Edit tour

Windows Analysis Report
vRWw6y4Pj2.exe

Overview

General Information

Sample name:	vRWw6y4Pj2.exe renamed because original name is a hash value
Original sample name:	ef9b7b7b887de914fbff13cd604c7535.exe
Analysis ID:	1579722
MD5:	ef9b7b7b887de914fbff13cd604c7535
SHA1:	6803d33d4f9a0732d7c5e8d09f25e79b05519fd8
SHA256:	9443eac4c1234c3d968480a3ab01eb48107e85ff4f797d25f2ec918447e7904f
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Program does not show much activity (idle)

Classification

Process Tree

System is w10x64

vRWw6y4Pj2.exe (PID: 6536 cmdline: "C:\Users\user\Desktop\vRWw6y4Pj2.exe" MD5: EF9B7B7B887DE914FBFF13CD604C7535)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: vRWw6y4Pj2.exe	ReversingLabs: Detection: 52%
Source: vRWw6y4Pj2.exe	Virustotal: Detection: 45%			Perma Link

Source: vRWw6y4Pj2.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF7079F85A0 FindFirstFileExW,FindClose,	1_2_00007FF7079F85A0
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF707A10B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF707A10B84
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF7079F79B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_00007FF7079F79B0

Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF7079F1000	1_2_00007FF7079F1000
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF707A15C74	1_2_00007FF707A15C74
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF707A028C0	1_2_00007FF707A028C0
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF707A05040	1_2_00007FF707A05040
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF707A0D880	1_2_00007FF707A0D880
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF707A01074	1_2_00007FF707A01074
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF7079F9FCD	1_2_00007FF7079F9FCD
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF7079F979B	1_2_00007FF7079F979B
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF707A15728	1_2_00007FF707A15728
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF707A0FBD8	1_2_00007FF707A0FBD8
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF707A01F30	1_2_00007FF707A01F30
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF707A12F20	1_2_00007FF707A12F20
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF707A14F10	1_2_00007FF707A14F10
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF707A00E70	1_2_00007FF707A00E70
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF7079F95FB	1_2_00007FF7079F95FB
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF707A0CD6C	1_2_00007FF707A0CD6C
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF707A02CC4	1_2_00007FF707A02CC4
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF707A01484	1_2_00007FF707A01484
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF707A00C64	1_2_00007FF707A00C64
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF707A133BC	1_2_00007FF707A133BC
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF707A0FBD8	1_2_00007FF707A0FBD8
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF707A073F4	1_2_00007FF707A073F4
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF7079F8B20	1_2_00007FF7079F8B20
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF707A10B84	1_2_00007FF707A10B84
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF707A07AAC	1_2_00007FF707A07AAC
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF707A18A38	1_2_00007FF707A18A38
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF707A01280	1_2_00007FF707A01280
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF707A00A60	1_2_00007FF707A00A60
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF707A091B0	1_2_00007FF707A091B0
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF707A0D200	1_2_00007FF707A0D200
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF707A1518C	1_2_00007FF707A1518C

Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe

Code function: String function: 00007FF7079F25F0 appears 50 times

Source: classification engine

Classification label: mal48.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe

Code function: 1_2_00007FF7079F29E0 GetLastError,FormatMessageW,MessageBoxW,

1_2_00007FF7079F29E0

Source: vRWw6y4Pj2.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: vRWw6y4Pj2.exe	ReversingLabs: Detection: 52%
Source: vRWw6y4Pj2.exe	Virustotal: Detection: 45%

Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe

File read: C:\Users\user\Desktop\vRWw6y4Pj2.exe

Jump to behavior

Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Section loaded: wintypes.dll	Jump to behavior

Source: vRWw6y4Pj2.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: vRWw6y4Pj2.exe

Static file information: File size 12644226 > 1048576

Source: vRWw6y4Pj2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: vRWw6y4Pj2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: vRWw6y4Pj2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: vRWw6y4Pj2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: vRWw6y4Pj2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: vRWw6y4Pj2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: vRWw6y4Pj2.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: vRWw6y4Pj2.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: vRWw6y4Pj2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: vRWw6y4Pj2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: vRWw6y4Pj2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: vRWw6y4Pj2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: vRWw6y4Pj2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe

Code function: 1_2_00007FF7079F50B0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00007FF7079F50B0

Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_1-17446

Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe

API coverage: 6.4 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF7079F85A0 FindFirstFileExW,FindClose,	1_2_00007FF7079F85A0
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF707A10B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	1_2_00007FF707A10B84
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF7079F79B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	1_2_00007FF7079F79B0

Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe

Code function: 1_2_00007FF7079FC44C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_00007FF7079FC44C

Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe

Code function: 1_2_00007FF707A12790 GetProcessHeap,

1_2_00007FF707A12790

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF7079FC62C SetUnhandledExceptionFilter,	1_2_00007FF7079FC62C
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF7079FC44C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF7079FC44C
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF7079FBBC0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FF7079FBBC0
Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe	Code function: 1_2_00007FF707A09924 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00007FF707A09924

Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe

Code function: 1_2_00007FF707A18880 cpuid

1_2_00007FF707A18880

Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe

Code function: 1_2_00007FF7079FC330 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

1_2_00007FF7079FC330

Source: C:\Users\user\Desktop\vRWw6y4Pj2.exe

Code function: 1_2_00007FF707A14F10 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

1_2_00007FF707A14F10

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 DLL Side-Loading	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
vRWw6y4Pj2.exe	53%	ReversingLabs	Win64.Trojan.Generic
vRWw6y4Pj2.exe	46%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ax-0001.ax-msedge.net	150.171.27.10	true	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579722
Start date and time:	2024-12-23 08:05:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	vRWw6y4Pj2.exe renamed because original name is a hash value
Original Sample Name:	ef9b7b7b887de914fbff13cd604c7535.exe
Detection:	MAL
Classification:	mal48.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 20 Number of non-executed functions: 83
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.3.187.198, 23.218.208.109, 20.190.177.85, 20.223.35.26, 2.16.158.58, 13.107.246.63, 20.109.210.53, 150.171.27.10, 2.16.158.56, 20.103.156.88
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, tse1.mm.bing.net, g.bing.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, glb.cws.prod.dcat.dsp.trafficmanager.net, prod.fs.microsoft.com.akadns.net
Report size getting too big, too many NtSetInformationFile calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ax-0001.ax-msedge.net	2E814B7D-3F0B-4AF7-8C7C-C8AE7CD57525_12172024125634383.dll	Get hash	malicious	Unknown	Browse	150.171.28.10
	fKdiT1D1dk.exe	Get hash	malicious	RHADAMANTHYS	Browse	150.171.27.10
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	150.171.28.10
	uDTW3VjJJT.exe	Get hash	malicious	LummaC, Stealc	Browse	150.171.27.10
	BB4S2ErvqK.exe	Get hash	malicious	LummaC	Browse	150.171.28.10
	hvm4oOzDaX.exe	Get hash	malicious	Unknown	Browse	150.171.27.10
	SWIFT.xls	Get hash	malicious	Unknown	Browse	150.171.27.10
	https://click.pstmrk.it/3s/veed.io%2Fshare-video-link%3Ftoken%3DeyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3MzQ2MzE2NDgsImlhdCI6MTczNDYzMDc0OCwic3ViIjoiZmY0NTdiM2MtYjI3MC00YzA0LWEwOTEtYjY3ZDJkOGQ3ZTU1Iiwicm9sZXMiOltdLCJraWQiOiJwcm9qZWN0cy92ZWVkLXByb2Qtc2VydmVyL2xvY2F0aW9ucy9ldXJvcGUtd2VzdDEva2V5UmluZ3MvdmVlZC1wcm9kLWtleXJpbmcvY3J5cHRvS2V5cy92ZWVkLXByb2QtandrLWtleS9jcnlwdG9LZXlWZXJzaW9ucy8xIiwiZmVhdHVyZXMiOnt9LCJzY29wZXMiOltdfQ.f-EtSCYYeQiR4cEb8w5ABF3koXpbxl8QeFIarADkLP6q32DzsnFZl76Y98Uad7M8RBPPuOQOV9SUbCY1hRa4IbqV9_4cTm0v7DuBTCKOZbHN1NiATZOGw2BzdEMqIEfnNo5A_H2_DLVQZLtd6sZzcRoNBzbmcq2_xlzWgmqIErGV0VYXIb-Vac1b-3wmAgIyE-VS7Cd5aHYtVyiV9T5HfrpjPl7-M6dLIaQqm6103z7gO_qoKow1qbFmNgGaUsQED1CHbqo-hCgXzib7NToyu0Qq4kSl-2NEzgLMKy1zFR2J0E0vr9FHirjR9fmmDF2nk76Ht8L2WbV-dRyXZBZaUikfojo56vYWI9cfSQrG_awuFNR0M1s6dpPwumDM8sXlMZYt4u5WZaNcRZynPHXeqNZcdwKhlZrFN0U3B3U7B69avz_FlMxw6Or_0aeJkUP5YZP3wH-IIbwwa6es37u8G7gWYINEfp-pJlKV7klV1CcskLf_53iNx7MtxgvAXLMNZJ2tnuxY8W6w_E-pchjpNP2I5NV2Ui2_bNSgl3kBuX3oWsX0m_wL3MZ39pE3paPp2FAIgQPpZ5a0BhmPYsMk2IPPel2dll8j1IYBwHsZ5a1IHsHA6gTMWkJl-uhAjN4mnXo7Om0NWRZvfFvatgA4YCoTXdntM31GIZxAyWF9a14%26postLoginUrl%3D%252Fview%252F3ab9b7be-178c-4289-b29e-75921856f7f5%252F/oMlP/0SC6AQ/AQ/15f5e010-d260-490a-9e5d-79f5643b5481/1/HSOO9aL291	Get hash	malicious	Unknown	Browse	150.171.27.10
	https://p.placed.com/api/v2/sync/impression?partner=barkley&plaid=0063o000014sWgoAAE&version=1.0&payload_campaign_identifier=71700000100870630&payload_timestamp=5943094174221506287&payload_type=impression&redirect=http%3A%2F%2Fgoogle.com%2Famp%2Fs%2Fgoal.com.co%2Fwp%2Fpayment	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10
	ktyihkdfesf.exe	Get hash	malicious	Vidar	Browse	150.171.27.10

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.98760059638872
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	vRWw6y4Pj2.exe
File size:	12'644'226 bytes
MD5:	ef9b7b7b887de914fbff13cd604c7535
SHA1:	6803d33d4f9a0732d7c5e8d09f25e79b05519fd8
SHA256:	9443eac4c1234c3d968480a3ab01eb48107e85ff4f797d25f2ec918447e7904f
SHA512:	c3c15e5a373882ee0110b1f19080720b0ff693159dc40be9cf66a5a67f7804c7e49953e0d0895d144c3d959c83e05d37f7990d32e5a9d37d8e4253e807709dfd
SSDEEP:	393216:kzuRUAwf7vLF4NkW+eGQR6n/ikWMWfogBx:kzuRIx1W+e5R4qPDXj
TLSH:	33D63386D3F48DF1FCBA523C45854119E6B1742403F4C98FABAE81A61F533E19E3EA91
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Xhc.Xhc.Xhc...`._hc...f..hc...g.Rhc.....[hc...`.Qhc...g.Ihc...f.phc...b.Shc.Xhb..hc.K.g.Ahc.K.a.Yhc.RichXhc.........PE..d..

File Icon


Icon Hash:	0e9313214080a157

Static PE Info

General

Entrypoint:	0x14000c0d0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A26A8B [Thu Jul 25 15:08:59 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	456e8615ad4320c9f54e50319a19df9c

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F0978B26E7Ch
dec eax
add esp, 28h
jmp 00007F0978B26A9Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007F0978B27248h
test eax, eax
je 00007F0978B26C43h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F0978B26C27h
dec eax
cmp ecx, eax
je 00007F0978B26C36h
xor eax, eax
dec eax
cmpxchg dword ptr [0003843Ch], ecx
jne 00007F0978B26C10h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F0978B26C19h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007F0978B26C29h
mov byte ptr [00038425h], 00000001h
call 00007F0978B26375h
call 00007F0978B27660h
test al, al
jne 00007F0978B26C26h
xor al, al
jmp 00007F0978B26C36h
call 00007F0978B3416Fh
test al, al
jne 00007F0978B26C2Bh
xor ecx, ecx
call 00007F0978B27670h
jmp 00007F0978B26C0Ch
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [000383ECh], 00000000h
mov ebx, ecx
jne 00007F0978B26C89h
cmp ecx, 01h
jnbe 00007F0978B26C8Ch
call 00007F0978B271BEh
test eax, eax
je 00007F0978B26C4Ah
test ebx, ebx
jne 00007F0978B26C46h
dec eax
lea ecx, dword ptr [000383D6h]
call 00007F0978B33F62h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3c76c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x49000	0x2bb4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x46000	0x2208	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4c000	0x768	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x39dc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39c80	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x450	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29210	0x29400	aca64598002ecff9eefbc96554edf015	False	0.5511067708333334	data	6.4784482217419175	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12642	0x12800	08d780ef12591c348fa0fa0c8d771aa9	False	0.5245592271959459	data	5.750866127143705	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x73d8	0xe00	d0a288978c66419b180b35f625b6dce7	False	0.13532366071428573	data	1.8378139998458343	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x46000	0x2208	0x2400	74cf3ea22e0a1756984435d6f80f7da5	False	0.4671223958333333	data	5.259201915045256	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x49000	0x2bb4	0x2c00	e29fd86a5b73bf6fb312f4fd0e85b0b6	False	0.13893821022727273	data	2.837433433937152	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x4c000	0x768	0x800	71de9271648326ec88350e903470cf3e	False	0.5576171875	data	5.283119454571673	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x490e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.08143153526970955
RT_GROUP_ICON	0x4b690	0x14	data	1.15
RT_MANIFEST	0x4b6a4	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, GetLastError, FormatMessageW, GetModuleFileNameW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, CreateDirectoryW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, GetEnvironmentStringsW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, WaitForSingleObject, Sleep, GetCurrentProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, DeleteFileW, IsProcessorFeaturePresent, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Network Behavior

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 23, 2024 08:06:39.799082041 CET	1.1.1.1	192.168.2.6	0x1487	No error (0)	g-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 08:06:39.799082041 CET	1.1.1.1	192.168.2.6	0x1487	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:06:39.799082041 CET	1.1.1.1	192.168.2.6	0x1487	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false

Target ID:	1
Start time:	02:06:17
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\vRWw6y4Pj2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\vRWw6y4Pj2.exe"
Imagebase:	0x7ff7079f0000
File size:	12'644'226 bytes
MD5 hash:	EF9B7B7B887DE914FBFF13CD604C7535
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	26

Executed Functions

Function 00007FF7079F1000 Relevance: 40.6, APIs: 5, Strings: 18, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

pyi-contents-directory, xrefs: 00007FF7079F35F8
MEI, xrefs: 00007FF7079F374E
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF7079F3820
_MEIPASS2, xrefs: 00007FF7079F36A2, 00007FF7079F36AE, 00007FF7079F39AC
pyi-disable-windowed-traceback, xrefs: 00007FF7079F361D
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF7079F378C
Could not create temporary directory!, xrefs: 00007FF7079F3838
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF7079F3905
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF7079F36FC
Failed to convert DLL search path!, xrefs: 00007FF7079F38A3
ERROR: failed to remove temporary directory: %s, xrefs: 00007FF7079F3A12
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF7079F37EF
WARNING: failed to remove temporary directory: %s, xrefs: 00007FF7079F3A31
pyi-runtime-tmpdir, xrefs: 00007FF7079F35D3
Failed to start splash screen!, xrefs: 00007FF7079F3933
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF7079F3653
pkg, xrefs: 00007FF7079F37CF
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF7079F391A

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: FileModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$ERROR: failed to remove temporary directory: %s$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$MEI$PYINSTALLER_STRICT_UNPACK_MODE$Path exceeds PYI_PATH_MAX limit.$WARNING: failed to remove temporary directory: %s$_MEIPASS2$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-runtime-tmpdir
API String ID: 514040917-585287483
Opcode ID: f1770e319abfa29e3ed3a0f96f66652fb7dde05eac488e8e917425ea2983622d
Instruction ID: 62cd2c53b52a15a220e4b31ac05c993d6d37dbd3e7b1141385b7bac2d706ae20
Opcode Fuzzy Hash: f1770e319abfa29e3ed3a0f96f66652fb7dde05eac488e8e917425ea2983622d
Instruction Fuzzy Hash: D4F18CA1A28783A1FB18FB25DD552F9A361AF45780FC44032DA1D436D6EF2CE56AC360

Function 00007FF707A15C74 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF707A159A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF707A159E9
Part of subcall function 00007FF707A159A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF707A15A67
Part of subcall function 00007FF707A159A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF707A15AB8

CreateFileW.KERNELBASE ref: 00007FF707A15D7A
CreateFileW.KERNEL32 ref: 00007FF707A15DCA
GetLastError.KERNEL32 ref: 00007FF707A15DFA
GetFileType.KERNELBASE ref: 00007FF707A15E0F
GetLastError.KERNEL32 ref: 00007FF707A15E19
CloseHandle.KERNEL32 ref: 00007FF707A15E4C
CloseHandle.KERNEL32 ref: 00007FF707A15FAF
CreateFileW.KERNEL32 ref: 00007FF707A15FE4
GetLastError.KERNEL32 ref: 00007FF707A15FF3

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
Instruction ID: fe6f854e6f4c0fca1fbbe4291f83ce86092f99c97a32564259c7db34c11f4fd1
Opcode Fuzzy Hash: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
Instruction Fuzzy Hash: EEC1B276B28A4185FB10DF69C880AAC7761FB89B98B415235DF2E977D4CF38D462C360

Function 00007FF7079F85A0 Relevance: 3.0, APIs: 2, Instructions: 29
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF7079F85D3
FindClose.KERNELBASE ref: 00007FF7079F85E2

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
Instruction ID: 789a80a83ead715c88e68f3963b75c78320679457a86672a199f532e2a474670
Opcode Fuzzy Hash: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
Instruction Fuzzy Hash: C6F06862A2D64286F7A09F64F849B66B390AF84768F850335D96D026D4DF3CD05A8A14

Function 00007FF7079F18F0 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7079F76A0: _fread_nolock.LIBCMT ref: 00007FF7079F774A

_fread_nolock.LIBCMT ref: 00007FF7079F19B4

Part of subcall function 00007FF7079F2760: MessageBoxW.USER32 ref: 00007FF7079F283B

Strings

Could not allocate memory for archive structure!, xrefs: 00007FF7079F19EE
MEI, xrefs: 00007FF7079F1931
malloc, xrefs: 00007FF7079F1AA8
Could not read full TOC!, xrefs: 00007FF7079F1AD4
Could not allocate buffer for TOC!, xrefs: 00007FF7079F1AA1
calloc, xrefs: 00007FF7079F19F5
Failed to read cookie!, xrefs: 00007FF7079F19BF
Failed to seek to cookie position!, xrefs: 00007FF7079F1989
Error on file., xrefs: 00007FF7079F1B0A
fseek, xrefs: 00007FF7079F1990
fread, xrefs: 00007FF7079F19C6, 00007FF7079F1ADB

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: _fread_nolock$Message
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 677216364-3497178890
Opcode ID: 620aea597a158353c9f1a37f88c06735d5bdd80b8431eba8f18faed9ceb3e2c9
Instruction ID: d47f74af4d0afbe97d8ceb596ccbe7aef7bffc256507200c12b8b763785e4d97
Opcode Fuzzy Hash: 620aea597a158353c9f1a37f88c06735d5bdd80b8431eba8f18faed9ceb3e2c9
Instruction Fuzzy Hash: C07184B1A2868BC5EB20EB28D8507B9A391FF48785F844035D98D47799EF2CE5478760

Function 00007FF707A0AD6C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF707A0B199

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 68a47ba86f230bb5d63a3bd262fc543bc7d5861b4e9f61d57eff9af495398285
Instruction ID: affda7fa63f696c165de75bab3d1fb5b24d683f1ec917269e61cf1f8454c4416
Opcode Fuzzy Hash: 68a47ba86f230bb5d63a3bd262fc543bc7d5861b4e9f61d57eff9af495398285
Instruction Fuzzy Hash: 43C1F6E290C78695E610AB289C00ABEB751FF91BC1F954931DA5D83791CF7CE85783B0

Function 00007FF7079F33E0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7079F3534), ref: 00007FF7079F3411

Part of subcall function 00007FF7079F29E0: GetLastError.KERNEL32(?,?,?,00007FF7079F342E,?,00007FF7079F3534), ref: 00007FF7079F2A14
Part of subcall function 00007FF7079F29E0: FormatMessageW.KERNEL32(?,?,?,00007FF7079F342E), ref: 00007FF7079F2A7D
Part of subcall function 00007FF7079F29E0: MessageBoxW.USER32 ref: 00007FF7079F2ACF

Strings

Failed to convert executable path to UTF-8., xrefs: 00007FF7079F34B8
GetModuleFileNameW, xrefs: 00007FF7079F3422
Failed to obtain executable path., xrefs: 00007FF7079F341B
Failed to resolve full path to executable %ls., xrefs: 00007FF7079F3461
\\?\, xrefs: 00007FF7079F3482

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: Message$ErrorFileFormatLastModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 517058245-2863816727
Opcode ID: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
Instruction ID: e60028dffde2be2469e5cfb323ee468589feb00a88ad4abee17510cc2dce6995
Opcode Fuzzy Hash: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
Instruction Fuzzy Hash: BF2171A1B2C54391FA61BB28EC517B9D250BF49395FC00136D65D866E5EF2CE507C730

Function 00007FF7079F25F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7079F86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7079F3FA4,00000000,00007FF7079F1925), ref: 00007FF7079F86E9

MessageBoxW.USER32 ref: 00007FF7079F2686
MessageBoxA.USER32 ref: 00007FF7079F269A

Strings

Error/warning (ANSI fallback), xrefs: 00007FF7079F268E
Error, xrefs: 00007FF7079F2677

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error$Error/warning (ANSI fallback)
API String ID: 1878133881-653037927
Opcode ID: f4c9aea142df8fc367965a88b37001c6795115f60fce42f8f88369c54fa23369
Instruction ID: d4068887c32aa36b23ac310cd0c03c12e5c4f88bef5bb00ae4b91ee379b77e71
Opcode Fuzzy Hash: f4c9aea142df8fc367965a88b37001c6795115f60fce42f8f88369c54fa23369
Instruction Fuzzy Hash: C21190B2628B8681FA20AB14F851BA9B364FF48784FD01136DA4C47644CF3CD606C760

Function 00007FF7079FBF5C Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7079FC12C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7079FC140

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7079FBF80
__scrt_release_startup_lock.LIBCMT ref: 00007FF7079FBFEE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7079FC041

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
Instruction ID: 5663a80ca937884bcc36155d0ebbd6c88f9cf421991eb5d70dfebf5b33eff57f
Opcode Fuzzy Hash: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
Instruction Fuzzy Hash: 02313A91E2C64B81FA54BB689C127B993919F46384FC88435E90E477D3DF2DA807C275

Function 00007FF707A08D48 Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF707A08D44), ref: 00007FF707A08D59
TerminateProcess.KERNEL32(?,?,?,00007FF707A08D44), ref: 00007FF707A08D64
ExitProcess.KERNEL32 ref: 00007FF707A08D73

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 824606f6feba241c18d37bd9947fb033388d99e3127919417550cde66a1966b4
Instruction ID: fc569db753d76504541e96bb10d88038a84c9024faeea732515eceb14185235e
Opcode Fuzzy Hash: 824606f6feba241c18d37bd9947fb033388d99e3127919417550cde66a1966b4
Instruction Fuzzy Hash: 64D09ED0F1960687FB587B785C9997992115F5C702F901938D84B463A3DF3CA81F43B4

Function 00007FF7079FF45C Relevance: 3.2, APIs: 2, Instructions: 177
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7079FF4A0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7079FF597

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bcfcf1faf55df9f9e23f958511fce33fc2a490ff62131b022dace26bbec7c8c2
Instruction ID: f3753b1836bacc79054fe5b2e5f967d759cee65600e7c44b1567c99304b9ed6d
Opcode Fuzzy Hash: bcfcf1faf55df9f9e23f958511fce33fc2a490ff62131b022dace26bbec7c8c2
Instruction Fuzzy Hash: 4651C962B1968746F624BE399C04A7AA292FF44BB4F944734DD7D477D5CF3CE4028620

Function 00007FF707A0B444 Relevance: 3.0, APIs: 2, Instructions: 46
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF707A0B5DD), ref: 00007FF707A0B490
GetLastError.KERNEL32(?,?,?,?,?,00007FF707A0B5DD), ref: 00007FF707A0B49A

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
Instruction ID: efb92377010c812123f6f7b23e21ac8535849d8c6a45c13830e408ddd6bfcf46
Opcode Fuzzy Hash: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
Instruction Fuzzy Hash: 2811C1E1A08A8181DA10AB29AD44579A361FF44BF4F940731EE7D47BE9CF7CD15287A0

Function 00007FF707A09E68 Relevance: 2.6, APIs: 2, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF707A09CE5,?,?,00000000,00007FF707A09D9A), ref: 00007FF707A09ED6
GetLastError.KERNEL32(?,?,?,00007FF707A09CE5,?,?,00000000,00007FF707A09D9A), ref: 00007FF707A09EE0

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
Instruction ID: a748b8d0ee1beaf9eb82687c94cc21b2f5a13ab422aa85f49e1314a026067a79
Opcode Fuzzy Hash: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
Instruction Fuzzy Hash: 8821D791F1C68240FE54B77DAC4077E92915F847A1F840A35EA2D873D2CF6CB84383A1

Function 00007FF707A0B1BC Relevance: 1.6, APIs: 1, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF707A0B1E4

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: aa739a885bc1dd54b6575df94a709b393c0322d321e92581108345db9e2bb901
Instruction ID: a9cdffff2838f18c5dda1d7c134ec7e9d0e9f7ae2cb49b5b1aad2fb8a11db608
Opcode Fuzzy Hash: aa739a885bc1dd54b6575df94a709b393c0322d321e92581108345db9e2bb901
Instruction Fuzzy Hash: 1741B6B290824147EA24AB3DAE5157EB3A0EF55782F540531D69DC3691CF3CE503C7B1

Function 00007FF7079F76A0 Relevance: 1.6, APIs: 1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fread_nolock.LIBCMT ref: 00007FF7079F774A

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: dd5b2227001afc13c5a7990e13e49d1c192561707a6cc0805bc8ebd48f98ae76
Instruction ID: 99ce88e23023d280247e0ba5daa9dda8e59014eebb364af9869d9c26b74a95c9
Opcode Fuzzy Hash: dd5b2227001afc13c5a7990e13e49d1c192561707a6cc0805bc8ebd48f98ae76
Instruction Fuzzy Hash: 6A216021B3869245FA10BA66AD047BAE651BF49BD4FC84430EE0D4B786DF7DE043C620

Function 00007FF707A0AC4C Relevance: 1.6, APIs: 1, Instructions: 79
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF707A0ACD2

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 41d876f7d863186cb99ffae5cfc70294694b7844598519de76c307bd1dc1648a
Instruction ID: b834407d89da3eb635f7606e498dae412788e26c5e5fca4058f0d76726846acf
Opcode Fuzzy Hash: 41d876f7d863186cb99ffae5cfc70294694b7844598519de76c307bd1dc1648a
Instruction Fuzzy Hash: 1931B2A2A1868182E6057B7D9C40B7DA650AF54BA2F814935DA1D833D2CF7CE45383B1

Function 00007FF707A08C79 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF707A08CA7

Part of subcall function 00007FF707A08DA0: GetModuleHandleExW.KERNEL32 ref: 00007FF707A08DC5
Part of subcall function 00007FF707A08DA0: GetProcAddress.KERNEL32 ref: 00007FF707A08DDB
Part of subcall function 00007FF707A08DA0: FreeLibrary.KERNEL32 ref: 00007FF707A08E02

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: ce8bbb5f42c0c70f8d6cb0f644a2b9beff4cd55938d93e86477bcb8353de4fc0
Instruction ID: 4caf3c147920db4a52f4b5dee5cefcd6238a427bcb5231240c95a3754b5de4fe
Opcode Fuzzy Hash: ce8bbb5f42c0c70f8d6cb0f644a2b9beff4cd55938d93e86477bcb8353de4fc0
Instruction Fuzzy Hash: BE21A1B2A167058AEB24AF78C8506EC73B0FF04719F840A3AD61C86AC5DF3CD446C7A4

Function 00007FF707A052A4 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF707A05209

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
Instruction ID: 10867722c7c56b2a99ceddd7520e6da88194f5d98529a4e35d96f6996b08a431
Opcode Fuzzy Hash: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
Instruction Fuzzy Hash: 3211A761E0D68141EA60BF799C00D7EE2A4BF59B81FC44831EB4CD7696CF3CD4628BA1

Function 00007FF707A15664 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF707A15687

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
Instruction ID: 7ae0c5dffc73712f7318144eb94c4300e84b0b538a6da3778e248dad25db5611
Opcode Fuzzy Hash: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
Instruction Fuzzy Hash: 262198B2A1868186EB61AF1CD840779B661EFC4B94F984234D65D877D5DF3CD412CB10

Function 00007FF7079FF6DC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7079FF730

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
Instruction ID: d072bc910d00dedc8f41672b653c737bd0147e85bec807a8dc65c1b9d4d16b47
Opcode Fuzzy Hash: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
Instruction Fuzzy Hash: 6501C461A1878341EA04FF669D0046AE696BF96FE0F884631EE6C53BD6DF3CE5138710

Function 00007FF707A0C90C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF7079FFFB0,?,?,?,00007FF707A0161A,?,?,?,?,?,00007FF707A02E09), ref: 00007FF707A0C94A

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
Instruction ID: 3ec25def307bf4bd984e8fe566c8a4d124d631b24b5c7b33e52ace2d8074d70a
Opcode Fuzzy Hash: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
Instruction Fuzzy Hash: 9CF03A80F1824744FE1476B95C11AB591805F487B2F880B30A96EC56C1EF1CA45382B0

Non-executed Functions

Function 00007FF7079F50B0 Relevance: 157.9, APIs: 44, Strings: 46, Instructions: 364libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF7079F5C57,?,00007FF7079F308E), ref: 00007FF7079F50C0
GetProcAddress.KERNEL32(?,00007FF7079F5C57,?,00007FF7079F308E), ref: 00007FF7079F5101
GetProcAddress.KERNEL32(?,00007FF7079F5C57,?,00007FF7079F308E), ref: 00007FF7079F5126
GetProcAddress.KERNEL32(?,00007FF7079F5C57,?,00007FF7079F308E), ref: 00007FF7079F514B
GetProcAddress.KERNEL32(?,00007FF7079F5C57,?,00007FF7079F308E), ref: 00007FF7079F5173
GetProcAddress.KERNEL32(?,00007FF7079F5C57,?,00007FF7079F308E), ref: 00007FF7079F519B
GetProcAddress.KERNEL32(?,00007FF7079F5C57,?,00007FF7079F308E), ref: 00007FF7079F51C3
GetProcAddress.KERNEL32(?,00007FF7079F5C57,?,00007FF7079F308E), ref: 00007FF7079F51EB
GetProcAddress.KERNEL32(?,00007FF7079F5C57,?,00007FF7079F308E), ref: 00007FF7079F5213

Strings

Py_PreInitialize, xrefs: 00007FF7079F51B9, 00007FF7079F51D5
PyObject_GetAttrString, xrefs: 00007FF7079F5551, 00007FF7079F556D
PyUnicode_Replace, xrefs: 00007FF7079F5781, 00007FF7079F579D
PyImport_AddModule, xrefs: 00007FF7079F53E9, 00007FF7079F5405
Py_ExitStatusException, xrefs: 00007FF7079F511C, 00007FF7079F5138
PySys_GetObject, xrefs: 00007FF7079F5641, 00007FF7079F565D
PyErr_NormalizeException, xrefs: 00007FF7079F5321, 00007FF7079F533D
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF7079F55C9, 00007FF7079F55E5
PyObject_Str, xrefs: 00007FF7079F55A1, 00007FF7079F55BD
PyMarshal_ReadObjectFromString, xrefs: 00007FF7079F5489, 00007FF7079F54A5
PyObject_CallFunction, xrefs: 00007FF7079F5501, 00007FF7079F551D
PyList_Append, xrefs: 00007FF7079F5461, 00007FF7079F547D
PyConfig_SetBytesString, xrefs: 00007FF7079F5259, 00007FF7079F5275
Py_Finalize, xrefs: 00007FF7079F5141, 00007FF7079F515D
PyUnicode_Join, xrefs: 00007FF7079F5759, 00007FF7079F5775
Py_InitializeFromConfig, xrefs: 00007FF7079F5169, 00007FF7079F5185
PyUnicode_FromString, xrefs: 00007FF7079F5731, 00007FF7079F574D
PyObject_SetAttrString, xrefs: 00007FF7079F5579, 00007FF7079F5595
PyConfig_SetWideStringList, xrefs: 00007FF7079F52A9, 00007FF7079F52C5
Py_DecRef, xrefs: 00007FF7079F50B6, 00007FF7079F50D2
Py_IsInitialized, xrefs: 00007FF7079F5191, 00007FF7079F51AD
PyUnicode_Decode, xrefs: 00007FF7079F56B9, 00007FF7079F56D5
GetProcAddress, xrefs: 00007FF7079F50E0
PyUnicode_DecodeFSDefault, xrefs: 00007FF7079F56E1, 00007FF7079F56FD
PyImport_ExecCodeModule, xrefs: 00007FF7079F5411, 00007FF7079F542D
PyConfig_InitIsolatedConfig, xrefs: 00007FF7079F5209, 00007FF7079F5225
PyRun_SimpleStringFlags, xrefs: 00007FF7079F55F1, 00007FF7079F560D
PyConfig_Clear, xrefs: 00007FF7079F51E1, 00007FF7079F51FD
PyModule_GetDict, xrefs: 00007FF7079F54D9, 00007FF7079F54F5
Py_DecodeLocale, xrefs: 00007FF7079F50F7, 00007FF7079F5113
PySys_SetObject, xrefs: 00007FF7079F5669, 00007FF7079F5685
PyStatus_Exception, xrefs: 00007FF7079F5619, 00007FF7079F5635
PyUnicode_AsUTF8, xrefs: 00007FF7079F5691, 00007FF7079F56AD
PyConfig_Read, xrefs: 00007FF7079F5231, 00007FF7079F524D
PyErr_Occurred, xrefs: 00007FF7079F5349, 00007FF7079F5365
PyUnicode_FromFormat, xrefs: 00007FF7079F5709, 00007FF7079F5725
PyMem_RawFree, xrefs: 00007FF7079F54B1, 00007FF7079F54CD
PyErr_Fetch, xrefs: 00007FF7079F52F9, 00007FF7079F5315
PyErr_Restore, xrefs: 00007FF7079F5399, 00007FF7079F53B5
PyEval_EvalCode, xrefs: 00007FF7079F53C1, 00007FF7079F53DD
PyImport_ImportModule, xrefs: 00007FF7079F5439, 00007FF7079F5455
PyObject_CallFunctionObjArgs, xrefs: 00007FF7079F5529, 00007FF7079F5545
PyErr_Print, xrefs: 00007FF7079F5371, 00007FF7079F538D
PyConfig_SetString, xrefs: 00007FF7079F5281, 00007FF7079F529D
PyErr_Clear, xrefs: 00007FF7079F52D1, 00007FF7079F52ED
Failed to get address for %hs, xrefs: 00007FF7079F50D9

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 190572456-2007157414
Opcode ID: 3c804ccaf4812c993b4970aca99c844c8aa25bcf6244ab31ff714926eb913965
Instruction ID: ecbf5e6b055c44e724f83941b8edb52262f72f4dba64aa056435c1c0888f2c58
Opcode Fuzzy Hash: 3c804ccaf4812c993b4970aca99c844c8aa25bcf6244ab31ff714926eb913965
Instruction Fuzzy Hash: CD1296E499EB0391FA55FB08AC509B4A3A0AF09761BD92435D81E123A0FF7CB55BC370

Function 00007FF707A133BC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF707A1340A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF707A13A76
_invalid_parameter_noinfo.LIBCMT ref: 00007FF707A13BEC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF707A13EAA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF707A140CA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF707A14307
memcpy_s.LIBCPMT ref: 00007FF707A143E2
memcpy_s.LIBCPMT ref: 00007FF707A1448D
memcpy_s.LIBCPMT ref: 00007FF707A1455C

Strings

1#QNAN, xrefs: 00007FF707A13523
1#SNAN, xrefs: 00007FF707A1351A
1#INF, xrefs: 00007FF707A13533
1#IND, xrefs: 00007FF707A134F7

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 006b587dceb6a8e5448b800068f928c3aefb42c20130fc8eaa47f3b19415637c
Instruction ID: c4679132e372f36dd6904c78bd52129b8c14760be43ae1c9c9318aec08e1bd07
Opcode Fuzzy Hash: 006b587dceb6a8e5448b800068f928c3aefb42c20130fc8eaa47f3b19415637c
Instruction Fuzzy Hash: E4B2E6B2A182828BFB659F6DD840BFDB7A1FF54384F845135DA0D57B84DB38A902CB50

Function 00007FF7079F79B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00007FF7079F7EF9,00007FF7079F39E6), ref: 00007FF7079F7A1B
RemoveDirectoryW.KERNEL32(?,00007FF7079F7EF9,00007FF7079F39E6), ref: 00007FF7079F7A9E
DeleteFileW.KERNEL32(?,00007FF7079F7EF9,00007FF7079F39E6), ref: 00007FF7079F7ABD
FindNextFileW.KERNEL32(?,00007FF7079F7EF9,00007FF7079F39E6), ref: 00007FF7079F7ACB
FindClose.KERNEL32(?,00007FF7079F7EF9,00007FF7079F39E6), ref: 00007FF7079F7ADC
RemoveDirectoryW.KERNEL32(?,00007FF7079F7EF9,00007FF7079F39E6), ref: 00007FF7079F7AE5

Strings

%s\*, xrefs: 00007FF7079F79E2

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 37c75c647de740c4d03e434983ba542f23ef98c0d39288f6f50529afbb256bed
Instruction ID: d4a30aedf41bc48a3a35f8a7a4aa774064a5c9cf9512c9bdeec9c78952bbc41d
Opcode Fuzzy Hash: 37c75c647de740c4d03e434983ba542f23ef98c0d39288f6f50529afbb256bed
Instruction Fuzzy Hash: BC41C261A2D94391FA20BB68EC449B9A361FF98750FC10632D99D436D4DF3CD64BC720

Function 00007FF7079F9FCD Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

invalid distance too far back, xrefs: 00007FF7079FA990
invalid distances set, xrefs: 00007FF7079FA4C0
invalid literal/length code, xrefs: 00007FF7079FA702
invalid distance code, xrefs: 00007FF7079FA8D4
invalid code -- missing end-of-block, xrefs: 00007FF7079FA3E6
invalid literal/lengths set, xrefs: 00007FF7079FA453
too many length or distance symbols, xrefs: 00007FF7079FA166
invalid bit length repeat, xrefs: 00007FF7079FA3B9
invalid code lengths set, xrefs: 00007FF7079FA14D

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 7289e34dee421d23927a0f8f8a094fde9ef8b8d5e9feb20e52711e481e6fcba8
Instruction ID: de21560019932b214412b07bfa4361a564c994d3c919ac92bcdb9afb527814a2
Opcode Fuzzy Hash: 7289e34dee421d23927a0f8f8a094fde9ef8b8d5e9feb20e52711e481e6fcba8
Instruction Fuzzy Hash: 7752F672A286A64BD7A49F14C858B7E7BE9FF45340F818139E64E87780DB3CE845CB50

Function 00007FF7079FC44C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7079FC468
RtlCaptureContext.KERNEL32 ref: 00007FF7079FC495
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7079FC4AF
RtlVirtualUnwind.KERNEL32 ref: 00007FF7079FC4F0
IsDebuggerPresent.KERNEL32 ref: 00007FF7079FC544
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7079FC561
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7079FC56C

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
Instruction ID: 91e560971d16e0d64d61e6eff8a1f9f7a1c333119f9ea62c933990aa68dd6074
Opcode Fuzzy Hash: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
Instruction Fuzzy Hash: D5316DB2618B8186EB60AF64E8407FEB365FF85744F84403ADA4D47B98DF38D549C720

Function 00007FF7079F29E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7079F342E,?,00007FF7079F3534), ref: 00007FF7079F2A14
FormatMessageW.KERNEL32(?,?,?,00007FF7079F342E), ref: 00007FF7079F2A7D
MessageBoxW.USER32 ref: 00007FF7079F2ACF

Strings

%ls%ls: %ls, xrefs: 00007FF7079F2A96
Error, xrefs: 00007FF7079F2ABE
<FormatMessageW failed.>, xrefs: 00007FF7079F2A83

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: Message$ErrorFormatLast
String ID: %ls%ls: %ls$<FormatMessageW failed.>$Error
API String ID: 3971115935-1149178304
Opcode ID: 0ded6d4e5eeb2df7dd6c32992adf891535d6bffb348d119068df09e90069f5ad
Instruction ID: 59d5e211cd619bdbb4ded2f9b4ec78ae6815d3d0601b2a55722a82baf9e819db
Opcode Fuzzy Hash: 0ded6d4e5eeb2df7dd6c32992adf891535d6bffb348d119068df09e90069f5ad
Instruction Fuzzy Hash: 832115B2618A8581F720AB14F8506DAB3A4FF88784F900136EACD53B58DF7CD557C754

Function 00007FF707A14F10 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF707A14F55

Part of subcall function 00007FF707A148A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF707A148BC

Part of subcall function 00007FF707A09C58: HeapFree.KERNEL32(?,?,?,00007FF707A12032,?,?,?,00007FF707A1206F,?,?,00000000,00007FF707A12535,?,?,?,00007FF707A12467), ref: 00007FF707A09C6E
Part of subcall function 00007FF707A09C58: GetLastError.KERNEL32(?,?,?,00007FF707A12032,?,?,?,00007FF707A1206F,?,?,00000000,00007FF707A12535,?,?,?,00007FF707A12467), ref: 00007FF707A09C78

Part of subcall function 00007FF707A09C10: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF707A09BEF,?,?,?,?,?,00007FF707A09ADA), ref: 00007FF707A09C19
Part of subcall function 00007FF707A09C10: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF707A09BEF,?,?,?,?,?,00007FF707A09ADA), ref: 00007FF707A09C3E

_get_daylight.LIBCMT ref: 00007FF707A14F44

Part of subcall function 00007FF707A14908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF707A1491C

_get_daylight.LIBCMT ref: 00007FF707A151BA
_get_daylight.LIBCMT ref: 00007FF707A151CB
_get_daylight.LIBCMT ref: 00007FF707A151DC
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF707A1541C), ref: 00007FF707A15203

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: ec3da476d7abf2ffb0f6397319154e28f094a84f5b0708b50d9998a811af1003
Instruction ID: 3b5c8fa3f04e449474397f1380b7996214fcc187a5a4b32e114fdfa9bf6facc2
Opcode Fuzzy Hash: ec3da476d7abf2ffb0f6397319154e28f094a84f5b0708b50d9998a811af1003
Instruction Fuzzy Hash: 0BD1AFA6E1829286F724BF2DDC509B9A391EF84784FC44135EA0D47B85DF3CE452C760

Function 00007FF707A09924 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF707A0999D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF707A099B5
RtlVirtualUnwind.KERNEL32 ref: 00007FF707A099F0
IsDebuggerPresent.KERNEL32 ref: 00007FF707A09A29
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF707A09A33
UnhandledExceptionFilter.KERNEL32 ref: 00007FF707A09A3E

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
Instruction ID: 69aef0dad878db75fd9943ca368d339436260ae8a6704f0bd4c192a7a19d4c07
Opcode Fuzzy Hash: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
Instruction Fuzzy Hash: 79317472618B8185EB60DF29EC406AEB3A4FF88754F940135EA9D43B65DF3CD156CB10

Function 00007FF707A10B84 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF707A10BD0
FindFirstFileExW.KERNEL32 ref: 00007FF707A10CDA

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 537ca4dcf685df196dbb745ebf7a8e3eb288cf6b089b90446fc853c3fde494ee
Instruction ID: 45cf56317943458990a51ac8d33133dccfdfb2934b5ae0bcabba9fdbe8d7d9e2
Opcode Fuzzy Hash: 537ca4dcf685df196dbb745ebf7a8e3eb288cf6b089b90446fc853c3fde494ee
Instruction Fuzzy Hash: 85B1B7A6B1969681FA60AB2A9C009BBF391EF44BE4F845131ED5D47BC5DF3CE482C710

Function 00007FF707A1518C Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF707A151BA

Part of subcall function 00007FF707A14908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF707A1491C

_get_daylight.LIBCMT ref: 00007FF707A151CB

Part of subcall function 00007FF707A148A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF707A148BC

_get_daylight.LIBCMT ref: 00007FF707A151DC

Part of subcall function 00007FF707A148D8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF707A148EC

Part of subcall function 00007FF707A09C58: HeapFree.KERNEL32(?,?,?,00007FF707A12032,?,?,?,00007FF707A1206F,?,?,00000000,00007FF707A12535,?,?,?,00007FF707A12467), ref: 00007FF707A09C6E
Part of subcall function 00007FF707A09C58: GetLastError.KERNEL32(?,?,?,00007FF707A12032,?,?,?,00007FF707A1206F,?,?,00000000,00007FF707A12535,?,?,?,00007FF707A12467), ref: 00007FF707A09C78

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF707A1541C), ref: 00007FF707A15203

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 246ddfbbe37c4787f9720b27dc9f743496b3bb1ed6dcb5155dd6029a6c9a153e
Instruction ID: 4101d1f353a27ebab3f4e44e0a2199d081c17b9a415caa2c15351866a54be879
Opcode Fuzzy Hash: 246ddfbbe37c4787f9720b27dc9f743496b3bb1ed6dcb5155dd6029a6c9a153e
Instruction Fuzzy Hash: A95170B2E1868286F710FF2DEC909A9A360BF88784F844135EA0D87795DF3CE4528760

Function 00007FF7079FC330 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7079FC35C
GetCurrentThreadId.KERNEL32 ref: 00007FF7079FC36A
GetCurrentProcessId.KERNEL32 ref: 00007FF7079FC376
QueryPerformanceCounter.KERNEL32 ref: 00007FF7079FC386

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
Instruction ID: b2441ebf8f30315191a2fc1df7ad746a484bc32a703fb81d4c50b1aaad015d96
Opcode Fuzzy Hash: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
Instruction Fuzzy Hash: 53114C62B18B458AEB00DB64EC446A873A4FB59758F840E31DA2D46BA4DF7CD19A8350

Function 00007FF707A12F20 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF707A12F86
memcpy_s.LIBCPMT ref: 00007FF707A12FB1

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: b41cb84a548d2e61bdeb7bb10330278f5fecde395d7a0ce6ff99175555b28b3c
Instruction ID: 119e9e951df09d024f8ffcd62f658cf2bb1ba4c434903ba699b7644575e7fa83
Opcode Fuzzy Hash: b41cb84a548d2e61bdeb7bb10330278f5fecde395d7a0ce6ff99175555b28b3c
Instruction Fuzzy Hash: CBC1E4B2B1868687EF24DF19A444A6AF791FB94B84F858135DB4E47784DF3DE802CB00

Function 00007FF7079F979B Relevance: 4.1, Strings: 3, Instructions: 397COMMON

Download Yara Rule

Strings

, xrefs: 00007FF7079F987B
header crc mismatch, xrefs: 00007FF7079F9C41
unknown header flags set, xrefs: 00007FF7079F97E5

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: 6a55f11302ef793728786adf415505d571280719f8ef56880a9f0a37636d8ec0
Instruction ID: db3175ae7911c313068d75d73aee554952e9931f521dc2183f4c15ef3906bdd6
Opcode Fuzzy Hash: 6a55f11302ef793728786adf415505d571280719f8ef56880a9f0a37636d8ec0
Instruction Fuzzy Hash: E7F1C572A283C64BE7A5AF19C888F3ABAEDEF44754F454534DA4D87390CB38E442C750

Function 00007FF707A18A38 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF707A18C87
RaiseException.KERNEL32 ref: 00007FF707A18C98

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 4367feba8b0fb5a89db2d79700bffb7903d016d74ce2a4ac284103265cf95646
Instruction ID: 94df3fcb8e47977c11621cec48ce7bf9205d699461f01d2e1c9899416c8d1057
Opcode Fuzzy Hash: 4367feba8b0fb5a89db2d79700bffb7903d016d74ce2a4ac284103265cf95646
Instruction Fuzzy Hash: 31B158B3605B898AEB15CF2DC88676C7BA0FB44B98F198931DA5D837A4CB3DD452C710

Function 00007FF707A02CC4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF707A03074
, xrefs: 00007FF707A02E32

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 25965de2e6678be5c8c686b25b3b835ec4bf2bfab2b797158b347abdb642f747
Instruction ID: 7eb3daaf67f90041641a08731f44d278227caa7b263f7e4f1001f0e23ba17017
Opcode Fuzzy Hash: 25965de2e6678be5c8c686b25b3b835ec4bf2bfab2b797158b347abdb642f747
Instruction Fuzzy Hash: 89E1F7B2A0970285EB68AE3DC854A3DB760FF44B49F944935DA0E836D4DF39D853C390

Function 00007FF7079F95FB Relevance: 2.7, Strings: 2, Instructions: 218COMMON

Download Yara Rule

Strings

invalid window size, xrefs: 00007FF7079F9769
incorrect header check, xrefs: 00007FF7079F9782

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: 226024973a440a2a6261c5f164d8bafa30541a105b972a390c392a8354fe07a0
Instruction ID: b31135776488e88942ca5c3dac62bd1fe19bd309fcbd3cd844854ace99fec788
Opcode Fuzzy Hash: 226024973a440a2a6261c5f164d8bafa30541a105b972a390c392a8354fe07a0
Instruction Fuzzy Hash: B791B872A282C74BE7A59F14C858B3E7AA9FF45354F518139DA4E867C0CB38E542CB10

Function 00007FF707A0D200 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 00007FF707A0D30D
gfff, xrefs: 00007FF707A0D38A

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 1324d18368fb7be0dec1b44ace24e6b174879433860390047f5d35653063db2a
Instruction ID: 4e7b8c24fd65574913e9b05bd5ab6bf461ea68bd2edec0eaa844bbb5b43ae45a
Opcode Fuzzy Hash: 1324d18368fb7be0dec1b44ace24e6b174879433860390047f5d35653063db2a
Instruction Fuzzy Hash: E05146A3B182C146E7249F799C11B69AB91EB44B94F889631CA988BAC1CF3DE442C751

Function 00007FF707A0FBD8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 5b606b63c70e86b5db4eecb07275e8e9c3e0e1f08e56a2b99ea5de7f73ebbe88
Instruction ID: 606dfb273c015e6a157c58aafb8cf2beccb45851497fe1eddbfe93cafa85468b
Opcode Fuzzy Hash: 5b606b63c70e86b5db4eecb07275e8e9c3e0e1f08e56a2b99ea5de7f73ebbe88
Instruction Fuzzy Hash: F002C3A1F1D68344FA64BB2D9C01E7AE680AF05B91FC54A35ED6D963D2DF3CA4438360

Function 00007FF707A0CD6C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF707A0D0AE

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: ee332c23296b8dd3ed29fdb42bef122adb490463d0c8b601810d73b835641fc7
Instruction ID: 0ac452ea2eb9d4d0e519714abd578397245c4e51a4d9502f41ac1f33504d7f21
Opcode Fuzzy Hash: ee332c23296b8dd3ed29fdb42bef122adb490463d0c8b601810d73b835641fc7
Instruction Fuzzy Hash: B4A146A3B0878586EB21DF3DA850BAABB90AF50B94F408532DE4D87781DB3DD502C761

Function 00007FF707A07AAC Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF707A07ACB

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: fa9fc3ba0f2a0ca574b62e3049f007bc07c74431d5877200bfd71a39e50ac507
Instruction ID: 289311c176d6dc22ca9cc0b31a8f05aac1a4805c87db220e9b1bce192c782dbb
Opcode Fuzzy Hash: fa9fc3ba0f2a0ca574b62e3049f007bc07c74431d5877200bfd71a39e50ac507
Instruction Fuzzy Hash: 25518191F0864241FE64BA3E5D1197AE291AF95BD6F884834DE0E877D5EF3CF44342A0

Function 00007FF707A12790 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF707A12794

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: fe1a72d78314f5032ff6e3f3402ce84269ae1386cefa971ca0fc6f511f9bbc55
Instruction ID: 5472a763a32c858759564dec785cb5a448d84d5e49ae29213ead3133893ec992
Opcode Fuzzy Hash: fe1a72d78314f5032ff6e3f3402ce84269ae1386cefa971ca0fc6f511f9bbc55
Instruction Fuzzy Hash: 60B09B50E07645C1E5043B595C4551452557F48700FD54034C40C41320DF2C10B64720

Function 00007FF707A028C0 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b05403af9c31de739a9311cbf741df56ce5de8bb6a66a9cc9bcf40cf40427d0b
Instruction ID: 870229dbd380790525591d08b4374676ec791bafc0be207f1347060ea9e5f721
Opcode Fuzzy Hash: b05403af9c31de739a9311cbf741df56ce5de8bb6a66a9cc9bcf40cf40427d0b
Instruction Fuzzy Hash: C3D109A2A0874285EB78AE3D8858B7DA390FF05B59F944935CE0D836D4DF39D853C3A0

Function 00007FF7079F8B20 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6de572fc7ea0867e481f021e98a3cee959a95ba6dd1d6718a656c0f39a4e480
Instruction ID: 59b8ac7b950e7fbcce8c52567af574316935c08feb1af2b06182db1305c524f9
Opcode Fuzzy Hash: b6de572fc7ea0867e481f021e98a3cee959a95ba6dd1d6718a656c0f39a4e480
Instruction Fuzzy Hash: 63C1A6722142F24FD289FB29E85997A73D1FB98309BD4402BEB8747B85CA3CE415D760

Function 00007FF707A01F30 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54646038064d7a6353eabae39e6447674b1691c16f4822fec46df2a19c6da082
Instruction ID: 219b9d529dcdd0b5842a0532a17f82e9a6815342dd0bcc4493cfcdea22addfe2
Opcode Fuzzy Hash: 54646038064d7a6353eabae39e6447674b1691c16f4822fec46df2a19c6da082
Instruction Fuzzy Hash: 1DB1A1B290874585E7649F3DC85867CBBA0FB49B49FA40535CB4E87395CF39E842C7A0

Function 00007FF707A0D880 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5cf27518f3756e107451e616d5c43acfc5497bdc9406be32d6656a2e3ee85f8
Instruction ID: 39c69d5610a78aade6844f70b9d97b8c4030fb7e392d157f29d5a84c202ebff1
Opcode Fuzzy Hash: c5cf27518f3756e107451e616d5c43acfc5497bdc9406be32d6656a2e3ee85f8
Instruction Fuzzy Hash: E081D2B3B0C68146E774DF6D984077AAA91EF86794F844635EA8D83B89CF3CE4018B50

Function 00007FF707A15728 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d2b2a23e656420a48cffdcfc29ff0550bdd13d7615b538a3eaf25f4462ec28d4
Instruction ID: 3dbca2d75b6cdb6d6402f38befd59e15bb1938db1cc47eae3c4e09fe905f6295
Opcode Fuzzy Hash: d2b2a23e656420a48cffdcfc29ff0550bdd13d7615b538a3eaf25f4462ec28d4
Instruction Fuzzy Hash: 25610DA2E1C28246F764AA2C8C10E3DE681EFC0770FD44635E65D86BD1DF7DE8128B21

Function 00007FF707A01074 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: c7e06c0cd7c8dc346f6858bf7c111c5331f882dd57025b1395a8883f1633d51f
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: 0A51A3B6A1865982E7249B3DC84066CB3A0FF49B59F644535CA8C87794CB3AE853C7D0

Function 00007FF707A01484 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: 77d6f2102cac2000924732834c25f999437f6da20ac69a7d23f86ebed7b21901
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: 1B51C7B6A1865582E7249B3DC844ABC73A0EF45B59F644531CE4D877A4CF3AE843C790

Function 00007FF707A00C64 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: 899569cc7b1ecf7322fdef4babfe4ab87da66c07f5e6178b84ce1cf406477c41
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: 7751B0B2A1865186E7249B3DC440B3EB3A1EF44B69F644531CE8C97795CB3AE843C7E0

Function 00007FF707A00E70 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction ID: 1a038a993b000102980418a4f72e4f2ab6463e8c14b948bff0050a45d5e720c6
Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction Fuzzy Hash: E751D1B2A1869586E7249B3CC440B7EA3A0EF44F59FA44431CE4C97794CB3AEC43C790

Function 00007FF707A01280 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction ID: c7bf2d743177c84acda7f22fe41540ff5116116c9d00ffc1c4816d4ba4a02b5a
Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction Fuzzy Hash: CF51F6B2A1865581E7649B3DC440ABCB3A1EF48B59FA44431CE4C877A8CF3AE853C7D0

Function 00007FF707A00A60 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction ID: fdf081fa964376dc3c69b6b574a831713479f57b2a5e2963c9e5a01e0c948fef
Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction Fuzzy Hash: 1B51D2B2A1865182E7249B3CC440B3AB7A0EF45F59FA44431CE4D97794DF3AE853C7A0

Function 00007FF707A05040 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: 4891668255f805f3039c6754082b60ca8117988db33c36364c3eeb1e583bcb28
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: F241BAD2D4974A04E955AD3C0D14E789680BF137A2DE81670CD9D933C2DB0D6DA7C9F0

Function 00007FF707A091B0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4c2069438db7bd6821668209f3bed185f6ed925e7f6c63ba07488e81febeb59c
Instruction ID: d07ab46d7ee08d49e52fde8f4e50c34018c159b7a2b95466604637b65a293eec
Opcode Fuzzy Hash: 4c2069438db7bd6821668209f3bed185f6ed925e7f6c63ba07488e81febeb59c
Instruction Fuzzy Hash: 4C41B3A2718A5581EF04DF2EDD5496AB391BB48FD0B899436DE0D97B58DF3CD0438340

Function 00007FF707A073F4 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6955196b928ea369f318f1367a91d651b99cb7ed2675060227c8542cf7a82c4a
Instruction ID: 1193f7943ec745c9d83f0caa74841ff66ea4c80b3f8cda256210f0a4f76864fd
Opcode Fuzzy Hash: 6955196b928ea369f318f1367a91d651b99cb7ed2675060227c8542cf7a82c4a
Instruction Fuzzy Hash: 5C310572B08B8241EB24AF396C8053EAAD4AF84BD1F544638EA5D93BD5DF3CE0134754

Function 00007FF707A18880 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b45f31a2a70b9ba878c3a12fffa6905b3575b51dadbfc3a0cbe7f45b87496cea
Instruction ID: df6efac03813287e4f8eb5b8bd321e555ed7aafe553e96ee169a7b26cf878f6e
Opcode Fuzzy Hash: b45f31a2a70b9ba878c3a12fffa6905b3575b51dadbfc3a0cbe7f45b87496cea
Instruction Fuzzy Hash: 26F044B1A196958EDB989F2DA812A6977D0FB08380B808039F58983B04DB7C90618F14

Function 00007FF7079FC62C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84fb9023dc3cd78644239ae856a17877a0dfc2a7c85af1c48b0789cc2cde0ccb
Instruction ID: cd9475cae9403348252fd9ab177062240b0751f1c6b51f7cf939a6a56cdd3b70
Opcode Fuzzy Hash: 84fb9023dc3cd78644239ae856a17877a0dfc2a7c85af1c48b0789cc2cde0ccb
Instruction Fuzzy Hash: 56A001A192CC6BE0E648AB08AC50525A220BF59300B905071D00D411A0DF3CA4068234

Function 00007FF7079F6EA0 Relevance: 119.3, APIs: 33, Strings: 35, Instructions: 280libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7079F6EB7
GetProcAddress.KERNEL32 ref: 00007FF7079F6EFD
GetProcAddress.KERNEL32 ref: 00007FF7079F6F22
GetProcAddress.KERNEL32 ref: 00007FF7079F6F47
GetProcAddress.KERNEL32 ref: 00007FF7079F6F6F
GetProcAddress.KERNEL32 ref: 00007FF7079F6F97
GetProcAddress.KERNEL32 ref: 00007FF7079F6FBF
GetProcAddress.KERNEL32 ref: 00007FF7079F6FE7
GetProcAddress.KERNEL32 ref: 00007FF7079F700F

Strings

Tcl_NewByteArrayObj, xrefs: 00007FF7079F725D, 00007FF7079F7279
Tcl_ThreadAlert, xrefs: 00007FF7079F716D, 00007FF7079F7189
Tcl_GetCurrentThread, xrefs: 00007FF7079F7005, 00007FF7079F7021
Tcl_Finalize, xrefs: 00007FF7079F6F65, 00007FF7079F6F81
Tcl_MutexUnlock, xrefs: 00007FF7079F707D, 00007FF7079F7099
Tcl_Init, xrefs: 00007FF7079F6EB0, 00007FF7079F6EC9
Tcl_ThreadQueueEvent, xrefs: 00007FF7079F7145, 00007FF7079F7161
Tcl_NewStringObj, xrefs: 00007FF7079F7235, 00007FF7079F7251
Tcl_EvalFile, xrefs: 00007FF7079F72D5, 00007FF7079F72F1
Tcl_DeleteInterp, xrefs: 00007FF7079F6FB5, 00007FF7079F6FD1
Tcl_CreateObjCommand, xrefs: 00007FF7079F71E5, 00007FF7079F7201
Tcl_MutexLock, xrefs: 00007FF7079F7055, 00007FF7079F7071
Tcl_GetString, xrefs: 00007FF7079F720D, 00007FF7079F7229
Tcl_ConditionNotify, xrefs: 00007FF7079F70F5, 00007FF7079F7111
Tcl_DoOneEvent, xrefs: 00007FF7079F6F3D, 00007FF7079F6F59
Tcl_CreateThread, xrefs: 00007FF7079F6FDD, 00007FF7079F6FF9
Tcl_Alloc, xrefs: 00007FF7079F734D, 00007FF7079F7369
Tk_Init, xrefs: 00007FF7079F739D, 00007FF7079F73B9
Tcl_CreateInterp, xrefs: 00007FF7079F6EF3, 00007FF7079F6F0F
Tcl_ConditionWait, xrefs: 00007FF7079F711D, 00007FF7079F7139
Tcl_GetVar2, xrefs: 00007FF7079F7195, 00007FF7079F71B1
GetProcAddress, xrefs: 00007FF7079F6ED7
Tcl_FindExecutable, xrefs: 00007FF7079F6F18, 00007FF7079F6F34
Tcl_ConditionFinalize, xrefs: 00007FF7079F70CD, 00007FF7079F70E9
Tcl_GetObjResult, xrefs: 00007FF7079F72AD, 00007FF7079F72C9
Tcl_FinalizeThread, xrefs: 00007FF7079F6F8D, 00007FF7079F6FA9
Tcl_SetVar2, xrefs: 00007FF7079F71BD, 00007FF7079F71D9
Tk_GetNumMainWindows, xrefs: 00007FF7079F73C5, 00007FF7079F73E1
Tcl_SetVar2Ex, xrefs: 00007FF7079F7285, 00007FF7079F72A1
Tcl_Free, xrefs: 00007FF7079F7375, 00007FF7079F7391
Tcl_EvalObjv, xrefs: 00007FF7079F7325, 00007FF7079F7341
Tcl_EvalEx, xrefs: 00007FF7079F72FD, 00007FF7079F7319
Tcl_MutexFinalize, xrefs: 00007FF7079F70A5, 00007FF7079F70C1
Tcl_JoinThread, xrefs: 00007FF7079F702D, 00007FF7079F7049
Failed to get address for %hs, xrefs: 00007FF7079F6ED0

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-3427451314
Opcode ID: ea7dfca1e90abb6d4d8c6eb1b798acaf406610e772db9aaa2d8df727af0780f5
Instruction ID: 123003a7bdf6a3d523cf6c11a6903e6753eda7baa897d961e976e74a697b79d2
Opcode Fuzzy Hash: ea7dfca1e90abb6d4d8c6eb1b798acaf406610e772db9aaa2d8df727af0780f5
Instruction Fuzzy Hash: F4E18FE5A2DB1390FA59FF58AC509B4E3A5AF08750FD81036D81E063A4EF7CB55AC230

Function 00007FF7079F15C0 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 137COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7079F1775
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF7079F16EF
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7079F168E
malloc, xrefs: 00007FF7079F16F6
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7079F165B
fwrite, xrefs: 00007FF7079F177C
fopen, xrefs: 00007FF7079F161E
fseek, xrefs: 00007FF7079F1695
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7079F1785
Failed to extract %s: failed to open target file!, xrefs: 00007FF7079F1617
fread, xrefs: 00007FF7079F178C
Failed to create symbolic link %s!, xrefs: 00007FF7079F15E2

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: Message
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2030045667-1550345328
Opcode ID: de2886e9ec4bce8e7a82fd945c19092a17145b62ba3eb50971492c1082ce60c7
Instruction ID: de52d37b70e2dcb956928210b001e591a8aab2e681f7ed9972658445d007b48c
Opcode Fuzzy Hash: de2886e9ec4bce8e7a82fd945c19092a17145b62ba3eb50971492c1082ce60c7
Instruction Fuzzy Hash: F851C0A1B28A4792FA10BB19ED405B9A3A0BF44B94FC44131EE1C47BE5EF3CE5578760

Function 00007FF7079F77D0 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7079F86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7079F3FA4,00000000,00007FF7079F1925), ref: 00007FF7079F86E9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF7079F7C97,?,?,FFFFFFFF,00007FF7079F3834), ref: 00007FF7079F782C

Part of subcall function 00007FF7079F26C0: MessageBoxW.USER32 ref: 00007FF7079F2736

Strings

CreateDirectory, xrefs: 00007FF7079F7974
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7079F78D9
%.*s, xrefs: 00007FF7079F790C
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF7079F789D
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7079F7840
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF7079F796D
\, xrefs: 00007FF7079F7861
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7079F7803

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 5adf1a7b4f365c991e592d6daa758356e56cb82b092043d5b28c068608273831
Instruction ID: d70c6073aaca2f1dc1aa155f2f2aac1a9bc600eda30f04fee46a5bb058a8585d
Opcode Fuzzy Hash: 5adf1a7b4f365c991e592d6daa758356e56cb82b092043d5b28c068608273831
Instruction Fuzzy Hash: F3418261B3CA4381FA50FB68EC51ABAE361AF84784FD44431D64E82795EF2CE5468770

Function 00007FF7079F20F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7079F211B
SelectObject.GDI32 ref: 00007FF7079F2162
DrawTextW.USER32 ref: 00007FF7079F2185
SelectObject.GDI32 ref: 00007FF7079F219B
ReleaseDC.USER32 ref: 00007FF7079F21AB
MoveWindow.USER32 ref: 00007FF7079F21FB
MoveWindow.USER32 ref: 00007FF7079F223B
MoveWindow.USER32 ref: 00007FF7079F228E
MoveWindow.USER32 ref: 00007FF7079F22D6

Strings

P%, xrefs: 00007FF7079F216F

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: d5dd136cfe9f7ccbcb0fe4cae99cf14dfe1cc9f89db7d8019ba122c6a34f6d98
Instruction ID: 06c5339ae1085e6683c7b56af5fdb6916dfbd3ee7ed50125ac20368c203c00fa
Opcode Fuzzy Hash: d5dd136cfe9f7ccbcb0fe4cae99cf14dfe1cc9f89db7d8019ba122c6a34f6d98
Instruction Fuzzy Hash: 94510866614BA186E6349F26E8185BAF7A1FB98B61F404131EFDE43794DF3CD046CB20

Function 00007FF707A055A0 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 493COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF707A055E3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF707A059D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF707A05C6C

Strings

:, xrefs: 00007FF707A0579C
f, xrefs: 00007FF707A05705
p, xrefs: 00007FF707A05695
-, xrefs: 00007FF707A05679
p, xrefs: 00007FF707A0570D

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 21cbc72c7e6dc269be11e21f83bf2085e3383c5e1ad4ae35147280bf7774980f
Instruction ID: 870385301baf61879586602913a362126afd1b89060d413d760ad399c2b600e9
Opcode Fuzzy Hash: 21cbc72c7e6dc269be11e21f83bf2085e3383c5e1ad4ae35147280bf7774980f
Instruction Fuzzy Hash: 8812C5A1E0C24386FB20BA38D844E79F651FF41752FD44835E689865C4DF3CE5A28FA0

Function 00007FF707A002E8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF707A00328
_invalid_parameter_noinfo.LIBCMT ref: 00007FF707A006F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF707A0098F

Strings

p, xrefs: 00007FF707A003CD
p, xrefs: 00007FF707A00432
f, xrefs: 00007FF707A0042A
f, xrefs: 00007FF707A003C0
f, xrefs: 00007FF707A00575

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 1ce7302e2fd45bb0c0c54093c0ec2c5d292275181cf657796836d36714c503ba
Instruction ID: c1804a0ec744922845777f3d8624b0e508fab3c061b3012ab383e6d396394553
Opcode Fuzzy Hash: 1ce7302e2fd45bb0c0c54093c0ec2c5d292275181cf657796836d36714c503ba
Instruction Fuzzy Hash: 1012D9A1E0C14386FB247A38D814B7BF252FF80756FD44931E689865C4DF7CE5828BA1

Function 00007FF7079F1050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 111COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7079F10C5
malloc, xrefs: 00007FF7079F10FC
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7079F10F5
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7079F1097
fseek, xrefs: 00007FF7079F10CC
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7079F11D0
fread, xrefs: 00007FF7079F11D7

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 876584c299d027f33137fc7dabb205f158a195f132e989b932e28c0aba37e536
Instruction ID: d7d4b1cf1c843f5042a746109555084eb757a5290e9f19ecd1864bf50e30b7af
Opcode Fuzzy Hash: 876584c299d027f33137fc7dabb205f158a195f132e989b932e28c0aba37e536
Instruction Fuzzy Hash: F2418E61B68A4782FA10FB16AC406BAE2A1BF45BD4F944031DD5D47B95DF3CF40683A0

Function 00007FF7079F1440 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 100COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7079F14A9
malloc, xrefs: 00007FF7079F14E0
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7079F14D9
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7079F146F
fseek, xrefs: 00007FF7079F14B0
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7079F159A
fread, xrefs: 00007FF7079F15A1

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: f2249ae50f4d5a80524765fe3aa1f2ed55e82a04716e5ab33badeebc7b74e53e
Instruction ID: 9ae5c9f03d31dc2ac3606bd0f198eb3b8155ad1a252151a09450c5d1c99b2fdd
Opcode Fuzzy Hash: f2249ae50f4d5a80524765fe3aa1f2ed55e82a04716e5ab33badeebc7b74e53e
Instruction Fuzzy Hash: 5D416FA1A6864782FA20BB19AC405BAE3A0FF44BD4FD44031DE5D47B95EF3CE5478760

Function 00007FF7079F7FC0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 89processsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7079F86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7079F3FA4,00000000,00007FF7079F1925), ref: 00007FF7079F86E9

SetConsoleCtrlHandler.KERNEL32(?,00007FF7079F39C0), ref: 00007FF7079F800A
GetStartupInfoW.KERNEL32(?,00007FF7079F39C0), ref: 00007FF7079F802B

Part of subcall function 00007FF707A0978C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF707A097A0

Part of subcall function 00007FF707A07A2C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF707A07A93

GetCommandLineW.KERNEL32(?,00007FF7079F39C0), ref: 00007FF7079F80CD
CreateProcessW.KERNEL32 ref: 00007FF7079F810F
WaitForSingleObject.KERNEL32(?,00007FF7079F39C0), ref: 00007FF7079F8123
GetExitCodeProcess.KERNEL32 ref: 00007FF7079F8133

Strings

CreateProcessW, xrefs: 00007FF7079F8146
Failed to create child process!, xrefs: 00007FF7079F813F

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Failed to create child process!
API String ID: 2895956056-699529898
Opcode ID: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
Instruction ID: eee9ded61cdcf3b62d5795ae7a4a924319a2afe311d25ae7025e11b6d8a724f2
Opcode Fuzzy Hash: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
Instruction Fuzzy Hash: 96412771A18B8281EA10AB24F8556AEF391FF85360F900735E6AD477D5DF7CD0468B50

Function 00007FF7079FDD28 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7079FDD85

Part of subcall function 00007FF7079FECDC: __GetUnwindTryBlock.LIBCMT ref: 00007FF7079FED1F
Part of subcall function 00007FF7079FECDC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7079FED44

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7079FDE5D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7079FE0AB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7079FE1B8

Strings

csm, xrefs: 00007FF7079FDD9F
csm, xrefs: 00007FF7079FDE06
csm, xrefs: 00007FF7079FDE80

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 9e3578d2910a1de3a92e15cd58e24121979594cfb80c91fc1a566261b89881c5
Instruction ID: 1c1c51be65dae32747688e21e95e0c7f90825c17048c7d5468f8f5ba4dde9361
Opcode Fuzzy Hash: 9e3578d2910a1de3a92e15cd58e24121979594cfb80c91fc1a566261b89881c5
Instruction Fuzzy Hash: 35D1A572A28B4286EB20EF65D8403ADB7A0FF55788F544135EE4D57BA5CF38E482C760

Function 00007FF7079F11F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 154COMMON

Download Yara Rule

Strings

Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7079F1256
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7079F12C3
malloc, xrefs: 00007FF7079F129C, 00007FF7079F12CA
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7079F13EE
1.3.1, xrefs: 00007FF7079F1229
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7079F1295

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: Message
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-2813020118
Opcode ID: 5f86db0b88a8597635f99d5b4cac90fa4f731a3afe8888101c8cea5847f0d3ec
Instruction ID: b32089e50e9754f7af708b2de80e3ec78a5264efc08d825fabd8585320321f9e
Opcode Fuzzy Hash: 5f86db0b88a8597635f99d5b4cac90fa4f731a3afe8888101c8cea5847f0d3ec
Instruction Fuzzy Hash: C5511362A1868781EA20BB16AC403BAA291FF85794FC40135EE4D87BD5EF3CE407C760

Function 00007FF707A0E020 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF707A0E3BA,?,?,-00000018,00007FF707A0A063,?,?,?,00007FF707A09F5A,?,?,?,00007FF707A0524E), ref: 00007FF707A0E19C
GetProcAddress.KERNEL32(?,?,?,00007FF707A0E3BA,?,?,-00000018,00007FF707A0A063,?,?,?,00007FF707A09F5A,?,?,?,00007FF707A0524E), ref: 00007FF707A0E1A8

Strings

api-ms-, xrefs: 00007FF707A0E0E6
ext-ms-, xrefs: 00007FF707A0E0F9

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
Instruction ID: 7651a88acd82148b64a25853f4b63cccdb688e96e63108f18421266870333990
Opcode Fuzzy Hash: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
Instruction Fuzzy Hash: 984113B1B1D60281FA11BB2EAD00E75A392BF05B90F894935DE0D97794EF3CE40793A0

Function 00007FF7079F7C40 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 116COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,?,FFFFFFFF,00007FF7079F3834), ref: 00007FF7079F7CE4
CreateDirectoryW.KERNEL32(?,?,FFFFFFFF,00007FF7079F3834), ref: 00007FF7079F7D2C

Part of subcall function 00007FF7079F7E10: GetEnvironmentVariableW.KERNEL32(00007FF7079F365F), ref: 00007FF7079F7E47
Part of subcall function 00007FF7079F7E10: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7079F7E69

Part of subcall function 00007FF707A07548: _invalid_parameter_noinfo.LIBCMT ref: 00007FF707A07561

Part of subcall function 00007FF7079F26C0: MessageBoxW.USER32 ref: 00007FF7079F2736

Strings

TMP, xrefs: 00007FF7079F7CA2
_MEI%d, xrefs: 00007FF7079F7CF2
LOADER: failed to set the TMP environment variable., xrefs: 00007FF7079F7CBC
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF7079F7D5E
TMP, xrefs: 00007FF7079F7C7C, 00007FF7079F7D83

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: Environment$CreateDirectoryExpandMessagePathStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 740614611-1339014028
Opcode ID: 11860e683bfeec2df00dcc2c56da5dbb6591d5702bb717516bbb2bb41ff9b0e3
Instruction ID: a443b7cb686a073d40364a10d26465c2b1939051fc624b20a3f51b42a5b38934
Opcode Fuzzy Hash: 11860e683bfeec2df00dcc2c56da5dbb6591d5702bb717516bbb2bb41ff9b0e3
Instruction Fuzzy Hash: EA418051B29A8380FA60FB699D55AF99251AF49784FD00432EE1D87796EF3CE50383A0

Function 00007FF7079FCFE8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7079FD29A,?,?,?,00007FF7079FCF8C,?,?,?,00007FF7079FCB89), ref: 00007FF7079FD06D
GetLastError.KERNEL32(?,?,?,00007FF7079FD29A,?,?,?,00007FF7079FCF8C,?,?,?,00007FF7079FCB89), ref: 00007FF7079FD07B
LoadLibraryExW.KERNEL32(?,?,?,00007FF7079FD29A,?,?,?,00007FF7079FCF8C,?,?,?,00007FF7079FCB89), ref: 00007FF7079FD0A5
FreeLibrary.KERNEL32(?,?,?,00007FF7079FD29A,?,?,?,00007FF7079FCF8C,?,?,?,00007FF7079FCB89), ref: 00007FF7079FD113
GetProcAddress.KERNEL32(?,?,?,00007FF7079FD29A,?,?,?,00007FF7079FCF8C,?,?,?,00007FF7079FCB89), ref: 00007FF7079FD11F

Strings

api-ms-, xrefs: 00007FF7079FD08D

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
Instruction ID: 1b3a3508cd69d397609ec94e28ab60106fb6c6ad5dd9b41dff7efff431c0207c
Opcode Fuzzy Hash: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
Instruction Fuzzy Hash: 48319065B2AA4391EE16EB16AC10679A3A4FF09BA4F9E0535DD1D47384EF3CE4478320

Function 00007FF7079F7B50 Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7079F7B70
OpenProcessToken.ADVAPI32 ref: 00007FF7079F7B83
GetTokenInformation.ADVAPI32 ref: 00007FF7079F7BA8
GetLastError.KERNEL32 ref: 00007FF7079F7BB2
GetTokenInformation.ADVAPI32 ref: 00007FF7079F7BF2
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7079F7C0E
CloseHandle.KERNEL32 ref: 00007FF7079F7C26

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 8356e17e6427c03366acad688ef96df5430cd8c67dfe58d52091e88c81740b7d
Instruction ID: e1a2a3245c10cfb54a37a3bd17d8acfff2e16568be5125ac450c6ac3652b1863
Opcode Fuzzy Hash: 8356e17e6427c03366acad688ef96df5430cd8c67dfe58d52091e88c81740b7d
Instruction Fuzzy Hash: 16214671A1CA4341EB10AF99E84463AE3A1FF857B4F900635DA6D43BE4DFBCD4468720

Function 00007FF707A0A460 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF707A0A46F
FlsGetValue.KERNEL32 ref: 00007FF707A0A484
FlsSetValue.KERNEL32 ref: 00007FF707A0A4A5
FlsSetValue.KERNEL32 ref: 00007FF707A0A4D2
FlsSetValue.KERNEL32 ref: 00007FF707A0A4E3
FlsSetValue.KERNEL32 ref: 00007FF707A0A4F4
SetLastError.KERNEL32 ref: 00007FF707A0A50F

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f1009f36f4b7e41e642a617816a0843c7a4fdcae41be86a1245b23186b7dd2e
Instruction ID: ae1ace3e12255b2b38eef3eca88793e2ce3c1aa6359df5971cc9974415176ea5
Opcode Fuzzy Hash: 4f1009f36f4b7e41e642a617816a0843c7a4fdcae41be86a1245b23186b7dd2e
Instruction Fuzzy Hash: 89216DA4B0C24242FA68733D5E45939E1525F487B2F848F34D93E86AD6DF2CB44347A1

Function 00007FF707A1707C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF707A170AD
GetLastError.KERNEL32 ref: 00007FF707A170B9
CloseHandle.KERNEL32 ref: 00007FF707A170D1
CreateFileW.KERNEL32 ref: 00007FF707A170FC
WriteConsoleW.KERNEL32 ref: 00007FF707A1711B

Strings

CONOUT$, xrefs: 00007FF707A170DD

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 274174309ff0e3cf7757a3f5c883333dff1858e51aae267b9afc88cc39a62d3b
Instruction ID: f9b7cf4bd92175ac9e17077b01c0583207a0e806295f7f3df18577127b51ebe5
Opcode Fuzzy Hash: 274174309ff0e3cf7757a3f5c883333dff1858e51aae267b9afc88cc39a62d3b
Instruction Fuzzy Hash: B21196A1B18B4186F7509B5AEC44B25A3A1FF88BE4F850234EA1D477A4DF3CD446C750

Function 00007FF7079F81F0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00000000,?,00007FF7079F39F2), ref: 00007FF7079F821D
K32EnumProcessModules.KERNEL32(?,00000000,?,00007FF7079F39F2), ref: 00007FF7079F827A

Part of subcall function 00007FF7079F86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7079F3FA4,00000000,00007FF7079F1925), ref: 00007FF7079F86E9

K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF7079F39F2), ref: 00007FF7079F8305
K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF7079F39F2), ref: 00007FF7079F8364
FreeLibrary.KERNEL32(?,00000000,?,00007FF7079F39F2), ref: 00007FF7079F8375
FreeLibrary.KERNEL32(?,00000000,?,00007FF7079F39F2), ref: 00007FF7079F838A

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: c116373e2a09e68fc95a37a35a910f387ed59b49a7d0ab4690c2b7d3ff367989
Instruction ID: 0c4e6c489d9d8f2746b3856d0e78f0ebd17bb9bf5e72cb2aae39bff3c6e244e3
Opcode Fuzzy Hash: c116373e2a09e68fc95a37a35a910f387ed59b49a7d0ab4690c2b7d3ff367989
Instruction Fuzzy Hash: D341B6A2A2968381EA70AF25E800ABAB394FF85BC4F854135DF5D57795DF3CE402C720

Function 00007FF7079F8400 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7079F7B50: GetCurrentProcess.KERNEL32 ref: 00007FF7079F7B70
Part of subcall function 00007FF7079F7B50: OpenProcessToken.ADVAPI32 ref: 00007FF7079F7B83
Part of subcall function 00007FF7079F7B50: GetTokenInformation.ADVAPI32 ref: 00007FF7079F7BA8
Part of subcall function 00007FF7079F7B50: GetLastError.KERNEL32 ref: 00007FF7079F7BB2
Part of subcall function 00007FF7079F7B50: GetTokenInformation.ADVAPI32 ref: 00007FF7079F7BF2
Part of subcall function 00007FF7079F7B50: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7079F7C0E
Part of subcall function 00007FF7079F7B50: CloseHandle.KERNEL32 ref: 00007FF7079F7C26

LocalFree.KERNEL32(?,00007FF7079F3814), ref: 00007FF7079F848C
LocalFree.KERNEL32(?,00007FF7079F3814), ref: 00007FF7079F8495

Strings

Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF7079F84A3
S-1-3-4, xrefs: 00007FF7079F8441
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF7079F8462
D:(A;;FA;;;%s), xrefs: 00007FF7079F8477

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 795f95526d0a951be163d7ee57e77295e71c5006ab84a191c0455a0dace466c7
Instruction ID: 175da053a165661757c4ecfed2d25cea65d21664b5ac05fd32c9e5b1faab8eab
Opcode Fuzzy Hash: 795f95526d0a951be163d7ee57e77295e71c5006ab84a191c0455a0dace466c7
Instruction Fuzzy Hash: 19216D71A2864286F750BB20EC157EAA3A1FF88780FD44435EA4D43B96DF3CD846C7A0

Function 00007FF707A0A5D8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF707A043FD,?,?,?,?,00007FF707A0979A,?,?,?,?,00007FF707A0649F), ref: 00007FF707A0A5E7
FlsSetValue.KERNEL32(?,?,?,00007FF707A043FD,?,?,?,?,00007FF707A0979A,?,?,?,?,00007FF707A0649F), ref: 00007FF707A0A61D
FlsSetValue.KERNEL32(?,?,?,00007FF707A043FD,?,?,?,?,00007FF707A0979A,?,?,?,?,00007FF707A0649F), ref: 00007FF707A0A64A
FlsSetValue.KERNEL32(?,?,?,00007FF707A043FD,?,?,?,?,00007FF707A0979A,?,?,?,?,00007FF707A0649F), ref: 00007FF707A0A65B
FlsSetValue.KERNEL32(?,?,?,00007FF707A043FD,?,?,?,?,00007FF707A0979A,?,?,?,?,00007FF707A0649F), ref: 00007FF707A0A66C
SetLastError.KERNEL32(?,?,?,00007FF707A043FD,?,?,?,?,00007FF707A0979A,?,?,?,?,00007FF707A0649F), ref: 00007FF707A0A687

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 5dcac91248c0014d458aec840eea87d8b317a92cf5de5997ea3edf93bd94a031
Instruction ID: 47eebc5cb8409429fbeebaf4f980d28511bddc443ab1dfb3a680267ca8b72025
Opcode Fuzzy Hash: 5dcac91248c0014d458aec840eea87d8b317a92cf5de5997ea3edf93bd94a031
Instruction Fuzzy Hash: 08115BA4F0C64242FA68733D9E85939E2525F487A1F848B34D83E866D6DF2CB44347A2

Function 00007FF7079F2300 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7079F2338
DialogBoxIndirectParamW.USER32 ref: 00007FF7079F23FE
DeleteObject.GDI32 ref: 00007FF7079F2431
DestroyIcon.USER32 ref: 00007FF7079F2443

Strings

Unhandled exception in script, xrefs: 00007FF7079F2368

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 43e0e9fc7257205e5ba4956726e7fb7afbd4954ec96d29d9005c09c1dc537ba6
Instruction ID: fc69cd6f546d2476b2c03a48e0d225d01c152cb2569a7c8fd9a9ebdb2a1a283a
Opcode Fuzzy Hash: 43e0e9fc7257205e5ba4956726e7fb7afbd4954ec96d29d9005c09c1dc537ba6
Instruction Fuzzy Hash: A53180B2A18A8289EB20FF65EC556F9A360FF89784F940135EA4D87B59DF3CD106C710

Function 00007FF7079F2760 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7079F86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7079F3FA4,00000000,00007FF7079F1925), ref: 00007FF7079F86E9

MessageBoxW.USER32 ref: 00007FF7079F283B
MessageBoxA.USER32 ref: 00007FF7079F284F

Strings

Error/warning (ANSI fallback), xrefs: 00007FF7079F2843
Error, xrefs: 00007FF7079F282C
%s%s: %s, xrefs: 00007FF7079F27EC

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Error$Error/warning (ANSI fallback)
API String ID: 1878133881-640379615
Opcode ID: c7e22cebafa3b4081381e7f20538df90bc3c47857982eb0ae5879fef5a553f49
Instruction ID: d7c3d1b9016efe316e4cb3d1816a23e58468d72096f8a5ad21a91793b57c4546
Opcode Fuzzy Hash: c7e22cebafa3b4081381e7f20538df90bc3c47857982eb0ae5879fef5a553f49
Instruction Fuzzy Hash: 422135B2628A8681F620AB14F8517EAA364FF88784F801136E68D53B59DF7CD646C750

Function 00007FF707A08DA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF707A08DC5
GetProcAddress.KERNEL32 ref: 00007FF707A08DDB
FreeLibrary.KERNEL32 ref: 00007FF707A08E02

Strings

mscoree.dll, xrefs: 00007FF707A08DBC
CorExitProcess, xrefs: 00007FF707A08DD4

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f1eb0c22b123c1cdb2873c61f44d146b1d21622817f8dd4d6a21f18b4a6e3d93
Instruction ID: f7c2ef7c4095663688ee206a005b8fa2ab055a0768cf38e6d698a03213717309
Opcode Fuzzy Hash: f1eb0c22b123c1cdb2873c61f44d146b1d21622817f8dd4d6a21f18b4a6e3d93
Instruction Fuzzy Hash: 91F062E1A1970281FA14AB2CEC44B799320AF49761FD40635C96D466F4CF3CD14BC774

Function 00007FF707A18678 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF707A186A0
_set_statfp.LIBCMT ref: 00007FF707A186BB
_set_statfp.LIBCMT ref: 00007FF707A186D7
_set_statfp.LIBCMT ref: 00007FF707A18713

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: d4b4a2c83569c4c74d126c869b82a88387df78b1f32acdb4bbade6f62d68abf7
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 231191BAE5CE0341F654312CEC55B7991406F55374FD94634E97E067D6CF2CA8838631

Function 00007FF707A0A6A0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF707A098B3,?,?,00000000,00007FF707A09B4E,?,?,?,?,?,00007FF707A09ADA), ref: 00007FF707A0A6BF
FlsSetValue.KERNEL32(?,?,?,00007FF707A098B3,?,?,00000000,00007FF707A09B4E,?,?,?,?,?,00007FF707A09ADA), ref: 00007FF707A0A6DE
FlsSetValue.KERNEL32(?,?,?,00007FF707A098B3,?,?,00000000,00007FF707A09B4E,?,?,?,?,?,00007FF707A09ADA), ref: 00007FF707A0A706
FlsSetValue.KERNEL32(?,?,?,00007FF707A098B3,?,?,00000000,00007FF707A09B4E,?,?,?,?,?,00007FF707A09ADA), ref: 00007FF707A0A717
FlsSetValue.KERNEL32(?,?,?,00007FF707A098B3,?,?,00000000,00007FF707A09B4E,?,?,?,?,?,00007FF707A09ADA), ref: 00007FF707A0A728

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 25d361a094b2c99e262beff41eaee06ac9464b6f74968b1c14d3cfe42ff85be4
Instruction ID: a3aef19a2b15acc6b6d13377d7991cc96685f9be404d46b76a8eeb776537f51d
Opcode Fuzzy Hash: 25d361a094b2c99e262beff41eaee06ac9464b6f74968b1c14d3cfe42ff85be4
Instruction Fuzzy Hash: C6115EA0F0C34241FA58733D9D85979E1515F587A1E848B34D83DD66D6DF2CF4434AA1

Function 00007FF707A0A534 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF707A0A545
FlsSetValue.KERNEL32 ref: 00007FF707A0A564
FlsSetValue.KERNEL32 ref: 00007FF707A0A58C
FlsSetValue.KERNEL32 ref: 00007FF707A0A59D
FlsSetValue.KERNEL32 ref: 00007FF707A0A5AE

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: a853173f6999e7d5ef833d9e4f06cbd56a904a1eb1d6261c936ae8f95b9bedb9
Instruction ID: a88d5a29a133d41e76681b6604656046cfb346429bdb2b0ecb8ece2aee9e499d
Opcode Fuzzy Hash: a853173f6999e7d5ef833d9e4f06cbd56a904a1eb1d6261c936ae8f95b9bedb9
Instruction Fuzzy Hash: 101106A0F0C20742FA6C723D4C56979A2815F59762EC49F34D93E9A2D2EF2CB44356B2

Function 00007FF707A052B0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF707A052EC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF707A05416
_invalid_parameter_noinfo.LIBCMT ref: 00007FF707A054CC

Strings

verbose, xrefs: 00007FF707A052C0

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
Instruction ID: f4fdb673cc02bf408006f9bf69fb6150690fc2d4ed6e91ad218e875c7cbf0182
Opcode Fuzzy Hash: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
Instruction Fuzzy Hash: 8991E4B2E0864641F724AE39D850FBDB292AF00B56FD44935DA4D833D5DF3DE4228BA1

Function 00007FF707A0EED8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF707A0F1B7

Part of subcall function 00007FF707A06D4C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF707A06D69

Strings

UTF-16LEUNICODE, xrefs: 00007FF707A0F155
UTF-8, xrefs: 00007FF707A0F136
ccs, xrefs: 00007FF707A0F0F2

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: f2afffe6052eb22f88312eb2a9052de40cf8af355caad6dfb5a285a3356e609b
Instruction ID: f2cd2697bccda39396f6fe06b9e93d88f6f2fc2ae9be53bf0e6924ce5ff0c100
Opcode Fuzzy Hash: f2afffe6052eb22f88312eb2a9052de40cf8af355caad6dfb5a285a3356e609b
Instruction Fuzzy Hash: 708196F2E0C14389FB747E3DC910A78B6A0BF11745FD58835DA09E7285EB2DE80392A1

Function 00007FF7079FC968 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7079FC993
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7079FCA2A
RtlUnwindEx.KERNEL32 ref: 00007FF7079FCA84

Strings

csm, xrefs: 00007FF7079FCA11

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
Instruction ID: 59fc41fb2bef9154000b42d9f296b602807a6523b5e67b0f87eb97083987aa7f
Opcode Fuzzy Hash: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
Instruction Fuzzy Hash: 9151B236B2960B8ADB14EF19E844A79B791EF45B98F90C531DA4D43788DF7CE842C720

Function 00007FF7079FE5A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7079FE5D0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7079FE6B8

Strings

csm, xrefs: 00007FF7079FE70A
csm, xrefs: 00007FF7079FE5F2

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 35f1ba398413474562c31f87a28067be7b3dedf2abf1bb91a394967b9293af31
Instruction ID: 9a3f6525572f574ed444e4213ca49d3b1cb8096c2abcc3818f25e40484c74542
Opcode Fuzzy Hash: 35f1ba398413474562c31f87a28067be7b3dedf2abf1bb91a394967b9293af31
Instruction Fuzzy Hash: 2951BF36A2874786EB34AB219844378B7A0EF54B94F944136DA5C47BE5CF3CE462CB20

Function 00007FF7079FE1F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7079FE257
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7079FE2A3

Strings

RCC, xrefs: 00007FF7079FE273
MOC, xrefs: 00007FF7079FE26B

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 7372cc8c5436f01c7c5bf562e068c966f7e5f7c30121bdd0ddd9e56561cf3a97
Instruction ID: 39b198bb125fc03902a38a248a90589ab5ce0866e484633b2375a9d96e0bc7a9
Opcode Fuzzy Hash: 7372cc8c5436f01c7c5bf562e068c966f7e5f7c30121bdd0ddd9e56561cf3a97
Instruction Fuzzy Hash: B161A432918BC681D721AB25E8407AAF7A0FF85B94F444235EB9C03BA5DF7CE191CB10

Function 00007FF7079F7530 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF7079F324C,?,?,00007FF7079F3964), ref: 00007FF7079F7642

Strings

%s%c, xrefs: 00007FF7079F75B4
%.*s, xrefs: 00007FF7079F75FB
\, xrefs: 00007FF7079F75A7

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 1156698ca0d33aa8d2468b4f0fdefbfa17a3fd1640f2d1a941dba21d9585616c
Instruction ID: 732acf8d927c0141a85b00d6e6d0cd962b15f37aafd7dfd83ba54c6dfb26b601
Opcode Fuzzy Hash: 1156698ca0d33aa8d2468b4f0fdefbfa17a3fd1640f2d1a941dba21d9585616c
Instruction Fuzzy Hash: DA31B861B29AC685FA21AB25EC107A6A255EF44BE4FC44231EE6D477C9DF2CD2078710

Function 00007FF7079F2870 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7079F86B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7079F3FA4,00000000,00007FF7079F1925), ref: 00007FF7079F86E9

MessageBoxW.USER32 ref: 00007FF7079F2906
MessageBoxA.USER32 ref: 00007FF7079F291A

Strings

Error/warning (ANSI fallback), xrefs: 00007FF7079F290E
Warning, xrefs: 00007FF7079F28F7

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error/warning (ANSI fallback)$Warning
API String ID: 1878133881-2698358428
Opcode ID: bedc3c020f71ec751042cc21f49bee78fdd2451348ef76e59aa444c99166d18b
Instruction ID: 232f64131415608539bb7478643c1469b610902d151722172898ac0a0fae0d0c
Opcode Fuzzy Hash: bedc3c020f71ec751042cc21f49bee78fdd2451348ef76e59aa444c99166d18b
Instruction Fuzzy Hash: 581190B2628B8681FA24AB14F851BA9B364FF48784FD01135DA4C47644CF3CD606C760

Function 00007FF707A0B8B0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF707A0B92F
WriteFile.KERNEL32 ref: 00007FF707A0BBF7
WriteFile.KERNEL32 ref: 00007FF707A0BC3D
GetLastError.KERNEL32 ref: 00007FF707A0BCF3

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: ce0c3b3fbf9f468b37350500bd40f597e2424e9246c9b6d769e6af97d5ebe549
Instruction ID: e5622876b183b7537e403760413ec4f9fbc24a51a5cf9b8c6be2daca19cbc9b0
Opcode Fuzzy Hash: ce0c3b3fbf9f468b37350500bd40f597e2424e9246c9b6d769e6af97d5ebe549
Instruction Fuzzy Hash: 1CD111B2B08A818AE710DF79D9406AC77B1FB48798B844635CE5E97B89DF38D417C360

Function 00007FF707A0C270 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF707A0C25B), ref: 00007FF707A0C38C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF707A0C25B), ref: 00007FF707A0C417

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 1f18d30cb6731d2276149ea46625d8d438ffcaf3b5eb5be8e43e25f336112fa7
Instruction ID: 290d4449dab53894b5131ac6f9d9d428d36cef7e6f00f85b1dcea476681d6751
Opcode Fuzzy Hash: 1f18d30cb6731d2276149ea46625d8d438ffcaf3b5eb5be8e43e25f336112fa7
Instruction Fuzzy Hash: 1C91F4A2E0865185F750AF7D9C44ABDABA1BF04B99F944639DE0E93A84DF38D443C370

Function 00007FF707A0EC9C Relevance: 6.2, APIs: 4, Instructions: 161COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF707A0ED8C
_get_daylight.LIBCMT ref: 00007FF707A0ED9D
_get_daylight.LIBCMT ref: 00007FF707A0EDAE
_isindst.LIBCMT ref: 00007FF707A0EE79

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: fe74ad9a1dfbf97a60779a6b4eb4e3da65874cecf87de461c354fefb5b69a27d
Instruction ID: a1b1c32b3828123460b7786e358a03864eee44beacc4e9bbafef954c26157ea0
Opcode Fuzzy Hash: fe74ad9a1dfbf97a60779a6b4eb4e3da65874cecf87de461c354fefb5b69a27d
Instruction Fuzzy Hash: 655116B2F081569AFB14FF7C9D41ABCA7A1AF0035AF900935DE1D92AE5DB38A4038750

Function 00007FF707A04A8C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF707A04ABF
GetFileInformationByHandle.KERNEL32 ref: 00007FF707A04B21
GetLastError.KERNEL32 ref: 00007FF707A04BB2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF707A049C4), ref: 00007FF707A04BFE

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 1ec8bf387a2241cb1ee0019bb6bb5a321e30a3d38cbcbe421edb0c1d83f6d5d9
Instruction ID: 0fbde584b4666312f0598faa955ceb969f316cd603037e05fd8b95513ec39b44
Opcode Fuzzy Hash: 1ec8bf387a2241cb1ee0019bb6bb5a321e30a3d38cbcbe421edb0c1d83f6d5d9
Instruction Fuzzy Hash: 5D51A1A2A086818AFB14EFB9D8407BD67A1BF4D749F504835DF0987648DF38D452C7A0

Function 00007FF707A04938 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF707A04965
CreateFileW.KERNEL32 ref: 00007FF707A049A4
CloseHandle.KERNEL32 ref: 00007FF707A049D9

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: ebea2a15e315379b7438f17c06ac6f564ef77e5ce815d722b4931623952d3bd6
Instruction ID: 2ed6594fe3f093588d09bbb2a6cf9b54372dc97a97151cd269c51396d6403427
Opcode Fuzzy Hash: ebea2a15e315379b7438f17c06ac6f564ef77e5ce815d722b4931623952d3bd6
Instruction Fuzzy Hash: 4641B4A2D187C143F314AB749910769A260FF997A5F509734E75C43AD1DF7CA0F18760

Function 00007FF7079F2030 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF7079F2064
SetWindowLongPtrW.USER32 ref: 00007FF7079F2086
GetWindowLongPtrW.USER32 ref: 00007FF7079F20B0
InvalidateRect.USER32 ref: 00007FF7079F20D0

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 4b9e5de1fbcf843bc779a4d54dee57f94c26a540a6e6e96758728fc1cf1e39ca
Instruction ID: 9be8959f1302cfc74748f2cb2dcc062a5686704d862fea810bccfaf432419fa3
Opcode Fuzzy Hash: 4b9e5de1fbcf843bc779a4d54dee57f94c26a540a6e6e96758728fc1cf1e39ca
Instruction Fuzzy Hash: C111A962E2814742FA54AB69FD447BD92A1FF88B90FC88031DA4907B99CF2DD4D38620

Function 00007FF707A14E2C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF707A10A70: _invalid_parameter_noinfo.LIBCMT ref: 00007FF707A10AA3

_get_daylight.LIBCMT ref: 00007FF707A14F44
_get_daylight.LIBCMT ref: 00007FF707A14F55

Strings

?, xrefs: 00007FF707A14ED5

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 03a08327e3a10131aa5bb8fa3ef37a2eed6d70488736d84a243644e572cc7fb3
Instruction ID: e1d79b7658a5f8381ed44c8090f0983e98dd87e7be2290ae1a52b6884af30daa
Opcode Fuzzy Hash: 03a08327e3a10131aa5bb8fa3ef37a2eed6d70488736d84a243644e572cc7fb3
Instruction Fuzzy Hash: 8241FB62A187C245FB24BB2DDC01B7AD650EF85BA4F944235EE5C46BD5DF3CD4428710

Function 00007FF707A0832C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF707A0835E

Part of subcall function 00007FF707A09C58: HeapFree.KERNEL32(?,?,?,00007FF707A12032,?,?,?,00007FF707A1206F,?,?,00000000,00007FF707A12535,?,?,?,00007FF707A12467), ref: 00007FF707A09C6E
Part of subcall function 00007FF707A09C58: GetLastError.KERNEL32(?,?,?,00007FF707A12032,?,?,?,00007FF707A1206F,?,?,00000000,00007FF707A12535,?,?,?,00007FF707A12467), ref: 00007FF707A09C78

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7079FBEC5), ref: 00007FF707A0837C

Strings

C:\Users\user\Desktop\vRWw6y4Pj2.exe, xrefs: 00007FF707A0836A

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\vRWw6y4Pj2.exe
API String ID: 3580290477-4072284935
Opcode ID: 53ad205ea1c6cb2f7bb7661613e3da0ecc1c0905bf47b453e04b3a6da8a19941
Instruction ID: 4e8d0510552851c1f379c152883b1a25f3cd6cdba43e740b79b78e27b825fb79
Opcode Fuzzy Hash: 53ad205ea1c6cb2f7bb7661613e3da0ecc1c0905bf47b453e04b3a6da8a19941
Instruction Fuzzy Hash: 0141D5B1A08B528AE714FF39AC808BDA394EF45791BC54435FA4D83745CF3DE49287A0

Function 00007FF707A0F8E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF707A0F916

Part of subcall function 00007FF707A0E8C8: GetCurrentDirectoryW.KERNEL32 ref: 00007FF707A0E908

Strings

:, xrefs: 00007FF707A0F956
., xrefs: 00007FF707A0F967

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: CurrentDirectory_invalid_parameter_noinfo
String ID: .$:
API String ID: 2020911589-4202072812
Opcode ID: 02917ae70002487e25aaa57807b70e18839398bc457e7bd9011200fb9d4eab61
Instruction ID: 50c41a717ca165e8f708677e7508a4f793a433f60647160775e0468f5593bdc0
Opcode Fuzzy Hash: 02917ae70002487e25aaa57807b70e18839398bc457e7bd9011200fb9d4eab61
Instruction Fuzzy Hash: C8418162F087529CFB10EBB99C505FC66B47F14399F940835EE0DA7A45DF38A45383A0

Function 00007FF707A0BF48 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF707A0C05F
GetLastError.KERNEL32 ref: 00007FF707A0C081

Strings

U, xrefs: 00007FF707A0C00B

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 0b7df1583adeec31525a7cba2b12c3ee68d62bc9877546cbea7757f0bce6ed29
Instruction ID: b088d44d6eca07b0233315da3df700a80db3a5dcaf2231806a4631a2b65e8956
Opcode Fuzzy Hash: 0b7df1583adeec31525a7cba2b12c3ee68d62bc9877546cbea7757f0bce6ed29
Instruction Fuzzy Hash: 9B41D6B2A1868185DB20DF29E844BA9B760FF88794F804531EE4D87B48DF3CD442C760

Function 00007FF707A0E8C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF707A0E908
GetCurrentDirectoryW.KERNEL32 ref: 00007FF707A0E95A

Strings

:, xrefs: 00007FF707A0E91E

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: e37c33f8f2befd5fbd3c49cdc0b6d52123385b6fd944ea7372e41dd3f6ca63dc
Instruction ID: 256b2487a3d092cb6314764808e991ebc7c7b986b4e827ef3828db3defdc8e79
Opcode Fuzzy Hash: e37c33f8f2befd5fbd3c49cdc0b6d52123385b6fd944ea7372e41dd3f6ca63dc
Instruction Fuzzy Hash: 9721D9A2B0C68181FB60BB29D84467DE3A1FF84B85FC54835D68C83684CF7CE946C7A1

Function 00007FF7079FF068 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF7079FF0B8
RaiseException.KERNEL32 ref: 00007FF7079FF0F9

Strings

csm, xrefs: 00007FF7079FF0E6

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 353d784395b77eefcba7ec404c7e4e47dbaba59ece92a9373595b893a828088a
Instruction ID: c545a9a02d82777feabdb271300f64aeb5c2f82674f5bae2af9b41ef2ffa2a4a
Opcode Fuzzy Hash: 353d784395b77eefcba7ec404c7e4e47dbaba59ece92a9373595b893a828088a
Instruction Fuzzy Hash: 81112B76618B8582EB219B15F840269B7E5FF88B94F984231DB8D07B68DF3CD5528B10

Function 00007FF707A0FA4C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF707A0FA7C
GetDriveTypeW.KERNEL32 ref: 00007FF707A0FABC

Strings

:, xrefs: 00007FF707A0FAA5

Memory Dump Source

Source File: 00000001.00000002.2184858693.00007FF7079F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7079F0000, based on PE: true

Associated: 00000001.00000002.2184839341.00007FF7079F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184929721.00007FF707A1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184955009.00007FF707A34000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2184993239.00007FF707A36000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ff7079f0000_vRWw6y4Pj2.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
Instruction ID: 8667788688401b3b824a79eb0d7b2395ee05d0da4c8b498304b6908924347253
Opcode Fuzzy Hash: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
Instruction Fuzzy Hash: 410171A191C64286FB30BF789861A7EA290EF48749FC01835D54DC2691DF3CE5178A64

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report vRWw6y4Pj2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

DNS Answers

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: vRWw6y4Pj2.exePID: 6536, Parent PID: 4004

General

Chronological Activities

Disassembly

Analysis Process: vRWw6y4Pj2.exePID: 6536, Parent PID: 4004COMMON

Execution Graph

Graph

Executed Functions

Function 00007FF7079F1000 Relevance: 40.6, APIs: 5, Strings: 18, Instructions: 338COMMON

Control-flow Graph

Function 00007FF707A15C74 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON

Control-flow Graph

Function 00007FF7079F85A0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Windows Analysis Report
vRWw6y4Pj2.exe

Function 00007FF7079F1000 Relevance: 40.6, APIs: 5, Strings: 18, Instructions: 338
COMMON

Function 00007FF707A15C74 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Function 00007FF7079F85A0 Relevance: 3.0, APIs: 2, Instructions: 29
COMMON

Function 00007FF7079F18F0 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 172
COMMON

Function 00007FF707A0AD6C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Function 00007FF7079F33E0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 59
COMMON

Function 00007FF7079F25F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44
windowCOMMON

Function 00007FF7079FBF5C Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Function 00007FF707A08D48 Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Function 00007FF7079FF45C Relevance: 3.2, APIs: 2, Instructions: 177
COMMONLIBRARYCODE

Function 00007FF707A0B444 Relevance: 3.0, APIs: 2, Instructions: 46
COMMONLIBRARYCODE

Function 00007FF707A09E68 Relevance: 2.6, APIs: 2, Instructions: 59
COMMON

Function 00007FF707A0B1BC Relevance: 1.6, APIs: 1, Instructions: 112
COMMONLIBRARYCODE

Function 00007FF7079F76A0 Relevance: 1.6, APIs: 1, Instructions: 85
COMMON

Function 00007FF707A0AC4C Relevance: 1.6, APIs: 1, Instructions: 79
COMMONLIBRARYCODE