Edit tour

Windows Analysis Report
solara-executor.exe

Overview

General Information

Sample name:	solara-executor.exe
Analysis ID:	1577819
MD5:	6107673fe6de87ac938d8d45ceee771b
SHA1:	0ebf97d44da9ce419102f2407e4b92ccc75677dd
SHA256:	1d820e33b6818f08161dbd3766b37e971b7531ee018dee1eb21822edb1eaa545
Tags:	exeuser-aachum
Infos:

Detection

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Contain functionality to detect virtual machines

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

PE file contains section with special chars

Tries to harvest and steal browser information (history, passwords, etc)

Abnormal high CPU Usage

Contains capabilities to detect virtual machines

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Detected potential crypto function

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

solara-executor.exe (PID: 788 cmdline: "C:\Users\user\Desktop\solara-executor.exe" MD5: 6107673FE6DE87AC938D8D45CEEE771B)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: solara-executor.exe PID: 788	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.solara-executor.exe.23d0fc481d0.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T19:28:06.291894+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49699	172.67.75.163	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: solara-executor.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: solara-executor.exe

ReversingLabs: Detection: 18%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: solara-executor.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\solara-executor.exe

Code function: 0_2_0000023D0FBC7740 Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,CryptUnprotectData,

0_2_0000023D0FBC7740

Source: unknown

HTTPS traffic detected: 172.67.75.163:443 -> 192.168.2.7:49699 version: TLS 1.2

Source: solara-executor.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\55yar\Desktop\imgui-master\examples\imgui_loader\Release\example_win32_directx9.pdb source: solara-executor.exe, solara-executor.exe, 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Users\55yar\Desktop\imgui-master\examples\imgui_loader\Release\example_win32_directx9.pdb/''GCTL source: solara-executor.exe, 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp

Source: C:\Users\user\Desktop\solara-executor.exe

Code function: 0_2_0000023D0FB2F46A Concurrency::details::WorkQueue::IsStructuredEmpty,FindFirstFileA,type_info::_name_internal_method,type_info::_name_internal_method,type_info::_name_internal_method,

0_2_0000023D0FB2F46A

Source: Joe Sandbox View

IP Address: 172.67.75.163 172.67.75.163

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49699 -> 172.67.75.163:443

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.74 Safari/537.36 Edg/79.0.309.43Host: api.myip.com

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.74 Safari/537.36 Edg/79.0.309.43Host: api.myip.com

Source: global traffic

DNS traffic detected: DNS query: api.myip.com

Source: solara-executor.exe, 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://https://https/:://websocketpp.processorGeneric
Source: solara-executor.exe, 00000000.00000003.1341908096.0000023D10332000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1341411906.0000023D102D3000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1300358467.0000023D102F6000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D10131000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: solara-executor.exe, solara-executor.exe, 00000000.00000003.1323546214.0000023D0FAAB000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1305911836.0000023D0FAB0000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1418031452.0000023D0FABC000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1343267729.0000023D0FAB0000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1287929797.0000023D0FF61000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1379681332.0000023D0FAB4000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1334362044.0000023D0FAAB000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1297087475.0000023D0FF61000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000002.3717359481.0000023D0FABD000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1310052156.0000023D0FAB4000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1300870498.0000023D0FF61000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1310110338.0000023D0FABC000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1398956164.0000023D0FAB4000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1294991572.0000023D0FAA4000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1297666822.0000023D0FAA5000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1383401441.0000023D0FAB4000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1349448809.0000023D0FAAB000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1400491675.0000023D0FAAB000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1300192041.0000023D0FF61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com/
Source: solara-executor.exe, 00000000.00000003.1323546214.0000023D0FAAB000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1305911836.0000023D0FAB0000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1418031452.0000023D0FABC000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1343267729.0000023D0FAB0000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1379681332.0000023D0FAB4000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1334362044.0000023D0FAAB000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000002.3717359481.0000023D0FABD000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1310052156.0000023D0FAB4000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1310110338.0000023D0FABC000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1398956164.0000023D0FAB4000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1294991572.0000023D0FAA4000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1297666822.0000023D0FAA5000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1383401441.0000023D0FAB4000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1349448809.0000023D0FAAB000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1400491675.0000023D0FAAB000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1413085319.0000023D0FAB4000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1300301777.0000023D0FAB5000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1389965174.0000023D0FAAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com/LL_Only:?
Source: solara-executor.exe, 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com/Russia
Source: solara-executor.exe, 00000000.00000003.1354621604.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2743020121.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2555027884.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1366950028.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1340036141.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1422821644.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1359882286.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1458025330.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1482885168.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1361379443.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000002.3718394702.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2578647107.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1466092210.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.adm
Source: solara-executor.exe, 00000000.00000003.1289015388.0000023D10253000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1297736420.0000023D10253000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: solara-executor.exe, 00000000.00000003.1289015388.0000023D10253000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1354621604.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2743020121.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2555027884.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1366950028.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1340036141.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1422821644.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1359882286.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1458025330.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1482885168.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1361379443.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000002.3718394702.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1297736420.0000023D10253000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2578647107.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1466092210.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: solara-executor.exe, 00000000.00000003.1341908096.0000023D10332000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1341411906.0000023D102D3000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1300358467.0000023D102F6000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D10131000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: solara-executor.exe, 00000000.00000003.1341908096.0000023D10332000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1341411906.0000023D102D3000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1300358467.0000023D102F6000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D10131000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: solara-executor.exe, 00000000.00000003.1341908096.0000023D10332000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1341411906.0000023D102D3000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1349509117.0000023D102B8000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1341411906.0000023D102B8000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1328622619.0000023D102B6000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1300358467.0000023D102F6000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1316487085.0000023D102B6000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1300358467.0000023D102B6000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D102BB000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1297178313.0000023D102B8000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000002.3719962029.0000023D102B8000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1334497632.0000023D102B8000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1366950028.0000023D102B8000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1365067301.0000023D102B8000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D10131000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: solara-executor.exe, 00000000.00000003.1354621604.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2743020121.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2555027884.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1366950028.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1340036141.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1422821644.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1359882286.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1458025330.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1482885168.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1361379443.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000002.3718394702.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2578647107.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1466092210.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mo
Source: solara-executor.exe, 00000000.00000003.1289015388.0000023D10253000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1297736420.0000023D10253000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: solara-executor.exe, 00000000.00000003.1289015388.0000023D10253000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1354621604.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2743020121.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2555027884.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1366950028.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1340036141.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1422821644.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1359882286.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1458025330.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1482885168.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1361379443.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000002.3718394702.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1297736420.0000023D10253000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2578647107.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1466092210.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: solara-executor.exe, 00000000.00000003.1341908096.0000023D10332000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1341411906.0000023D102D3000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1300358467.0000023D102F6000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D10131000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: solara-executor.exe, 00000000.00000003.1341908096.0000023D10332000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1341411906.0000023D102D3000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1300358467.0000023D102F6000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D10131000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: solara-executor.exe, 00000000.00000003.1341908096.0000023D10332000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1341411906.0000023D102D3000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1300358467.0000023D102F6000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D10131000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: solara-executor.exe, solara-executor.exe, 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/ocornut/imgui/blob/master/docs/FAQ.md#qa-usage
Source: solara-executor.exe, 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/ocornut/imgui/blob/master/docs/FAQ.md#qa-usage(Hold
Source: solara-executor.exe, 00000000.00000003.1354621604.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2743020121.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2555027884.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1366950028.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1340036141.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1422821644.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1359882286.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1458025330.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1482885168.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1361379443.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000002.3718394702.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2578647107.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1466092210.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qq
Source: solara-executor.exe, 00000000.00000003.1297736420.0000023D10253000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2578647107.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1466092210.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: solara-executor.exe, 00000000.00000003.1354621604.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2743020121.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2555027884.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1366950028.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1340036141.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1422821644.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1359882286.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1458025330.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1482885168.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1361379443.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000002.3718394702.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2578647107.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1466092210.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c/
Source: solara-executor.exe, 00000000.00000003.1289015388.0000023D10253000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1297736420.0000023D10253000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: solara-executor.exe, 00000000.00000003.1341908096.0000023D10332000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1341411906.0000023D102D3000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1300358467.0000023D102F6000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D10131000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: solara-executor.exe, 00000000.00000003.1341908096.0000023D10332000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1341411906.0000023D102D3000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1300358467.0000023D102F6000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D10131000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: solara-executor.exe, 00000000.00000003.1354621604.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2743020121.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2555027884.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1366950028.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1340036141.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1422821644.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1359882286.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1458025330.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1482885168.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1361379443.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000002.3718394702.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2578647107.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1466092210.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarke
Source: solara-executor.exe, 00000000.00000003.1289015388.0000023D10253000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1297736420.0000023D10253000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u

Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699

Source: unknown

HTTPS traffic detected: 172.67.75.163:443 -> 192.168.2.7:49699 version: TLS 1.2

Source: C:\Users\user\Desktop\solara-executor.exe

Code function: 0_2_00007FF7C18A1C20 OpenClipboard,GetClipboardData,CloseClipboard,GlobalLock,WideCharToMultiByte,WideCharToMultiByte,GlobalUnlock,CloseClipboard,

0_2_00007FF7C18A1C20

Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18DE200 DestroyWindow,SetClipboardData,GetClipboardData,EmptyClipboard,		0_2_00007FF7C18DE200
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18A1D70 OpenClipboard,MultiByteToWideChar,GlobalAlloc,GlobalLock,MultiByteToWideChar,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,CloseClipboard,		0_2_00007FF7C18A1D70

Source: C:\Users\user\Desktop\solara-executor.exe

Code function: 0_2_00007FF7C18DE200 DestroyWindow,SetClipboardData,GetClipboardData,EmptyClipboard,

0_2_00007FF7C18DE200

Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18D0330 GetClientRect,QueryPerformanceCounter,GetForegroundWindow,ClientToScreen,SetCursorPos,GetCursorPos,ScreenToClient,GetKeyState,GetKeyState,GetKeyState,GetKeyState,		0_2_00007FF7C18D0330
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18D0D02 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,		0_2_00007FF7C18D0D02

System Summary

PE file contains section with special chars

Source: solara-executor.exe

Static PE information: section name: "/hR

Source: C:\Users\user\Desktop\solara-executor.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18D3F90 PostQuitMessage,GetWindowRect,SetWindowPos,NtdllDefWindowProc_A,		0_2_00007FF7C18D3F90
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18DE278 NtdllDefWindowProc_A,		0_2_00007FF7C18DE278

Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18CF2F0	0_2_00007FF7C18CF2F0
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18CEA60	0_2_00007FF7C18CEA60
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18CFCE0	0_2_00007FF7C18CFCE0
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18D0330	0_2_00007FF7C18D0330
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18D4720	0_2_00007FF7C18D4720
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18CC310	0_2_00007FF7C18CC310
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C1895A30	0_2_00007FF7C1895A30
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C189C250	0_2_00007FF7C189C250
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C189F250	0_2_00007FF7C189F250
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18AC270	0_2_00007FF7C18AC270
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18CBA80	0_2_00007FF7C18CBA80
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C189E1C0	0_2_00007FF7C189E1C0
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18BF9E0	0_2_00007FF7C18BF9E0
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18B59E0	0_2_00007FF7C18B59E0
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18AB1E0	0_2_00007FF7C18AB1E0
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C189FA00	0_2_00007FF7C189FA00
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18C2A00	0_2_00007FF7C18C2A00
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C1886CB0	0_2_00007FF7C1886CB0
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18A54F0	0_2_00007FF7C18A54F0
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18B7CE0	0_2_00007FF7C18B7CE0
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18ABD10	0_2_00007FF7C18ABD10
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18D0D02	0_2_00007FF7C18D0D02
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18A6C90	0_2_00007FF7C18A6C90
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C188FBB0	0_2_00007FF7C188FBB0
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18B6BC0	0_2_00007FF7C18B6BC0
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18ADB50	0_2_00007FF7C18ADB50
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18CCB40	0_2_00007FF7C18CCB40
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18CA370	0_2_00007FF7C18CA370
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C1887390	0_2_00007FF7C1887390
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18A96B0	0_2_00007FF7C18A96B0
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C1896EC0	0_2_00007FF7C1896EC0
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18A7EF0	0_2_00007FF7C18A7EF0
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18946F0	0_2_00007FF7C18946F0
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C189D620	0_2_00007FF7C189D620
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C1894620	0_2_00007FF7C1894620
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18CE5B0	0_2_00007FF7C18CE5B0
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18BCDD0	0_2_00007FF7C18BCDD0
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18B25F0	0_2_00007FF7C18B25F0
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18C0DE0	0_2_00007FF7C18C0DE0
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C1889E10	0_2_00007FF7C1889E10
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18BD530	0_2_00007FF7C18BD530
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18AAD40	0_2_00007FF7C18AAD40
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C1885D90	0_2_00007FF7C1885D90
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18C6090	0_2_00007FF7C18C6090
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C188DFB0	0_2_00007FF7C188DFB0
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18ABFC0	0_2_00007FF7C18ABFC0
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18B97F0	0_2_00007FF7C18B97F0
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C1889730	0_2_00007FF7C1889730
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_0000023D0FBF0FF0	0_2_0000023D0FBF0FF0

Source: C:\Users\user\Desktop\solara-executor.exe	Code function: String function: 00007FF7C18DE460 appears 867 times
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: String function: 00007FF7C18A1F40 appears 40 times
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: String function: 00007FF7C18985B0 appears 36 times

Source: solara-executor.exe

Static PE information: Section: bbbb ZLIB complexity 0.9988679984861591

Source: classification engine

Classification label: mal88.spyw.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\solara-executor.exe

Code function: 0_2_0000023D0FC0CB40 CreateToolhelp32Snapshot,Process32NextW,Concurrency::details::WorkQueue::IsStructuredEmpty,Concurrency::details::WorkQueue::IsStructuredEmpty,Process32NextW,

0_2_0000023D0FC0CB40

Source: C:\Users\user\Desktop\solara-executor.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\SVQ08EEO.htm

Jump to behavior

Source: C:\Users\user\Desktop\solara-executor.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: solara-executor.exe, 00000000.00000003.1300301777.0000023D0FADA000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1310052156.0000023D0FADA000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1297666822.0000023D0FADA000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1383401441.0000023D0FADA000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1418031452.0000023D0FADA000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1334362044.0000023D0FADA000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1413085319.0000023D0FADA000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1323546214.0000023D0FADA000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1379681332.0000023D0FADA000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1398956164.0000023D0FADA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE local_addresses (guid VARCHAR PRIMARY KEY, use_count INTEGER NOT NULL DEFAULT 0, use_date INTEGER NOT NULL DEFAULT 0, date_modified INTEGER NOT NULL DEFAULT 0, language_code VARCHAR, label VARCHAR, initial_creator_id INTEGER DEFAULT 0, last_modifier_id INTEGER DEFAULT 0)key));
Source: solara-executor.exe, 00000000.00000002.3718394702.0000023D1018E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1340036141.0000023D102A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: solara-executor.exe

ReversingLabs: Detection: 18%

Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: xinput1_4.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\solara-executor.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: solara-executor.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: solara-executor.exe

Static file information: File size 1248295 > 1048576

Source: solara-executor.exe

Static PE information: Raw size of bbbb is bigger than: 0x100000 < 0x121000

Source: solara-executor.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\55yar\Desktop\imgui-master\examples\imgui_loader\Release\example_win32_directx9.pdb source: solara-executor.exe, solara-executor.exe, 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Users\55yar\Desktop\imgui-master\examples\imgui_loader\Release\example_win32_directx9.pdb/''GCTL source: solara-executor.exe, 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\solara-executor.exe

Unpacked PE file: 0.2.solara-executor.exe.7ff7c1880000.1.unpack "/hR:EW;bbbb:EW;Unknown_Section2:W; vs "/hR:ER;bbbb:ER;Unknown_Section2:W;

Source: C:\Users\user\Desktop\solara-executor.exe

Code function: 0_2_00007FF7C18CF7A0 QueryPerformanceFrequency,QueryPerformanceCounter,GetKeyboardLayout,GetLocaleInfoA,LoadLibraryA,GetProcAddress,GetProcAddress,

0_2_00007FF7C18CF7A0

Source: initial sample

Static PE information: section where entry point is pointing to: bbbb

Source: solara-executor.exe	Static PE information: section name: "/hR
Source: solara-executor.exe	Static PE information: section name: bbbb
Source: solara-executor.exe	Static PE information: section name: bNbF

Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18DE578 push rax; retf	0_2_00007FF7C18DE579
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_0000023D0FB44970 push es; ret	0_2_0000023D0FB4497F
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_0000023D0FC9C5C7 push esi; iretd	0_2_0000023D0FC9C5F0
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_0000023D0FC7C2BA push 52F6EBC2h; retn F6EBh	0_2_0000023D0FC7C333
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_0000023D0FC7D632 pushfd ; retf BD37h	0_2_0000023D0FC7D7D9

Source: solara-executor.exe

Static PE information: section name: bbbb entropy: 7.999761627141752

Source: C:\Users\user\Desktop\solara-executor.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Malware Analysis System Evasion

Contain functionality to detect virtual machines

Source: C:\Users\user\Desktop\solara-executor.exe	Code function: \\.\VBoxMiniRdrDN \\.\VBoxMiniRdrDN \\.\VBoxMiniRdrDN		0_2_00007FF7C18D3C00
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: SOFTWARE\VMware, Inc.\VMware Tools SOFTWARE\VMware, Inc.\VMware Tools SOFTWARE\VMware, Inc.\VMware Tools		0_2_00007FF7C18D3D40

Source: C:\Users\user\Desktop\solara-executor.exe

File opened / queried: VBoxMiniRdrDN

Jump to behavior

Source: C:\Users\user\Desktop\solara-executor.exe	Window / User API: threadDelayed 5541			Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	Window / User API: foregroundWindowGot 1658			Jump to behavior

Source: C:\Users\user\Desktop\solara-executor.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\solara-executor.exe

0_2_0000023D0FB2F46A

Source: solara-executor.exe, 00000000.00000003.1271381336.0000023D10144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: solara-executor.exe, 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: vboxservice
Source: solara-executor.exe, 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtrayx64dbgh
Source: solara-executor.exe, 00000000.00000003.1271381336.0000023D10144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: solara-executor.exe, 00000000.00000003.1271381336.0000023D10144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: solara-executor.exe, 00000000.00000003.1271381336.0000023D10144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: solara-executor.exe, 00000000.00000002.3716741170.0000023D0FA36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@z
Source: solara-executor.exe, 00000000.00000003.1271381336.0000023D10144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: solara-executor.exe, solara-executor.exe, 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: \\.\VBoxMiniRdrDN
Source: solara-executor.exe, 00000000.00000003.1271381336.0000023D10144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: solara-executor.exe, 00000000.00000003.1271381336.0000023D10144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: solara-executor.exe, 00000000.00000003.1300301777.0000023D0FADA000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1310052156.0000023D0FADA000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000002.3716741170.0000023D0FA36000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1297666822.0000023D0FADA000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1383401441.0000023D0FADA000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1418031452.0000023D0FADA000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1334362044.0000023D0FADA000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1413085319.0000023D0FADA000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1323546214.0000023D0FADA000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1379681332.0000023D0FADA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: solara-executor.exe, 00000000.00000003.1271381336.0000023D10144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: solara-executor.exe, 00000000.00000003.1271381336.0000023D10144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: solara-executor.exe, 00000000.00000003.1271381336.0000023D10144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: solara-executor.exe, solara-executor.exe, 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: qemu-ga
Source: solara-executor.exe, 00000000.00000003.1271381336.0000023D10144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: solara-executor.exe, 00000000.00000003.1271381336.0000023D10144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: solara-executor.exe, 00000000.00000003.1271381336.0000023D10144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: solara-executor.exe, 00000000.00000003.1271381336.0000023D10144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: solara-executor.exe, 00000000.00000003.1271381336.0000023D10144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: solara-executor.exe, 00000000.00000003.1271381336.0000023D10144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: solara-executor.exe, 00000000.00000003.1271381336.0000023D10144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: solara-executor.exe, 00000000.00000003.1271381336.0000023D10144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: solara-executor.exe, 00000000.00000003.1271381336.0000023D10144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: solara-executor.exe, 00000000.00000003.1271381336.0000023D10144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: solara-executor.exe, 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware ToolsNOPQRSTUVWXYZABCDEFGHIJKLMnopqrstuvwxyzabcdefghijklm0123456789+/LoadLibraryA
Source: solara-executor.exe, 00000000.00000003.1271381336.0000023D10144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: solara-executor.exe, 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: vmtoolsdvboxserviceu
Source: solara-executor.exe, 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Kernel32.dllKernel32.dll\\.\VBoxMiniRdrDN
Source: solara-executor.exe, 00000000.00000003.1271381336.0000023D10144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: solara-executor.exe, 00000000.00000003.1300301777.0000023D0FADA000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1310052156.0000023D0FADA000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1297666822.0000023D0FADA000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1383401441.0000023D0FADA000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1418031452.0000023D0FADA000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1334362044.0000023D0FADA000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1413085319.0000023D0FADA000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1323546214.0000023D0FADA000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1379681332.0000023D0FADA000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1398956164.0000023D0FADA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: solara-executor.exe, 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareuser
Source: solara-executor.exe, 00000000.00000003.1271381336.0000023D10144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: solara-executor.exe, 00000000.00000003.1271381336.0000023D10144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: solara-executor.exe, 00000000.00000003.1271381336.0000023D10144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: solara-executor.exe, 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: vmwaretray
Source: solara-executor.exe, 00000000.00000003.1271381336.0000023D10144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: solara-executor.exe, 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: qemu-gaVGAuthServicevmwaretrayv
Source: solara-executor.exe, solara-executor.exe, 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtray
Source: solara-executor.exe, 00000000.00000003.1271381336.0000023D10144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: solara-executor.exe, 00000000.00000003.1271381336.0000023D10144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: solara-executor.exe, 00000000.00000003.1271381336.0000023D10144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: solara-executor.exe, 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: solara-executor.exe, 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: wiresharkvmwareuseri
Source: solara-executor.exe, 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: vmtoolsd
Source: solara-executor.exe, 00000000.00000003.1271381336.0000023D10144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: solara-executor.exe, 00000000.00000003.1271381336.0000023D10144000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE

Source: C:\Users\user\Desktop\solara-executor.exe

API call chain: ExitProcess graph end node

graph_0-72683

Source: C:\Users\user\Desktop\solara-executor.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\solara-executor.exe

Code function: 0_2_00007FF7C18DC628 IsProcessorFeaturePresent,00007FFB1E6719C0,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,00007FFB1E6719C0,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7C18DC628

Source: C:\Users\user\Desktop\solara-executor.exe

Code function: 0_2_00007FF7C18CF7A0 QueryPerformanceFrequency,QueryPerformanceCounter,GetKeyboardLayout,GetLocaleInfoA,LoadLibraryA,GetProcAddress,GetProcAddress,

0_2_00007FF7C18CF7A0

Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18DC628 IsProcessorFeaturePresent,00007FFB1E6719C0,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,00007FFB1E6719C0,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7C18DC628
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18DE0B0 SetUnhandledExceptionFilter,	0_2_00007FF7C18DE0B0
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18DE0D0 SetUnhandledExceptionFilter,	0_2_00007FF7C18DE0D0
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18DE0C0 SetUnhandledExceptionFilter,	0_2_00007FF7C18DE0C0
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18DE050 QueryPerformanceCounter,SetUnhandledExceptionFilter,	0_2_00007FF7C18DE050
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: 0_2_00007FF7C18DC80C SetUnhandledExceptionFilter,	0_2_00007FF7C18DC80C

Source: C:\Users\user\Desktop\solara-executor.exe	Code function: QueryPerformanceFrequency,QueryPerformanceCounter,GetKeyboardLayout,GetLocaleInfoA,LoadLibraryA,GetProcAddress,GetProcAddress,	0_2_00007FF7C18CF7A0
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: GetLocaleInfoA,	0_2_00007FF7C18DE0A0
Source: C:\Users\user\Desktop\solara-executor.exe	Code function: GetKeyboardLayout,GetLocaleInfoA,	0_2_00007FF7C18D105B

Source: C:\Users\user\Desktop\solara-executor.exe

Code function: 0_2_00007FF7C18DC8B8 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7C18DC8B8

Stealing of Sensitive Information

Found many strings related to Crypto-Wallets (likely being stolen)

Source: solara-executor.exe	String found in binary or memory: Electrum-LTC
Source: solara-executor.exe	String found in binary or memory: ElectronCash
Source: solara-executor.exe	String found in binary or memory: \com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: solara-executor.exe	String found in binary or memory: \Exodus\exodus.wallet
Source: solara-executor.exe	String found in binary or memory: \Ethereum\keystore
Source: solara-executor.exe	String found in binary or memory: Exodus Web
Source: solara-executor.exe	String found in binary or memory: \Ethereum\keystore
Source: solara-executor.exe	String found in binary or memory: \Coinomi\Coinomi\wallets
Source: solara-executor.exe	String found in binary or memory: \Ethereum\keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\solara-executor.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\solara-executor.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Source: Yara match	File source: 0.2.solara-executor.exe.23d0fc481d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: solara-executor.exe PID: 788, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Input Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 Virtualization/Sandbox Evasion	1 Input Capture	1 Query Registry	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	121 Security Software Discovery	SMB/Windows Admin Shares	2 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	11 Virtualization/Sandbox Evasion	Distributed Component Object Model	3 Clipboard Data	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	12 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
solara-executor.exe	18%	ReversingLabs
solara-executor.exe	100%	Avira	HEUR/AGEN.1314582
solara-executor.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://https://https/:://websocketpp.processorGeneric	0%	Avira URL Cloud	safe
https://bridge.sfo1.adm	0%	Avira URL Cloud	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	0%	Avira URL Cloud	safe
https://contile-images.services.mo	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.myip.com	172.67.75.163	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.myip.com/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://https://https/:://websocketpp.processorGeneric	solara-executor.exe, 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	solara-executor.exe, 00000000.00000003.1289015388.0000023D10253000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1297736420.0000023D10253000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	solara-executor.exe, 00000000.00000003.1341908096.0000023D10332000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1341411906.0000023D102D3000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1300358467.0000023D102F6000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D10131000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c/	solara-executor.exe, 00000000.00000003.1354621604.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2743020121.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2555027884.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1366950028.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1340036141.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1422821644.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1359882286.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1458025330.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1482885168.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1361379443.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000002.3718394702.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2578647107.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1466092210.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	solara-executor.exe, 00000000.00000003.1341908096.0000023D10332000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1341411906.0000023D102D3000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1300358467.0000023D102F6000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D10131000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	solara-executor.exe, 00000000.00000003.1341908096.0000023D10332000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1341411906.0000023D102D3000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1300358467.0000023D102F6000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D10131000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.invisalign.com/?utm_source=admarke	solara-executor.exe, 00000000.00000003.1354621604.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2743020121.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2555027884.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1366950028.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1340036141.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1422821644.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1359882286.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1458025330.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1482885168.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1361379443.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000002.3718394702.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2578647107.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1466092210.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	solara-executor.exe, 00000000.00000003.1289015388.0000023D10253000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1297736420.0000023D10253000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	solara-executor.exe, 00000000.00000003.1341908096.0000023D10332000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1341411906.0000023D102D3000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1300358467.0000023D102F6000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D10131000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	solara-executor.exe, 00000000.00000003.1341908096.0000023D10332000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1341411906.0000023D102D3000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1349509117.0000023D102B8000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1341411906.0000023D102B8000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1328622619.0000023D102B6000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1300358467.0000023D102F6000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1316487085.0000023D102B6000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1300358467.0000023D102B6000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D102BB000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1297178313.0000023D102B8000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000002.3719962029.0000023D102B8000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1334497632.0000023D102B8000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1366950028.0000023D102B8000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1365067301.0000023D102B8000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D10131000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.myip.com/Russia	solara-executor.exe, 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp	false		high
https://github.com/ocornut/imgui/blob/master/docs/FAQ.md#qa-usage(Hold	solara-executor.exe, 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp	false		high
https://www.ecosia.org/newtab/	solara-executor.exe, 00000000.00000003.1341908096.0000023D10332000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1341411906.0000023D102D3000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1300358467.0000023D102F6000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D10131000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	solara-executor.exe, 00000000.00000003.1341908096.0000023D10332000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1341411906.0000023D102D3000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1300358467.0000023D102F6000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D10131000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	solara-executor.exe, 00000000.00000003.1289015388.0000023D10253000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1354621604.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2743020121.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2555027884.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1366950028.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1340036141.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1422821644.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1359882286.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1458025330.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1482885168.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1361379443.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000002.3718394702.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1297736420.0000023D10253000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2578647107.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1466092210.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.sfo1.adm	solara-executor.exe, 00000000.00000003.1354621604.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2743020121.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2555027884.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1366950028.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1340036141.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1422821644.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1359882286.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1458025330.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1482885168.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1361379443.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000002.3718394702.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2578647107.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1466092210.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/ocornut/imgui/blob/master/docs/FAQ.md#qa-usage	solara-executor.exe, solara-executor.exe, 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	solara-executor.exe, 00000000.00000003.1341908096.0000023D10332000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1341411906.0000023D102D3000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1300358467.0000023D102F6000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D10131000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qq	solara-executor.exe, 00000000.00000003.1354621604.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2743020121.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2555027884.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1366950028.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1340036141.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1422821644.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1359882286.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1458025330.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1482885168.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1361379443.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000002.3718394702.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2578647107.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1466092210.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	solara-executor.exe, 00000000.00000003.1289015388.0000023D10253000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1297736420.0000023D10253000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e	solara-executor.exe, 00000000.00000003.1297736420.0000023D10253000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2578647107.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1466092210.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	solara-executor.exe, 00000000.00000003.1289015388.0000023D10253000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1297736420.0000023D10253000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.myip.com/LL_Only:?	solara-executor.exe, 00000000.00000003.1323546214.0000023D0FAAB000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1305911836.0000023D0FAB0000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1418031452.0000023D0FABC000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1343267729.0000023D0FAB0000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1379681332.0000023D0FAB4000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1334362044.0000023D0FAAB000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000002.3717359481.0000023D0FABD000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1310052156.0000023D0FAB4000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1310110338.0000023D0FABC000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1398956164.0000023D0FAB4000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1294991572.0000023D0FAA4000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1297666822.0000023D0FAA5000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1383401441.0000023D0FAB4000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1349448809.0000023D0FAAB000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1400491675.0000023D0FAAB000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1413085319.0000023D0FAB4000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1300301777.0000023D0FAB5000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1389965174.0000023D0FAAB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	solara-executor.exe, 00000000.00000003.1341908096.0000023D10332000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1341411906.0000023D102D3000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1300358467.0000023D102F6000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D10131000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mo	solara-executor.exe, 00000000.00000003.1354621604.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2743020121.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2555027884.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1366950028.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1340036141.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1422821644.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1359882286.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1458025330.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1482885168.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1361379443.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000002.3718394702.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2578647107.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1466092210.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta	solara-executor.exe, 00000000.00000003.1289015388.0000023D10253000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1354621604.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2743020121.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2555027884.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1366950028.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1340036141.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1422821644.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1359882286.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1458025330.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1289015388.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1482885168.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1361379443.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000002.3718394702.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1297736420.0000023D10253000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.2578647107.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp, solara-executor.exe, 00000000.00000003.1466092210.0000023D1020E000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.75.163	api.myip.com	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577819
Start date and time:	2024-12-18 19:27:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	solara-executor.exe
Detection:	MAL
Classification:	mal88.spyw.evad.winEXE@1/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 88% Number of executed functions: 31 Number of non-executed functions: 129
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 52.149.20.212
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: solara-executor.exe

Simulations

Behavior and APIs

Time	Type	Description
14:57:51	API Interceptor	16619569x Sleep call for process: solara-executor.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.75.163	http://keynstrings.com/qdop/shriejeapd-xtre-czoyj-wux-182-n-ql72-dn6/?c=fg228vRhwgeAXmTlARVFPNkYQLEru1SQGolYq6DI2QO81BQyaFaUvmsyEbo4THF&dx6ywq7xi--6pmvnh36bm-q6ly=LedZebpban&f5W%2bAIcMkGZ9Lp3h7Da%2bJcuQl1mIISCF0%2bsnvlLl1C7JZwlOpPadnHGgzJCg9kkRnhKcM0BjIT2Bh9Pj1vF476j%3d%1d&url=htths%2a%0v%0wfr-tr.fazeboak.bon%2fUrbanZoccer%7c	Get hash	malicious	GRQ Scam	Browse	trk.adtrk18.com/aff_c?offer_id=15108&aff_id=1850&url_id=14904&aff_sub=ee27fca9-b066-4ae9-9cbc-def0df49be21&aff_sub5=cm3l19374

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.myip.com	WaveExecutor.exe	Get hash	malicious	Unknown	Browse	104.26.8.59
	Nexus-Executor.exe	Get hash	malicious	Unknown	Browse	104.26.9.59
	WaveExecutor.exe	Get hash	malicious	Unknown	Browse	104.26.9.59
	Nexus-Executor.exe	Get hash	malicious	Unknown	Browse	104.26.9.59
	Fortexternal.exe	Get hash	malicious	Unknown	Browse	104.26.9.59
	Fortexternal.exe	Get hash	malicious	Unknown	Browse	104.26.9.59
	file.exe	Get hash	malicious	Unknown	Browse	104.26.9.59
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	172.67.75.163
	file.exe	Get hash	malicious	Amadey, XWorm	Browse	172.67.75.163
	file.exe	Get hash	malicious	Unknown	Browse	104.26.8.59

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://usemployee-hrdbenefits.com	Get hash	malicious	Unknown	Browse	104.16.123.96
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	172.67.131.246
	https://em.navan.com/MDM3LUlLWi04NzEAAAGXecU3IyvXka_yOfm1UXs3oOmq7mq-S6uBgGscrsY0kWMgpLalbadmEIYbTEXYqyKQHEXyRQM=	Get hash	malicious	Unknown	Browse	104.16.79.73
	A file has been sent to you via DROPBOX.pdf	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://usps.com-parcelbvxce.vip/i/	Get hash	malicious	Unknown	Browse	104.21.4.80
	http://golden1-alert.net/online	Get hash	malicious	Unknown	Browse	104.17.25.14
	Setup.msi	Get hash	malicious	Unknown	Browse	172.67.218.192
	'Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.179.225
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.88.199

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	Setup.msi	Get hash	malicious	Unknown	Browse	172.67.75.163
	InstallSetup.exe	Get hash	malicious	LummaC	Browse	172.67.75.163
	T2dvU8f2xg.exe	Get hash	malicious	Unknown	Browse	172.67.75.163
	PAYMENT SWIFT AND SOA TT07180016-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.75.163
	z68scancopy.vbs	Get hash	malicious	FormBook	Browse	172.67.75.163
	oiBxz37xUo.dll	Get hash	malicious	Unknown	Browse	172.67.75.163
	T2dvU8f2xg.exe	Get hash	malicious	Unknown	Browse	172.67.75.163
	oiBxz37xUo.dll	Get hash	malicious	Unknown	Browse	172.67.75.163
	7nJ9Jo78Vq.dll	Get hash	malicious	Unknown	Browse	172.67.75.163

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.941670398228598
TrID:	Win64 Executable GUI (202006/5) 93.51% Win64 Executable (generic) (12005/4) 5.56% DOS Executable Generic (2002/1) 0.93% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	solara-executor.exe
File size:	1'248'295 bytes
MD5:	6107673fe6de87ac938d8d45ceee771b
SHA1:	0ebf97d44da9ce419102f2407e4b92ccc75677dd
SHA256:	1d820e33b6818f08161dbd3766b37e971b7531ee018dee1eb21822edb1eaa545
SHA512:	798affa3cabc3537d226ebdffa458309b0fa81a21939990eebdf121971e870d70d96f8b75ff6746b5d397e28015beb81f8af35df51f10adbf91c378d4dce74d2
SSDEEP:	24576:PDnqyaenIySWhuUSC/i/dH9ONOznpY4sEkm30TEhibtyuk5mj5dRvgRnFpt:PGy5LSwUdbznqfEZ3RGN2Fpt
TLSH:	DE45122BB7E46771D934D473CB9BC71AB330A262D0768B5B05C28B1F665A00A774BF18
File Content Preview:	MZ......................@.2.92.UPX!._0x001818c..........................!..L.!This program cannot be run in DOS mode....$.......4=..p\..p\..p\..y$P.`\..`...v\..`...r\..`...y\..`...n\..;$..`\..W...s\..p\...\..;...x\..;.<.q\..;...q\..Richp\.................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140631280
Entrypoint Section:	bbbb
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6761A24F [Tue Dec 17 16:09:51 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	b20f1daac672151d282f9ffd530ca36b

Entrypoint Preview

Instruction
push ebx
push esi
push edi
push ebp
dec eax
lea esi, dword ptr [FFEDFD75h]
dec eax
lea edi, dword ptr [esi-00510000h]
push edi
mov eax, 0062FDCFh
push eax
dec eax
mov ecx, esp
dec eax
mov edx, edi
dec eax
mov edi, esi
mov esi, 00120274h
push ebp
dec eax
mov ebp, esp
inc esp
mov ecx, dword ptr [ecx]
dec ecx
mov eax, edx
dec eax
mov edx, esi
dec eax
lea esi, dword ptr [edi+02h]
push esi
mov al, byte ptr [edi]
dec edx
mov cl, al
and al, 07h
shr cl, 00000003h
dec eax
mov ebx, FFFFFD00h
dec eax
shl ebx, cl
mov cl, al
dec eax
lea ebx, dword ptr [esp+ebx*2-00000E78h]
dec eax
and ebx, FFFFFFC0h
push 00000000h
dec eax
cmp esp, ebx
jne 00007F1BF0C2A45Bh
push ebx
dec eax
lea edi, dword ptr [ebx+08h]
mov cl, byte ptr [esi-01h]
dec edx
mov byte ptr [edi+02h], al
mov al, cl
shr cl, 00000004h
mov byte ptr [edi+01h], cl
and al, 0Fh
mov byte ptr [edi], al
dec eax
lea ecx, dword ptr [edi-04h]
push eax
inc ecx
push edi
dec eax
lea eax, dword ptr [edi+04h]
inc ebp
xor edi, edi
inc ecx
push esi
inc ecx
mov esi, 00000001h
inc ecx
push ebp
inc ebp
xor ebp, ebp
inc ecx
push esp
push ebp
push ebx
dec eax
sub esp, 48h
dec eax
mov dword ptr [esp+38h], ecx
dec eax
mov dword ptr [esp+20h], eax
mov eax, 00000001h
dec eax
mov dword ptr [esp+40h], esi
dec esp
mov dword ptr [esp+30h], eax
mov ebx, eax
inc esp
mov dword ptr [esp+2Ch], ecx
movzx ecx, byte ptr [edi+02h]
shl ebx, cl
mov ecx, ebx

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729
[IMP] VS2005 build 50727

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6411b0	0x504	bNbF
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x632000	0xf1b0	bNbF
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x322000	0x4410	"/hR
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6416b4	0x20	bNbF
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x631e60	0x28	bbbb
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x631e90	0x140	bbbb
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
"/hR	0x1000	0x510000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bbbb	0x511000	0x121000	0x121000	fb76c604981fcb6c4067a2c5117730c7	False	0.9988679984861591	data	7.999761627141752	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bNbF	0x632000	0x10000	0xf800	0c5ce6f0a1e32589f6d634730baa9e50	False	0.2612462197580645	data	3.9453169926813554	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
None	0x640ff4	0x2e	data			1.108695652173913
RT_RCDATA	0x336020	0x3201	empty			0
RT_RCDATA	0x339224	0x3201	empty			0
RT_RCDATA	0x33c428	0x3201	empty			0
RT_RCDATA	0x33f62c	0x3201	empty			0
RT_RCDATA	0x342830	0x3201	empty			0
RT_RCDATA	0x345a34	0x3201	empty			0
RT_RCDATA	0x348c38	0x3201	empty			0
RT_RCDATA	0x34be3c	0x3201	empty			0
RT_RCDATA	0x34f040	0x3201	empty			0
RT_RCDATA	0x352244	0x3201	empty			0
RT_RCDATA	0x355448	0x3201	empty			0
RT_RCDATA	0x35864c	0x3201	empty			0
RT_RCDATA	0x35b850	0x3201	empty			0
RT_RCDATA	0x35ea54	0x3201	empty			0
RT_RCDATA	0x361c58	0x3201	empty			0
RT_RCDATA	0x364e5c	0x3201	empty			0
RT_RCDATA	0x368060	0x3201	empty			0
RT_RCDATA	0x36b264	0x3201	empty			0
RT_RCDATA	0x36e468	0x3201	empty			0
RT_RCDATA	0x37166c	0x3201	empty			0
RT_RCDATA	0x374870	0x3201	empty			0
RT_RCDATA	0x377a74	0x3201	empty			0
RT_RCDATA	0x37ac78	0x3201	empty			0
RT_RCDATA	0x37de7c	0x3201	empty			0
RT_RCDATA	0x381080	0x3201	empty			0
RT_RCDATA	0x384284	0x3201	empty			0
RT_RCDATA	0x387488	0x3201	empty			0
RT_RCDATA	0x38a68c	0x3201	empty			0
RT_RCDATA	0x38d890	0x76	empty			0
RT_RCDATA	0x38d908	0x22	empty			0
RT_RCDATA	0x38d92c	0x3201	empty			0
RT_RCDATA	0x390b30	0x3201	empty			0
RT_RCDATA	0x393d34	0x3201	empty			0
RT_RCDATA	0x396f38	0x3201	empty			0
RT_RCDATA	0x39a13c	0x3201	empty			0
RT_RCDATA	0x39d340	0x796	empty			0
RT_RCDATA	0x39dad8	0xf	empty			0
RT_RCDATA	0x39dae8	0x3201	empty			0
RT_RCDATA	0x3a0cec	0x3201	empty			0
RT_RCDATA	0x3a3ef0	0xedcf4	empty			0
RT_RCDATA	0x491be4	0x3201	empty			0
RT_RCDATA	0x494de8	0x9418	empty			0
RT_RCDATA	0x49e200	0x3201	empty			0
RT_RCDATA	0x4a1404	0x3201	empty			0
RT_RCDATA	0x4a4608	0x55	empty			0
RT_RCDATA	0x4a4660	0x3201	empty			0
RT_RCDATA	0x4a7864	0x3201	empty			0
RT_RCDATA	0x4aaa68	0x3201	empty			0
RT_RCDATA	0x4adc6c	0x3201	empty			0
RT_RCDATA	0x4b0e70	0x3201	empty			0
RT_RCDATA	0x4b4074	0x3201	empty			0
RT_RCDATA	0x4b7278	0x9e	empty			0
RT_RCDATA	0x4b7318	0x1f2	empty			0
RT_RCDATA	0x4b750c	0x3201	empty			0
RT_RCDATA	0x4ba710	0x3201	empty			0
RT_RCDATA	0x4bd914	0x3201	empty			0
RT_RCDATA	0x4c0b18	0x3201	empty			0
RT_RCDATA	0x4c3d1c	0x7d	empty			0
RT_RCDATA	0x4c3d9c	0x7d	empty			0
RT_RCDATA	0x4c3e1c	0x7d	empty			0
RT_RCDATA	0x4c3e9c	0x7d	empty			0
RT_RCDATA	0x4c3f1c	0x7d	empty			0
RT_RCDATA	0x4c3f9c	0x7d	empty			0
RT_RCDATA	0x4c401c	0x7d	empty			0
RT_RCDATA	0x4c409c	0x7d	empty			0
RT_RCDATA	0x4c411c	0x7d	empty			0
RT_RCDATA	0x4c419c	0x7d	empty			0
RT_RCDATA	0x4c421c	0x7d	empty			0
RT_RCDATA	0x4c429c	0x7d	empty			0
RT_RCDATA	0x4c431c	0x7d	empty			0
RT_RCDATA	0x4c439c	0x7d	empty			0
RT_RCDATA	0x4c441c	0x7d	empty			0
RT_RCDATA	0x4c449c	0x7d	empty			0
RT_RCDATA	0x4c451c	0x7d	empty			0
RT_RCDATA	0x4c459c	0x7d	empty			0
RT_RCDATA	0x4c461c	0x3201	empty			0
RT_RCDATA	0x4c7820	0x3201	empty			0
RT_RCDATA	0x4caa24	0x3201	empty			0
RT_RCDATA	0x4cdc28	0x3201	empty			0
RT_RCDATA	0x4d0e2c	0x3201	empty			0
RT_RCDATA	0x4d4030	0x3201	empty			0
RT_RCDATA	0x4d7234	0x3201	empty			0
RT_RCDATA	0x4da438	0x3201	empty			0
RT_RCDATA	0x4dd63c	0x3201	empty			0
RT_RCDATA	0x4e0840	0x3201	empty			0
RT_RCDATA	0x4e3a44	0x3201	empty			0
RT_RCDATA	0x4e6c48	0x3201	empty			0
RT_RCDATA	0x4e9e4c	0x3201	empty			0
RT_RCDATA	0x4ed050	0x3201	empty			0
RT_RCDATA	0x4f0254	0x3201	empty			0
RT_RCDATA	0x4f3458	0x3201	empty			0
RT_RCDATA	0x4f665c	0x3201	empty			0
RT_RCDATA	0x4f9860	0x3201	empty			0
RT_RCDATA	0x4fca64	0x3201	empty			0
RT_RCDATA	0x4ffc68	0x3201	empty			0
RT_RCDATA	0x502e6c	0x3201	empty			0
RT_RCDATA	0x506070	0x3201	empty			0
RT_RCDATA	0x509274	0x3201	empty			0
RT_RCDATA	0x50c478	0x3201	empty			0
RT_RCDATA	0x50f67c	0x3201	empty			0
RT_RCDATA	0x512880	0x3201	data			1.0008593078665728
RT_RCDATA	0x515a84	0x3201	data			1.0008593078665728
RT_RCDATA	0x518c88	0x3201	data			1.0008593078665728
RT_RCDATA	0x51be8c	0x3201	data			1.0008593078665728
RT_RCDATA	0x51f090	0x3201	data			1.0008593078665728
RT_RCDATA	0x522294	0x3201	data			1.0008593078665728
RT_RCDATA	0x525498	0x3201	data			1.0008593078665728
RT_RCDATA	0x52869c	0x3201	data			1.0008593078665728
RT_RCDATA	0x52b8a0	0x3201	data			1.0008593078665728
RT_RCDATA	0x52eaa4	0x3201	data			1.0008593078665728
RT_RCDATA	0x531ca8	0x3201	data			1.0008593078665728
RT_RCDATA	0x534eac	0x3201	data			1.0008593078665728
RT_RCDATA	0x5380b0	0x3201	data			1.0008593078665728
RT_RCDATA	0x53b2b4	0x3201	data			1.0008593078665728
RT_RCDATA	0x53e4b8	0x3201	OpenPGP Public Key			1.0008593078665728
RT_RCDATA	0x5416bc	0x3201	data			1.0008593078665728
RT_RCDATA	0x5448c0	0x3201	data			1.0008593078665728
RT_RCDATA	0x547ac4	0x3201	data			1.0008593078665728
RT_RCDATA	0x54acc8	0x3201	data			1.0008593078665728
RT_RCDATA	0x54decc	0x3201	data			1.0008593078665728
RT_RCDATA	0x5510d0	0x3201	data			1.0008593078665728
RT_RCDATA	0x5542d4	0x3201	data			1.0008593078665728
RT_RCDATA	0x5574d8	0x3201	data			1.0008593078665728
RT_RCDATA	0x55a6dc	0x3201	data			1.0008593078665728
RT_RCDATA	0x55d8e0	0x3201	data			1.0008593078665728
RT_RCDATA	0x560ae4	0x3201	data			1.0008593078665728
RT_RCDATA	0x563ce8	0x3201	data			1.0008593078665728
RT_RCDATA	0x566eec	0x3201	data			1.0008593078665728
RT_RCDATA	0x56a0f0	0x3201	SysEx File -			1.0008593078665728
RT_RCDATA	0x56d2f4	0x3201	data			1.0008593078665728
RT_RCDATA	0x5704f8	0x3201	data			1.0008593078665728
RT_RCDATA	0x5736fc	0x3201	data			1.0008593078665728
RT_RCDATA	0x576900	0x3201	data			1.0008593078665728
RT_RCDATA	0x579b04	0x3201	data			1.0008593078665728
RT_RCDATA	0x57cd08	0x3201	data			1.0008593078665728
RT_RCDATA	0x57ff0c	0x3201	data			1.0008593078665728
RT_RCDATA	0x583110	0x3201	data			1.0008593078665728
RT_RCDATA	0x586314	0x3201	data			1.0008593078665728
RT_RCDATA	0x589518	0x3201	data			1.0008593078665728
RT_RCDATA	0x58c71c	0x3201	data			1.0008593078665728
RT_RCDATA	0x58f920	0x3201	data			1.0008593078665728
RT_RCDATA	0x592b24	0x3201	data			1.0008593078665728
RT_RCDATA	0x595d28	0x3201	data			1.0008593078665728
RT_RCDATA	0x598f2c	0x3201	data			1.0008593078665728
RT_RCDATA	0x59c130	0x3201	data			1.0008593078665728
RT_RCDATA	0x59f334	0x3201	data			1.0008593078665728
RT_RCDATA	0x5a2538	0x3201	OpenPGP Public Key			1.0008593078665728
RT_RCDATA	0x5a573c	0x3201	data			1.0008593078665728
RT_RCDATA	0x5a8940	0x3201	data			1.0008593078665728
RT_RCDATA	0x5abb44	0x3201	data			1.0008593078665728
RT_RCDATA	0x5aed48	0x3201	data			1.0008593078665728
RT_RCDATA	0x5b1f4c	0x3201	data			1.0008593078665728
RT_RCDATA	0x5b5150	0x3201	OpenPGP Public Key			1.0008593078665728
RT_RCDATA	0x5b8354	0x3201	data			1.0008593078665728
RT_RCDATA	0x5bb558	0x3201	data			1.0008593078665728
RT_RCDATA	0x5be75c	0x3201	data			1.0008593078665728
RT_RCDATA	0x5c1960	0x3201	data			1.0008593078665728
RT_RCDATA	0x5c4b64	0x3201	data			1.0008593078665728
RT_RCDATA	0x5c7d68	0x3201	data			1.0008593078665728
RT_RCDATA	0x5caf6c	0x3201	data			1.0008593078665728
RT_RCDATA	0x5ce170	0x3201	data			1.0008593078665728
RT_RCDATA	0x5d1374	0x3201	data			1.0008593078665728
RT_RCDATA	0x5d4578	0x3201	data			1.0008593078665728
RT_RCDATA	0x5d777c	0x3201	data			1.0008593078665728
RT_RCDATA	0x5da980	0x3201	data			1.0008593078665728
RT_RCDATA	0x5ddb84	0x3201	data			1.0008593078665728
RT_RCDATA	0x5e0d88	0x3201	data			1.0008593078665728
RT_RCDATA	0x5e3f8c	0x3201	data			1.0008593078665728
RT_RCDATA	0x5e7190	0x3201	data			1.0008593078665728
RT_RCDATA	0x5ea394	0x3201	data			1.0008593078665728
RT_RCDATA	0x5ed598	0x3201	data			1.0008593078665728
RT_RCDATA	0x5f079c	0x3201	data			1.0008593078665728
RT_RCDATA	0x5f39a0	0x3201	data			1.0008593078665728
RT_RCDATA	0x5f6ba4	0x3201	data			1.0008593078665728
RT_RCDATA	0x5f9da8	0x3201	data			1.0008593078665728
RT_RCDATA	0x5fcfac	0x3201	data			1.0008593078665728
RT_RCDATA	0x6001b0	0x3201	data			1.0008593078665728
RT_RCDATA	0x6033b4	0x3201	data			1.0008593078665728
RT_RCDATA	0x6065b8	0x3201	data			1.0008593078665728
RT_RCDATA	0x6097bc	0x3201	data			1.0008593078665728
RT_RCDATA	0x60c9c0	0x3201	data			1.0008593078665728
RT_RCDATA	0x60fbc4	0x3201	data			1.0008593078665728
RT_RCDATA	0x612dc8	0x3201	data			1.0008593078665728
RT_RCDATA	0x615fcc	0x3201	data			1.0008593078665728
RT_RCDATA	0x6191d0	0x3201	data			1.0008593078665728
RT_RCDATA	0x61c3d4	0x3201	data			1.0008593078665728
RT_RCDATA	0x61f5d8	0x3201	data			1.0008593078665728
RT_RCDATA	0x6227dc	0x3201	data			1.0008593078665728
RT_RCDATA	0x6259e0	0x3201	data			1.0008593078665728
RT_MANIFEST	0x641028	0x2	data			5.0
RT_MANIFEST	0x641030	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727
None	0x628d68	0x102	data			1.0426356589147288
None	0x628e6c	0xda	data			1.0504587155963303
None	0x628f48	0xba	data			1.0591397849462365
None	0x629004	0x12a	data			1.0369127516778522
None	0x629130	0x16e	data			1.030054644808743
None	0x6292a0	0x16c	data			1.0302197802197801
None	0x62940c	0xfa	data			1.044
None	0x629508	0x11a	data			1.0390070921985815
None	0x629624	0x178	data			1.0292553191489362
None	0x62979c	0xe0	data			1.0491071428571428
None	0x62987c	0xbc	data			1.0585106382978724
None	0x629938	0x124	data			1.0376712328767124
None	0x629a5c	0xb0	data			1.0625
None	0x629b0c	0xa6	data			1.0662650602409638
None	0x629bb4	0x7e	data			1.0873015873015872
None	0x629c34	0xd6	data			1.0514018691588785
None	0x629d0c	0xe6	data			1.0478260869565217
None	0x629df4	0xea	data			1.047008547008547
None	0x629ee0	0xca	data			1.0544554455445545
None	0x629fac	0xde	data			1.0495495495495495
None	0x62a08c	0x98	data			1.0723684210526316
None	0x62a124	0xe4	data			1.0482456140350878
None	0x62a208	0xc2	data			1.056701030927835
None	0x62a2cc	0xbe	data			1.0578947368421052
None	0x62a38c	0x11a	data			1.0390070921985815
None	0x62a4a8	0xa8	data			1.0654761904761905
None	0x62a550	0xda	data			1.0504587155963303
None	0x62a62c	0xa2	data			1.0679012345679013
None	0x62a6d0	0xea	data			1.047008547008547
None	0x62a7bc	0x88	data			1.0808823529411764
None	0x62a844	0xd8	data			1.0509259259259258
None	0x62a91c	0x152	data			1.032544378698225
None	0x62aa70	0x134	data			1.0357142857142858
None	0x62aba4	0xec	data			1.0466101694915255
None	0x62ac90	0x120	data			1.0381944444444444
None	0x62adb0	0x116	data			1.039568345323741
None	0x62aec8	0x7e	data			1.0873015873015872
None	0x62af48	0xf2	data			1.0454545454545454
None	0x62b03c	0x106	data			1.0419847328244274
None	0x62b144	0xdc	data			1.05
None	0x62b220	0xde	OpenPGP Secret Key			1.0495495495495495
None	0x62b300	0x152	data			1.032544378698225
None	0x62b454	0x154	data			1.0323529411764707
None	0x62b5a8	0xe4	data			1.0482456140350878
None	0x62b68c	0xc0	OpenPGP Secret Key			1.0572916666666667
None	0x62b74c	0xac	data			1.063953488372093
None	0x62b7f8	0xf2	data			1.0454545454545454
None	0x62b8ec	0xdc	data			1.05
None	0x62b9c8	0x126	data			1.0374149659863945
None	0x62baf0	0x9c	data			1.0705128205128205
None	0x62bb8c	0x8a	data			1.0797101449275361
None	0x62bc18	0x15a	data			1.0317919075144508
None	0x62bd74	0xf8	data			1.0443548387096775
None	0x62be6c	0xe2	data			1.0486725663716814
None	0x62bf50	0x5a	data			1.1222222222222222
None	0x62bfac	0x106	data			1.0419847328244274
None	0x62c0b4	0xc8	data			1.055
None	0x62c17c	0xcc	data			1.053921568627451
None	0x62c248	0xd6	data			1.0514018691588785
None	0x62c320	0x144	data			1.0339506172839505
None	0x62c464	0x138	data			1.0352564102564104
None	0x62c59c	0xf8	data			1.0443548387096775
None	0x62c694	0xe2	data			1.0486725663716814
None	0x62c778	0xd6	data			1.0514018691588785
None	0x62c850	0x140	data			1.034375
None	0x62c990	0x88	data			1.0808823529411764
None	0x62ca18	0x10c	data			1.041044776119403
None	0x62cb24	0x9a	data			1.0714285714285714
None	0x62cbc0	0x88	data			1.0808823529411764
None	0x62cc48	0xc4	data			1.0561224489795917
None	0x62cd0c	0xbc	data			1.0585106382978724
None	0x62cdc8	0xa2	data			1.0679012345679013
None	0x62ce6c	0x100	OpenPGP Secret Key			1.04296875
None	0x62cf6c	0x100	data			1.04296875
None	0x62d06c	0x126	data			1.0374149659863945
None	0x62d194	0x100	data			1.04296875
None	0x62d294	0x80	data			1.0859375
None	0x62d314	0xee	data			1.046218487394958
None	0x62d404	0x9e	data			1.0696202531645569
None	0x62d4a4	0x94	data			1.0743243243243243
None	0x62d538	0xf8	OpenPGP Public Key			1.0443548387096775
None	0x62d630	0xe0	data			1.0491071428571428
None	0x62d710	0x100	data			1.04296875
None	0x62d810	0x8a	data			1.0797101449275361
None	0x62d89c	0x5a	data			1.1222222222222222
None	0x62d8f8	0x100	data			1.04296875
None	0x62d9f8	0xac	data			1.063953488372093
None	0x62daa4	0x144	data			1.0339506172839505
None	0x62dbe8	0x14e	data			1.032934131736527
None	0x62dd38	0xa4	data			1.0670731707317074
None	0x62dddc	0xd0	data			1.0528846153846154
None	0x62deac	0xf8	data			1.0443548387096775
None	0x62dfa4	0x15a	data			1.0317919075144508
None	0x62e100	0xb2	data			1.0617977528089888
None	0x62e1b4	0xf2	data			1.0454545454545454
None	0x62e2a8	0xbc	data			1.0585106382978724
None	0x62e364	0xc2	data			1.056701030927835
None	0x62e428	0xe8	data			1.0474137931034482
None	0x62e510	0x164	data			1.0308988764044944
None	0x62e674	0x98	data			1.0723684210526316
None	0x62e70c	0xf4	OpenPGP Public Key			1.0450819672131149
None	0x62e800	0x158	data			1.0319767441860466
None	0x62e958	0xe0	data			1.0491071428571428
None	0x62ea38	0x82	data			1.0846153846153845
None	0x62eabc	0x126	data			1.0374149659863945

Imports

DLL	Import
ADVAPI32.dll	RegOpenKeyExA
api-ms-win-crt-heap-l1-1-0.dll	free
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale
api-ms-win-crt-math-l1-1-0.dll	cosf
api-ms-win-crt-runtime-l1-1-0.dll	exit
api-ms-win-crt-stdio-l1-1-0.dll	fseek
api-ms-win-crt-string-l1-1-0.dll	strcmp
api-ms-win-crt-utility-l1-1-0.dll	qsort
d3d9.dll	Direct3DCreate9
IMM32.dll	ImmGetContext
kErneL32.DlL	LoadLibraryA, DeleteAtom, GetProcAddress, VirtualProtect
MSVCP140.dll	_Query_perf_counter
olE32.dll	CoTaskMemFree
SHELL32.dll	ShellExecuteA
USER32.dll	SetCursor
VCRUNTIME140.dll	memset
VCRUNTIME140_1.dll	__CxxFrameHandler4

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-18T19:28:06.291894+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49699	172.67.75.163	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 19:28:04.527626038 CET	49699	443	192.168.2.7	172.67.75.163
Dec 18, 2024 19:28:04.527688980 CET	443	49699	172.67.75.163	192.168.2.7
Dec 18, 2024 19:28:04.527781963 CET	49699	443	192.168.2.7	172.67.75.163
Dec 18, 2024 19:28:04.546013117 CET	49699	443	192.168.2.7	172.67.75.163
Dec 18, 2024 19:28:04.546034098 CET	443	49699	172.67.75.163	192.168.2.7
Dec 18, 2024 19:28:05.773899078 CET	443	49699	172.67.75.163	192.168.2.7
Dec 18, 2024 19:28:05.773998022 CET	49699	443	192.168.2.7	172.67.75.163
Dec 18, 2024 19:28:05.892168045 CET	49699	443	192.168.2.7	172.67.75.163
Dec 18, 2024 19:28:05.892199993 CET	443	49699	172.67.75.163	192.168.2.7
Dec 18, 2024 19:28:05.892591953 CET	443	49699	172.67.75.163	192.168.2.7
Dec 18, 2024 19:28:05.892657995 CET	49699	443	192.168.2.7	172.67.75.163
Dec 18, 2024 19:28:05.895287037 CET	49699	443	192.168.2.7	172.67.75.163
Dec 18, 2024 19:28:05.935369015 CET	443	49699	172.67.75.163	192.168.2.7
Dec 18, 2024 19:28:06.291966915 CET	443	49699	172.67.75.163	192.168.2.7
Dec 18, 2024 19:28:06.292062998 CET	443	49699	172.67.75.163	192.168.2.7
Dec 18, 2024 19:28:06.292063951 CET	49699	443	192.168.2.7	172.67.75.163
Dec 18, 2024 19:28:06.292134047 CET	49699	443	192.168.2.7	172.67.75.163
Dec 18, 2024 19:28:06.293407917 CET	49699	443	192.168.2.7	172.67.75.163
Dec 18, 2024 19:28:06.293442011 CET	443	49699	172.67.75.163	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 19:28:04.382294893 CET	51184	53	192.168.2.7	1.1.1.1
Dec 18, 2024 19:28:04.521354914 CET	53	51184	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 19:28:04.382294893 CET	192.168.2.7	1.1.1.1	0x5903	Standard query (0)	api.myip.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 19:28:04.521354914 CET	1.1.1.1	192.168.2.7	0x5903	No error (0)	api.myip.com	172.67.75.163	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:28:04.521354914 CET	1.1.1.1	192.168.2.7	0x5903	No error (0)	api.myip.com	104.26.9.59	A (IP address)	IN (0x0001)	false
Dec 18, 2024 19:28:04.521354914 CET	1.1.1.1	192.168.2.7	0x5903	No error (0)	api.myip.com	104.26.8.59	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.myip.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	172.67.75.163	443	788	C:\Users\user\Desktop\solara-executor.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 18:28:05 UTC	182	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.74 Safari/537.36 Edg/79.0.309.43 Host: api.myip.com
2024-12-18 18:28:06 UTC	780	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 18:28:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xcLhpMoTtX8ez3EMU8%2Bzce77s58rGn2Gfbj%2BZiEzSf72JwiM1uUT5qPPS1GajNmxS2j6yYuNOaVpXYVxaKNLG43YV%2BqqXKWChXYXQzxqX72leHNa46H3nDQaFq%2F1AQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4135f1daaa424a-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1590&min_rtt=1587&rtt_var=601&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2818&recv_bytes=820&delivery_rate=1810291&cwnd=252&unsent_bytes=0&cid=41e387b3aba6f1ba&ts=535&x=0"
2024-12-18 18:28:06 UTC	63	IN	Data Raw: 33 39 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 63 22 3a 22 55 53 22 7d 0d 0a Data Ascii: 39{"ip":"8.46.123.189","country":"United States","cc":"US"}
2024-12-18 18:28:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	13:28:02
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\solara-executor.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\solara-executor.exe"
Imagebase:	0x7ff7c1880000
File size:	1'248'295 bytes
MD5 hash:	6107673FE6DE87AC938D8D45CEEE771B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	19.7%
Signature Coverage:	24.2%
Total number of Nodes:	773
Total number of Limit Nodes:	35

Executed Functions

Function 00007FF7C18D4720 Relevance: 37.6, APIs: 7, Strings: 14, Instructions: 892
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHBrowseForFolder.SHELL32 ref: 00007FF7C18D4B10
SHGetPathFromIDList.SHELL32 ref: 00007FF7C18D4B3D
CoTaskMemFree.OLE32 ref: 00007FF7C18D4C11

Part of subcall function 00007FF7C18D3AD0: CreateFileA.KERNEL32 ref: 00007FF7C18D3B29
Part of subcall function 00007FF7C18D3AD0: CloseHandle.KERNEL32 ref: 00007FF7C18D3B41

RemoveDirectoryA.KERNEL32 ref: 00007FF7C18D5289
CreateDirectoryA.KERNEL32 ref: 00007FF7C18D5299
MessageBoxA.USER32 ref: 00007FF7C18D52BE
ExitProcess.KERNEL32 ref: 00007FF7C18D5A35

Strings

C:\Users\user\Desktop\solara-executor, xrefs: 00007FF7C18D4B4B, 00007FF7C18D4B5E, 00007FF7C18D4B7A, 00007FF7C18D4BD2, 00007FF7C18D51C4, 00007FF7C18D5282, 00007FF7C18D5292
Fail, xrefs: 00007FF7C18D52A9
choose install folder, xrefs: 00007FF7C18D4AEE
Loader, xrefs: 00007FF7C18D4C4E, 00007FF7C18D53BD
P, xrefs: 00007FF7C18D4AFD
..., xrefs: 00007FF7C18D4AB4
Failed to create setup directory, xrefs: 00007FF7C18D52B0
continue, xrefs: 00007FF7C18D5A0F
solara-executor, xrefs: 00007FF7C18D4BB3
installation..., xrefs: 00007FF7C18D5885
destinatinal folder, xrefs: 00007FF7C18D515C
f, xrefs: 00007FF7C18D47FE
Solara, xrefs: 00007FF7C18D4C22, 00007FF7C18D5391
Install, xrefs: 00007FF7C18D526B

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: CreateDirectory$BrowseCloseExitFileFolderFreeFromHandleListMessagePathProcessRemoveTask
String ID: Loader$...$C:\Users\user\Desktop\solara-executor$Fail$Failed to create setup directory$Install$P$Solara$choose install folder$continue$destinatinal folder$f$installation...$solara-executor
API String ID: 380753353-2284742252
Opcode ID: 8d7d44eaddbc20831c6762e85175d0632f03872633d4611175878a45b0127301
Instruction ID: 193e9e83be9a3614c16247647ba1c2785cc4db45cfe516540635d86583949b3c
Opcode Fuzzy Hash: 8d7d44eaddbc20831c6762e85175d0632f03872633d4611175878a45b0127301
Instruction Fuzzy Hash: 2AA2333590D68695E761FF22E8903AAF3A0FFC9360F808235D98D576A5DFBCE1548B10

Function 00007FF7C18CF7A0 Relevance: 36.9, APIs: 7, Strings: 14, Instructions: 150
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryPerformanceFrequency.KERNEL32 ref: 00007FF7C18CF803
QueryPerformanceCounter.KERNEL32 ref: 00007FF7C18CF819
GetKeyboardLayout.USER32 ref: 00007FF7C18CF910
GetLocaleInfoA.KERNEL32 ref: 00007FF7C18CF92C
LoadLibraryA.KERNEL32 ref: 00007FF7C18CF9C5
GetProcAddress.KERNEL32 ref: 00007FF7C18CF9FD
GetProcAddress.KERNEL32 ref: 00007FF7C18CFA11

Strings

XInputGetState, xrefs: 00007FF7C18CFA03
imgui_impl_win32, xrefs: 00007FF7C18CF8D0
xinput1_4.dll, xrefs: 00007FF7C18CF977
XInputGetCapabilities, xrefs: 00007FF7C18CF9EF
C:\Users\55yar\Desktop\imgui-master\backends\imgui_impl_win32.cpp, xrefs: 00007FF7C18CF7E7
GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?", xrefs: 00007FF7C18CF7C3
xinput9_1_0.dll, xrefs: 00007FF7C18CF98F
xinput1_3.dll, xrefs: 00007FF7C18CF983
io.BackendPlatformUserData == nullptr && "Already initialized a platform backend!", xrefs: 00007FF7C18CF7EE
xinput1_2.dll, xrefs: 00007FF7C18CF99B
i >= 0 && i < Size, xrefs: 00007FF7C18CF955
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7C18CF7BC
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7C18CF94E
xinput1_1.dll, xrefs: 00007FF7C18CF9A7

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: AddressPerformanceProcQuery$CounterFrequencyInfoKeyboardLayoutLibraryLoadLocale
String ID: C:\Users\55yar\Desktop\imgui-master\backends\imgui_impl_win32.cpp$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$C:\Users\55yar\Desktop\imgui-master\imgui.h$GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?"$XInputGetCapabilities$XInputGetState$i >= 0 && i < Size$imgui_impl_win32$io.BackendPlatformUserData == nullptr && "Already initialized a platform backend!"$xinput1_1.dll$xinput1_2.dll$xinput1_3.dll$xinput1_4.dll$xinput9_1_0.dll
API String ID: 2839060773-805143068
Opcode ID: b7794f76b813ba0ffa93ba3e4a0341deb698b7340ee9810f303d84f49f8841cb
Instruction ID: a5804cac20946d6b6138ae3c980e7b3c2942c466fe9eaaa9e978a682c563bd94
Opcode Fuzzy Hash: b7794f76b813ba0ffa93ba3e4a0341deb698b7340ee9810f303d84f49f8841cb
Instruction Fuzzy Hash: 40718436A0CF8686EB50AF15E8502A9B3F5FB44764F845136CA8D43760EF7CE469C710

Function 00007FF7C18D0330 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 182
keyboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClientRect.USER32 ref: 00007FF7C18D03B0
QueryPerformanceCounter.KERNEL32 ref: 00007FF7C18D03EC
GetForegroundWindow.USER32 ref: 00007FF7C18D0445
ClientToScreen.USER32 ref: 00007FF7C18D047D
SetCursorPos.USER32 ref: 00007FF7C18D048F
GetCursorPos.USER32 ref: 00007FF7C18D04A9
ScreenToClient.USER32 ref: 00007FF7C18D04BB
GetKeyState.USER32 ref: 00007FF7C18D04FD
GetKeyState.USER32 ref: 00007FF7C18D0544
GetKeyState.USER32 ref: 00007FF7C18D058B
GetKeyState.USER32 ref: 00007FF7C18D05D2

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7C18D0380
bd != nullptr && "Context or backend not initialized? Did you call ImGui_ImplWin32_Init()?", xrefs: 00007FF7C18D0361
C:\Users\55yar\Desktop\imgui-master\backends\imgui_impl_win32.cpp, xrefs: 00007FF7C18D035A, 00007FF7C18D0431
GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?", xrefs: 00007FF7C18D0387
bd->hWnd != 0, xrefs: 00007FF7C18D0438

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: State$Client$CursorScreen$CounterForegroundPerformanceQueryRectWindow
String ID: C:\Users\55yar\Desktop\imgui-master\backends\imgui_impl_win32.cpp$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?"$bd != nullptr && "Context or backend not initialized? Did you call ImGui_ImplWin32_Init()?"$bd->hWnd != 0
API String ID: 1576454153-990843061
Opcode ID: b9b1333f0241c167bb0d36fc47031ea75db285839677a006f3658dc029a391cc
Instruction ID: 335fef02d5965233dd456f6e646a520799ea823407c18ff230f6f303644f8907
Opcode Fuzzy Hash: b9b1333f0241c167bb0d36fc47031ea75db285839677a006f3658dc029a391cc
Instruction Fuzzy Hash: 2091B121E0C78786FB11BF25D444379A7E1EF917B8F884235E94D16591DFACE8A4CB20

Function 00007FF7C18D3F90 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 126
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtdllDefWindowProc_A.NTDLL ref: 00007FF7C18D41D0

Strings

E, xrefs: 00007FF7C18D4176

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: NtdllProc_Window
String ID: E
API String ID: 4255912815-3568589458
Opcode ID: 60b10af7e7726b57b2a11d93ff49d429ce7ba957dc1b0bd3a5e91d316a4ed560
Instruction ID: 250f04cf598b81c0fd7a985c0e47f2317aa77314e3c4478a827a0b037bcbcda5
Opcode Fuzzy Hash: 60b10af7e7726b57b2a11d93ff49d429ce7ba957dc1b0bd3a5e91d316a4ed560
Instruction Fuzzy Hash: 2E51437160C7868AE760EF24E44437AF3E0EB867B5F900135EA8D82A94DFBDD854CB10

Function 0000023D0FB2F46A Relevance: 8.0, APIs: 5, Instructions: 519
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FB2F47B
FindFirstFileA.KERNEL32 ref: 0000023D0FB2F48B

Part of subcall function 0000023D0FB05180: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FB05217

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$FileFindFirst
String ID:
API String ID: 2113789597-0
Opcode ID: 06887e1307c0165ed681ee8080f10d51a9ecc12a7ddf961e6366d459280c14db
Instruction ID: 3e32a1794db5d272c714fdf105045d80e37867489e050956883cde43133e7e3d
Opcode Fuzzy Hash: 06887e1307c0165ed681ee8080f10d51a9ecc12a7ddf961e6366d459280c14db
Instruction Fuzzy Hash: 5812E4311187488FD7AAEB14D499BEFB3E9FBD9700F504A5EA08EC3191DE349645CB42

Function 0000023D0FC0CB40 Relevance: 7.7, APIs: 5, Instructions: 166
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0000023D0FC0CB6D
Process32NextW.KERNEL32 ref: 0000023D0FC0CBEF
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FC0CC5C
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FC0CC95
Process32NextW.KERNEL32 ref: 0000023D0FC0CD3E

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyNextProcess32Queue::StructuredWork$CreateSnapshotToolhelp32
String ID:
API String ID: 2993956496-0
Opcode ID: ccef948bbded8c3c363223a2ce267501defc5825a781fad79f845297002980c6
Instruction ID: 051cf0fc8bf55936297471bb4f842fd673e1e746de5990d79b275be4abbb4daf
Opcode Fuzzy Hash: ccef948bbded8c3c363223a2ce267501defc5825a781fad79f845297002980c6
Instruction Fuzzy Hash: D151E131118B488FE369EB24D499BDEB7E5FBD4700F504A1DA08AD3191DF389A45CB46

Function 00007FF7C18CF2F0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 215
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18CF57D

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7C18CF319
, xrefs: 00007FF7C18CF3DD
GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?", xrefs: 00007FF7C18CF320

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007F020
String ID: $C:\Users\55yar\Desktop\imgui-master\imgui.cpp$GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?"
API String ID: 2739980228-1764846569
Opcode ID: 5db2f53e23f677ae7509081ccb2224cb15c8adaa29a8ea850ebc6fde4c863757
Instruction ID: 69db1880e28a0c175341917b095904d87ddc69c4455150170208d9e31dfc9eb2
Opcode Fuzzy Hash: 5db2f53e23f677ae7509081ccb2224cb15c8adaa29a8ea850ebc6fde4c863757
Instruction Fuzzy Hash: B2916B32708B8186EB10DF26D4903ADBBA5FB99B98F848136DE0E43B64DF78D419C710

Function 0000023D0FBC7740 Relevance: 4.7, APIs: 3, Instructions: 164encryptionCOMMON

Download Yara Rule

APIs

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 0000023D0FBC77D6
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 0000023D0FBC7854
CryptUnprotectData.CRYPT32 ref: 0000023D0FBC78AD

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_$CryptDataUnprotect
String ID:
API String ID: 3418212865-0
Opcode ID: 4a58d185219048462ed20adef7d46b637afd1ce34fa3cdcfcaa02483a53deee4
Instruction ID: 8fad0c142a1e1f3c97d1ceb1f5246398c40efe6d16e0cbad527ce7055c301063
Opcode Fuzzy Hash: 4a58d185219048462ed20adef7d46b637afd1ce34fa3cdcfcaa02483a53deee4
Instruction Fuzzy Hash: 5051DB70518B888FE7B5EB28D4597AEB7E5FB98301F60492DA08DC3261DF749984CF42

Function 00007FF7C18CEA60 Relevance: 2.9, Strings: 2, Instructions: 374COMMON

Download Yara Rule

Strings

i >= 0 && i < Size, xrefs: 00007FF7C18CECA9, 00007FF7C18CEE48, 00007FF7C18CEE96
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7C18CECA2, 00007FF7C18CEE41, 00007FF7C18CEE8F

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$i >= 0 && i < Size
API String ID: 0-1817040388
Opcode ID: 56d521ff8339707aadcb59bad46e377d0a037c71524e825469e81c85201c9fb9
Instruction ID: 7562f798294476b94df591d1eec5b126f0328ad9a31413dba7dbfbc9f3e8eaa1
Opcode Fuzzy Hash: 56d521ff8339707aadcb59bad46e377d0a037c71524e825469e81c85201c9fb9
Instruction Fuzzy Hash: 1D028936608B85C6DB20DF26D4946AE7BA5FB88BA8F528136DF4D43764CF38D454CB10

Function 00007FF7C18CFCE0 Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f85459a4f5f85dc817c154eb3d07b0bf51aad233fa7be8da4c6d5771264566b4
Instruction ID: 91b4719166ba119cfd0ced09ea092e7a4f92c6bd87bf9478c8c86c6913d8bc36
Opcode Fuzzy Hash: f85459a4f5f85dc817c154eb3d07b0bf51aad233fa7be8da4c6d5771264566b4
Instruction Fuzzy Hash: D2020702E2C7AB85F752BE3544412F9A3C18F6B364F588732ED58369D5DF6CA4A2C360

Function 00007FF7C18D26C0 Relevance: 15.5, APIs: 10, Instructions: 516
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7C18D2818

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ce6c98c5b26b5447e9699c6d82b08a0c665aec57600c35ced484b5b0925df019
Instruction ID: 621389a7c2d6a01f2399863a4831be8da1b89de650179228747736a14dacad59
Opcode Fuzzy Hash: ce6c98c5b26b5447e9699c6d82b08a0c665aec57600c35ced484b5b0925df019
Instruction Fuzzy Hash: 6542C43660DBC685DBB0EB15E4943AAB3A5FBC97A0F804535DA8D43B69DF7CC0648B10

Function 00007FF7C18D41E0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 59
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF7C18D4221
RegisterClassExA.USER32 ref: 00007FF7C18D427A
GetSystemMetrics.USER32 ref: 00007FF7C18D4282
GetSystemMetrics.USER32 ref: 00007FF7C18D429B
CreateWindowExA.USER32 ref: 00007FF7C18D430D
ShowWindow.USER32 ref: 00007FF7C18D4326
UpdateWindow.USER32 ref: 00007FF7C18D4333

Strings

class001, xrefs: 00007FF7C18D425A, 00007FF7C18D4304

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: Window$MetricsSystem$ClassCreateHandleModuleRegisterShowUpdate
String ID: class001
API String ID: 3666473625-3656631403
Opcode ID: 53389c19fc29f04132dcce79cdbd498e5441cdc0ef18e48b201337a412e8095a
Instruction ID: e22685fe55cb3d2fd1a46f0ab55d27438f841ec8e5574dcf213277b47d21882d
Opcode Fuzzy Hash: 53389c19fc29f04132dcce79cdbd498e5441cdc0ef18e48b201337a412e8095a
Instruction Fuzzy Hash: E6310B7490CB429AE781AF20F89436AB7E0FB46765F901139D58D86A64CFFDE058CB60

Function 00007FF7C18D6C10 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 151
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32 ref: 00007FF7C18D6E6D

Strings

v2.1.1 Setup!Before starting the installation, select the folder where the files will be installed, xrefs: 00007FF7C18D6DFE
FrghcZrah, xrefs: 00007FF7C18D6C2B
A, xrefs: 00007FF7C18D6CF6
v2.1.1 Setup, xrefs: 00007FF7C18D6E23
Solara, xrefs: 00007FF7C18D6DE3, 00007FF7C18D6E2A
Welcome to , xrefs: 00007FF7C18D6DEA

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: Message
String ID: v2.1.1 Setup$ v2.1.1 Setup!Before starting the installation, select the folder where the files will be installed$A$FrghcZrah$Solara$Welcome to
API String ID: 2030045667-4036644300
Opcode ID: 818e4b6d2888c4cba2b6a02a4dad209fdc6011418aa973f574071f8947bbbd02
Instruction ID: 6098c3e2c173f22bef698086961cc494142c1bf698978b2b4ac698a76f8f3b97
Opcode Fuzzy Hash: 818e4b6d2888c4cba2b6a02a4dad209fdc6011418aa973f574071f8947bbbd02
Instruction Fuzzy Hash: 93715221A0DB8381DB60FF65F4412AAE7E0EB85774FD04135E68D43B6ADEACD165CB20

Function 0000023D0FB06FE0 Relevance: 6.7, APIs: 4, Instructions: 693
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000023D0FB0A110: char_traits.LIBCPMTD ref: 0000023D0FB0A13D

std::_Fac_node::_Fac_node.LIBCPMTD ref: 0000023D0FB0754F
CreateToolhelp32Snapshot.KERNEL32 ref: 0000023D0FB075C4
Process32FirstW.KERNEL32 ref: 0000023D0FB0764B
Process32NextW.KERNEL32 ref: 0000023D0FB077AB

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: Process32$CreateFac_nodeFac_node::_FirstNextSnapshotToolhelp32char_traitsstd::_
String ID:
API String ID: 4114415025-0
Opcode ID: b447e1fdda4dec36b7a34e48ad19bb37ccf871ec3052bdc89735a2700575b0cd
Instruction ID: 5dd9e00c1b614864da4405dac2da4c62d05c8fcfd1073c82f18260aaf2454f6d
Opcode Fuzzy Hash: b447e1fdda4dec36b7a34e48ad19bb37ccf871ec3052bdc89735a2700575b0cd
Instruction Fuzzy Hash: 5D322331214B484FE75AFB34D4697EFB2D5FB98700FA0497A604AC32A2ED39DA45CB41

Function 0000023D0FCEA382 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 143
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32 ref: 0000023D0FCEA428

Strings

d, xrefs: 0000023D0FCEA3D9
%, xrefs: 0000023D0FCEA492

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: %$d
API String ID: 544645111-2062555646
Opcode ID: 54094574cc393b862cd2771380fe1ec476da5795c3c02fbf705b5334c7136e22
Instruction ID: 31baa3a7719e2f4c6dcb4ca10798af1ef818c9aa5e2c650f1b3a91c4ea1e22a1
Opcode Fuzzy Hash: 54094574cc393b862cd2771380fe1ec476da5795c3c02fbf705b5334c7136e22
Instruction Fuzzy Hash: 9141B03061CB588FE31CCA59E4DD36AB2D5F7A8715F60061DF087C32D0C66CC6898B5A

Function 0000023D0FBE8720 Relevance: 4.7, APIs: 3, Instructions: 233
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::_name_internal_method.LIBCMTD ref: 0000023D0FBE87C0

Part of subcall function 0000023D0FB36A80: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FB36AAB
Part of subcall function 0000023D0FB36A80: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FB36ABA

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FBE8826
CreateFileA.KERNEL32 ref: 0000023D0FBE8852

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$CreateFiletype_info::_name_internal_method
String ID:
API String ID: 645652700-0
Opcode ID: 819d9873fe87e5e0672c7b493bbbe385e55e3c781ecdd4f5973528374cac9e4f
Instruction ID: 2533aa9417087490b12a00a80064dc4fb4ffea291eb3aa12cb0ce560c0a3d892
Opcode Fuzzy Hash: 819d9873fe87e5e0672c7b493bbbe385e55e3c781ecdd4f5973528374cac9e4f
Instruction Fuzzy Hash: 45817230219B488FE799EB28D858B9EB7E1FB99710F504A6DE04DC32D1DE39D941CB02

Function 0000023D0FBF0EBC Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 207memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 0000023D0FCEA5C6

Strings

d, xrefs: 0000023D0FCEA574
%, xrefs: 0000023D0FCEA620

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: %$d
API String ID: 4275171209-2062555646
Opcode ID: 0397274e70c8a7f3d789460244b764dcb58fce8343aaa3aac63c8b35ee727e9f
Instruction ID: ec9c44e40ae3d6643be0220d2efcb9cf463cc7c6d4bed3b5d281ee088f988f1b
Opcode Fuzzy Hash: 0397274e70c8a7f3d789460244b764dcb58fce8343aaa3aac63c8b35ee727e9f
Instruction Fuzzy Hash: 7151FF30618B488FD31CDA28D4AD7AE77D5F79D755F600A2DB08BC32D1C66CC6868B06

Function 0000023D0FB04740 Relevance: 4.6, APIs: 3, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FB0476C
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FB0477E

Part of subcall function 0000023D0FB053C0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FB053DD

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FB047BB

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork
String ID:
API String ID: 1865873047-0
Opcode ID: 56f0e97885bd8304239a8f2878fdd14305f6cae0faeb2e433c02dacfefb3af0e
Instruction ID: c67ce48ea23faa033a03a45a1bacc1d318425f456cfc404b3c80f6fb46f25832
Opcode Fuzzy Hash: 56f0e97885bd8304239a8f2878fdd14305f6cae0faeb2e433c02dacfefb3af0e
Instruction Fuzzy Hash: 0B310C30128B888FD3A8EF28D459B9EB7E1FB94700F90092DB08AC36A1DF749545CF42

Function 0000023D0FBE8D40 Relevance: 4.6, APIs: 3, Instructions: 80fileCOMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FBE8D86
CreateFileA.KERNEL32 ref: 0000023D0FBE8DB5
ReadFile.KERNEL32 ref: 0000023D0FBE8DE4

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: File$Concurrency::details::CreateEmptyQueue::ReadStructuredWork
String ID:
API String ID: 586831839-0
Opcode ID: ebd15ed829b08a1b500daa4d553f069842ecabd0a130300aab089dd93fe54596
Instruction ID: 96f4b76e3b779886f88c17fc046054e2d474e711a3d8d001ec34a98068816924
Opcode Fuzzy Hash: ebd15ed829b08a1b500daa4d553f069842ecabd0a130300aab089dd93fe54596
Instruction Fuzzy Hash: 5421D474658B488FDB94EF1CC499B5ABBE0FB99301F50491DF489C3260DB79D944CB42

Function 00007FF7C18D3AD0 Relevance: 4.6, APIs: 3, Instructions: 68registryfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00007FF7C18D3B29
CloseHandle.KERNEL32 ref: 00007FF7C18D3B41
RegOpenKeyExA.ADVAPI32 ref: 00007FF7C18D3BCD

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: CloseCreateFileHandleOpen
String ID:
API String ID: 420164193-0
Opcode ID: 400d762f45c222ad54dc4951f779c31423d5e1f4fd11ce37fb757c510c9c0084
Instruction ID: a40d78b4924e93a1063ceaa2be23d1f8e4f693b6d682cd332b1b4e1823800c6d
Opcode Fuzzy Hash: 400d762f45c222ad54dc4951f779c31423d5e1f4fd11ce37fb757c510c9c0084
Instruction Fuzzy Hash: 79217C3160C78282E750AF54E4183AAA6E0E7847B4F904235EA9D47BD8DFBEC4558B10

Function 0000023D0FBE8CA0 Relevance: 4.5, APIs: 3, Instructions: 48fileCOMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FBE8CC7
CreateFileA.KERNEL32 ref: 0000023D0FBE8CF6
ReadFile.KERNEL32 ref: 0000023D0FBE8D1E

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: File$Concurrency::details::CreateEmptyQueue::ReadStructuredWork
String ID:
API String ID: 586831839-0
Opcode ID: 00f0e8137a90342245313ce85138990c6ed6b9c8d6714f93bfdec8d0e61b2606
Instruction ID: 6843469450ce5b412686234d7315c3f9fc025ecd5dccd17cf2b388a379745048
Opcode Fuzzy Hash: 00f0e8137a90342245313ce85138990c6ed6b9c8d6714f93bfdec8d0e61b2606
Instruction Fuzzy Hash: 9001C274618B488FD744EF28C45971ABBE1FB9A345F50491DF08AC32A0DB79D9458B42

Function 00007FF7C18D4540 Relevance: 4.5, APIs: 3, Instructions: 32windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32 ref: 00007FF7C18D4559
TranslateMessage.USER32 ref: 00007FF7C18D4568
DispatchMessageA.USER32 ref: 00007FF7C18D4573

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: fb7ffd9013c6280f3680469662e411462aaa5576de6003425bd1f7d40c52d67d
Instruction ID: 58d145801615d168644e8cfdb7ad77da0eb8e6e678405d3cc7b6f36890124a0b
Opcode Fuzzy Hash: fb7ffd9013c6280f3680469662e411462aaa5576de6003425bd1f7d40c52d67d
Instruction Fuzzy Hash: AC011A2192C29386F750BF20A85567AAAE0AF91335FE01035F18F42D95CFACE1298B30

Function 00007FF7C18B21B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18B236B

Strings

gfff, xrefs: 00007FF7C18B21F0

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007F020
String ID: gfff
API String ID: 2739980228-1553575800
Opcode ID: 7d68b32931d35f0c8cfeb6dd836044b0c014b9c7283b959deb82a84e693a6c20
Instruction ID: a024782e7594d2868aab7c4ac3c2907e93ce4b7c18bd9a47b9c2d1af93af4ef7
Opcode Fuzzy Hash: 7d68b32931d35f0c8cfeb6dd836044b0c014b9c7283b959deb82a84e693a6c20
Instruction Fuzzy Hash: E9515663708A8586D705DF2899112ADFBB2FB8CB90F898236DA4897799CB3CE555C700

Function 00007FF7C18D4370 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

00007FFB0CB45F50.D3D9 ref: 00007FF7C18D437B

Strings

@, xrefs: 00007FF7C18D440A

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007
String ID: @
API String ID: 3568877910-2766056989
Opcode ID: c9bde2acb797ea5a268e1411900f8b57382d5fe92209a827650add27bf516a59
Instruction ID: b30d5682ceb27db4f4362de1541014ce4f78f5647dc4e4c1be96998cc2e7d23f
Opcode Fuzzy Hash: c9bde2acb797ea5a268e1411900f8b57382d5fe92209a827650add27bf516a59
Instruction Fuzzy Hash: 4311C6B494C70696E791AF01E884365A6E0BB467A4FC06135D90D47BA0DFFEA1548B20

Function 0000023D0FBE8BC0 Relevance: 3.1, APIs: 2, Instructions: 56fileCOMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FBE8BE0
CreateFileA.KERNEL32 ref: 0000023D0FBE8C0F

Part of subcall function 0000023D0FB0A170: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FB0A18D

Part of subcall function 0000023D0FBE8720: type_info::_name_internal_method.LIBCMTD ref: 0000023D0FBE87C0
Part of subcall function 0000023D0FBE8720: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FBE8826
Part of subcall function 0000023D0FBE8720: CreateFileA.KERNEL32 ref: 0000023D0FBE8852

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$CreateFile$type_info::_name_internal_method
String ID:
API String ID: 2627539804-0
Opcode ID: cc7fafd89d896ea43074705b9a37fd9b433cefd388bc7ac13a0765c05240d101
Instruction ID: 226f1f4a8d46d4aebb12c227fc0d020f06945e8179876233e6c2bef9841bf687
Opcode Fuzzy Hash: cc7fafd89d896ea43074705b9a37fd9b433cefd388bc7ac13a0765c05240d101
Instruction Fuzzy Hash: A3111B70618B888FE794EF28D45975EBBE1FBD9341F50492DA08DC32A1DB79D8458B02

Function 00007FF7C18DC0CC Relevance: 3.1, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

_RTC_Initialize.LIBCMT ref: 00007FF7C18DC104
00007FFB2ADB1B20.API-MS-WIN-CRT-LOCALE-L1-1-0 ref: 00007FF7C18DC150

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007Initialize
String ID:
API String ID: 3598312978-0
Opcode ID: 5b54a8b9123677f748fd2ee654e194cb8d97a930d90aeec746cf412f2530cc20
Instruction ID: adbbc978b044b77ce66edf995685f3043e93d4b9b14d7879b56cd13904312b1c
Opcode Fuzzy Hash: 5b54a8b9123677f748fd2ee654e194cb8d97a930d90aeec746cf412f2530cc20
Instruction Fuzzy Hash: A7115544E0C74351FB54BFB149562B992C14F95370FC40439E50D862C3AFACA8624732

Function 00007FF7C18DC064 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C18DC094

Part of subcall function 00007FF7C18DC898: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7C18DC8A1

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C18DC09A

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: 8e01c2beb72ffa579fafe4c983bce2458ba15fa5ed39c72685a4d74e7f09d0a2
Instruction ID: 0a0a887db4f58371e967226cfbe30eef5e8cd2d762127df0308d3844e8cb4a04
Opcode Fuzzy Hash: 8e01c2beb72ffa579fafe4c983bce2458ba15fa5ed39c72685a4d74e7f09d0a2
Instruction Fuzzy Hash: 05F01750E5D30741FB697AA664121B891C04F0AB70FDC0634D97C053C2EE9DA8B68331

Function 0000023D0FC133C0 Relevance: 1.7, APIs: 1, Instructions: 247COMMON

Download Yara Rule

APIs

std::_Fac_node::_Fac_node.LIBCPMTD ref: 0000023D0FC1343A

Part of subcall function 0000023D0FB0A170: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FB0A18D

Part of subcall function 0000023D0FBE8720: type_info::_name_internal_method.LIBCMTD ref: 0000023D0FBE87C0
Part of subcall function 0000023D0FBE8720: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FBE8826
Part of subcall function 0000023D0FBE8720: CreateFileA.KERNEL32 ref: 0000023D0FBE8852

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$CreateFac_nodeFac_node::_Filestd::_type_info::_name_internal_method
String ID:
API String ID: 3000750846-0
Opcode ID: 3f2ef6f74bf225def2dab778cd6fcba1428f71d8aef22a335888cc59ac8b6020
Instruction ID: 262fde686e9820d36d27ac502ecac86166086902c632bb8e5b1a11170a632098
Opcode Fuzzy Hash: 3f2ef6f74bf225def2dab778cd6fcba1428f71d8aef22a335888cc59ac8b6020
Instruction Fuzzy Hash: BE915F3025CB888FE769EB28C455BDFB7E5FB99704F50095DE089C3291DA39DA40CB06

Function 00007FF7C18D1B90 Relevance: 1.7, APIs: 1, Instructions: 199libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF7C18D1DDE

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0687a482410035a8978432453c5d728bbb6bc986c65ef01f96900fa291c08832
Instruction ID: 1a995ba456efb52689821a3ce70dbf1137cfe20c0fc1fdad63e6c6c0aace3cce
Opcode Fuzzy Hash: 0687a482410035a8978432453c5d728bbb6bc986c65ef01f96900fa291c08832
Instruction Fuzzy Hash: 7FA1A936619B8586DB60DF0AE49032AB7A0F7C9BA4F504125EBCE83B68DF7CD450CB00

Function 0000023D0FC29D5C Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000023D0FC29D8C

Part of subcall function 0000023D0FC2A810: std::bad_alloc::bad_alloc.LIBCMTD ref: 0000023D0FC2A819

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_taskstd::bad_alloc::bad_alloc
String ID:
API String ID: 680105476-0
Opcode ID: 64a47e28c3614743c32ebf0df84499a9aef0dcbac1c74a8302aad57f47b4e453
Instruction ID: 9ce183666a2998d0b5caba318e0fd0ed97b37d09c73b3c069f4f1125ead761e0
Opcode Fuzzy Hash: 64a47e28c3614743c32ebf0df84499a9aef0dcbac1c74a8302aad57f47b4e453
Instruction Fuzzy Hash: 8901A414221B0A0AFAEC737978DF3B811DCEB45B40F7C0414F416C29C2ED2D8A45B25D

Function 00007FF7C18DBCB0 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7C18DBCD3

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: b1371d319780f7c63a2b5d838895a119c58dee36737aa1d21d8aaa4a908d7d1e
Instruction ID: e647ceb30cb5f4d155815b5422db53a4cef5539b175c310d153816732c709b4f
Opcode Fuzzy Hash: b1371d319780f7c63a2b5d838895a119c58dee36737aa1d21d8aaa4a908d7d1e
Instruction Fuzzy Hash: DC010061A1DF4681D760BF19E44031AE3E4FB897B8F841231E99D46798DF6CD5608714

Non-executed Functions

Function 00007FF7C18B25F0 Relevance: 54.1, APIs: 16, Strings: 14, Instructions: 1603COMMON

Download Yara Rule

APIs

00007FFB1E6719C0.VCRUNTIME140 ref: 00007FF7C18B2777
00007FFB1E6719C0.VCRUNTIME140 ref: 00007FF7C18B2789
00007FFB1E6719C0.VCRUNTIME140 ref: 00007FF7C18B2ABA
00007FFB1E6719C0.VCRUNTIME140 ref: 00007FF7C18B2B09
00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18B3F7F
00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18B4005

Strings

0 && "stbtt_InitFont(): failed to parse FontData. It is correct and complete? Check FontDataSize.", xrefs: 00007FF7C18B2A58
font_offset >= 0 && "FontData is incorrect, or FontNo cannot be found.", xrefs: 00007FF7C18B28CC
cfg.DstFont && (!cfg.DstFont->IsLoaded() || cfg.DstFont->ContainerAtlas == atlas), xrefs: 00007FF7C18B2821
C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF7C18B2B50, 00007FF7C18B2BAC, 00007FF7C18B2BDE
src_range[0] <= src_range[1] && "Invalid range: is your glyph range array persistent? it is zero-terminated?", xrefs: 00007FF7C18B2961
atlas->ConfigData.Size > 0, xrefs: 00007FF7C18B2635
src_tmp.GlyphsList.Size == src_tmp.GlyphsCount, xrefs: 00007FF7C18B2D53
n < (Storage.Size << 5), xrefs: 00007FF7C18B2B57, 00007FF7C18B2BB3, 00007FF7C18B2BE5
font->ConfigData == font_config, xrefs: 00007FF7C18B3AC1
i >= 0 && i < Size, xrefs: 00007FF7C18B27C0, 00007FF7C18B27E5, 00007FF7C18B286B, 00007FF7C18B2911, 00007FF7C18B2A19, 00007FF7C18B2F65, 00007FF7C18B2FA8, 00007FF7C18B2FED, 00007FF7C18B312F, 00007FF7C18B36A4, 00007FF7C18B39E4, 00007FF7C18B3B3F
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7C18B27B9, 00007FF7C18B27DE, 00007FF7C18B2864, 00007FF7C18B290A, 00007FF7C18B2A12, 00007FF7C18B2F5E, 00007FF7C18B2FA1, 00007FF7C18B2FE6, 00007FF7C18B3128, 00007FF7C18B369D, 00007FF7C18B39DD, 00007FF7C18B3B38
glyph_index_in_font != 0, xrefs: 00007FF7C18B3163
src_tmp.DstIndex != -1, xrefs: 00007FF7C18B2A79
C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp, xrefs: 00007FF7C18B262E, 00007FF7C18B281A, 00007FF7C18B28C5, 00007FF7C18B295A, 00007FF7C18B2A5F, 00007FF7C18B2A80, 00007FF7C18B2D4C, 00007FF7C18B315C, 00007FF7C18B3ABA

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007$E6719$F020
String ID: 0 && "stbtt_InitFont(): failed to parse FontData. It is correct and complete? Check FontDataSize."$C:\Users\55yar\Desktop\imgui-master\imgui.h$C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp$C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$atlas->ConfigData.Size > 0$cfg.DstFont && (!cfg.DstFont->IsLoaded() || cfg.DstFont->ContainerAtlas == atlas)$font->ConfigData == font_config$font_offset >= 0 && "FontData is incorrect, or FontNo cannot be found."$glyph_index_in_font != 0$i >= 0 && i < Size$n < (Storage.Size << 5)$src_range[0] <= src_range[1] && "Invalid range: is your glyph range array persistent? it is zero-terminated?"$src_tmp.DstIndex != -1$src_tmp.GlyphsList.Size == src_tmp.GlyphsCount
API String ID: 3379756305-2192739418
Opcode ID: 96ea50517a9594f90f97f70fabda856bc0af3c5d5e1c59cf1a40ae8a93fede3e
Instruction ID: 43f1b83be25d6c9f77b346156e0cc80ecb8424d89683b5b3805826f81980e3fd
Opcode Fuzzy Hash: 96ea50517a9594f90f97f70fabda856bc0af3c5d5e1c59cf1a40ae8a93fede3e
Instruction Fuzzy Hash: AEF22432B08A8686E715EF29D8842BDB7E1FB497A4F948236CF0D53660DF78E465C710

Function 00007FF7C1889E10 Relevance: 48.3, APIs: 2, Strings: 25, Instructions: 1049COMMON

Download Yara Rule

APIs

00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C188AA84
00007FFB2ADBA0D0.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FF7C188AEDF

Strings

Click %s Button to break in debugger! (remap w/ Ctrl+Shift), xrefs: 00007FF7C188AD51
Size > 0, xrefs: 00007FF7C188ABDE
g.Font->IsLoaded(), xrefs: 00007FF7C188A274
g.CurrentWindow->IsFallbackWindow == true, xrefs: 00007FF7C188B026
GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?", xrefs: 00007FF7C1889E54
GImGui != 0, xrefs: 00007FF7C188A715
g.WindowsFocusOrder.Size <= g.Windows.Size, xrefs: 00007FF7C188A584
HoveredId: 0x%08X, xrefs: 00007FF7C188ACF7
Left, xrefs: 00007FF7C188AD0F
Remap w/ Ctrl+Shift: click anywhere to select new mouse button., xrefs: 00007FF7C188AD3B
Debug##Default, xrefs: 00007FF7C188AFCA
i >= 0 && i < Size, xrefs: 00007FF7C1889E96, 00007FF7C1889ECA, 00007FF7C188A121, 00007FF7C188A241, 00007FF7C188A8F5, 00007FF7C188A92C, 00007FF7C188A95F, 00007FF7C188AAFA
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7C1889E4D, 00007FF7C188A0F7, 00007FF7C188A26D, 00007FF7C188A57D, 00007FF7C188A6C9, 00007FF7C188A70E, 00007FF7C188AD95, 00007FF7C188B01F
GetCurrentWindowRead()->Flags & ImGuiWindowFlags_Tooltip, xrefs: 00007FF7C188AD9C
Right, xrefs: 00007FF7C188AD1B
g.MovingWindow && g.MovingWindow->RootWindow, xrefs: 00007FF7C188A6D0
g.Viewports.Size == 1, xrefs: 00007FF7C188A0FE
it >= Data && it < Data + Size, xrefs: 00007FF7C1889F07
Press ESC to abort picking., xrefs: 00007FF7C188AD03
(Debug Log: Auto-disabled some ImGuiDebugLogFlags after 2 frames), xrefs: 00007FF7C188AFA2
NewFrame(): ClearActiveID() because it isn't marked alive anymore!, xrefs: 00007FF7C188A3C3
gfff, xrefs: 00007FF7C188B114
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7C1889E8F, 00007FF7C1889EC3, 00007FF7C1889F00, 00007FF7C188A11A, 00007FF7C188A23A, 00007FF7C188A8EE, 00007FF7C188A925, 00007FF7C188A958, 00007FF7C188AAF3, 00007FF7C188ABD7
333?, xrefs: 00007FF7C188ACDE
Middle, xrefs: 00007FF7C188AD27

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007$F020
String ID: (Debug Log: Auto-disabled some ImGuiDebugLogFlags after 2 frames)$333?$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$C:\Users\55yar\Desktop\imgui-master\imgui.h$Click %s Button to break in debugger! (remap w/ Ctrl+Shift)$Debug##Default$GImGui != 0$GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?"$GetCurrentWindowRead()->Flags & ImGuiWindowFlags_Tooltip$HoveredId: 0x%08X$Left$Middle$NewFrame(): ClearActiveID() because it isn't marked alive anymore!$Press ESC to abort picking.$Remap w/ Ctrl+Shift: click anywhere to select new mouse button.$Right$Size > 0$g.CurrentWindow->IsFallbackWindow == true$g.Font->IsLoaded()$g.MovingWindow && g.MovingWindow->RootWindow$g.Viewports.Size == 1$g.WindowsFocusOrder.Size <= g.Windows.Size$gfff$i >= 0 && i < Size$it >= Data && it < Data + Size
API String ID: 4100318414-8291574
Opcode ID: d3b2595934c51ed1d8cb045eddf48157a67c1cc9c59cca699bf918a1817e944d
Instruction ID: f4b9d5f9d04466e33021ab8ea7bf4755233ec1ec1aa9557d6419ce38a37872f2
Opcode Fuzzy Hash: d3b2595934c51ed1d8cb045eddf48157a67c1cc9c59cca699bf918a1817e944d
Instruction Fuzzy Hash: 47C2B232A087C289EB21EF35C8441E8B7E1FF54768F888235DA0D5BA95DFBCA555C720

Function 00007FF7C18C6090 Relevance: 36.4, Strings: 26, Instructions: 3919COMMON

Download Yara Rule

Strings

apply_new_text_length <= buf_size, xrefs: 00007FF7C18C8F58
callback_data.Flags == flags, xrefs: 00007FF7C18C8BC9
buf != 0 && buf_size >= 0, xrefs: 00007FF7C18C612D
!((flags & ImGuiInputTextFlags_CallbackCompletion) && (flags & ImGuiInputTextFlags_AllowTabInput)), xrefs: 00007FF7C18C617D
!((flags & ImGuiInputTextFlags_CallbackHistory) && (flags & ImGuiInputTextFlags_Multiline)), xrefs: 00007FF7C18C6155
password_font->Glyphs.empty() && password_font->IndexAdvanceX.empty() && password_font->IndexLookup.empty(), xrefs: 00007FF7C18C6F45
C:\Users\55yar\Desktop\imgui-master\imgui_widgets.cpp, xrefs: 00007FF7C18C6126, 00007FF7C18C614E, 00007FF7C18C6176, 00007FF7C18C6746, 00007FF7C18C6B98, 00007FF7C18C6F3E, 00007FF7C18C6FC5, 00007FF7C18C7109, 00007FF7C18C71FC, 00007FF7C18C7615, 00007FF7C18C8877, 00007FF7C18C88B5, 00007FF7C18C89A4, 00007FF7C18C8B7C, 00007FF7C18C8B9F, 00007FF7C18C8BC2, 00007FF7C18C8C69, 00007FF7C18C8E94, 00007FF7C18C8F51, 00007FF7C18C934E
apply_new_text_length >= 0, xrefs: 00007FF7C18C8E9B
@, xrefs: 00007FF7C18CA0BA
callback != 0, xrefs: 00007FF7C18C674D, 00007FF7C18C89AB
idx <= obj->TextLen, xrefs: 00007FF7C18C7110, 00007FF7C18C7203
g.DragDropActive || g.ActiveId == id || g.ActiveId == 0 || g.ActiveIdPreviousFrame == id || (g.CurrentMultiSelect != 0 && g.BoxSel, xrefs: 00007FF7C18CA0A6
i >= 0 && i < Size, xrefs: 00007FF7C18C7134, 00007FF7C18C7227, 00007FF7C18C7546
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7C18C6C32, 00007FF7C18C6CA1, 00007FF7C18C6CDE, 00007FF7C18C6D20, 00007FF7C18C6D5D, 00007FF7C18C6DA8, 00007FF7C18C770D, 00007FF7C18C77A3, 00007FF7C18C78C1, 00007FF7C18C796F, 00007FF7C18C7A01, 00007FF7C18C7A9D, 00007FF7C18C7B44, 00007FF7C18C7BEB, 00007FF7C18C7C25, 00007FF7C18C7CD3, 00007FF7C18CA09F
state && state->ID == id, xrefs: 00007FF7C18C6B9F
callback_data.Buf == callback_buf, xrefs: 00007FF7C18C8B83
state != 0, xrefs: 00007FF7C18C6FCC, 00007FF7C18C761C, 00007FF7C18C887E, 00007FF7C18C9355
callback_data.BufTextLen == (int)strlen(callback_data.Buf), xrefs: 00007FF7C18C8C70
buf[0] != 0, xrefs: 00007FF7C18C88BC
#SCROLLY, xrefs: 00007FF7C18C67C1, 00007FF7C18C67F0, 00007FF7C18C9E36
%*s%.*s, xrefs: 00007FF7C18C9FA0
callback_data.BufSize == state->BufCapacity, xrefs: 00007FF7C18C8BA6
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7C18C712D, 00007FF7C18C7220, 00007FF7C18C753F
C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp, xrefs: 00007FF7C18C92A2, 00007FF7C18C9B5D
font->ContainerAtlas->TexID == _CmdHeader.TextureId, xrefs: 00007FF7C18C92A9, 00007FF7C18C9B64
IsNamedKeyOrMod(key) && (owner_id != ((ImGuiID)0) || (flags & (ImGuiInputFlags_LockThisFrame | ImGuiInputFlags_LockUntilRelease))), xrefs: 00007FF7C18C6C39, 00007FF7C18C6CA8, 00007FF7C18C6CE5, 00007FF7C18C6D27, 00007FF7C18C6D64, 00007FF7C18C6DAF, 00007FF7C18C7714, 00007FF7C18C77AA, 00007FF7C18C78C8, 00007FF7C18C7976, 00007FF7C18C7A08, 00007FF7C18C7AA4, 00007FF7C18C7B4B, 00007FF7C18C7BF2, 00007FF7C18C7C2C, 00007FF7C18C7CDA

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: __swprintf_l
String ID: !((flags & ImGuiInputTextFlags_CallbackCompletion) && (flags & ImGuiInputTextFlags_AllowTabInput))$!((flags & ImGuiInputTextFlags_CallbackHistory) && (flags & ImGuiInputTextFlags_Multiline))$#SCROLLY$%*s%.*s$@$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$C:\Users\55yar\Desktop\imgui-master\imgui.h$C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp$C:\Users\55yar\Desktop\imgui-master\imgui_widgets.cpp$IsNamedKeyOrMod(key) && (owner_id != ((ImGuiID)0) || (flags & (ImGuiInputFlags_LockThisFrame | ImGuiInputFlags_LockUntilRelease)))$apply_new_text_length <= buf_size$apply_new_text_length >= 0$buf != 0 && buf_size >= 0$buf[0] != 0$callback != 0$callback_data.Buf == callback_buf$callback_data.BufSize == state->BufCapacity$callback_data.BufTextLen == (int)strlen(callback_data.Buf)$callback_data.Flags == flags$font->ContainerAtlas->TexID == _CmdHeader.TextureId$g.DragDropActive || g.ActiveId == id || g.ActiveId == 0 || g.ActiveIdPreviousFrame == id || (g.CurrentMultiSelect != 0 && g.BoxSel$i >= 0 && i < Size$idx <= obj->TextLen$password_font->Glyphs.empty() && password_font->IndexAdvanceX.empty() && password_font->IndexLookup.empty()$state != 0$state && state->ID == id
API String ID: 1488884202-4266151527
Opcode ID: e788e00ba91244ff4c9861e61677eaf4e20344cbc13bffa4944e22b1783e51dc
Instruction ID: 6f9da12db1f0911d1adf6514bc3584c4e0c8d76d89761bb0d2abc7c8e8026512
Opcode Fuzzy Hash: e788e00ba91244ff4c9861e61677eaf4e20344cbc13bffa4944e22b1783e51dc
Instruction Fuzzy Hash: 0B930332A0C7868AEB10EF25D0906B9B7E1FF45778F948235DA4907695CFBCE465CB20

Function 00007FF7C1887390 Relevance: 26.8, APIs: 10, Strings: 5, Instructions: 530COMMON

Download Yara Rule

APIs

00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18875A9
00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C188767F
00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C1887776
00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C1887807
00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18878BC
00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C1887965
00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18879F6
00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C1887AB5
00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C1887B84
00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C1887C89

Strings

Forgot to shutdown Platform backend?, xrefs: 00007FF7C18873A9
(g.IO.BackendRendererUserData == 0) && "Forgot to shutdown Renderer backend?", xrefs: 00007FF7C188740E
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7C18873C9, 00007FF7C1887407
Forgot to shutdown Renderer backend?, xrefs: 00007FF7C18873E7
(g.IO.BackendPlatformUserData == 0) && "Forgot to shutdown Platform backend?", xrefs: 00007FF7C18873D0

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007F020
String ID: (g.IO.BackendPlatformUserData == 0) && "Forgot to shutdown Platform backend?"$(g.IO.BackendRendererUserData == 0) && "Forgot to shutdown Renderer backend?"$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$Forgot to shutdown Platform backend?$Forgot to shutdown Renderer backend?
API String ID: 2739980228-2716422499
Opcode ID: 26288e8c175f015e1836f85dd7fd1a69da7496cc3a127bc8ca54b656109c5204
Instruction ID: 77fae9d868b76095add60040cfe92820f0659480b56d764b1d5bf43c7ff81366
Opcode Fuzzy Hash: 26288e8c175f015e1836f85dd7fd1a69da7496cc3a127bc8ca54b656109c5204
Instruction Fuzzy Hash: EE428032608A8292EB09EF24C6941FCB3B5FB54BA8F984136DB0D47654DF78E576C360

Function 00007FF7C18B97F0 Relevance: 24.4, Strings: 19, Instructions: 617COMMON

Download Yara Rule

Strings

Mismatching PushID/PopID!, xrefs: 00007FF7C18B9F0F
Calling PopStyleColor() too many times!, xrefs: 00007FF7C18B97F7
outer_window == inner_window || outer_window == inner_window->ParentWindow, xrefs: 00007FF7C18B98C7
(outer_window->DC.ItemWidthStack.Size >= temp_data->HostBackupItemWidthStackSize) && "Too many PopItemWidth!", xrefs: 00007FF7C18B9FB1
Too many PopItemWidth!, xrefs: 00007FF7C18B9F83
Size > 0, xrefs: 00007FF7C18B9B29, 00007FF7C18B9EE4, 00007FF7C18B9F35
(inner_window->IDStack.back() == table_instance->TableInstanceID) && "Mismatching PushID/PopID!", xrefs: 00007FF7C18B9F65
table->RowPosY2 == inner_window->DC.CursorPos.y, xrefs: 00007FF7C18B99D4
C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF7C18B9A9E, 00007FF7C18B9C1E, 00007FF7C18B9DB3, 00007FF7C18B9E3D, 00007FF7C18BA340
p >= Buf.Data && p < Buf.Data + Buf.Size, xrefs: 00007FF7C18BA347
(table->Flags & ImGuiTableFlags_ScrollX) == 0, xrefs: 00007FF7C18BA0EC
g.CurrentWindow == outer_window && g.CurrentTable == table, xrefs: 00007FF7C18BA224
g.TablesTempDataStacked > 0, xrefs: 00007FF7C18BA247
table != 0 && "Only call EndTable() if BeginTable() returns true!", xrefs: 00007FF7C18B984D
p >= Data && p < DataEnd, xrefs: 00007FF7C18B9AA5, 00007FF7C18B9C25, 00007FF7C18B9DBA, 00007FF7C18B9E44
i >= 0 && i < Size, xrefs: 00007FF7C18B995E, 00007FF7C18BA27F, 00007FF7C18BA2C5
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7C18B9957, 00007FF7C18B9B22, 00007FF7C18B9EDD, 00007FF7C18B9F2E, 00007FF7C18BA278, 00007FF7C18BA2BE
C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp, xrefs: 00007FF7C18B9846, 00007FF7C18B9898, 00007FF7C18B98C0, 00007FF7C18B99CD, 00007FF7C18B9F5E, 00007FF7C18B9FAA, 00007FF7C18BA0E5, 00007FF7C18BA21D, 00007FF7C18BA240
inner_window == g.CurrentWindow, xrefs: 00007FF7C18B989F

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID: (inner_window->IDStack.back() == table_instance->TableInstanceID) && "Mismatching PushID/PopID!"$(outer_window->DC.ItemWidthStack.Size >= temp_data->HostBackupItemWidthStackSize) && "Too many PopItemWidth!"$(table->Flags & ImGuiTableFlags_ScrollX) == 0$C:\Users\55yar\Desktop\imgui-master\imgui.h$C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp$Calling PopStyleColor() too many times!$Mismatching PushID/PopID!$Size > 0$Too many PopItemWidth!$g.CurrentWindow == outer_window && g.CurrentTable == table$g.TablesTempDataStacked > 0$i >= 0 && i < Size$inner_window == g.CurrentWindow$outer_window == inner_window || outer_window == inner_window->ParentWindow$p >= Buf.Data && p < Buf.Data + Buf.Size$p >= Data && p < DataEnd$table != 0 && "Only call EndTable() if BeginTable() returns true!"$table->RowPosY2 == inner_window->DC.CursorPos.y
API String ID: 0-2342475368
Opcode ID: fb8c50e147d00a123830afff88922648a2ae1b96f566e52dfccd9055c5c3bd33
Instruction ID: fb409918b3b9d31e2b9e8148496fa37b1bdb1f784ebd69d1062d1d2dcd46c30b
Opcode Fuzzy Hash: fb8c50e147d00a123830afff88922648a2ae1b96f566e52dfccd9055c5c3bd33
Instruction Fuzzy Hash: B372B332A0CA8696E755EF36C8843F9B3A0FF15764F848631DA0D161A1DFBCB5A4C720

Function 00007FF7C18B7CE0 Relevance: 24.0, APIs: 3, Strings: 10, Instructions: 1289COMMON

Download Yara Rule

APIs

00007FFB1E6719C0.VCRUNTIME140 ref: 00007FF7C18B7DA7
00007FFB1E6719C0.VCRUNTIME140 ref: 00007FF7C18B7DC1
00007FFB1E6719C0.VCRUNTIME140(?), ref: 00007FF7C18B8883

Strings

p >= Data && p < DataEnd, xrefs: 00007FF7C18B7E50, 00007FF7C18B7E91, 00007FF7C18B7F8F, 00007FF7C18B8220, 00007FF7C18B833B, 00007FF7C18B8388, 00007FF7C18B8524, 00007FF7C18B8646, 00007FF7C18B8678, 00007FF7C18B8900, 00007FF7C18B8938, 00007FF7C18B8A6C, 00007FF7C18B8E47, 00007FF7C18B8E81, 00007FF7C18B8F16, 00007FF7C18B91DB, 00007FF7C18B920D
table->LeftMostEnabledColumn >= 0 && table->RightMostEnabledColumn >= 0, xrefs: 00007FF7C18B8168
i >= 0 && i < Size, xrefs: 00007FF7C18B86E4
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7C18B86DD
!is_visible, xrefs: 00007FF7C18B8CC9
C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF7C18B7E49, 00007FF7C18B7E8A, 00007FF7C18B7F88, 00007FF7C18B8219, 00007FF7C18B8334, 00007FF7C18B8381, 00007FF7C18B851D, 00007FF7C18B863F, 00007FF7C18B8671, 00007FF7C18B88F9, 00007FF7C18B8931, 00007FF7C18B8A65, 00007FF7C18B8E40, 00007FF7C18B8E7A, 00007FF7C18B8F0F, 00007FF7C18B91D4, 00007FF7C18B9206
column->IndexWithinEnabledSet <= column->DisplayOrder, xrefs: 00007FF7C18B800F
table->IsLayoutLocked == false, xrefs: 00007FF7C18B7D5B
#ContextMenu, xrefs: 00007FF7C18B9129
C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp, xrefs: 00007FF7C18B7D54, 00007FF7C18B8008, 00007FF7C18B8161, 00007FF7C18B8CC2

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007E6719
String ID: !is_visible$#ContextMenu$C:\Users\55yar\Desktop\imgui-master\imgui.h$C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp$column->IndexWithinEnabledSet <= column->DisplayOrder$i >= 0 && i < Size$p >= Data && p < DataEnd$table->IsLayoutLocked == false$table->LeftMostEnabledColumn >= 0 && table->RightMostEnabledColumn >= 0
API String ID: 1823926093-1387518580
Opcode ID: ec0702dd844992c5246f3174f8b9bbc99badffcfda43b03853648fa86f9c6ef8
Instruction ID: 995548c08dd952c8fed84697fcacefbedf3fa3ffe5c8707e23bd801d967a627e
Opcode Fuzzy Hash: ec0702dd844992c5246f3174f8b9bbc99badffcfda43b03853648fa86f9c6ef8
Instruction Fuzzy Hash: 4FE2C132A0C68696E755EF36C5413A8B7A0FF5A764F888735DB08235A1DBB8F4B4C710

Function 00007FF7C18D0D02 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 232keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32 ref: 00007FF7C18D0D24
GetKeyState.USER32 ref: 00007FF7C18D0D62
GetKeyState.USER32 ref: 00007FF7C18D0D98
GetKeyState.USER32 ref: 00007FF7C18D0DCE
GetKeyState.USER32 ref: 00007FF7C18D0DE0
GetKeyState.USER32 ref: 00007FF7C18D0EB1
GetKeyState.USER32 ref: 00007FF7C18D0EED
GetKeyState.USER32 ref: 00007FF7C18D0F3D
GetKeyState.USER32 ref: 00007FF7C18D0F79
GetKeyState.USER32 ref: 00007FF7C18D0FC9
GetKeyState.USER32 ref: 00007FF7C18D1005

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7C18D0E8F
ImGui::IsNamedKey(key), xrefs: 00007FF7C18D0E96

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: State
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$ImGui::IsNamedKey(key)
API String ID: 1649606143-1336968070
Opcode ID: 000c7aad7ae504db2632ddcdd900167e4b492e161e73d0c01b1bbe1108e36a38
Instruction ID: 2167139b56b55cb4567ec079695b3cc29f6a79efd504b7fbba6cec66eba1287e
Opcode Fuzzy Hash: 000c7aad7ae504db2632ddcdd900167e4b492e161e73d0c01b1bbe1108e36a38
Instruction Fuzzy Hash: 5791EF10E8C75705FBA1BE3464013FAA2C18F62378FD90635EC5A065D6CFACA8A28370

Function 00007FF7C18CCB40 Relevance: 20.3, APIs: 2, Strings: 9, Instructions: 1043COMMON

Download Yara Rule

APIs

00007FFB2ADA49A0.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF7C18CCE46
00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18CD0CA

Strings

N/A, xrefs: 00007FF7C18CD1B2
tab->NameOffset < tab_bar->TabsNames.Buf.Size, xrefs: 00007FF7C18CD1D0
Calling PopStyleColor() too many times!, xrefs: 00007FF7C18CCB43
tab->LastFrameVisible >= tab_bar->PrevFrameVisible, xrefs: 00007FF7C18CD155
i >= 0 && i < Size, xrefs: 00007FF7C18CCC07, 00007FF7C18CCC52, 00007FF7C18CCC85, 00007FF7C18CCCD8, 00007FF7C18CCD37, 00007FF7C18CD12C, 00007FF7C18CD283, 00007FF7C18CD450, 00007FF7C18CD47E, 00007FF7C18CD4AE, 00007FF7C18CD5D3
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7C18CD9D0
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7C18CCC00, 00007FF7C18CCC4B, 00007FF7C18CCC7E, 00007FF7C18CCCD1, 00007FF7C18CCD30, 00007FF7C18CD125, 00007FF7C18CD27C, 00007FF7C18CD449, 00007FF7C18CD477, 00007FF7C18CD4A7, 00007FF7C18CD5CC
IsNamedKeyOrMod(key) && (owner_id != ((ImGuiID)0) || (flags & (ImGuiInputFlags_LockThisFrame | ImGuiInputFlags_LockUntilRelease))), xrefs: 00007FF7C18CD9D7
C:\Users\55yar\Desktop\imgui-master\imgui_widgets.cpp, xrefs: 00007FF7C18CD14E, 00007FF7C18CD1C9

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007$F020
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$C:\Users\55yar\Desktop\imgui-master\imgui.h$C:\Users\55yar\Desktop\imgui-master\imgui_widgets.cpp$Calling PopStyleColor() too many times!$IsNamedKeyOrMod(key) && (owner_id != ((ImGuiID)0) || (flags & (ImGuiInputFlags_LockThisFrame | ImGuiInputFlags_LockUntilRelease)))$N/A$i >= 0 && i < Size$tab->LastFrameVisible >= tab_bar->PrevFrameVisible$tab->NameOffset < tab_bar->TabsNames.Buf.Size
API String ID: 4100318414-961183113
Opcode ID: c6d1a4655b269b2cbdfe3e597586c49ea58f02e291c79375d4aad5c9a3d81ca7
Instruction ID: b2d0ccd1bb661a3d4d9f37783984b9218d06a9b1c11061030506b827419021a2
Opcode Fuzzy Hash: c6d1a4655b269b2cbdfe3e597586c49ea58f02e291c79375d4aad5c9a3d81ca7
Instruction Fuzzy Hash: B7B2F232A087868AE751EF3AC0501B9B7E1FF597A8F448736DA0D632A4DB78F461C750

Function 00007FF7C18D3D40 Relevance: 17.6, Strings: 14, Instructions: 80COMMON

Download Yara Rule

Strings

-, xrefs: 00007FF7C18D3DDE
*, xrefs: 00007FF7C18D3DF7
2, xrefs: 00007FF7C18D3D93
), xrefs: 00007FF7C18D3DB6
#, xrefs: 00007FF7C18D3E65
, xrefs: 00007FF7C18D3DE3
2, xrefs: 00007FF7C18D3DD4
, xrefs: 00007FF7C18D3DA2
#, xrefs: 00007FF7C18D3D49
., xrefs: 00007FF7C18D3E01
*, xrefs: 00007FF7C18D3DF2
-, xrefs: 00007FF7C18D3D9D
SOFTWARE\VMware, Inc.\VMware Tools, xrefs: 00007FF7C18D3E42, 00007FF7C18D3E80, 00007FF7C18D3EBD
', xrefs: 00007FF7C18D3DFC

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: AcquireExclusiveLock
String ID: $ $#$#$'$)$*$*$-$-$.$2$2$SOFTWARE\VMware, Inc.\VMware Tools
API String ID: 4021432409-1915594051
Opcode ID: 4e38b839c97e853e088b89e59f31bd11186dc15767536bcab97c3b54645444db
Instruction ID: e84149e4f0eef26602518006a150ee2713be1e4ba19ced45e6a30175313ebe7c
Opcode Fuzzy Hash: 4e38b839c97e853e088b89e59f31bd11186dc15767536bcab97c3b54645444db
Instruction Fuzzy Hash: BD41E01250C7C1C5E762DB28E44835AEFA0E793368F581169E7D947BDACBEEC148CB21

Function 00007FF7C18A1D70 Relevance: 15.0, APIs: 10, Instructions: 50clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00007FF7C18A1D7B
MultiByteToWideChar.KERNEL32 ref: 00007FF7C18A1DAE
GlobalAlloc.KERNEL32 ref: 00007FF7C18A1DC2
GlobalLock.KERNEL32 ref: 00007FF7C18A1DD3
MultiByteToWideChar.KERNEL32 ref: 00007FF7C18A1DF2
GlobalUnlock.KERNEL32 ref: 00007FF7C18A1DFB
EmptyClipboard.USER32 ref: 00007FF7C18A1E01
SetClipboardData.USER32 ref: 00007FF7C18A1E0F
GlobalFree.KERNEL32 ref: 00007FF7C18A1E1D
CloseClipboard.USER32 ref: 00007FF7C18A1E23

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: ClipboardGlobal$ByteCharMultiWide$AllocCloseDataEmptyFreeLockOpenUnlock
String ID:
API String ID: 1965520120-0
Opcode ID: 157459983b14d43045f12caff330d5b23f9d56f10b12b28ab43e68da8f23084f
Instruction ID: 10fa87a2ed2a6998261163243879b578e6f16922f27678e8c7bcc18ee1bd2beb
Opcode Fuzzy Hash: 157459983b14d43045f12caff330d5b23f9d56f10b12b28ab43e68da8f23084f
Instruction Fuzzy Hash: BB115131B0DB0382EB247F26B814225A3E1AF49BF1F484635DA4D43BA4DE7CD4608720

Function 00007FF7C1886CB0 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 396COMMON

Download Yara Rule

APIs

00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C1887227

Strings

FindSettingsHandler(handler->TypeName) == 0, xrefs: 00007FF7C1886E20, 00007FF7C1886F4E
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7C1886CE9, 00007FF7C1886E19, 00007FF7C1886F47
C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF7C1887329
Table, xrefs: 00007FF7C1886E3E
Window, xrefs: 00007FF7C1886D06
n >= 0 && n < BITCOUNT, xrefs: 00007FF7C1887330
!g.Initialized && !g.SettingsLoaded, xrefs: 00007FF7C1886CF0

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007F020
String ID: !g.Initialized && !g.SettingsLoaded$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$FindSettingsHandler(handler->TypeName) == 0$Table$Window$n >= 0 && n < BITCOUNT
API String ID: 2739980228-416841283
Opcode ID: 99d0254d89a6abc808eb31087cf52d3574c70eaa104251720cba6e683b7780ca
Instruction ID: 44799c5a9a0b8a35cbb20f85ce991336b3070759baff96eb95e5eac71830675b
Opcode Fuzzy Hash: 99d0254d89a6abc808eb31087cf52d3574c70eaa104251720cba6e683b7780ca
Instruction Fuzzy Hash: 1412B336A0DB8686EB10EF24E8802B9B7E5FB44764F944236DA4D437A4DFBCE465C310

Function 00007FF7C1896EC0 Relevance: 14.3, Strings: 11, Instructions: 524COMMON

Download Yara Rule

Strings

key != ImGuiKey_None, xrefs: 00007FF7C189713B
0 && "Unknown event!", xrefs: 00007FF7C189746A
it >= Data && it < Data + Size && it_last >= it && it_last <= Data + Size, xrefs: 00007FF7C18975C8
i >= 0 && i < Size, xrefs: 00007FF7C1896F7B, 00007FF7C1897345, 00007FF7C1897515
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7C1897043, 00007FF7C1897134, 00007FF7C1897463
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7C1896F74, 00007FF7C189733E, 00007FF7C189750E, 00007FF7C18975C1
C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF7C189718C, 00007FF7C1897270
Processed, xrefs: 00007FF7C18974F9
button >= 0 && button < ImGuiMouseButton_COUNT, xrefs: 00007FF7C189704A
n >= 0 && n < BITCOUNT, xrefs: 00007FF7C1897193, 00007FF7C1897277
Remaining, xrefs: 00007FF7C1897525

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID: 0 && "Unknown event!"$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$C:\Users\55yar\Desktop\imgui-master\imgui.h$C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$Processed$Remaining$button >= 0 && button < ImGuiMouseButton_COUNT$i >= 0 && i < Size$it >= Data && it < Data + Size && it_last >= it && it_last <= Data + Size$key != ImGuiKey_None$n >= 0 && n < BITCOUNT
API String ID: 0-1923509833
Opcode ID: 1ed67802044e51be6d7839670f05d2371b5f64d9626a24ad05dad900cbb79e92
Instruction ID: 99a2c0b9d5269ea2850df4bf06af53baa12550eea9e149da4ba2e0701eea3781
Opcode Fuzzy Hash: 1ed67802044e51be6d7839670f05d2371b5f64d9626a24ad05dad900cbb79e92
Instruction Fuzzy Hash: 4142E262B0C3C286EB68AF25A5503B9BBD0FB42764F844135DA9D47684DBBCF474CB20

Function 00007FF7C18DC628 Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7C18DC644
00007FFB1E6719C0.VCRUNTIME140 ref: 00007FF7C18DC668
RtlCaptureContext.KERNEL32 ref: 00007FF7C18DC671
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7C18DC68B
RtlVirtualUnwind.KERNEL32 ref: 00007FF7C18DC6CC
00007FFB1E6719C0.VCRUNTIME140 ref: 00007FF7C18DC6FF
IsDebuggerPresent.KERNEL32 ref: 00007FF7C18DC720
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7C18DC73D
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7C18DC748

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007E6719ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 2277577599-0
Opcode ID: c688bddeaeefac873e56668a93d44276559217fb76c9b2df63bf723872700d1b
Instruction ID: 57f46b9a122f45fdacb816be445bf0f60dd589ca942910c924e5b046b3cbc5da
Opcode Fuzzy Hash: c688bddeaeefac873e56668a93d44276559217fb76c9b2df63bf723872700d1b
Instruction Fuzzy Hash: A0315272618B8286EB60AF60E8403EDB3B1FB84764F84443ADA4E47B95DF7CD558C720

Function 00007FF7C18A1C20 Relevance: 12.1, APIs: 8, Instructions: 87clipboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C18810A0: 00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C188112E

OpenClipboard.USER32 ref: 00007FF7C18A1C38
GetClipboardData.USER32 ref: 00007FF7C18A1C55
CloseClipboard.USER32 ref: 00007FF7C18A1C63

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: Clipboard$00007CloseDataF020Open
String ID:
API String ID: 2409120337-0
Opcode ID: 4f80a7dd8e70029c47bd5bee4d5a62c6acc5d586712dd20aedd815bcf88934c7
Instruction ID: fd2444b8ae52c43ebb1a507f87df3e9de3b8801b43ce6d66bc642f96f96b6455
Opcode Fuzzy Hash: 4f80a7dd8e70029c47bd5bee4d5a62c6acc5d586712dd20aedd815bcf88934c7
Instruction Fuzzy Hash: 4731723270CB4287E754AF25B80415AA6E5FB89BB0F940534EE8D47794DF7CE4618720

Function 00007FF7C189E1C0 Relevance: 10.5, Strings: 8, Instructions: 475COMMON

Download Yara Rule

Strings

!scoring_rect.IsInverted(), xrefs: 00007FF7C189E9E4
[nav] NavMoveRequest: clamp NavRectRel for gamepad move, xrefs: 00007FF7C189E6AF
<NULL>, xrefs: 00007FF7C189E522
g.NavMoveFlags & ImGuiNavMoveFlags_Forwarded, xrefs: 00007FF7C189E28D
[nav] NavInitRequest: from move, window "%s", layer=%d, xrefs: 00007FF7C189E530
g.NavMoveDir != ImGuiDir_None && g.NavMoveClipDir != ImGuiDir_None, xrefs: 00007FF7C189E264
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7C189E25D, 00007FF7C189E286, 00007FF7C189E9DD
[nav] NavMoveRequestForward %d, xrefs: 00007FF7C189E2A9

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID: !scoring_rect.IsInverted()$<NULL>$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$[nav] NavInitRequest: from move, window "%s", layer=%d$[nav] NavMoveRequest: clamp NavRectRel for gamepad move$[nav] NavMoveRequestForward %d$g.NavMoveDir != ImGuiDir_None && g.NavMoveClipDir != ImGuiDir_None$g.NavMoveFlags & ImGuiNavMoveFlags_Forwarded
API String ID: 0-1751011103
Opcode ID: 616e74a7204e9dce75e279fc66c1a8e3481e8fb7dc9d7603612969489961d151
Instruction ID: 1ac745690aa335bff4dbdcab4c764ffb1dbedff8e7e7f1c1f13f3cb5f4d986ad
Opcode Fuzzy Hash: 616e74a7204e9dce75e279fc66c1a8e3481e8fb7dc9d7603612969489961d151
Instruction Fuzzy Hash: 2132EB32D1CBCA46E352AF3680412F9B790EF697B4F588731DE58362E1DF6875A18630

Function 00007FF7C18A96B0 Relevance: 10.4, Strings: 8, Instructions: 438COMMON

Download Yara Rule

Strings

dy >= 0, xrefs: 00007FF7C18A9977
x >= 0 && x < len, xrefs: 00007FF7C18A98CE
C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h, xrefs: 00007FF7C18A9742, 00007FF7C18A9808, 00007FF7C18A98C7, 00007FF7C18A9970, 00007FF7C18A9993, 00007FF7C18A9B43, 00007FF7C18A9B6F
sy1 > y_final-0.01f, xrefs: 00007FF7C18A9B76
fabsf(area) <= 1.01f, xrefs: 00007FF7C18A9B4A
e->sy <= y_bottom && e->ey >= y_top, xrefs: 00007FF7C18A980F
e->ey >= y_top, xrefs: 00007FF7C18A9749
dx >= 0, xrefs: 00007FF7C18A999A

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h$dx >= 0$dy >= 0$e->ey >= y_top$e->sy <= y_bottom && e->ey >= y_top$fabsf(area) <= 1.01f$sy1 > y_final-0.01f$x >= 0 && x < len
API String ID: 0-3568222241
Opcode ID: a88b8822a652a6a58d3c13b7e93a3326d83c4615cbc288f37a7b030f3c75b75f
Instruction ID: aa31fbcbea16ba5685e75c349d5bdbebec1c08a151af02ad779a4f92ceef4b20
Opcode Fuzzy Hash: a88b8822a652a6a58d3c13b7e93a3326d83c4615cbc288f37a7b030f3c75b75f
Instruction Fuzzy Hash: 7F12DB22D1CF8D86E312AF3754820B5E290AFBF3A4F59D732F948315B2DF6C61A19610

Function 00007FF7C18A6C90 Relevance: 9.6, APIs: 4, Strings: 1, Instructions: 830COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h, xrefs: 00007FF7C18A71E5

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h
API String ID: 0-2705777111
Opcode ID: edfeb65d1308a1a2c81e6d4701ec9977621ea4772a7802d1cdbd828d6ad7ee2b
Instruction ID: c0d3c87a37e426ec4993d3c905ce47a3caa8bd44b7e1ab3bb9080ab314beb4bf
Opcode Fuzzy Hash: edfeb65d1308a1a2c81e6d4701ec9977621ea4772a7802d1cdbd828d6ad7ee2b
Instruction Fuzzy Hash: E9728C23A1CBE846D3039F3690422B9B7E1EF6E794F59C333ED44A2661EB38E5518700

Function 00007FF7C18BCDD0 Relevance: 9.0, Strings: 7, Instructions: 237COMMON

Download Yara Rule

Strings

p >= Data && p < DataEnd, xrefs: 00007FF7C18BCE53, 00007FF7C18BCEE5, 00007FF7C18BCF83, 00007FF7C18BD090
*Missing Text*, xrefs: 00007FF7C18BCE76
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7C18BD133
<Unknown>, xrefs: 00007FF7C18BD0B9
(0) && "Calling PopItemFlag() too many times!", xrefs: 00007FF7C18BD13A
C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF7C18BCE4C, 00007FF7C18BCEDE, 00007FF7C18BCF7C, 00007FF7C18BD089
Calling PopItemFlag() too many times!, xrefs: 00007FF7C18BD11D

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID: (0) && "Calling PopItemFlag() too many times!"$*Missing Text*$<Unknown>$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$Calling PopItemFlag() too many times!$p >= Data && p < DataEnd
API String ID: 0-3275063505
Opcode ID: e4eb3a359b1981c674d1e108ddc2ebf9e4a2e7cc717a12fab28e3b0eef34b5ea
Instruction ID: a7769ece1e384d83d5493b551ac5a3504c4469ae165f4224202bd64c650941c7
Opcode Fuzzy Hash: e4eb3a359b1981c674d1e108ddc2ebf9e4a2e7cc717a12fab28e3b0eef34b5ea
Instruction Fuzzy Hash: E7B1D132A0CB8291EB60EF14D9402A9A7E1FB41BB8F844176DE4C07795DFBCE865C760

Function 00007FF7C189D620 Relevance: 8.1, Strings: 6, Instructions: 635COMMON

Download Yara Rule

Strings

g.NavMoveDir == ImGuiDir_None, xrefs: 00007FF7C189DDE0
g.NavLayer == ImGuiNavLayer_Main || g.NavLayer == ImGuiNavLayer_Menu, xrefs: 00007FF7C189D94C
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7C189D945, 00007FF7C189DD34, 00007FF7C189DDD9, 00007FF7C189DF0A
[nav] NavInitRequest: ApplyResult: NavID 0x%08X in Layer %d Window "%s", xrefs: 00007FF7C189D837
g.NavWindow != 0, xrefs: 00007FF7C189DF11
g.NavActivateDownId == g.NavActivateId, xrefs: 00007FF7C189DD3B

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$[nav] NavInitRequest: ApplyResult: NavID 0x%08X in Layer %d Window "%s"$g.NavActivateDownId == g.NavActivateId$g.NavLayer == ImGuiNavLayer_Main || g.NavLayer == ImGuiNavLayer_Menu$g.NavMoveDir == ImGuiDir_None$g.NavWindow != 0
API String ID: 0-2167808928
Opcode ID: 50a410fa7a85a90cac139f97951d64da551fdd238b8ea691b949dc80aa3e0e2c
Instruction ID: c155a3ef482a7536087fc1b44c9cc2c28e6c4eee8c25b80aca0ceae6dab55655
Opcode Fuzzy Hash: 50a410fa7a85a90cac139f97951d64da551fdd238b8ea691b949dc80aa3e0e2c
Instruction Fuzzy Hash: 69729B32E0C6C289E765AF35C0443B9AAD1EF45B79F884335DA58172E1CBF878A5C720

Function 00007FF7C18BF9E0 Relevance: 8.0, Strings: 6, Instructions: 493COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7C18C0028
C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF7C18BFCFF, 00007FF7C18C0051, 00007FF7C18C00F9
id != 0, xrefs: 00007FF7C18BFB9B
button >= 0 && button < ((int)(sizeof(g.IO.MouseDown) / sizeof(*(g.IO.MouseDown)))), xrefs: 00007FF7C18C002F
button >= 0 && button < ImGuiMouseButton_COUNT, xrefs: 00007FF7C18BFD06, 00007FF7C18C0058, 00007FF7C18C0100
C:\Users\55yar\Desktop\imgui-master\imgui_widgets.cpp, xrefs: 00007FF7C18BFB94

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$C:\Users\55yar\Desktop\imgui-master\imgui_widgets.cpp$button >= 0 && button < ((int)(sizeof(g.IO.MouseDown) / sizeof(*(g.IO.MouseDown))))$button >= 0 && button < ImGuiMouseButton_COUNT$id != 0
API String ID: 0-2768765550
Opcode ID: c83ec724d9ec7e2db4255f0bedf28826b5c2049c68488d60edb634a86f50e9d0
Instruction ID: b87405ffa440233ad082c21e14655130184063ffe297e92110332319a9d3fcd1
Opcode Fuzzy Hash: c83ec724d9ec7e2db4255f0bedf28826b5c2049c68488d60edb634a86f50e9d0
Instruction Fuzzy Hash: 9F22D032E0C28646EB69AE2594503B9F7D1AF467B4F884275DE59172D2CFBCB8708720

Function 00007FF7C188DFB0 Relevance: 7.2, Strings: 5, Instructions: 977COMMON

Download Yara Rule

Strings

6, xrefs: 00007FF7C188E607
5, xrefs: 00007FF7C188E62E
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7C188E70D, 00007FF7C188E77B, 00007FF7C188E903, 00007FF7C188E944, 00007FF7C188E986, 00007FF7C188E9C0, 00007FF7C188EA27, 00007FF7C188EA5C, 00007FF7C188EA87, 00007FF7C188EAB9
idx == 0 || idx == 1, xrefs: 00007FF7C188E714, 00007FF7C188E782, 00007FF7C188E90A, 00007FF7C188E94B, 00007FF7C188E98D, 00007FF7C188E9C7, 00007FF7C188EA2E, 00007FF7C188EA63, 00007FF7C188EA8E, 00007FF7C188EAC0
#RESIZE, xrefs: 00007FF7C188E142

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID: #RESIZE$5$6$C:\Users\55yar\Desktop\imgui-master\imgui.h$idx == 0 || idx == 1
API String ID: 0-650503096
Opcode ID: 240daf669a9bafcbcedf6166f787f1416c004a1cd6fa2f3e4bb0a79944367b7c
Instruction ID: df494e882dfde7a2a19cb83b8b4c7e46452f6716b576bb80a3553ae3f52d852b
Opcode Fuzzy Hash: 240daf669a9bafcbcedf6166f787f1416c004a1cd6fa2f3e4bb0a79944367b7c
Instruction Fuzzy Hash: 52B21732D1C78985F352EF3694412B9B7A0EF5A374F588731EA48279A1DF78B494CB20

Function 00007FF7C18BD530 Relevance: 6.4, Strings: 5, Instructions: 140COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF7C18BD5AF
settings->ColumnsCount == table->ColumnsCount && settings->ColumnsCountMax >= settings->ColumnsCount, xrefs: 00007FF7C18BD617
settings->ID == table->ID, xrefs: 00007FF7C18BD5EE
C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp, xrefs: 00007FF7C18BD5E7, 00007FF7C18BD610
p >= begin() && p < end(), xrefs: 00007FF7C18BD5B6

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp$p >= begin() && p < end()$settings->ColumnsCount == table->ColumnsCount && settings->ColumnsCountMax >= settings->ColumnsCount$settings->ID == table->ID
API String ID: 0-2168725360
Opcode ID: ee471b1d82bd3160a00610b93ddc27c37a03770945cf0a57a55015e5da5f3d14
Instruction ID: 743c02e766520c522b07aa22c686bc6dc6c78356a4391664b95b7b1517bc0358
Opcode Fuzzy Hash: ee471b1d82bd3160a00610b93ddc27c37a03770945cf0a57a55015e5da5f3d14
Instruction Fuzzy Hash: D861D23390C6C296DB51DF25E8842A9B7E0FB01768F88C536DB8D472A1DB7CE559CB20

Function 00007FF7C18DC8B8 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7C18DC8E4
GetCurrentThreadId.KERNEL32 ref: 00007FF7C18DC8F2
GetCurrentProcessId.KERNEL32 ref: 00007FF7C18DC8FE
QueryPerformanceCounter.KERNEL32 ref: 00007FF7C18DC90E

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: ea28d440da4e979608dc7e616e30e56526e81ae9f67b9b208852c015bdb344e1
Instruction ID: 4f6bb0a6bc1a7b1a060363e583330952b74256eb2b50bc62f8b81ad44faf0f92
Opcode Fuzzy Hash: ea28d440da4e979608dc7e616e30e56526e81ae9f67b9b208852c015bdb344e1
Instruction Fuzzy Hash: 3A112122B18F0289EB00EF60E8542B873A4FB59778F440E35DA6D46798DF7CD5658350

Function 00007FF7C189FA00 Relevance: 5.6, Strings: 4, Instructions: 628COMMON

Download Yara Rule

Strings

shared_mods != 0, xrefs: 00007FF7C189FEB3
GImGui != 0, xrefs: 00007FF7C18A00D7, 00007FF7C18A0133
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7C189FEAC, 00007FF7C18A00D0, 00007FF7C18A012C
##NavUpdateWindowing, xrefs: 00007FF7C189FAE6

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID: ##NavUpdateWindowing$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$GImGui != 0$shared_mods != 0
API String ID: 0-1670481530
Opcode ID: 360b769d1a2fdec6627b6b08fcd4e9414ce7f2e576724d62d04151109e8b5536
Instruction ID: d6bdee042a299fd8d94ab59c32dac10cb6d5a7ea14b132e463ec447fbc06e23d
Opcode Fuzzy Hash: 360b769d1a2fdec6627b6b08fcd4e9414ce7f2e576724d62d04151109e8b5536
Instruction Fuzzy Hash: 9062A222A0C78696E759AF3181443BDA6D1FF55778F888235CA5D132D2DFACB8B4C720

Function 00007FF7C18ABFC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 203COMMON

Download Yara Rule

APIs

00007FFB1E6719C0.VCRUNTIME140 ref: 00007FF7C18AC01A

Strings

C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h, xrefs: 00007FF7C18AC1EE
pixels[i*stride_in_bytes] == 0, xrefs: 00007FF7C18AC1F5

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007E6719
String ID: C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h$pixels[i*stride_in_bytes] == 0
API String ID: 1823926093-15633718
Opcode ID: fc9bdb31b49db41d9048269f0056432805a2286ecc5246c3cfab3adad49f64b9
Instruction ID: 7d41029af0e0a00d9fe642e5a9ddbb0cf6e631e0eec82b164ab18b88213ce08e
Opcode Fuzzy Hash: fc9bdb31b49db41d9048269f0056432805a2286ecc5246c3cfab3adad49f64b9
Instruction Fuzzy Hash: 59710673B0C6A247D3269B2CA84136EFED1B789764F5C4235EAC9C2B45CA7CE521CA50

Function 00007FF7C18ABD10 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 196COMMON

Download Yara Rule

APIs

00007FFB1E6719C0.VCRUNTIME140 ref: 00007FF7C18ABD7A

Strings

C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h, xrefs: 00007FF7C18ABF4D
pixels[i] == 0, xrefs: 00007FF7C18ABF54

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007E6719
String ID: C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h$pixels[i] == 0
API String ID: 1823926093-2060079458
Opcode ID: c264afed42174643e985218cfa408d0faf0002bce259567f4b919d414c4abda1
Instruction ID: def15fb58439d94c53b8a2c5c919eb5521c606b3a6641b6efaad26810c4332ac
Opcode Fuzzy Hash: c264afed42174643e985218cfa408d0faf0002bce259567f4b919d414c4abda1
Instruction Fuzzy Hash: CC71C37362C6E686C721CF79984467AFFE5E785724F484239EA8C82B45CA7ED124CB10

Function 00007FF7C188FBB0 Relevance: 5.4, Strings: 4, Instructions: 420COMMON

Download Yara Rule

Strings

#COLLAPSE, xrefs: 00007FF7C188FDAE
Size > 0, xrefs: 00007FF7C188FD39, 00007FF7C188FF66
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7C188FD32, 00007FF7C188FF5F
#CLOSE, xrefs: 00007FF7C188FFDA

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID: #CLOSE$#COLLAPSE$C:\Users\55yar\Desktop\imgui-master\imgui.h$Size > 0
API String ID: 0-766050946
Opcode ID: 1126328c5b21c693ac038cd1df2188b2ff28e9b00e29aeb85db486171dcffa84
Instruction ID: 586bfb9088238ef4734844182aaf97ab74f34be91d4d22a19ea160bbabed63af
Opcode Fuzzy Hash: 1126328c5b21c693ac038cd1df2188b2ff28e9b00e29aeb85db486171dcffa84
Instruction Fuzzy Hash: C3121932E1CB8985F311DF3290416F9B3E0AF6A3B4F549732EE48236A1DF69A495C750

Function 00007FF7C18C0DE0 Relevance: 5.4, Strings: 4, Instructions: 420COMMON

Download Yara Rule

Strings

ImMax(size_contents_v, size_visible_v) > 0.0f, xrefs: 00007FF7C18C1000
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7C18C111A, 00007FF7C18C1152
idx == 0 || idx == 1, xrefs: 00007FF7C18C1121, 00007FF7C18C1159
C:\Users\55yar\Desktop\imgui-master\imgui_widgets.cpp, xrefs: 00007FF7C18C0FF9

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$C:\Users\55yar\Desktop\imgui-master\imgui_widgets.cpp$ImMax(size_contents_v, size_visible_v) > 0.0f$idx == 0 || idx == 1
API String ID: 0-3128625980
Opcode ID: b79e59873a2d6d86e0f324a7f6a030a3696cd852f2a3f58e1130bf7054de911f
Instruction ID: 671b84ba6e3e7ca32cd75e43afebbc18feac7f189d8b9b08f0279eb09d8814fe
Opcode Fuzzy Hash: b79e59873a2d6d86e0f324a7f6a030a3696cd852f2a3f58e1130bf7054de911f
Instruction Fuzzy Hash: 2E12E732D1CBC985E312EA3750812B9E791AFAF7A4F5CC732ED58325A1DB6CB491C610

Function 00007FF7C18C2A00 Relevance: 5.3, Strings: 4, Instructions: 302COMMON

Download Yara Rule

Strings

##v, xrefs: 00007FF7C18C2A6E, 00007FF7C18C2ECF
#ComboPopup, xrefs: 00007FF7C18C2C31
i >= 0 && i < Size, xrefs: 00007FF7C18C2CAA
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7C18C2CA3

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID: ##v$#ComboPopup$C:\Users\55yar\Desktop\imgui-master\imgui.h$i >= 0 && i < Size
API String ID: 0-2429816084
Opcode ID: 896d9a7eb4ff265f7d9a372d651be776c216d9fd4f77bbaffeda6aa337f1ec2a
Instruction ID: c57e97fd274ad07c4f2c5b0d3a5b7d21bbcd2a3d8c02d487a8cb78c32bf88076
Opcode Fuzzy Hash: 896d9a7eb4ff265f7d9a372d651be776c216d9fd4f77bbaffeda6aa337f1ec2a
Instruction Fuzzy Hash: B4E1F732E18B8989E711DF3694401EDB3A1FF69368F449732EE08375E5DF68A065D710

Function 00007FF7C18CC310 Relevance: 4.1, Strings: 3, Instructions: 301COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7C18CC8C4
(0) && "Calling PopItemFlag() too many times!", xrefs: 00007FF7C18CC8CB
Calling PopItemFlag() too many times!, xrefs: 00007FF7C18CC8AE

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID: (0) && "Calling PopItemFlag() too many times!"$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$Calling PopItemFlag() too many times!
API String ID: 0-102052167
Opcode ID: d533dedf91d6cb1dc57bdba6c40da6b5cd47abdc815c8fb68137785444874cbe
Instruction ID: 71d86e02d0079176ed421eedcd1de9d69a6377ffe2d85d90988b35081576c18b
Opcode Fuzzy Hash: d533dedf91d6cb1dc57bdba6c40da6b5cd47abdc815c8fb68137785444874cbe
Instruction Fuzzy Hash: 87E1B53191CAC985E322AF3690413F9F390EF99764F489332EA48265A1DFADA4A5C710

Function 00007FF7C1885D90 Relevance: 3.6, APIs: 2, Instructions: 579COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7C18ACE80: 00007FFB1E6719C0.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000023D0B271FE0,00007FF7C1885C91), ref: 00007FF7C18ACFE7
Part of subcall function 00007FF7C18ACE80: 00007FFB2ADBA0D0.API-MS-WIN-CRT-MATH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000023D0B271FE0,00007FF7C1885C91), ref: 00007FF7C18AD044

00007FFB1E6719C0.VCRUNTIME140 ref: 00007FF7C188640C
00007FFB1E6719C0.VCRUNTIME140 ref: 00007FF7C1886BAF

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007$E6719
String ID:
API String ID: 2352233328-0
Opcode ID: 9e4317997261937fea7a7ee8b6c161e0b27ad81cbb1ca3eaf5bda0d117835ba9
Instruction ID: 5bbfe1517637d42c28442b15c7a17e04c1774529eeb9c7f49056a9cdc9631cd9
Opcode Fuzzy Hash: 9e4317997261937fea7a7ee8b6c161e0b27ad81cbb1ca3eaf5bda0d117835ba9
Instruction Fuzzy Hash: C5828173815BC187D328CF30B9981DAB7A8FB55350F105219DBF622A61DB78F1A6E708

Function 00007FF7C18AB1E0 Relevance: 3.3, APIs: 2, Instructions: 255COMMON

Download Yara Rule

APIs

00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18AB53F
00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18AB5C0

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007F020
String ID:
API String ID: 2739980228-0
Opcode ID: a901a21fe380d731cddb8a90d61eee48211ebf7b2a1aaf05e539e712814af4b7
Instruction ID: 89a2132821ba0c8cdcd907188c2f7f92dcda4b4a6c5d4525019afbe46d49d493
Opcode Fuzzy Hash: a901a21fe380d731cddb8a90d61eee48211ebf7b2a1aaf05e539e712814af4b7
Instruction Fuzzy Hash: BAB11733A18AD586E321EF3590442BEF7E4FF58BA4F448332EB8552654EB78E492C710

Function 00007FF7C18D105B Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GetKeyboardLayout.USER32 ref: 00007FF7C18D105D
GetLocaleInfoA.KERNEL32 ref: 00007FF7C18D1079

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: InfoKeyboardLayoutLocale
String ID:
API String ID: 1218629382-0
Opcode ID: f283ab7825a6475dc086a71a2a168ceadd91aec4ad0de022f7e24bf4c51d4291
Instruction ID: 5fdb0da35d64060e687af15b2baad19422f4dddf390e2538791afcaeba73ddb7
Opcode Fuzzy Hash: f283ab7825a6475dc086a71a2a168ceadd91aec4ad0de022f7e24bf4c51d4291
Instruction Fuzzy Hash: 0BF0A022718A8686E762AF66A4002AAF3D4FB48774F94403BCF8D53350DE7DD893C710

Function 00007FF7C189C250 Relevance: 2.8, Strings: 2, Instructions: 281COMMON

Download Yara Rule

Strings

(window->ChildFlags | g.NavWindow->ChildFlags) & ImGuiChildFlags_NavFlattened, xrefs: 00007FF7C189C2E4
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7C189C2DD

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID: (window->ChildFlags | g.NavWindow->ChildFlags) & ImGuiChildFlags_NavFlattened$C:\Users\55yar\Desktop\imgui-master\imgui.cpp
API String ID: 0-3836044477
Opcode ID: 59a3e0b9d0ed32fc26bab3bb040e05495808e826a9946ae6e3f556fdb2d6b851
Instruction ID: a4e1c4dfe46d5c8e17d117e022fb1ad93f9cdfe4902efacc54adb95442ae27a7
Opcode Fuzzy Hash: 59a3e0b9d0ed32fc26bab3bb040e05495808e826a9946ae6e3f556fdb2d6b851
Instruction Fuzzy Hash: E0D1E523D0CA8E81E3237A3740420B9F3D0AF6E3B5F589736FD58361A1DB9A75A54660

Function 00007FF7C18A7EF0 Relevance: 2.7, Strings: 2, Instructions: 225COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h, xrefs: 00007FF7C18A8FAD
!(o > b->size || o < 0), xrefs: 00007FF7C18A8FB4

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID: !(o > b->size || o < 0)$C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h
API String ID: 0-2013812653
Opcode ID: 0d476810ee24973e4687efe328c80034deff5b45b82e8c1e7edba5a50064980d
Instruction ID: ec9aa0f088a01a34c834ad61157d4743572c518123289671ae1e413f7d78033c
Opcode Fuzzy Hash: 0d476810ee24973e4687efe328c80034deff5b45b82e8c1e7edba5a50064980d
Instruction Fuzzy Hash: 12B1D132A0CAC48AE701DF7A90401BDBBF0FB893A5F545335EF8922675DB78A591CB10

Function 00007FF7C18B59E0 Relevance: 2.6, Strings: 2, Instructions: 124COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp, xrefs: 00007FF7C18B5A28
text_end != 0, xrefs: 00007FF7C18B5A2F

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp$text_end != 0
API String ID: 0-48455972
Opcode ID: 08f38f8f42a20b6ae9d2cfd4b0838849bdb775e757d534d2916361f9775c9024
Instruction ID: 922acbc3b6dbb2c54461e4d26b2b590cc55156cabfae13d5615f47870572847f
Opcode Fuzzy Hash: 08f38f8f42a20b6ae9d2cfd4b0838849bdb775e757d534d2916361f9775c9024
Instruction Fuzzy Hash: DD41D811A0D75A86EB21ED239880179E691AF55BB0FD88732DD0C276D49BBCE4918B10

Function 00007FF7C18946F0 Relevance: 2.6, Strings: 2, Instructions: 79COMMON

Download Yara Rule

Strings

Size > 0, xrefs: 00007FF7C1894716
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7C189470F

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$Size > 0
API String ID: 0-1180621679
Opcode ID: 1e37af945958fdbbf9efb019e9e7f485eed15aa847ee9e907e7b1330e220a63a
Instruction ID: 89eff65ec01cd1302ece1b03bf9520ab856d458f57109479fcd52f9e96a31af2
Opcode Fuzzy Hash: 1e37af945958fdbbf9efb019e9e7f485eed15aa847ee9e907e7b1330e220a63a
Instruction Fuzzy Hash: 1931AE72B141E98BEB98CF62A850F797B60E3D6742B896131EF8417A48C63CD111CBA0

Function 00007FF7C1894620 Relevance: 2.6, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

Size > 0, xrefs: 00007FF7C189464F
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7C1894648

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$Size > 0
API String ID: 0-1180621679
Opcode ID: 1692b8b0b4d5c362798770ae27053444f645312b350ac7f61c9bf755d23bb4d4
Instruction ID: c07c06154faa8cf3da22706df563bdc971dba589d53164888d751f4d03e5fe0c
Opcode Fuzzy Hash: 1692b8b0b4d5c362798770ae27053444f645312b350ac7f61c9bf755d23bb4d4
Instruction Fuzzy Hash: 89110AB160869186E708CF61E8E007977E0F785791F81103BEBCE07645DE7CD191C760

Function 0000023D0FBF0FF0 Relevance: 1.7, Strings: 1, Instructions: 412COMMON

Download Yara Rule

Strings

@, xrefs: 0000023D0FBF1378

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 571b037c833f41477eab1f803613ee28cd15a9307d76852dee75fe241bfed66e
Instruction ID: c73843b55131a0efdfe486e10ee6e1e8d33891bf2f294fb9754f8729c57e02a7
Opcode Fuzzy Hash: 571b037c833f41477eab1f803613ee28cd15a9307d76852dee75fe241bfed66e
Instruction Fuzzy Hash: EEE1F07421CB888FE7A4DF18D45876AB7E1FB99305F20491DE48EC32A0DB78D885DB06

Function 00007FF7C18A54F0 Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h, xrefs: 00007FF7C18A5726

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID: C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h
API String ID: 0-2705777111
Opcode ID: 0e547a02c0faae0f31701a54dd046d557730ddebfdeab5f4b8c068a73400c959
Instruction ID: ac8df0f177b05cb9226476e7be562fb452d8085eaa63f7d3e6755b7f16145931
Opcode Fuzzy Hash: 0e547a02c0faae0f31701a54dd046d557730ddebfdeab5f4b8c068a73400c959
Instruction Fuzzy Hash: 735158A6B284B183DB20DF2AC8C15BC77D1E74A752FD48076D25CC2F91C62DC15A9F20

Function 00007FF7C18D3C00 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

\\.\VBoxMiniRdrDN, xrefs: 00007FF7C18D3CAD, 00007FF7C18D3CEB, 00007FF7C18D3D28

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: AcquireExclusiveLock
String ID: \\.\VBoxMiniRdrDN
API String ID: 4021432409-4073649278
Opcode ID: 4d59e053f126c934bbe87067bd4d078bce445e7bd00d98d7c2fa9bd51dfe6ad4
Instruction ID: d7e8e397911ceebf26f9dcc9c299e4b04ebe0d30198f0c411acd499569d0a6bd
Opcode Fuzzy Hash: 4d59e053f126c934bbe87067bd4d078bce445e7bd00d98d7c2fa9bd51dfe6ad4
Instruction Fuzzy Hash: 86316D2250CBC289D761EB2CA84425ABBA0A793374F940374F7EE477E9DB6CD101CB21

Function 00007FF7C18ADB50 Relevance: .9, Instructions: 868COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01177c0944c594afe8d2519272f25f100af435ea639e3592be59496485798271
Instruction ID: 16323632255ba6e0c3cf01a8141ccaee4f3ed5c6397913f0ad74eb7917049fe3
Opcode Fuzzy Hash: 01177c0944c594afe8d2519272f25f100af435ea639e3592be59496485798271
Instruction Fuzzy Hash: 54925F33928B8886C715CF37948116DBBA0FFADB94B19D716DE0823761EB35E4A4DB00

Function 00007FF7C18CA370 Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7056ad41baa53b0861df8fc1b3d75c338a12c52f935646fbc65459307e15986b
Instruction ID: 8b357af4b3ed0f0aff0409bdfb2fdd94039d46895b8389527512678a59537347
Opcode Fuzzy Hash: 7056ad41baa53b0861df8fc1b3d75c338a12c52f935646fbc65459307e15986b
Instruction Fuzzy Hash: 0B22A332E0C7858AE711DE7690503BEF7A0FB593B8F544335EE4826695EBBCA464CB10

Function 00007FF7C18AC270 Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27504f3df9fe3d2bcbeeb46f454de5265eb1ecadf1d403471eb2c49202ba0498
Instruction ID: c69ea13b2ad9baf47f7b12a0008affda1b03cc84f18602ba2f372066265d4258
Opcode Fuzzy Hash: 27504f3df9fe3d2bcbeeb46f454de5265eb1ecadf1d403471eb2c49202ba0498
Instruction Fuzzy Hash: 9702E332A186C48BD325CF369041679F7E0FF5DBA4F148336EA8963655EB38E5A1CB10

Function 00007FF7C18B6BC0 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7a4d81e31cc1f335a30e7f1e06cc74edf758b19acc56c80cb797eaa226930cd
Instruction ID: 176e12f7a6082f0317e0806fac03128ccc4d2713eadda583f5b01cfcd9eabfdb
Opcode Fuzzy Hash: c7a4d81e31cc1f335a30e7f1e06cc74edf758b19acc56c80cb797eaa226930cd
Instruction Fuzzy Hash: EC02ED23D1CB8986D311EE3694421B9F3A0FFAE3A4F645731FE44229A5DF69F0619B10

Function 00007FF7C18CBA80 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be17f392ea121d90e75c9b272ceadb28d56538019bb9e4878e4f70c653414feb
Instruction ID: 39149944aabcb91a3078366e29a6e9251ee060974c95d5dc72c2fd1749058ec0
Opcode Fuzzy Hash: be17f392ea121d90e75c9b272ceadb28d56538019bb9e4878e4f70c653414feb
Instruction Fuzzy Hash: 0FF1A532A0CB8286E771EE2590503B9B7E0EB55FB4F884135DE89076D5CBB9E855CB20

Function 00007FF7C1889730 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ce395c067b3fab69857288410e128d86538e75d917210ad2953944e45964f92
Instruction ID: 070bb7f973b7777b7cece2549e96efecfe11ac82c2345ff82b8fde6ebd09cabc
Opcode Fuzzy Hash: 1ce395c067b3fab69857288410e128d86538e75d917210ad2953944e45964f92
Instruction Fuzzy Hash: 2ED1C062D0D6C395FF66AE3540002B9B7D0AF92778F984135EE491A9C6CFBCA8619330

Function 00007FF7C18CE5B0 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d84135fe5031b75b4d8ac2960b53fb71714476753b43893bff389ca86a997f9
Instruction ID: 42c725d99a0496f59cf818d93e7e90402149fecae001cb8aa71138368349c82f
Opcode Fuzzy Hash: 4d84135fe5031b75b4d8ac2960b53fb71714476753b43893bff389ca86a997f9
Instruction Fuzzy Hash: 2AC14D36750B8982E7108F3BD454BAD67A1EB9EF98F09D231CE0A17B64DF7AD1458700

Function 00007FF7C18AAD40 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33a42b9f9b29d3832b029c47bcf8cdb7f01e3eef0a0307a1879daa4bfe730252
Instruction ID: e1c7ffd19c0481230f4ce1df78729a8efc6a7803b8ba0a87b30ddbb5965164c3
Opcode Fuzzy Hash: 33a42b9f9b29d3832b029c47bcf8cdb7f01e3eef0a0307a1879daa4bfe730252
Instruction Fuzzy Hash: 93B1A622E28FCC41E223AA3750821F5E250AF7F3D5F2DDB23FD8475AB2AB5961D15610

Function 00007FF7C1895A30 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15ba45cef193519d0e8a2cf2df657ba8e3e1ef1d8cacf801574288a9be6fea2f
Instruction ID: bd6eaa90a7f8599ef08f1a1bf9d74116c93a5fd2f3bf4ba42c0d4247117b8984
Opcode Fuzzy Hash: 15ba45cef193519d0e8a2cf2df657ba8e3e1ef1d8cacf801574288a9be6fea2f
Instruction Fuzzy Hash: 66D1C322D0E3C1C9E3519F3594407F87BD4FB66B68F4C827BDB8817686CB6864609B71

Function 00007FF7C189F250 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6877bc407da904a33211ddbdad51888c4838a2b73c3e89749f5d9815c1d3e555
Instruction ID: ffde2fc2a47944cb2276ba1c7850904b09df52dc6884b9a3ca0291c531577df8
Opcode Fuzzy Hash: 6877bc407da904a33211ddbdad51888c4838a2b73c3e89749f5d9815c1d3e555
Instruction Fuzzy Hash: FB91063291C68587E35AAF3590403FDBBE0FF04778F588376DA59161D5DBB875A08B20

Function 00007FF7C18DE050 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 648528a407e212a7f5a2beb008c6e8ef11472fc43ed2d5d1bde36790216f3e34
Instruction ID: 30eb593ccc0df632dca798ab862b691de12d64854e677112edbfd4912043f67f
Opcode Fuzzy Hash: 648528a407e212a7f5a2beb008c6e8ef11472fc43ed2d5d1bde36790216f3e34
Instruction Fuzzy Hash: 91311CA790EBC74BE3527E784C660697FD0BB96E3478E817AC284421C3E99A2C15C771

Function 00007FF7C18DE200 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f76b69e54d21ee0aea8ea25b6d29d9dd87d9392bb8614d28d55f211ad7c3c1d
Instruction ID: 8d5aeda3c4468e37c3a8c3bbcadd7bd9eb944eef9013cf07a238db053b930e97
Opcode Fuzzy Hash: 6f76b69e54d21ee0aea8ea25b6d29d9dd87d9392bb8614d28d55f211ad7c3c1d
Instruction Fuzzy Hash: 6521DE87D4D7C71DF7EA7E641CAA438AFC0DBA2A31BCD4579F2C8021C3988969258771

Function 00007FF7C18DE0B0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36ee239c5d24e46cdd60b743f7756e6b305d80beccbf515749a4b6e0d5898f4c
Instruction ID: 8efe81b674044060ef540dd6e2ed909a186920d40193c506a0d7474432a7d634
Opcode Fuzzy Hash: 36ee239c5d24e46cdd60b743f7756e6b305d80beccbf515749a4b6e0d5898f4c
Instruction Fuzzy Hash: C101CCA790EBC34BE3533E784D5A0197FD0BB95E2478E817AC384421C7E99A2C15C732

Function 00007FF7C18DE0C0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a422d00b7dd0fd14525c5c1af7926a5ef345e25b0c1d376ef78f2dd52a3de787
Instruction ID: 1ac1175e5c213a103c36fe6ac33a48b88bf9cc72f0b8133b7bbc759494c07441
Opcode Fuzzy Hash: a422d00b7dd0fd14525c5c1af7926a5ef345e25b0c1d376ef78f2dd52a3de787
Instruction Fuzzy Hash: CCF0E1A790EBC24BE3523E7888661597FD0BB91E2078E807AD284421C7ED9A2C15C772

Function 00007FF7C18DE0D0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3ea30ebda66b848019ad8e19e71a2c59527ec1bc90ae7bae2b6b1a2228ddcf9
Instruction ID: 57f1dc0f6e9746295eb4caa9197501df34d7b2584d478b62c06df6688c71e486
Opcode Fuzzy Hash: e3ea30ebda66b848019ad8e19e71a2c59527ec1bc90ae7bae2b6b1a2228ddcf9
Instruction Fuzzy Hash: FFF0D0A790EBC64BF3523E7889560197FD0BB55E3078E8079C284021C7E9992C158331

Function 00007FF7C18DE0A0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f801bfde92b589c3a6d53c17ddcd4892fa86ee7eb976dc1f946df16b7269d6e
Instruction ID: eb61445867441c150f99d4ff4aab3d9140ac7fb9988d7b1424a8b8cdb021d597
Opcode Fuzzy Hash: 2f801bfde92b589c3a6d53c17ddcd4892fa86ee7eb976dc1f946df16b7269d6e
Instruction Fuzzy Hash: 33E0C99790EBC64AE3532E384CA50197F90BA9292478E81BAC284431C7E88D2C15C732

Function 00007FF7C18DE278 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21c79f8d4b1a295e38c2abf4fbd9cca6c3c5ba9f495910fed74b6d6a85d07fda
Instruction ID: f7118079c3a338a18b7a3944f13fc7f5bb145a072c5f55ae06d92256a2c9fd4f
Opcode Fuzzy Hash: 21c79f8d4b1a295e38c2abf4fbd9cca6c3c5ba9f495910fed74b6d6a85d07fda
Instruction Fuzzy Hash: C3C0924BC0CA470EFAB4783808FAAE48BC4EF73270F894631F558834D11A8A39234270

Function 00007FF7C18DC80C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 629e4b8bc268abd5ff6f1821ab861a0b50d73f20c8cb0795d9f958efeeda9d3b
Instruction ID: 0ac6a22c403f10194fcbdceacb29358cda26580ba9ae4d2f5eb3bb804b3ecb45
Opcode Fuzzy Hash: 629e4b8bc268abd5ff6f1821ab861a0b50d73f20c8cb0795d9f958efeeda9d3b
Instruction Fuzzy Hash: B9A0012191CA0390EB04BF00A851920A2E1BB50370B808475C04D414609FACA821C320

Function 0000023D0FB04850 Relevance: 36.9, APIs: 1, Strings: 20, Instructions: 159COMMON

Download Yara Rule

APIs

Part of subcall function 0000023D0FB05360: _WChar_traits.LIBCPMTD ref: 0000023D0FB0538D

Part of subcall function 0000023D0FB04AA0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FB04AD0
Part of subcall function 0000023D0FB04AA0: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 0000023D0FB04B2F
Part of subcall function 0000023D0FB04AA0: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FB04B41

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 0000023D0FB048B8

Strings

, xrefs: 0000023D0FB0490A
K, xrefs: 0000023D0FB0490F
g, xrefs: 0000023D0FB048FB
a, xrefs: 0000023D0FB04928
a, xrefs: 0000023D0FB04932
M, xrefs: 0000023D0FB048F1
a, xrefs: 0000023D0FB048F6
i, xrefs: 0000023D0FB04900
D, xrefs: 0000023D0FB04923
l, xrefs: 0000023D0FB04941
y, xrefs: 0000023D0FB04919
e, xrefs: 0000023D0FB04914
B, xrefs: 0000023D0FB0493C
KDBM, xrefs: 0000023D0FB049A9
t, xrefs: 0000023D0FB0492D
, xrefs: 0000023D0FB04937
, xrefs: 0000023D0FB0491E
b, xrefs: 0000023D0FB0494B
c, xrefs: 0000023D0FB04905
o, xrefs: 0000023D0FB04946

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Concurrency::details::_CriticalEmptyLock::_Queue::ReentrantScoped_lockScoped_lock::~_StructuredWork$Char_traits
String ID: $ $ $B$D$K$KDBM$M$a$a$a$b$c$e$g$i$l$o$t$y
API String ID: 1777712374-1292890139
Opcode ID: b2d997a1cd0057e47c91f10b8e029a4fbb281733a314e99ff4f758cdf7aee981
Instruction ID: 9e3e360875220711aa5d01d297727dbcae331bf1e6df04bc7ef379f6b2bb6fdb
Opcode Fuzzy Hash: b2d997a1cd0057e47c91f10b8e029a4fbb281733a314e99ff4f758cdf7aee981
Instruction Fuzzy Hash: 6261F93050CB848FE765EB68C448B9ABBE1FBA5304F14492DA0C9C7261DBB9D489CB53

Function 00007FF7C1897C60 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 76COMMON

Download Yara Rule

APIs

00007FFB2ADB5630.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C1897C8F
00007FFB2ADB5630.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7C1897CA4

Strings

1.91.6 WIP, xrefs: 00007FF7C1897C80, 00007FF7C1897C98
sz_idx == sizeof(ImDrawIdx) && "Mismatched struct layout!", xrefs: 00007FF7C1897D90
sz_vec4 == sizeof(ImVec4) && "Mismatched struct layout!", xrefs: 00007FF7C1897D48
sz_vec2 == sizeof(ImVec2) && "Mismatched struct layout!", xrefs: 00007FF7C1897D24
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7C1897CB3, 00007FF7C1897CD6, 00007FF7C1897CFB, 00007FF7C1897D1D, 00007FF7C1897D41, 00007FF7C1897D65, 00007FF7C1897D89
sz_vert == sizeof(ImDrawVert) && "Mismatched struct layout!", xrefs: 00007FF7C1897D6C
sz_io == sizeof(ImGuiIO) && "Mismatched struct layout!", xrefs: 00007FF7C1897CDD
strcmp(version, "1.91.6 WIP") == 0 && "Mismatched version string!", xrefs: 00007FF7C1897CBA
sz_style == sizeof(ImGuiStyle) && "Mismatched struct layout!", xrefs: 00007FF7C1897D02

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007B5630
String ID: 1.91.6 WIP$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$strcmp(version, "1.91.6 WIP") == 0 && "Mismatched version string!"$sz_idx == sizeof(ImDrawIdx) && "Mismatched struct layout!"$sz_io == sizeof(ImGuiIO) && "Mismatched struct layout!"$sz_style == sizeof(ImGuiStyle) && "Mismatched struct layout!"$sz_vec2 == sizeof(ImVec2) && "Mismatched struct layout!"$sz_vec4 == sizeof(ImVec4) && "Mismatched struct layout!"$sz_vert == sizeof(ImDrawVert) && "Mismatched struct layout!"
API String ID: 2248877218-1295771896
Opcode ID: 73982e209b0fe399edd5979ae14340f42387c4a8ef84f5c8a3e1b2a1a2d52266
Instruction ID: 4d9061bb336dbf6028ed03bbc3172fff6e365d6ccb34219d6b0945f367c8a231
Opcode Fuzzy Hash: 73982e209b0fe399edd5979ae14340f42387c4a8ef84f5c8a3e1b2a1a2d52266
Instruction Fuzzy Hash: 9B311A25A0DA4780EB10BF05E8441A5A3E2FF567B4FC85435D84D036A4DFADE529C770

Function 00007FF7C18B47D0 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 170COMMON

Download Yara Rule

APIs

00007FFB1E6719C0.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7C18B4ABE), ref: 00007FF7C18B48FE
00007FFB1E6719C0.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7C18B4ABE), ref: 00007FF7C18B4911
00007FFB1E6719C0.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7C18B4ABE), ref: 00007FF7C18B4929
00007FFB1E6719C0.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,00000000,00007FF7C18B4ABE), ref: 00007FF7C18B4971

Strings

i >= 0 && i < Size, xrefs: 00007FF7C18B4836
index >= 0, xrefs: 00007FF7C18B4815
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7C18B480E, 00007FF7C18B482F
C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp, xrefs: 00007FF7C18B4860, 00007FF7C18B48BD
r->IsPacked(), xrefs: 00007FF7C18B4867
pad_left + line_width + pad_right == r->Width && y < r->Height, xrefs: 00007FF7C18B48C4

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007E6719
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp$i >= 0 && i < Size$index >= 0$pad_left + line_width + pad_right == r->Width && y < r->Height$r->IsPacked()
API String ID: 1823926093-458361149
Opcode ID: c8c261c216b1aebd6a1147a5566a9e7cdbbc1a367a531d2b4b0594f3f14ed8bd
Instruction ID: ae467e046b27d8b637398fe8c5f48f525227f447f9cd52464d2062166270f611
Opcode Fuzzy Hash: c8c261c216b1aebd6a1147a5566a9e7cdbbc1a367a531d2b4b0594f3f14ed8bd
Instruction Fuzzy Hash: 34713332B08B5682E700DF29E841278B3A2FF55BA0F958235DE5D537A0EFB8E065C350

Function 0000023D0FB869A0 Relevance: 17.0, APIs: 11, Instructions: 484COMMON

Download Yara Rule

APIs

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 0000023D0FB86BDD
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 0000023D0FB86C5A
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 0000023D0FB86C73
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 0000023D0FB86CB3
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 0000023D0FB86D12
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 0000023D0FB86D2B
_Min_value.LIBCPMTD ref: 0000023D0FB86D62
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 0000023D0FB86D7E
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 0000023D0FB86D97
_Max_value.LIBCPMTD ref: 0000023D0FB86DCE
_Min_value.LIBCPMTD ref: 0000023D0FB86DEB

Part of subcall function 0000023D0FB8F140: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 0000023D0FB8F165

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$CriticalLock::_ReentrantScoped_lockScoped_lock::~_$Affinity::operator!=Concurrency::details::HardwareMin_value$Max_valueSchedulerScheduler::_
String ID:
API String ID: 2048856540-0
Opcode ID: e866146c94e960af1540157134187f2a0fce7dbc0c02fbcd93b84c3e2d61bdcf
Instruction ID: 74fd23f0c9f1a72d8092e71274fd03b8aa10756760ea04f553d1b9fac073acbd
Opcode Fuzzy Hash: e866146c94e960af1540157134187f2a0fce7dbc0c02fbcd93b84c3e2d61bdcf
Instruction Fuzzy Hash: 1A02EE7011CB888FDBB5EB18D498BEAB3E5FBE8701F50091E958EC3291DE749945CB42

Function 0000023D0FB72A10 Relevance: 15.2, APIs: 10, Instructions: 190COMMON

Download Yara Rule

APIs

std::make_error_code.LIBCPMTD ref: 0000023D0FB72A62

Part of subcall function 0000023D0FB18FE0: std::error_condition::error_condition.LIBCPMTD ref: 0000023D0FB18FFE

std::make_error_code.LIBCPMTD ref: 0000023D0FB72AB6
std::make_error_code.LIBCPMTD ref: 0000023D0FB72AF1

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: std::make_error_code$std::error_condition::error_condition
String ID:
API String ID: 2527301759-0
Opcode ID: 71ef438b1bb58b4182dc28e9ffd7d5b29104a32867a1bdd3a258c92d20c36c8b
Instruction ID: 0e57b04d0f7dbc6596b8860630d3cab3996b0b582d34e9fc4272fea6c1264d63
Opcode Fuzzy Hash: 71ef438b1bb58b4182dc28e9ffd7d5b29104a32867a1bdd3a258c92d20c36c8b
Instruction Fuzzy Hash: D56100302187554BE25EDB29E459B2AB7E9BB85740FB00868F1C9C76E2CA2CDE41CF51

Function 00007FF7C18A9E40 Relevance: 14.4, APIs: 4, Strings: 4, Instructions: 426COMMON

Download Yara Rule

APIs

00007FFB1E6719C0.VCRUNTIME140 ref: 00007FF7C18A9FBF
00007FFB1E6719C0.VCRUNTIME140 ref: 00007FF7C18A9FD6

Strings

C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h, xrefs: 00007FF7C18AA001, 00007FF7C18AA0E1, 00007FF7C18AA17E
z->direction, xrefs: 00007FF7C18AA008
z->ey >= scan_y_top, xrefs: 00007FF7C18AA185
z != 0, xrefs: 00007FF7C18AA0E8

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007E6719
String ID: C:\Users\55yar\Desktop\imgui-master\imstb_truetype.h$z != 0$z->direction$z->ey >= scan_y_top
API String ID: 1823926093-479673919
Opcode ID: b1f5d2743eba00185b4ef35da03a36488c5a9ffa4c6548543b2ac54dad6f16f8
Instruction ID: 5ecfad2a2bd917d1d067fde3f8357addd6cf5131f62666c43cac415bb416c436
Opcode Fuzzy Hash: b1f5d2743eba00185b4ef35da03a36488c5a9ffa4c6548543b2ac54dad6f16f8
Instruction Fuzzy Hash: 5E12D232908BC587D7629F35D0412A9B3A0FF58BA4F588336DB4963764EB7CE1A5CB10

Function 00007FF7C18B4020 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 216COMMON

Download Yara Rule

APIs

00007FFB1E6719C0.VCRUNTIME140 ref: 00007FF7C18B40D7

Part of subcall function 00007FF7C18A50E0: 00007FFB2ADA49A0.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF7C18A5139

00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18B43A0

Strings

pack_rects[i].w == user_rects[i].Width && pack_rects[i].h == user_rects[i].Height, xrefs: 00007FF7C18B42DB
pack_context != 0, xrefs: 00007FF7C18B4054
i >= 0 && i < Size, xrefs: 00007FF7C18B4107, 00007FF7C18B412F, 00007FF7C18B415D, 00007FF7C18B4185, 00007FF7C18B41CD, 00007FF7C18B4221, 00007FF7C18B424C, 00007FF7C18B4287, 00007FF7C18B42B3
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7C18B4100, 00007FF7C18B4128, 00007FF7C18B4156, 00007FF7C18B417E, 00007FF7C18B41C6, 00007FF7C18B421A, 00007FF7C18B4245, 00007FF7C18B4280, 00007FF7C18B42AC
user_rects.Size >= 1, xrefs: 00007FF7C18B4074
C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp, xrefs: 00007FF7C18B404D, 00007FF7C18B406D, 00007FF7C18B42D4

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007$E6719F020
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp$i >= 0 && i < Size$pack_context != 0$pack_rects[i].w == user_rects[i].Width && pack_rects[i].h == user_rects[i].Height$user_rects.Size >= 1
API String ID: 1826410401-766226355
Opcode ID: 8ce10e466192048a1693556da465ee69bb877a76bb65d9e6bfeac6a609cba9b4
Instruction ID: 76362661f2aca1f0907f6c51b86d474688047db647e9c9df266f282a9e5330e1
Opcode Fuzzy Hash: 8ce10e466192048a1693556da465ee69bb877a76bb65d9e6bfeac6a609cba9b4
Instruction Fuzzy Hash: D6A19F36A0CA1386EB14EF15D8441B8B7A1FB45BB8F808136CE4E47664DFBCE566C760

Function 00007FF7C18BDF40 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 114COMMON

Download Yara Rule

APIs

00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18BE006

Strings

p >= Data && p < DataEnd, xrefs: 00007FF7C18BE070
i >= 0 && i < Size, xrefs: 00007FF7C18BE11C
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7C18BE115
C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF7C18BE069, 00007FF7C18BE0CA
table->MemoryCompacted == false, xrefs: 00007FF7C18BDF6F
p >= Buf.Data && p < Buf.Data + Buf.Size, xrefs: 00007FF7C18BE0D1
C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp, xrefs: 00007FF7C18BDF68

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007F020
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp$i >= 0 && i < Size$p >= Buf.Data && p < Buf.Data + Buf.Size$p >= Data && p < DataEnd$table->MemoryCompacted == false
API String ID: 2739980228-1783795845
Opcode ID: 62f75428c15231a191c8b2183383776eb55f8038cf437fe52e0662faf8159130
Instruction ID: d99632c751811b794cf3c78a9800cd010f5ef1f1ed18aa1d27db58c2e0de7116
Opcode Fuzzy Hash: 62f75428c15231a191c8b2183383776eb55f8038cf437fe52e0662faf8159130
Instruction Fuzzy Hash: E251B272A0CA8686DB10EF15E8542E8B7E1FB55B68F840136CE0C47764DFBDE166C360

Function 0000023D0FB4A850 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

UnDecorator::getVbTableType.LIBCMTD ref: 0000023D0FB4A955
shared_ptr.LIBCMTD ref: 0000023D0FB4A9C3

Strings

d, xrefs: 0000023D0FB4A95C

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: Decorator::getTableTypeshared_ptr
String ID: d
API String ID: 143873753-2564639436
Opcode ID: 9472d0e4b889f094a3cab1acffd77fe61c7aaf73f92bde8c9ff228181d57b494
Instruction ID: b21a6396654ab48aca862be9b6d984be7e1461ab8e4f3eeafb5626c43e4e8137
Opcode Fuzzy Hash: 9472d0e4b889f094a3cab1acffd77fe61c7aaf73f92bde8c9ff228181d57b494
Instruction Fuzzy Hash: E59134305187848FD799EB28D058B5BBBE5FFD9700F54095DB089C72A2DA38D945CF02

Function 0000023D0FB4A540 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 244COMMON

Download Yara Rule

APIs

UnDecorator::getVbTableType.LIBCMTD ref: 0000023D0FB4A647
shared_ptr.LIBCMTD ref: 0000023D0FB4A6B5

Strings

d, xrefs: 0000023D0FB4A64E

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: Decorator::getTableTypeshared_ptr
String ID: d
API String ID: 143873753-2564639436
Opcode ID: 9036c0c1e63749c3bc76dfb6a94ead1f4178844c3cfab8ee976c09acc3f1cf2d
Instruction ID: a25838b289224cf26f0e0d22fe6133e3d6d58648ce73fac4f5e3bdd1adf33838
Opcode Fuzzy Hash: 9036c0c1e63749c3bc76dfb6a94ead1f4178844c3cfab8ee976c09acc3f1cf2d
Instruction Fuzzy Hash: 9B9111306187848FE799EB28D45876BBBE5FBD9700F54095DB0C9C72A2DA38DA45CF02

Function 0000023D0FB50EC0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 150COMMON

Download Yara Rule

APIs

Part of subcall function 0000023D0FB0A110: char_traits.LIBCPMTD ref: 0000023D0FB0A13D

type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB50F36
type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB50F55
type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB50FE6
type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB51041
type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB51093

Strings

, xrefs: 0000023D0FB50F08
', xrefs: 0000023D0FB50F6D

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: type_info::_name_internal_method$char_traits
String ID: $'
API String ID: 2432257368-2481900351
Opcode ID: 80be3a970e3a749e1926a631d758321b903abe1dc6e94d3da15c608f29041d81
Instruction ID: 8814b916289fcd38dd37b185e99a2d769bcb45581af8357362685598fb71449e
Opcode Fuzzy Hash: 80be3a970e3a749e1926a631d758321b903abe1dc6e94d3da15c608f29041d81
Instruction Fuzzy Hash: 6A513331118B888FD7A6FB18D489BDEB7E5FBA8B00F50495DA089C31A1DF389644CF42

Function 00007FF7C18D0C30 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

TrackMouseEvent.USER32 ref: 00007FF7C18D0CCE
GetMessageExtraInfo.USER32 ref: 00007FF7C18D126A
TrackMouseEvent.USER32 ref: 00007FF7C18D12FB
TrackMouseEvent.USER32 ref: 00007FF7C18D1305
ScreenToClient.USER32 ref: 00007FF7C18D1331

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7C18D134E
Ctx != 0, xrefs: 00007FF7C18D1355

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: EventMouseTrack$ClientExtraInfoMessageScreen
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$Ctx != 0
API String ID: 3561655495-3890275027
Opcode ID: 56b5d8c4c4cd4702416651cf8138708fd5936cd832d97e54c425377689c9d51c
Instruction ID: fc880a02a2592bd92882a9df5c76b6ed0d66ee494d2d256deeb1957f3750fad7
Opcode Fuzzy Hash: 56b5d8c4c4cd4702416651cf8138708fd5936cd832d97e54c425377689c9d51c
Instruction Fuzzy Hash: AD618C72A0C7428AE714EF65E4402ADB7E1FF45764F984139DA0A52A94CFBCE4A58720

Function 00007FF7C188CB20 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 130COMMON

Download Yara Rule

APIs

__swprintf_l.LIBCMT ref: 00007FF7C188CC55
__swprintf_l.LIBCMT ref: 00007FF7C188CC67

Strings

#Child, xrefs: 00007FF7C188CCB9
%s/%08X, xrefs: 00007FF7C188CC5C
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7C188CB5A
%s/%s_%08X, xrefs: 00007FF7C188CC49
id != 0, xrefs: 00007FF7C188CB61

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: __swprintf_l
String ID: #Child$%s/%08X$%s/%s_%08X$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$id != 0
API String ID: 1488884202-1586801193
Opcode ID: 46a1a0c6a0e47ec31a009c470b2dafd8de949c046316960332f141e314256c12
Instruction ID: 2c7db8e8a3853f6ab873b15cfd88a5280e30d3fc110de01924c33e46293cddc3
Opcode Fuzzy Hash: 46a1a0c6a0e47ec31a009c470b2dafd8de949c046316960332f141e314256c12
Instruction Fuzzy Hash: 7551CF32A0CB8696E754EF26D0402E9F7E1FF89764F848136DA4C03A95CFBCA0A5C710

Function 00007FF7C18A43E0 Relevance: 12.4, APIs: 8, Instructions: 350COMMON

Download Yara Rule

APIs

00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18A446E
00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18A455A
00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18A45DA
00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18A46F6
00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18A4806
00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18A48E6
00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18A4966
00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18A49E7

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007F020
String ID:
API String ID: 2739980228-0
Opcode ID: f94a614454fe2cb526baa10b2cce888be569503d75c325dc1dce0eb86242048f
Instruction ID: 9255269816f0f59b637fd25799468e3f5d4dc1d87162ae45b6b9a32b279c0a81
Opcode Fuzzy Hash: f94a614454fe2cb526baa10b2cce888be569503d75c325dc1dce0eb86242048f
Instruction Fuzzy Hash: 7E027A7271999296DB09FF24C5950FCB3B4FB50B64B944232D60E832A1EF78E67AC350

Function 00007FF7C1888380 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C1888442
00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18884FA
00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C188858A

Part of subcall function 00007FF7C18881E0: 00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C1888269
Part of subcall function 00007FF7C18881E0: 00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18882E9
Part of subcall function 00007FF7C18881E0: 00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C188836A

00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C1888624

Strings

DrawList == &DrawListInst, xrefs: 00007FF7C18883BA
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7C18883B3

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007F020
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$DrawList == &DrawListInst
API String ID: 2739980228-20161693
Opcode ID: 2d8ea6574ee6b8056d063ee5808aa292970097db89a4d7c438daa540352c4861
Instruction ID: 1b561b159502af8822da7e37b74a1688f40c8ba56a2bac29facedb4dd8f758b3
Opcode Fuzzy Hash: 2d8ea6574ee6b8056d063ee5808aa292970097db89a4d7c438daa540352c4861
Instruction Fuzzy Hash: 0471CE7360DA9286D745EF28D0951FCB3B5FB04B98F984236CA0E87660DF78D5AAC350

Function 0000023D0FB3FBC0 Relevance: 9.4, APIs: 6, Instructions: 410COMMON

Download Yara Rule

APIs

UnDecorator::getVbTableType.LIBCMTD ref: 0000023D0FB3FC91

Part of subcall function 0000023D0FB40350: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FB4035E

Part of subcall function 0000023D0FB43150: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FB43163

bool_.LIBCPMTD ref: 0000023D0FB3FDA3
shared_ptr.LIBCMTD ref: 0000023D0FB3FDB0
UnDecorator::getVbTableType.LIBCMTD ref: 0000023D0FB3FE53
bool_.LIBCPMTD ref: 0000023D0FB3FF3B
shared_ptr.LIBCMTD ref: 0000023D0FB3FF48

Part of subcall function 0000023D0FB43080: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FB4308E
Part of subcall function 0000023D0FB43080: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FB430C4

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$Decorator::getTableTypebool_shared_ptr
String ID:
API String ID: 2413108386-0
Opcode ID: 09bb8693cdd345d70ffcf971e1c493b358d70803e10c2bb5853e910151989129
Instruction ID: 78b4c0b67b0cbdb58288015236fba209c42c9faafe4aacd6565398688324d156
Opcode Fuzzy Hash: 09bb8693cdd345d70ffcf971e1c493b358d70803e10c2bb5853e910151989129
Instruction Fuzzy Hash: 84F1463055CB488FE76AEB18D458BEBB7E4FF99700F60491DA089C7192DE749A44CF42

Function 0000023D0FB6E080 Relevance: 9.4, APIs: 6, Instructions: 408COMMON

Download Yara Rule

APIs

Concurrency::details::ScheduleGroupSegmentBase::HasUnrealizedChores.LIBCMTD ref: 0000023D0FB6E0A3
Concurrency::details::ScheduleGroupSegmentBase::HasUnrealizedChores.LIBCMTD ref: 0000023D0FB6E0B7
std::make_error_code.LIBCPMTD ref: 0000023D0FB6E0D0
std::make_error_code.LIBCPMTD ref: 0000023D0FB6E132
std::make_error_code.LIBCPMTD ref: 0000023D0FB6E300

Part of subcall function 0000023D0FB16020: Concurrency::details::_ReaderWriterLock::_ReaderWriterLock.LIBCMTD ref: 0000023D0FB1602E

std::make_error_code.LIBCPMTD ref: 0000023D0FB6E1B7

Part of subcall function 0000023D0FB18FE0: std::error_condition::error_condition.LIBCPMTD ref: 0000023D0FB18FFE

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: std::make_error_code$Base::ChoresConcurrency::details::GroupReaderScheduleSegmentUnrealizedWriter$Concurrency::details::_LockLock::_std::error_condition::error_condition
String ID:
API String ID: 3233732842-0
Opcode ID: 4de1addda922bb358011cb094d11cd136575d8eaefb607a23010c85f2e40a63c
Instruction ID: 66fe78f8d91bf89b45bc284a984b072d46b5d0bd6e36ff6169498e97caa06098
Opcode Fuzzy Hash: 4de1addda922bb358011cb094d11cd136575d8eaefb607a23010c85f2e40a63c
Instruction Fuzzy Hash: EBF1DF301187888FD6A9EB28D459BEEB7E5FBD9700F60485DA18DC3292DE38D945CF42

Function 0000023D0FB3BB60 Relevance: 9.1, APIs: 6, Instructions: 129COMMON

Download Yara Rule

APIs

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 0000023D0FB3BBA6
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0000023D0FB3BBC9
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0000023D0FB3BBEF
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0000023D0FB3BC62
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0000023D0FB3BC88
List.LIBCMTD ref: 0000023D0FB3BC94

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::ContextIdentityQueueWork$Affinity::operator!=HardwareList
String ID:
API String ID: 2242293343-0
Opcode ID: 0f09c845dda9b562757045dec8ee4d3361f5b6171332ab6d94f79fbde5fb3f63
Instruction ID: 2037bf7c8f7c72563ac828a062894ba93f7490d13a9339c91e73b3235c1ffad4
Opcode Fuzzy Hash: 0f09c845dda9b562757045dec8ee4d3361f5b6171332ab6d94f79fbde5fb3f63
Instruction Fuzzy Hash: 58414631158B488FD799EB14E459BDBB7E4FFD4700F90491DA089D3292DE78DA44CB42

Function 0000023D0FB81A30 Relevance: 9.1, APIs: 6, Instructions: 93COMMON

Download Yara Rule

APIs

type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB81A5E

Part of subcall function 0000023D0FB576A0: Concurrency::details::FreeThreadProxyFactory::Retire.LIBCMTD ref: 0000023D0FB576B8

type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB81A80

Part of subcall function 0000023D0FB80D30: Concurrency::details::FreeThreadProxyFactory::Retire.LIBCMTD ref: 0000023D0FB80D48

type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB81AA2
type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB81AC4
type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB81AE6
type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB81B08

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: type_info::_name_internal_method$Concurrency::details::Factory::FreeProxyRetireThread
String ID:
API String ID: 1588182640-0
Opcode ID: aeb162027570cbcb45857eaeecfccc621a0a56d2e3941c5bc9fa514a50d9ad9c
Instruction ID: 08378deee12152001031b5d588d9584e49a6a8e5152785a4bec19e77bb8df034
Opcode Fuzzy Hash: aeb162027570cbcb45857eaeecfccc621a0a56d2e3941c5bc9fa514a50d9ad9c
Instruction Fuzzy Hash: C631CB30618B888FDAA4EF28D45975EB7E1FBE9740F60095DA48DC3252DA789941CB42

Function 00007FF7C1887D10 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 246COMMON

Download Yara Rule

APIs

00007FFB1E6719C0.VCRUNTIME140 ref: 00007FF7C1887F1B
00007FFB1E6719C0.VCRUNTIME140 ref: 00007FF7C1887F59

Strings

Size > 0, xrefs: 00007FF7C188805B
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7C1888054
#MOVE, xrefs: 00007FF7C18880C0

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007E6719
String ID: #MOVE$C:\Users\55yar\Desktop\imgui-master\imgui.h$Size > 0
API String ID: 1823926093-319756798
Opcode ID: b4340bdd38b7b9769abd49ed6405a14d352e2387e4be97406b1e305ec5bfd546
Instruction ID: 935ed02f5a3eb312d366214ace35f8e57c95796cd8813ebed1bd446e168a61f4
Opcode Fuzzy Hash: b4340bdd38b7b9769abd49ed6405a14d352e2387e4be97406b1e305ec5bfd546
Instruction Fuzzy Hash: 50D13A32606BC19AD754DF29E988799B7A9F705F24FA94238C7A807790DF35E072C704

Function 00007FF7C18B13B0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18B1484
00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18B1567
00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18B15F0

Strings

!Locked && "Cannot modify a locked ImFontAtlas between NewFrame() and EndFrame/Render()!", xrefs: 00007FF7C18B13DA
C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp, xrefs: 00007FF7C18B13D3

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007F020
String ID: !Locked && "Cannot modify a locked ImFontAtlas between NewFrame() and EndFrame/Render()!"$C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp
API String ID: 2739980228-3599239301
Opcode ID: 25f72e3c8c282048cd647ec2fff06e31e0aedba023ac7ffc24038e7a7775b1cc
Instruction ID: 3401ef1746931bd2af8c96b2f1152864addd8ba3fbb5e817d9c0a560be77bc66
Opcode Fuzzy Hash: 25f72e3c8c282048cd647ec2fff06e31e0aedba023ac7ffc24038e7a7775b1cc
Instruction Fuzzy Hash: 5061C373A09A4682DB45EF14E5942BCB3B1FB05BA4F948236DB0E47364DF78E56AC340

Function 00007FF7C18BCA90 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 147COMMON

Download Yara Rule

APIs

00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18BCBC0

Strings

column->SortOrder < table->SortSpecsCount, xrefs: 00007FF7C18BCC7F
p >= Data && p < DataEnd, xrefs: 00007FF7C18BCC55
C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF7C18BCC4E
C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp, xrefs: 00007FF7C18BCC78

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007F020
String ID: C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$C:\Users\55yar\Desktop\imgui-master\imgui_tables.cpp$column->SortOrder < table->SortSpecsCount$p >= Data && p < DataEnd
API String ID: 2739980228-2291414753
Opcode ID: e9122d132843dbd3fc90186753353c71bc0eb896d549cd1bf48cf2c0944e686a
Instruction ID: 3e35c07260ebb133d78d22c94e57d1a45da370ab04c33c7ee56bc3a245763092
Opcode Fuzzy Hash: e9122d132843dbd3fc90186753353c71bc0eb896d549cd1bf48cf2c0944e686a
Instruction Fuzzy Hash: 6A61CF3260CA9292DB08EF28D5941BCB7A0FB44B60F844136DF5D83254DFBCE5A6C3A0

Function 00007FF7C1882E30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

00007FFB2ADA8950.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C1882EC1
00007FFB2ADA8950.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FF7C1882EEC
00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C1882FA9

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7C1882E51
filename && mode, xrefs: 00007FF7C1882E58

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007$A8950$F020
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$filename && mode
API String ID: 3465666832-1878659873
Opcode ID: 32812b3c54b52d5fddf171a9a411fc68495d8a89a2949104707e8eea0ed6fa51
Instruction ID: e3dc4780a491b95fd3033eca764d94ec805e16c9acd3db39c4ff7aabaf824e4d
Opcode Fuzzy Hash: 32812b3c54b52d5fddf171a9a411fc68495d8a89a2949104707e8eea0ed6fa51
Instruction Fuzzy Hash: 8A419121A0DA5382FB54FF15A444178A3E2FF48BB4B980131DA4E43BD1DE7CE466C320

Function 00007FF7C18D13F9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetMessageExtraInfo.USER32 ref: 00007FF7C18D13F9
GetCapture.USER32 ref: 00007FF7C18D1491
SetCapture.USER32 ref: 00007FF7C18D149F

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7C18D14BE
Ctx != 0, xrefs: 00007FF7C18D14C5

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: Capture$ExtraInfoMessage
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$Ctx != 0
API String ID: 2172523684-3890275027
Opcode ID: e5ed3c2d33467ee866650776db45dde0e5327c93dae5451d5cdba795c5f28f26
Instruction ID: 1b2db570d07fb4c5cc56e4c651c90efbe43025ede49e42c3d910c7521e902c44
Opcode Fuzzy Hash: e5ed3c2d33467ee866650776db45dde0e5327c93dae5451d5cdba795c5f28f26
Instruction Fuzzy Hash: B821E466609B4386E751EF25E4442A9B3E2FF44BB8FC00232DE2E47394DF78E5568760

Function 00007FF7C18A1F40 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

printf.MSPDB140-MSVCRT ref: 00007FF7C18A203E

Strings

[%s] [%05d] , xrefs: 00007FF7C18A1F9A
Size > 0, xrefs: 00007FF7C18A2020
[%05d] , xrefs: 00007FF7C18A1FAF
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7C18A2019

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: printf
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$Size > 0$[%05d] $[%s] [%05d]
API String ID: 3524737521-3476604433
Opcode ID: 1f05ae7bfb494f84aad7026fd753fc4d603e48b965f2e09f5000b0581db317b5
Instruction ID: d1e72e87da49856ed43fdf0ded8f6e77c7e0793957c23aee5666f69748b54643
Opcode Fuzzy Hash: 1f05ae7bfb494f84aad7026fd753fc4d603e48b965f2e09f5000b0581db317b5
Instruction Fuzzy Hash: C421CD76A08A4286EB21AF11F8445AAB7E1EF40BA4F848031DE4D57655CF7CE5A4C750

Function 00007FF7C18CFA50 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00007FF7C18CFAD2

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7C18CFAAA
bd != nullptr && "No platform backend to shutdown, or already shutdown?", xrefs: 00007FF7C18CFA8B
C:\Users\55yar\Desktop\imgui-master\backends\imgui_impl_win32.cpp, xrefs: 00007FF7C18CFA84
GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?", xrefs: 00007FF7C18CFAB1

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: FreeLibrary
String ID: C:\Users\55yar\Desktop\imgui-master\backends\imgui_impl_win32.cpp$C:\Users\55yar\Desktop\imgui-master\imgui.cpp$GImGui != 0 && "No current context. Did you call ImGui::CreateContext() and ImGui::SetCurrentContext() ?"$bd != nullptr && "No platform backend to shutdown, or already shutdown?"
API String ID: 3664257935-1332676508
Opcode ID: bb86a6f7c7364d40ceef79f0e52fd7b12f9ff1b9120e67842a6bdd4e3ffcc0a4
Instruction ID: 2cc8bb7a5feedbbbebd8ec4821abe48774cbe2cdb773afcee84d1b907819dafd
Opcode Fuzzy Hash: bb86a6f7c7364d40ceef79f0e52fd7b12f9ff1b9120e67842a6bdd4e3ffcc0a4
Instruction Fuzzy Hash: 2231613160DB4682EB44AF19E490678B7A1FB15BA8F888136DA0D43760DF7CE865C760

Function 00007FF7C18D14F3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetMessageExtraInfo.USER32 ref: 00007FF7C18D14F3
GetCapture.USER32 ref: 00007FF7C18D1573
ReleaseCapture.USER32 ref: 00007FF7C18D157E

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7C18D1593
Ctx != 0, xrefs: 00007FF7C18D159A

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: Capture$ExtraInfoMessageRelease
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$Ctx != 0
API String ID: 1767768705-3890275027
Opcode ID: 0527ba3645a25572ded4bfe279cd1dbea92f4c5092a315049e297b2bad3063cb
Instruction ID: f366b96fd43d7db32a5788403a5b1d7ad7789204ed7abf51436793f51d6d914f
Opcode Fuzzy Hash: 0527ba3645a25572ded4bfe279cd1dbea92f4c5092a315049e297b2bad3063cb
Instruction Fuzzy Hash: 7721D062A1DB4386E751BF65D4002BAA2E1FF49BB4FC40031E90F477A5CEBDE4968720

Function 0000023D0FB55F20 Relevance: 8.0, APIs: 5, Instructions: 479COMMON

Download Yara Rule

APIs

std::make_error_code.LIBCPMTD ref: 0000023D0FB56127

Part of subcall function 0000023D0FB2AB90: std::error_condition::error_condition.LIBCPMTD ref: 0000023D0FB2ABAE

Part of subcall function 0000023D0FB355D0: _Func_class.LIBCONCRTD ref: 0000023D0FB355E3

Concurrency::details::ScheduleGroupSegmentBase::HasUnrealizedChores.LIBCMTD ref: 0000023D0FB5615A
std::make_error_code.LIBCPMTD ref: 0000023D0FB561A5

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: std::make_error_code$Base::ChoresConcurrency::details::Func_classGroupScheduleSegmentUnrealizedstd::error_condition::error_condition
String ID:
API String ID: 831135708-0
Opcode ID: 2b019b4e3f526854cc6463bb2731e43c27d4326d5903197f3522d122ad0e4905
Instruction ID: 681b19818919b2adf9598422babced25a6a76ba8e31a10486b5bd372edc432db
Opcode Fuzzy Hash: 2b019b4e3f526854cc6463bb2731e43c27d4326d5903197f3522d122ad0e4905
Instruction Fuzzy Hash: C3F11630158B484FE7AAFB28D459BDEB3D9FB94700FA04969A04DC3292DE7CDA45CB41

Function 0000023D0FB52740 Relevance: 7.9, APIs: 5, Instructions: 422COMMON

Download Yara Rule

APIs

Concurrency::details::ScheduleGroupSegmentBase::HasUnrealizedChores.LIBCMTD ref: 0000023D0FB527C5
std::make_error_code.LIBCPMTD ref: 0000023D0FB52810
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FB52904
Concurrency::details::VirtualProcessorRoot::GetSchedulerProxy.LIBCMTD ref: 0000023D0FB52BB3

Part of subcall function 0000023D0FB5F6A0: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 0000023D0FB5F6CB

Concurrency::details::VirtualProcessorRoot::GetSchedulerProxy.LIBCMTD ref: 0000023D0FB52C8E

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Scheduler$ProcessorProxyRoot::Virtual$Base::ChoresConcurrency::details::_EmptyGroupQueue::ScheduleScheduler::_SegmentStructuredUnrealizedWorkstd::make_error_code
String ID:
API String ID: 1866601945-0
Opcode ID: 78ae9953cbedf62042fc3d33d4decda1cf0a4d0c091af80d0bda17040aa99622
Instruction ID: 9c40006af8a041794db3d4e8d244eda1e7bb4a71328be26758ecc0d9c7ef64ae
Opcode Fuzzy Hash: 78ae9953cbedf62042fc3d33d4decda1cf0a4d0c091af80d0bda17040aa99622
Instruction Fuzzy Hash: 11F10230658B488FE7B9FB28D459BDAB3E5FB98700F50492DA0CDC3291DE789645CB42

Function 0000023D0FB413D0 Relevance: 7.8, APIs: 5, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc1c347d2910cc0400b9c5d360fd704ec17404c1c8a9becaaf1b808fa4f3174e
Instruction ID: fd11bc1980d01c233207e2ce93885617a570fc3d3d735f25982ff2d5ed4a1f5e
Opcode Fuzzy Hash: cc1c347d2910cc0400b9c5d360fd704ec17404c1c8a9becaaf1b808fa4f3174e
Instruction Fuzzy Hash: 0CB1ED3051CB888FDBA5EB1CC095FAAB7E5FB98344F50495DA08EC7261DB74E981CB42

Function 0000023D0FB35960 Relevance: 7.8, APIs: 5, Instructions: 294COMMON

Download Yara Rule

APIs

fpos.LIBCPMTD ref: 0000023D0FB35A03
fpos.LIBCPMTD ref: 0000023D0FB35B8E
fpos.LIBCPMTD ref: 0000023D0FB35BC9
fpos.LIBCPMTD ref: 0000023D0FB35C3C

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: fpos
String ID:
API String ID: 1083263101-0
Opcode ID: 6a66e7cf8dba913559191b32390491cef5c931f42b95be3e289b6306e1102091
Instruction ID: 5ed21ac2bc58091dafa2e254a4e2323fb370261652343a09789b367a7110e6b5
Opcode Fuzzy Hash: 6a66e7cf8dba913559191b32390491cef5c931f42b95be3e289b6306e1102091
Instruction Fuzzy Hash: 0EB1113025CB898FD7B9EB18D459B6AB7E4FB99705F68091DE48AC3290D738D944CF02

Function 0000023D0FB799B0 Relevance: 7.8, APIs: 5, Instructions: 277COMMON

Download Yara Rule

APIs

std::make_error_code.LIBCPMTD ref: 0000023D0FB799F1

Part of subcall function 0000023D0FB18FE0: std::error_condition::error_condition.LIBCPMTD ref: 0000023D0FB18FFE

std::make_error_code.LIBCPMTD ref: 0000023D0FB79A94
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 0000023D0FB79B96
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 0000023D0FB79BBA

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: Affinity::operator!=Concurrency::details::Hardwarestd::make_error_code$std::error_condition::error_condition
String ID:
API String ID: 1851498522-0
Opcode ID: 5030b6f4d4358b935513f3764e1def77f0374254cb11d93097da90f9fbad4d41
Instruction ID: 4e2c348527a893fe17a2119d098c17cb3f84e48151822ca034bdf3fc77ff1341
Opcode Fuzzy Hash: 5030b6f4d4358b935513f3764e1def77f0374254cb11d93097da90f9fbad4d41
Instruction Fuzzy Hash: 8BA15431118B484BE76AEB24D445BEFB3E5FB95710F500A19A08EC31E1DE78DA45CF41

Function 0000023D0FB226B0 Relevance: 7.7, APIs: 5, Instructions: 190COMMON

Download Yara Rule

APIs

std::bad_exception::bad_exception.LIBCMTD ref: 0000023D0FB226D8
Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 0000023D0FB22767

Part of subcall function 0000023D0FB20B80: std::error_condition::error_condition.LIBCPMTD ref: 0000023D0FB20BB2

Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 0000023D0FB227FE
std::error_condition::error_condition.LIBCPMTD ref: 0000023D0FB2286F
Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 0000023D0FB228DC

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_SchedulerScheduler::_$std::error_condition::error_condition$std::bad_exception::bad_exception
String ID:
API String ID: 3801495819-0
Opcode ID: f3d1858459e0af94582484c269b498f47c4f8567e9ef1adb0021aa434c7c7154
Instruction ID: de18b6f141f465824d1438c7e8758c32d19ae4ebb08d77d27a70097d4e68f47c
Opcode Fuzzy Hash: f3d1858459e0af94582484c269b498f47c4f8567e9ef1adb0021aa434c7c7154
Instruction Fuzzy Hash: 77613D34618B488FD7E9EF28D448B9AB7E1FB98710F50495DE08DC3291DB78D945CB02

Function 0000023D0FB9A5E0 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

UnDecorator::getVbTableType.LIBCMTD ref: 0000023D0FB9A608

Part of subcall function 0000023D0FB9C140: shared_ptr.LIBCPMTD ref: 0000023D0FB9C161

__crt_scoped_stack_ptr.LIBCPMTD ref: 0000023D0FB9A687
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FB9A6E6
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FB9A6FD
__crt_scoped_stack_ptr.LIBCPMTD ref: 0000023D0FB9A7A6

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork__crt_scoped_stack_ptr$Decorator::getTableTypeshared_ptr
String ID:
API String ID: 2480882750-0
Opcode ID: f2ef7a86016f0f96fb29ac205b938adafa905e91da66757f72e9247496227554
Instruction ID: f05ae8ad33fdd6c8fee10573834d6e9e2e39f607dfb4f210f95bcd9fe35c840a
Opcode Fuzzy Hash: f2ef7a86016f0f96fb29ac205b938adafa905e91da66757f72e9247496227554
Instruction Fuzzy Hash: 3F61EB7051CB488FE7A5EF28C489B9AB7E4FB98740F50491EA48DC3261DB78D985CF42

Function 0000023D0FB6FF60 Relevance: 7.7, APIs: 5, Instructions: 171COMMON

Download Yara Rule

APIs

Concurrency::details::ScheduleGroupSegmentBase::HasUnrealizedChores.LIBCMTD ref: 0000023D0FB6FF83
Concurrency::details::ScheduleGroupSegmentBase::HasUnrealizedChores.LIBCMTD ref: 0000023D0FB6FF97
std::make_error_code.LIBCPMTD ref: 0000023D0FB6FFB0
std::make_error_code.LIBCPMTD ref: 0000023D0FB70003

Part of subcall function 0000023D0FB16020: Concurrency::details::_ReaderWriterLock::_ReaderWriterLock.LIBCMTD ref: 0000023D0FB1602E

std::make_error_code.LIBCPMTD ref: 0000023D0FB70067

Part of subcall function 0000023D0FB18FE0: std::error_condition::error_condition.LIBCPMTD ref: 0000023D0FB18FFE

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: std::make_error_code$Base::ChoresConcurrency::details::GroupReaderScheduleSegmentUnrealizedWriter$Concurrency::details::_LockLock::_std::error_condition::error_condition
String ID:
API String ID: 3233732842-0
Opcode ID: 36f1b8e1be24ef3a6cc2bc1991dc0e8dbe358b09201980bfd4b288c65b8c3771
Instruction ID: 3782be0b2f258fdd75f651b2768c8886e4ec88589346113286a8d55f0c52422c
Opcode Fuzzy Hash: 36f1b8e1be24ef3a6cc2bc1991dc0e8dbe358b09201980bfd4b288c65b8c3771
Instruction Fuzzy Hash: 0151C7301587484FE3A9EB18D859B9EB3E5FF94740FA0456DA08DC31A6DF389945CF06

Function 0000023D0FB70D30 Relevance: 7.6, APIs: 5, Instructions: 146COMMON

Download Yara Rule

APIs

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 0000023D0FB70D65

Part of subcall function 0000023D0FB742A0: type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB742B8

std::make_error_code.LIBCPMTD ref: 0000023D0FB70D7E

Part of subcall function 0000023D0FB18FE0: std::error_condition::error_condition.LIBCPMTD ref: 0000023D0FB18FFE

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 0000023D0FB70DA7
std::make_error_code.LIBCPMTD ref: 0000023D0FB70DC0

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: Affinity::operator!=Concurrency::details::Hardwarestd::make_error_code$std::error_condition::error_conditiontype_info::_name_internal_method
String ID:
API String ID: 2306575402-0
Opcode ID: 4b39966be41b15abd6190cfefa99efc2f337a93b3f9923bc7b93d7348519477d
Instruction ID: 238132d55c33e7f46b4d86f687e5d94ef18bc7be49ca5d1d17ba1dc1d201ca52
Opcode Fuzzy Hash: 4b39966be41b15abd6190cfefa99efc2f337a93b3f9923bc7b93d7348519477d
Instruction Fuzzy Hash: A25164306187888BE76AEB24D459BAF77E5FB84744F504A19A0C9D71D2DB3CDA048F42

Function 00007FF7C1882CA0 Relevance: 7.6, APIs: 5, Instructions: 100COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7C1882CE2
MultiByteToWideChar.KERNEL32 ref: 00007FF7C1882D05
MultiByteToWideChar.KERNEL32 ref: 00007FF7C1882D53
MultiByteToWideChar.KERNEL32 ref: 00007FF7C1882D73
00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C1882DFC

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: ByteCharMultiWide$00007F020
String ID:
API String ID: 2477082939-0
Opcode ID: fc5896e256cb37e3bf40e60c3bf080396ef434dd3cf173f2239811d82b423f67
Instruction ID: 9f1b153551993668e7d81c398655e6c892da946bc817ac6d780a160afb0b303a
Opcode Fuzzy Hash: fc5896e256cb37e3bf40e60c3bf080396ef434dd3cf173f2239811d82b423f67
Instruction Fuzzy Hash: 5C41AF76608B4186D724EF16E8440A9BBA2FB48BE4F488236DE4D43B94DF7CC566C700

Function 0000023D0FB4BF60 Relevance: 7.6, APIs: 5, Instructions: 79COMMON

Download Yara Rule

APIs

type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB4BF8E

Part of subcall function 0000023D0FB576A0: Concurrency::details::FreeThreadProxyFactory::Retire.LIBCMTD ref: 0000023D0FB576B8

type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB4BFB0
type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB4BFD2
type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB4BFF4
type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB4C016

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: type_info::_name_internal_method$Concurrency::details::Factory::FreeProxyRetireThread
String ID:
API String ID: 1588182640-0
Opcode ID: 815c5ab9791d234820be11a13cdb67723ff592c1cb60b69b78e51ea6d37036d7
Instruction ID: 918f842ea623715fc91c2455080974398966e6555cbe1c5b7efc2cec8b0b963b
Opcode Fuzzy Hash: 815c5ab9791d234820be11a13cdb67723ff592c1cb60b69b78e51ea6d37036d7
Instruction Fuzzy Hash: 7721CD30618B888FDAA5FF2CD45975EB7E1FBE8740FA0495DA48DC3252DE7899408B42

Function 0000023D0FB6FCF0 Relevance: 7.6, APIs: 5, Instructions: 79COMMON

Download Yara Rule

APIs

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 0000023D0FB6FD17

Part of subcall function 0000023D0FB742A0: type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB742B8

std::make_error_code.LIBCPMTD ref: 0000023D0FB6FD2D

Part of subcall function 0000023D0FB18FE0: std::error_condition::error_condition.LIBCPMTD ref: 0000023D0FB18FFE

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 0000023D0FB6FD50
std::make_error_code.LIBCPMTD ref: 0000023D0FB6FD66

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: Affinity::operator!=Concurrency::details::Hardwarestd::make_error_code$std::error_condition::error_conditiontype_info::_name_internal_method
String ID:
API String ID: 2306575402-0
Opcode ID: a32136fa3a3c95708d011456afc3b85815d78c4fd3309404f318db35ddc1acc6
Instruction ID: 15415cf1f3193c6a7c37c3a715120a83d2e3c46181222f2f857e14fefbf352b8
Opcode Fuzzy Hash: a32136fa3a3c95708d011456afc3b85815d78c4fd3309404f318db35ddc1acc6
Instruction Fuzzy Hash: 07213630258B488FE74AEB24E455BAE77E5FBC4740FA0491DA085C72E2DA3CDA45DF81

Function 0000023D0FB81C70 Relevance: 7.6, APIs: 5, Instructions: 79COMMON

Download Yara Rule

APIs

type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB81C9E

Part of subcall function 0000023D0FB80D30: Concurrency::details::FreeThreadProxyFactory::Retire.LIBCMTD ref: 0000023D0FB80D48

type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB81CC0
type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB81CE2
type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB81D04
type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB81D26

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: type_info::_name_internal_method$Concurrency::details::Factory::FreeProxyRetireThread
String ID:
API String ID: 1588182640-0
Opcode ID: 1289f65bedd4f753d9bc64e073d9728bff9e2b420633cab40bd45a22262cb7c2
Instruction ID: 96afaa4f0e75279856af82fc1ebea0129874593468d158626d01f700ab560a5f
Opcode Fuzzy Hash: 1289f65bedd4f753d9bc64e073d9728bff9e2b420633cab40bd45a22262cb7c2
Instruction Fuzzy Hash: 7F21ED30618B888FDAA4FB2CD45975EB7E1FBE8740FA0495DA48DC3252DE789940CB42

Function 0000023D0FB694F0 Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 0000023D0FB6951A
shared_ptr.LIBCMTD ref: 0000023D0FB6952E

Part of subcall function 0000023D0FB71B90: shared_ptr.LIBCMTD ref: 0000023D0FB71B9E

allocator.LIBCPMTD ref: 0000023D0FB69542
shared_ptr.LIBCMTD ref: 0000023D0FB69554
allocator.LIBCPMTD ref: 0000023D0FB69568

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: shared_ptr$allocator$Affinity::operator!=Concurrency::details::Hardware
String ID:
API String ID: 1053258265-0
Opcode ID: d0542d8c5f8c00544737d49b6b181d538de8c3696277a9840e8cef3017e38d50
Instruction ID: 6651d4bb0fb80e00e6759eed98d2a7dd5bfc9b9ffdc2e82744405c2ce5889e46
Opcode Fuzzy Hash: d0542d8c5f8c00544737d49b6b181d538de8c3696277a9840e8cef3017e38d50
Instruction Fuzzy Hash: EC118F3011CB488FD7A4EB28D4497ABB7E5FBD8700F50491EA4CDC3252DA34AA448B82

Function 0000023D0FB0E510 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 341COMMON

Download Yara Rule

APIs

type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB0E53C
type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB0E5F2
type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB0E6BA

Part of subcall function 0000023D0FB0A110: char_traits.LIBCPMTD ref: 0000023D0FB0A13D

Strings

, xrefs: 0000023D0FB0E734

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: type_info::_name_internal_method$char_traits
String ID:
API String ID: 2432257368-3916222277
Opcode ID: 484fa9ed5a09ce3c1aba4d5e140585cca91a770afe66fd64d1cb6647b4050987
Instruction ID: 19f93738d2e4d98329d427516be165dec8ec3c38cb6721b22b0e4a80a43f5dd6
Opcode Fuzzy Hash: 484fa9ed5a09ce3c1aba4d5e140585cca91a770afe66fd64d1cb6647b4050987
Instruction Fuzzy Hash: D9C1EF31518B488FD76AEB28D459BDFB7E5FB98704F504E29A08AC3191EF38D644CB42

Function 00007FF7C18BE150 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 187COMMON

Download Yara Rule

APIs

00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18BE432

Strings

p < end(), xrefs: 00007FF7C18BE209, 00007FF7C18BE376
C:\Users\55yar\Desktop\imgui-master\imgui_internal.h, xrefs: 00007FF7C18BE1C5, 00007FF7C18BE202, 00007FF7C18BE332, 00007FF7C18BE36F
p >= begin() && p < end(), xrefs: 00007FF7C18BE1CC, 00007FF7C18BE339

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007F020
String ID: C:\Users\55yar\Desktop\imgui-master\imgui_internal.h$p < end()$p >= begin() && p < end()
API String ID: 2739980228-1901453082
Opcode ID: 9d9a1517e51c1fe0e5a5e04ee605e1aa435a62f3df0e428a25b9debd2f4fc217
Instruction ID: 1cb4ccf8fae72bbc893f0df1d893ac3230af855d80e8f1b243c982e57b5701fe
Opcode Fuzzy Hash: 9d9a1517e51c1fe0e5a5e04ee605e1aa435a62f3df0e428a25b9debd2f4fc217
Instruction Fuzzy Hash: F581B172B09A429AEB18EF14D9442A9F3E1FF04BA5F848139DE1D47254DF7CE565C320

Function 0000023D0FB1C5F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 145COMMON

Download Yara Rule

APIs

_Subatomic.LIBCONCRTD ref: 0000023D0FB1C660
_Subatomic.LIBCONCRTD ref: 0000023D0FB1C6FC

Strings

d, xrefs: 0000023D0FB1C630

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: Subatomic
String ID: d
API String ID: 3648745215-2564639436
Opcode ID: efb1fcbe8c1811717f4302681e42682ec25775e0b23f357535bcb0ed867f423a
Instruction ID: ef82669b7df80007be19fe6f901f76b2b1af756a4b551fb01b82b6aaf13250df
Opcode Fuzzy Hash: efb1fcbe8c1811717f4302681e42682ec25775e0b23f357535bcb0ed867f423a
Instruction Fuzzy Hash: AF410F70258B488FD795EF28C44D7AABBE6FBA9341F50591EA08AD3260DB74D944CF02

Function 00007FF7C18D1091 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

IsWindowUnicode.USER32 ref: 00007FF7C18D1094
MultiByteToWideChar.KERNEL32 ref: 00007FF7C18D116F

Strings

C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7C18D1188
Ctx != 0, xrefs: 00007FF7C18D118F

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: ByteCharMultiUnicodeWideWindow
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$Ctx != 0
API String ID: 3417139564-3890275027
Opcode ID: 209bfdbab78ec921e6c6e0e02f910ef59687700a5ea740a5dff3d48987ec466a
Instruction ID: 5d7846766bd624f3ffe1d1c9debc42b28fa8c33ee0f16c8fe8b47fde3d642129
Opcode Fuzzy Hash: 209bfdbab78ec921e6c6e0e02f910ef59687700a5ea740a5dff3d48987ec466a
Instruction Fuzzy Hash: F5519222A1CB4386EB65EF34D4402B9A3E1FF45B79F884136DA4D47A94DFBCD8528320

Function 00007FF7C18A41F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18A4304
00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18A43C6

Strings

!Locked && "Cannot modify a locked ImFontAtlas between NewFrame() and EndFrame/Render()!", xrefs: 00007FF7C18A4224, 00007FF7C18A4255
C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp, xrefs: 00007FF7C18A421D, 00007FF7C18A424E

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007F020
String ID: !Locked && "Cannot modify a locked ImFontAtlas between NewFrame() and EndFrame/Render()!"$C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp
API String ID: 2739980228-3599239301
Opcode ID: 6fb84a0008613fc9e451bc84090f232af98be13056d41ae15d4a5a2dbfb217a0
Instruction ID: d68c1ea2ab9fd24841386cfe7a16b8bf8b36d44419e9c5d8922dbe42f5626304
Opcode Fuzzy Hash: 6fb84a0008613fc9e451bc84090f232af98be13056d41ae15d4a5a2dbfb217a0
Instruction Fuzzy Hash: C851BCB2A0DA5282EB04FF14E4944ACB3F4FB59BA4F984236CA4D43650DFBCD56AC750

Function 0000023D0FB04AA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FB04AD0
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 0000023D0FB04B2F
Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FB04B41

Strings

, xrefs: 0000023D0FB04B85

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_
String ID:
API String ID: 991905282-3916222277
Opcode ID: 9ff833f645241d309f74730e56746fcdce4bb14be2cacbeb9f454d4447fa5017
Instruction ID: eb3b07d4eb8e4442bc0e9e4b2e850cb29479569112f603e80504bf8af3b14244
Opcode Fuzzy Hash: 9ff833f645241d309f74730e56746fcdce4bb14be2cacbeb9f454d4447fa5017
Instruction Fuzzy Hash: 2B410D30118B448FE3A8EF28C49975EB7E0FB88701FA0591DB09AC32A1CB749945CF42

Function 00007FF7C18B1620 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18B16C6
00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18B1744

Strings

!Locked && "Cannot modify a locked ImFontAtlas between NewFrame() and EndFrame/Render()!", xrefs: 00007FF7C18B1640
C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp, xrefs: 00007FF7C18B1639

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007F020
String ID: !Locked && "Cannot modify a locked ImFontAtlas between NewFrame() and EndFrame/Render()!"$C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp
API String ID: 2739980228-3599239301
Opcode ID: 949da079233bebc451fdb1efe9aea4bc1086646359ae301130959504423949a1
Instruction ID: 0a5e0800145ef73c5973f570ea0d0cf745ca1cabd6862334b2b82a64a15e5dfa
Opcode Fuzzy Hash: 949da079233bebc451fdb1efe9aea4bc1086646359ae301130959504423949a1
Instruction Fuzzy Hash: 0B31E57360DA5282D745EF24E4951BCB3F5FB15B94B948233CA0E47254DF78D5AAC340

Function 0000023D0FB72950 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

std::make_error_code.LIBCPMTD ref: 0000023D0FB729A7

Part of subcall function 0000023D0FB18FE0: std::error_condition::error_condition.LIBCPMTD ref: 0000023D0FB18FFE

std::make_error_code.LIBCPMTD ref: 0000023D0FB729D2
std::make_error_code.LIBCPMTD ref: 0000023D0FB729EE

Strings

}, xrefs: 0000023D0FB72996

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: std::make_error_code$std::error_condition::error_condition
String ID: }
API String ID: 2527301759-4239843852
Opcode ID: be98c45c2635ea1b7c099d9ee1afc8aab728c4e80a3655f5ac3be0dc2360b2bb
Instruction ID: 3c35b36ea60d0ff210e839586201ff900c12bfb13b2ccb49640f780e34ed0949
Opcode Fuzzy Hash: be98c45c2635ea1b7c099d9ee1afc8aab728c4e80a3655f5ac3be0dc2360b2bb
Instruction Fuzzy Hash: AB213E301187848BE35DDB58D044B1ABBE5FB85780F64092DF0C9C31A1D678CA80DF02

Function 0000023D0FB55890 Relevance: 6.4, APIs: 4, Instructions: 359COMMON

Download Yara Rule

APIs

Concurrency::details::ScheduleGroupSegmentBase::HasUnrealizedChores.LIBCMTD ref: 0000023D0FB55917
std::make_error_code.LIBCPMTD ref: 0000023D0FB55992
Concurrency::details::VirtualProcessorRoot::GetSchedulerProxy.LIBCMTD ref: 0000023D0FB55B1C

Part of subcall function 0000023D0FB5F870: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 0000023D0FB5F8CD
Part of subcall function 0000023D0FB5F870: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 0000023D0FB5F8E4

Concurrency::details::VirtualProcessorRoot::GetSchedulerProxy.LIBCMTD ref: 0000023D0FB55CAB

Part of subcall function 0000023D0FB36BC0: char_traits.LIBCPMTD ref: 0000023D0FB36BE0

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: Scheduler$Concurrency::details::$Concurrency::details::_ProcessorProxyRoot::Scheduler::_Virtual$Base::ChoresGroupScheduleSegmentUnrealizedchar_traitsstd::make_error_code
String ID:
API String ID: 3113402709-0
Opcode ID: e2d3ee74bc8f1c16197933b13d06f8bb0aa28bf4c35c2e9712a17edbc610efea
Instruction ID: 918f83794dc885978dba3088c42096253c573a36239421dca82049ba92f586cc
Opcode Fuzzy Hash: e2d3ee74bc8f1c16197933b13d06f8bb0aa28bf4c35c2e9712a17edbc610efea
Instruction Fuzzy Hash: 1AC10531158B4C8FE7BAEB18D459BDBB3E5FBA8700F50092E948DC3291DE789645CB42

Function 0000023D0FB71370 Relevance: 6.3, APIs: 4, Instructions: 304COMMON

Download Yara Rule

APIs

UnDecorator::getVbTableType.LIBCMTD ref: 0000023D0FB71564

Part of subcall function 0000023D0FB450A0: char_traits.LIBCPMTD ref: 0000023D0FB450C1

Concurrency::details::VirtualProcessorRoot::GetSchedulerProxy.LIBCMTD ref: 0000023D0FB715C1

Part of subcall function 0000023D0FB7A0F0: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 0000023D0FB7A112

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: Scheduler$Concurrency::details::Concurrency::details::_Decorator::getProcessorProxyRoot::Scheduler::_TableTypeVirtualchar_traits
String ID:
API String ID: 1673230147-0
Opcode ID: cfb114ce81b8242a8138127994242184d9f7b02dc7cc79d7158feec11a0593a8
Instruction ID: d67aa6ff7152939ffc04404cad5f188f8e5f0804860c9166bc62cde335f239a8
Opcode Fuzzy Hash: cfb114ce81b8242a8138127994242184d9f7b02dc7cc79d7158feec11a0593a8
Instruction Fuzzy Hash: 0BC1CA7055CB888FE7A5EB18D499BDBB7E5FBA8700F50492EA08DC3261DF349584CB42

Function 0000023D0FB724C0 Relevance: 6.3, APIs: 4, Instructions: 266COMMON

Download Yara Rule

APIs

Concurrency::details::ScheduleGroupSegmentBase::HasUnrealizedChores.LIBCMTD ref: 0000023D0FB724E3
std::make_error_code.LIBCPMTD ref: 0000023D0FB724FC

Part of subcall function 0000023D0FB18FE0: std::error_condition::error_condition.LIBCPMTD ref: 0000023D0FB18FFE

std::make_error_code.LIBCPMTD ref: 0000023D0FB7253B

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: std::make_error_code$Base::ChoresConcurrency::details::GroupScheduleSegmentUnrealizedstd::error_condition::error_condition
String ID:
API String ID: 1046759889-0
Opcode ID: 28292fa4d794b396cedd1ba8fdc4833dcd5acff12edfc6de44ad94c6088fe729
Instruction ID: b2814f06d266524e8ca8afcb925a65c1a09903115c9996670aca65cb74d041f6
Opcode Fuzzy Hash: 28292fa4d794b396cedd1ba8fdc4833dcd5acff12edfc6de44ad94c6088fe729
Instruction Fuzzy Hash: 9EB1C930118B888FD7A9EB28D459BDEB7E5FBD8700FA0495DA08DC3292DE349945CF42

Function 0000023D0FB3BF20 Relevance: 6.3, APIs: 4, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa309a1d5eda81a3067fdfd55af1e6fde9889dbaabf2b138042415afc4b680ce
Instruction ID: 3f022a31d3a945d438a43b6b3e3def9cf748e9caf2dcaaa608d1414a091ca812
Opcode Fuzzy Hash: fa309a1d5eda81a3067fdfd55af1e6fde9889dbaabf2b138042415afc4b680ce
Instruction Fuzzy Hash: FE91EE30118B488FDBA5EB18C095FAAB7E5FBE9304F50495DA08EC7262CB75E945CF42

Function 0000023D0FB6DCB0 Relevance: 6.2, APIs: 4, Instructions: 212COMMON

Download Yara Rule

APIs

std::make_error_code.LIBCPMTD ref: 0000023D0FB6DCED

Part of subcall function 0000023D0FB18FE0: std::error_condition::error_condition.LIBCPMTD ref: 0000023D0FB18FFE

std::make_error_code.LIBCPMTD ref: 0000023D0FB6DD3C

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: std::make_error_code$std::error_condition::error_condition
String ID:
API String ID: 2527301759-0
Opcode ID: 914871444acda03db8c397575b484ba356f5dbd6d30ab43649a56d47f3854115
Instruction ID: 01a9ce5234a3145382d4399389ba4de734bf02bdccef5be307e1b4fd526fb3d5
Opcode Fuzzy Hash: 914871444acda03db8c397575b484ba356f5dbd6d30ab43649a56d47f3854115
Instruction Fuzzy Hash: 82810330158B898FE3A9EB18D455BAEB7E5FFD4700F50496DA08EC31A2DA38D945CF42

Function 0000023D0FB35700 Relevance: 6.2, APIs: 4, Instructions: 210COMMON

Download Yara Rule

APIs

fpos.LIBCPMTD ref: 0000023D0FB3579A
fpos.LIBCPMTD ref: 0000023D0FB35863
fpos.LIBCPMTD ref: 0000023D0FB358B2
fpos.LIBCPMTD ref: 0000023D0FB3594F

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: fpos
String ID:
API String ID: 1083263101-0
Opcode ID: 6482d30fa890008c781780ebb765b1d214955e0675561b79e15b2cde454a484b
Instruction ID: 64b553bd7909de1d859f42576bb29d0d472e36e8d40b6cbd742cf1d7da377371
Opcode Fuzzy Hash: 6482d30fa890008c781780ebb765b1d214955e0675561b79e15b2cde454a484b
Instruction Fuzzy Hash: E281003055CB89CFE7A5EB28D459B2AB7E4FB98754F68091DB499C32A0C738D940CF02

Function 0000023D0FB18290 Relevance: 6.1, APIs: 4, Instructions: 147COMMON

Download Yara Rule

APIs

Part of subcall function 0000023D0FB0A170: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FB0A18D

type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB183B2
type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB183CD
type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB1840F
type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB1842A

Part of subcall function 0000023D0FB0A110: char_traits.LIBCPMTD ref: 0000023D0FB0A13D

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: type_info::_name_internal_method$Concurrency::details::EmptyQueue::StructuredWorkchar_traits
String ID:
API String ID: 1744367693-0
Opcode ID: 05dacfb44ce026340830ddc3cf9d5ce59777114b69a1943011c7116f23cbb7e6
Instruction ID: 26dd8b61c03b6bc3fa998e7bc38509b40456328f8fccf45657122aa52baaaf55
Opcode Fuzzy Hash: 05dacfb44ce026340830ddc3cf9d5ce59777114b69a1943011c7116f23cbb7e6
Instruction Fuzzy Hash: 715131301187848FE3A5EF18D484BAFB7E5FB98744F544A1DB089C72A1DB78DA45CB42

Function 00007FF7C18C59A0 Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

APIs

00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18C5A26
00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18C5AA3
00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18C5B20
00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18C5B9E

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007F020
String ID:
API String ID: 2739980228-0
Opcode ID: e68efa2831d778e4f34f330c17ca88291312f669d56948be7ecc4bde90aff0f3
Instruction ID: 02051f4b44b0e727c73fbc561a33e0cc42b6aed3b2553ef8003e9fc7e02bbac1
Opcode Fuzzy Hash: e68efa2831d778e4f34f330c17ca88291312f669d56948be7ecc4bde90aff0f3
Instruction Fuzzy Hash: 11518D7261DA52C6CB49EF28D0A50BCB7B1FB58B54B948233CA0E83290DF79D56AC740

Function 0000023D0FB3C210 Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

APIs

shared_ptr.LIBCMTD ref: 0000023D0FB3C2E4
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 0000023D0FB3C2F4
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0000023D0FB3C305

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Affinity::operator!=Base::ContextHardwareIdentityQueueWorkshared_ptr
String ID:
API String ID: 714649587-0
Opcode ID: 606393b9907e576b18da76dfb43c28659ee352b60d92254cb05aa7b94d9479f7
Instruction ID: e06c385f7ed07a8249801fd05b735477b09008db2346c336efbc6578a812f967
Opcode Fuzzy Hash: 606393b9907e576b18da76dfb43c28659ee352b60d92254cb05aa7b94d9479f7
Instruction Fuzzy Hash: C2411070518F488FD799EB18D499B6AB7E4FBA8345F60091DB089C32A1DB34D941CF42

Function 0000023D0FBDE560 Relevance: 6.1, APIs: 4, Instructions: 120COMMON

Download Yara Rule

APIs

Part of subcall function 0000023D0FBDE760: _Byte_length.LIBCPMTD ref: 0000023D0FBDE7CE

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 0000023D0FBDE5E5
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 0000023D0FBDE60E
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 0000023D0FBDE645
Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 0000023D0FBDE66E

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_$Byte_length
String ID:
API String ID: 1141060839-0
Opcode ID: 73401877cca2df4d9d6e09be458f0decb97a0093fc0ac4ecf507f84a65ce1821
Instruction ID: c0e170bbe076a643818926d0afe3362b58853831e488099c63d186ca529b587f
Opcode Fuzzy Hash: 73401877cca2df4d9d6e09be458f0decb97a0093fc0ac4ecf507f84a65ce1821
Instruction Fuzzy Hash: 91412230118B488FE759FB18D459BAEB7E5FB98741F50492EA089C3161DF749984CF42

Function 0000023D0FB8D460 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB8D48B

Part of subcall function 0000023D0FB576A0: Concurrency::details::FreeThreadProxyFactory::Retire.LIBCMTD ref: 0000023D0FB576B8

type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB8D4AA

Part of subcall function 0000023D0FB80D30: Concurrency::details::FreeThreadProxyFactory::Retire.LIBCMTD ref: 0000023D0FB80D48

type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB8D4C9
type_info::_name_internal_method.LIBCMTD ref: 0000023D0FB8D4E8

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: type_info::_name_internal_method$Concurrency::details::Factory::FreeProxyRetireThread
String ID:
API String ID: 1588182640-0
Opcode ID: 6ae970fd7b6ecd4af07a3924a38ebf6e4c6a300736612a1d38c72f7b099ca0b1
Instruction ID: a37aae4ad83cfe83de477217a36519f441afd2764018af1f2891f359a389d35e
Opcode Fuzzy Hash: 6ae970fd7b6ecd4af07a3924a38ebf6e4c6a300736612a1d38c72f7b099ca0b1
Instruction Fuzzy Hash: 7611003061CB488FDA95FB2CD45975EBBE1FBD8740F60095DA089C3262DA38D945CF42

Function 0000023D0FB03D40 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 321COMMON

Download Yara Rule

APIs

Part of subcall function 0000023D0FB05360: _WChar_traits.LIBCPMTD ref: 0000023D0FB0538D

Part of subcall function 0000023D0FB04740: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FB0476C
Part of subcall function 0000023D0FB04740: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FB0477E
Part of subcall function 0000023D0FB04740: Concurrency::details::WorkQueue::IsStructuredEmpty.LIBCMTD ref: 0000023D0FB047BB

Part of subcall function 0000023D0FB04850: Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 0000023D0FB048B8

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock.LIBCMTD ref: 0000023D0FB0412A

Strings

, xrefs: 0000023D0FB041B1
X, xrefs: 0000023D0FB03EE3

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: Concurrency::details::EmptyQueue::StructuredWork$Concurrency::details::_CriticalLock::_ReentrantScoped_lockScoped_lock::~_$Char_traits
String ID: $X
API String ID: 1626164810-1398056850
Opcode ID: da34108681e6cb996675731457550fc137bc86ebf3564906fc77d927d8b33079
Instruction ID: 21e198cc3ad0fc4f4d9d8dd58df9b8a822399e14fc86699a8a78e410349358e9
Opcode Fuzzy Hash: da34108681e6cb996675731457550fc137bc86ebf3564906fc77d927d8b33079
Instruction Fuzzy Hash: 28D1C630618B888FD7B5EB28D4997DEB7E1FB98301F50492EA48DC3251DB749985CB42

Function 0000023D0FB65560 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 194COMMON

Download Yara Rule

Strings

", xrefs: 0000023D0FB65636
", xrefs: 0000023D0FB6574E

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID:
String ID: "$"
API String ID: 0-3758156766
Opcode ID: 8fdaf1600544622fd33f728529cb6508d7889566d47cbe218040ba2ee86dacff
Instruction ID: 2e0774151e71d64f64735c17e76483d4cdb43b5362182693a034f1dfa3385f0b
Opcode Fuzzy Hash: 8fdaf1600544622fd33f728529cb6508d7889566d47cbe218040ba2ee86dacff
Instruction Fuzzy Hash: 4B710D31118B488AD7A9EB14D485FDBB7E5FB94744F640A1DB08AC31A1DE38D645CF82

Function 0000023D0FB24B00 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 151COMMON

Download Yara Rule

APIs

std::error_condition::error_condition.LIBCPMTD ref: 0000023D0FB24CEA

Part of subcall function 0000023D0FB201A0: Concurrency::details::VirtualProcessor::ClaimTicket::InitializeTicket.LIBCMTD ref: 0000023D0FB201BD

Strings

@, xrefs: 0000023D0FB24B66
@, xrefs: 0000023D0FB24BED

Memory Dump Source

Source File: 00000000.00000002.3717485517.0000023D0FB00000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000023D0FB00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23d0fb00000_solara-executor.jbxd

Yara matches

Similarity

API ID: ClaimConcurrency::details::InitializeProcessor::TicketTicket::Virtualstd::error_condition::error_condition
String ID: @$@
API String ID: 2004282921-149943524
Opcode ID: 9950cd689140dd32029c8ba334a83ce130f8fc6c6ba909f7c99662a502cc7da8
Instruction ID: be2892384e785456f7bde2b85c825bc32c9a95006139cb966475742dce774760
Opcode Fuzzy Hash: 9950cd689140dd32029c8ba334a83ce130f8fc6c6ba909f7c99662a502cc7da8
Instruction Fuzzy Hash: 3A51F57450C744CFE7A9EB18D088B9EB7E4FB99744F20092EE199C3681DB749944CF06

Function 00007FF7C1889BC0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

00007FFB2ADBA0D0.API-MS-WIN-CRT-MATH-L1-1-0 ref: 00007FF7C1889D80

Strings

max_error > 0.0f, xrefs: 00007FF7C1889CC6
C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp, xrefs: 00007FF7C1889CBF

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007
String ID: C:\Users\55yar\Desktop\imgui-master\imgui_draw.cpp$max_error > 0.0f
API String ID: 3568877910-3636960062
Opcode ID: a1e7d619fba98255bbb59b74f2aa783b82d974d6421d94029452daf7382b12b9
Instruction ID: dcf19ca5a4560a7bd4741f193655e3e74e8309011a7f200f45f81bc8e78e6af2
Opcode Fuzzy Hash: a1e7d619fba98255bbb59b74f2aa783b82d974d6421d94029452daf7382b12b9
Instruction Fuzzy Hash: 2861C732D1C7C985F302AF3680412A9B7D0EFA9764F4CC732EA49365A5DFA8B4D58720

Function 00007FF7C18A0E40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18A0F2F

Strings

g.SettingsWindows.empty(), xrefs: 00007FF7C18A0E7A
C:\Users\55yar\Desktop\imgui-master\imgui.cpp, xrefs: 00007FF7C18A0E73

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007F020
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.cpp$g.SettingsWindows.empty()
API String ID: 2739980228-1747592857
Opcode ID: 5fcca6ab54b0025e594ec8bc263e215ec36465dfda948e98fee39a4306cf2aa2
Instruction ID: 6f7cd1800432555818256ecb88298fb68bd2b4eb7bbd0352544359e14240aa3b
Opcode Fuzzy Hash: 5fcca6ab54b0025e594ec8bc263e215ec36465dfda948e98fee39a4306cf2aa2
Instruction Fuzzy Hash: D741D132A0DA8682EB40EF21E0541B8B3A1FB44BA8F984136EA4D13785DF7CE465C710

Function 00007FF7C18A2A40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 94COMMON

Download Yara Rule

APIs

00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18A2BA4

Strings

i >= 0 && i < Size, xrefs: 00007FF7C18A2A96, 00007FF7C18A2AC6
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7C18A2A8F, 00007FF7C18A2ABF

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007F020
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$i >= 0 && i < Size
API String ID: 2739980228-1817040388
Opcode ID: 62ab15f237ae12dd1f2f720af39e278684e74126654c7f3b00041a021f926d09
Instruction ID: 25e10b389c906aab7a0d456c80947bffa1733849ba4efc37994b1ef1a585b746
Opcode Fuzzy Hash: 62ab15f237ae12dd1f2f720af39e278684e74126654c7f3b00041a021f926d09
Instruction Fuzzy Hash: 9E419232A0CA9287EB14EF14E4901A8B3B5FB447B4B948232DA4D477A0DF78E566C750

Function 00007FF7C18A2BC0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18A2D10

Strings

i >= 0 && i < Size, xrefs: 00007FF7C18A2C16, 00007FF7C18A2C46
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7C18A2C0F, 00007FF7C18A2C3F

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007F020
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$i >= 0 && i < Size
API String ID: 2739980228-1817040388
Opcode ID: 9589bf8728c09f5c901920cbf28053feb88018c1b016dbdcb7ec8812433a96cc
Instruction ID: 4ce88aa3150296fccdeb2ff46a4d61fd609d177bc228bd8d0faf2a4cc140058d
Opcode Fuzzy Hash: 9589bf8728c09f5c901920cbf28053feb88018c1b016dbdcb7ec8812433a96cc
Instruction Fuzzy Hash: 5B41BF32A0CA8683D714EF24E8941A8B3B6FB44BB8B944132DE4D477A4DF7CE566C750

Function 00007FF7C18A2810 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

00007FFB2AD9F020.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF7C18A293C

Strings

i >= 0 && i < Size, xrefs: 00007FF7C18A2858, 00007FF7C18A2887
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7C18A2851, 00007FF7C18A2880

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007F020
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$i >= 0 && i < Size
API String ID: 2739980228-1817040388
Opcode ID: ab78d67b3827ca981ba7196448e1a9a9ce10ad8f11ce5b15fb4adaa829971505
Instruction ID: 87d8fcf7a947a9ffc3ab30452e6167c0f8098c72385e83f2d1a0d388c057795c
Opcode Fuzzy Hash: ab78d67b3827ca981ba7196448e1a9a9ce10ad8f11ce5b15fb4adaa829971505
Instruction Fuzzy Hash: 8031AD32A0CA5683D714EF24E4800A8B3E2FB44BA8B944136EA4D83764DF7CE566C750

Function 00007FF7C188B200 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

00007FFB2ADA49A0.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FF7C188B28E

Strings

i >= 0 && i < Size, xrefs: 00007FF7C188B2BC
C:\Users\55yar\Desktop\imgui-master\imgui.h, xrefs: 00007FF7C188B2B5

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007
String ID: C:\Users\55yar\Desktop\imgui-master\imgui.h$i >= 0 && i < Size
API String ID: 3568877910-1817040388
Opcode ID: fae55c63b829811270316bffbfd4df00558370b4b6ef951384af4ae9f73947b3
Instruction ID: 3a1e8914e506ca26243e97b9b143a28953dbd51b171357a625c1393d09187a74
Opcode Fuzzy Hash: fae55c63b829811270316bffbfd4df00558370b4b6ef951384af4ae9f73947b3
Instruction Fuzzy Hash: B021BC21B1C68685FB64EF15A4406ADA7A0FB85FA0F885035DA8E47B58CF7CE861C710

Function 00007FF7C18A1E80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

00007FFB2CBD2E80.IMM32 ref: 00007FF7C18A1EA2

Strings

@, xrefs: 00007FF7C18A1EF3
, xrefs: 00007FF7C18A1EB5

Memory Dump Source

Source File: 00000000.00000002.3721717873.00007FF7C1881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF7C1880000, based on PE: true

Associated: 00000000.00000002.3721681580.00007FF7C1880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1BAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1D11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3721717873.00007FF7C1EB0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722280395.00007FF7C1EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3722315850.00007FF7C1EB2000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1880000_solara-executor.jbxd

Similarity

API ID: 00007
String ID: $@
API String ID: 3568877910-1077428164
Opcode ID: 53b76e4c7360ced8355a90c1ba8cca2d8cf467df60d04d43bb1f796f4f86dbcd
Instruction ID: c31c74b8240eb87d2fe10b69d297fa3f0d61d3a1f949a84ce1c9a23dce60a31d
Opcode Fuzzy Hash: 53b76e4c7360ced8355a90c1ba8cca2d8cf467df60d04d43bb1f796f4f86dbcd
Instruction Fuzzy Hash: 9011077291878287D725DF21F14412AB3E1FB99BA4F544235EB8907B18DB7CE994CF10

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report solara-executor.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
solara-executor.exe

Function 00007FF7C18D4720 Relevance: 37.6, APIs: 7, Strings: 14, Instructions: 892
windowCOMMON

Function 00007FF7C18CF7A0 Relevance: 36.9, APIs: 7, Strings: 14, Instructions: 150
libraryloaderCOMMON

Function 00007FF7C18D0330 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 182
keyboardCOMMON

Function 00007FF7C18D3F90 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 126
nativeCOMMON

Function 0000023D0FB2F46A Relevance: 8.0, APIs: 5, Instructions: 519
fileCOMMON

Function 0000023D0FC0CB40 Relevance: 7.7, APIs: 5, Instructions: 166
processCOMMON

Function 00007FF7C18CF2F0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 215
COMMON

Function 00007FF7C18D26C0 Relevance: 15.5, APIs: 10, Instructions: 516
COMMON

Function 00007FF7C18D41E0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 59
registryCOMMON

Function 00007FF7C18D6C10 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 151
windowCOMMON

Function 0000023D0FB06FE0 Relevance: 6.7, APIs: 4, Instructions: 693
processCOMMON

Function 0000023D0FCEA382 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 143
memoryCOMMON

Function 0000023D0FBE8720 Relevance: 4.7, APIs: 3, Instructions: 233
fileCOMMON