00007FF6B9071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B9070000, based on PE: true

Associated: 00000000.00000002.2226448428.00007FF6B9070000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228604279.00007FF6B909B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228665028.00007FF6B90B4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2228763061.00007FF6B90B6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b9070000_PyIsvSahWy.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
Instruction ID: 22acd7dc8645ef190fc7beeb5162422e206a7ca83ab745b2b56bf57668395ff9
Opcode Fuzzy Hash: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
Instruction Fuzzy Hash: 0C018F62B1C24286FB68AF7894A127E27A0EF58758F90003DD75DC2691DE7CE504CA14

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PyIsvSahWy.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

DNS Answers

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: PyIsvSahWy.exePID: 3840, Parent PID: 4004

General

Chronological Activities

Disassembly

Analysis Process: PyIsvSahWy.exePID: 3840, Parent PID: 4004COMMON

Execution Graph

Graph

Executed Functions

Function 00007FF6B9071000 Relevance: 40.6, APIs: 5, Strings: 18, Instructions: 338COMMON

Control-flow Graph

Function 00007FF6B9095C74 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON

Windows Analysis Report
PyIsvSahWy.exe

Function 00007FF6B9071000 Relevance: 40.6, APIs: 5, Strings: 18, Instructions: 338
COMMON

Function 00007FF6B9095C74 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Function 00007FF6B90785A0 Relevance: 3.0, APIs: 2, Instructions: 29
COMMON

Function 00007FF6B90718F0 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 172
COMMON

Function 00007FF6B908AD6C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Function 00007FF6B90733E0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 59
COMMON

Function 00007FF6B90725F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44
windowCOMMON

Function 00007FF6B907BF5C Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Function 00007FF6B9088D48 Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Function 00007FF6B907F45C Relevance: 3.2, APIs: 2, Instructions: 177
COMMONLIBRARYCODE

Function 00007FF6B908B444 Relevance: 3.0, APIs: 2, Instructions: 46
COMMONLIBRARYCODE

Function 00007FF6B9089E68 Relevance: 2.6, APIs: 2, Instructions: 59
COMMON

Function 00007FF6B908B1BC Relevance: 1.6, APIs: 1, Instructions: 112
COMMONLIBRARYCODE

Function 00007FF6B90776A0 Relevance: 1.6, APIs: 1, Instructions: 85
COMMON

Function 00007FF6B908AC4C Relevance: 1.6, APIs: 1, Instructions: 79
COMMONLIBRARYCODE