Edit tour

Windows Analysis Report
G6xnfES308.exe

Overview

General Information

Sample name:	G6xnfES308.exe renamed because original name is a hash value
Original sample name:	727e4f3a96a22e109e3345e0c54cafcc.exe
Analysis ID:	1580890
MD5:	727e4f3a96a22e109e3345e0c54cafcc
SHA1:	48fd9b372b4c46eb8d4355d409a8cb2fbad75316
SHA256:	94edbfc9e6d4274c871d96e4d215d0ccaa30890e00b2151c72578c3da53af1a2
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains sections with non-standard names

Program does not show much activity (idle)

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

G6xnfES308.exe (PID: 4896 cmdline: "C:\Users\user\Desktop\G6xnfES308.exe" MD5: 727E4F3A96A22E109E3345E0C54CAFCC)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: G6xnfES308.exe	Virustotal: Detection: 54%			Perma Link
Source: G6xnfES308.exe	ReversingLabs: Detection: 39%

Source: G6xnfES308.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF787057F4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF787057F4C
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF787057F4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF787057F4C
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF787061FE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF787061FE4
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF787048B00 FindFirstFileExW,FindClose,	0_2_00007FF787048B00

Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF7870673BC	0_2_00007FF7870673BC
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF787056030	0_2_00007FF787056030
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF78706481C	0_2_00007FF78706481C
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF787061038	0_2_00007FF787061038
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF787057F4C	0_2_00007FF787057F4C
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF7870490D0	0_2_00007FF7870490D0
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF78706A0F8	0_2_00007FF78706A0F8
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF787057F4C	0_2_00007FF787057F4C
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF787041F50	0_2_00007FF787041F50
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF787051F94	0_2_00007FF787051F94
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF7870587D0	0_2_00007FF7870587D0
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF787061FE4	0_2_00007FF787061FE4
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF7870537E0	0_2_00007FF7870537E0
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF787052E50	0_2_00007FF787052E50
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF787066E70	0_2_00007FF787066E70
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF7870666EC	0_2_00007FF7870666EC
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF78705A530	0_2_00007FF78705A530
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF787051D90	0_2_00007FF787051D90
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF78705E5B0	0_2_00007FF78705E5B0
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF787057D98	0_2_00007FF787057D98
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF78705EC30	0_2_00007FF78705EC30
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF787066470	0_2_00007FF787066470
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF787061038	0_2_00007FF787061038
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF787051B84	0_2_00007FF787051B84
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF787064380	0_2_00007FF787064380
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF7870523A4	0_2_00007FF7870523A4
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF787053BE4	0_2_00007FF787053BE4
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF78705E11C	0_2_00007FF78705E11C
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF787047960	0_2_00007FF787047960
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF787051980	0_2_00007FF787051980
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF7870521A0	0_2_00007FF7870521A0

Source: C:\Users\user\Desktop\G6xnfES308.exe

Code function: String function: 00007FF787042B30 appears 47 times

Source: classification engine

Classification label: mal48.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\G6xnfES308.exe

Code function: 0_2_00007FF787048570 GetLastError,FormatMessageW,WideCharToMultiByte,

0_2_00007FF787048570

Source: G6xnfES308.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\G6xnfES308.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: G6xnfES308.exe	Virustotal: Detection: 54%
Source: G6xnfES308.exe	ReversingLabs: Detection: 39%

Source: C:\Users\user\Desktop\G6xnfES308.exe

File read: C:\Users\user\Desktop\G6xnfES308.exe

Jump to behavior

Source: C:\Users\user\Desktop\G6xnfES308.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\G6xnfES308.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\G6xnfES308.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\G6xnfES308.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\G6xnfES308.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\G6xnfES308.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\G6xnfES308.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\G6xnfES308.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\G6xnfES308.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\G6xnfES308.exe	Section loaded: wintypes.dll	Jump to behavior

Source: G6xnfES308.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: G6xnfES308.exe

Static file information: File size 14186081 > 1048576

Source: G6xnfES308.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: G6xnfES308.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: G6xnfES308.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: G6xnfES308.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: G6xnfES308.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: G6xnfES308.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: G6xnfES308.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: G6xnfES308.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: G6xnfES308.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: G6xnfES308.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: G6xnfES308.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: G6xnfES308.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: G6xnfES308.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: G6xnfES308.exe

Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\G6xnfES308.exe

Code function: 0_2_00007FF78708506C push rcx; iretd

0_2_00007FF78708506D

Source: C:\Users\user\Desktop\G6xnfES308.exe

Code function: 0_2_00007FF787046F00 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF787046F00

Source: C:\Users\user\Desktop\G6xnfES308.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-16760

Source: C:\Users\user\Desktop\G6xnfES308.exe

API coverage: 5.8 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF787057F4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF787057F4C
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF787057F4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF787057F4C
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF787061FE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF787061FE4
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF787048B00 FindFirstFileExW,FindClose,	0_2_00007FF787048B00

Source: C:\Users\user\Desktop\G6xnfES308.exe

Code function: 0_2_00007FF78704C67C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF78704C67C

Source: C:\Users\user\Desktop\G6xnfES308.exe

Code function: 0_2_00007FF787063BF0 GetProcessHeap,

0_2_00007FF787063BF0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF78704C860 SetUnhandledExceptionFilter,	0_2_00007FF78704C860
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF78704C67C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF78704C67C
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF78704BDE0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF78704BDE0
Source: C:\Users\user\Desktop\G6xnfES308.exe	Code function: 0_2_00007FF78705ACD8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF78705ACD8

Source: C:\Users\user\Desktop\G6xnfES308.exe

Code function: 0_2_00007FF787069F40 cpuid

0_2_00007FF787069F40

Source: C:\Users\user\Desktop\G6xnfES308.exe

Code function: 0_2_00007FF78704C560 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF78704C560

Source: C:\Users\user\Desktop\G6xnfES308.exe

Code function: 0_2_00007FF7870666EC _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF7870666EC

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 DLL Side-Loading	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
G6xnfES308.exe	54%	Virustotal		Browse
G6xnfES308.exe	39%	ReversingLabs	Win64.Trojan.Generic

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580890
Start date and time:	2024-12-26 12:55:36 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	G6xnfES308.exe renamed because original name is a hash value
Original Sample Name:	727e4f3a96a22e109e3345e0c54cafcc.exe
Detection:	MAL
Classification:	mal48.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 17 Number of non-executed functions: 84
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 20.190.177.82, 13.107.246.63
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, login.live.com, ocsp.edge.digicert.com, ctldl.windowsupdate.com
Report size getting too big, too many NtSetInformationFile calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	XM6cn2uNux.exe	Get hash	malicious	LummaC	Browse	192.229.221.95
	bG89JAQXz2.exe	Get hash	malicious	LummaC	Browse	192.229.221.95
	q8b3OisMC4.dll	Get hash	malicious	Unknown	Browse	192.229.221.95
	eszstwQPwq.ps1	Get hash	malicious	LockBit ransomware, Metasploit	Browse	192.229.221.95
	0vM02qWRT9.ps1	Get hash	malicious	LockBit ransomware, Metasploit	Browse	192.229.221.95
	30136156071477318040.js	Get hash	malicious	Unknown	Browse	192.229.221.95
	BJQizQ6sqT.exe	Get hash	malicious	LummaC	Browse	192.229.221.95
	6vNMeuQvlu.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	192.229.221.95
	2ZsJ2iP8Q2.exe	Get hash	malicious	LummaC	Browse	192.229.221.95
	BVGvbpplT8.exe	Get hash	malicious	LummaC, Stealc	Browse	192.229.221.95

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.995732935302339
TrID:	Win64 Executable GUI (202006/5) 77.37% InstallShield setup (43055/19) 16.49% Win64 Executable (generic) (12005/4) 4.60% Generic Win/DOS Executable (2004/3) 0.77% DOS Executable Generic (2002/1) 0.77%
File name:	G6xnfES308.exe
File size:	14'186'081 bytes
MD5:	727e4f3a96a22e109e3345e0c54cafcc
SHA1:	48fd9b372b4c46eb8d4355d409a8cb2fbad75316
SHA256:	94edbfc9e6d4274c871d96e4d215d0ccaa30890e00b2151c72578c3da53af1a2
SHA512:	67ba801a5041d041c8f26f32b3045187e0570c5348a352b5b6707767bc26f9ac2c5d7b5a14d95510650e38d3004dddd9e5ad0150647b3a5f41e6e6e141f34bed
SSDEEP:	393216:uEkMDn78nxpUTLfhJuW+eGQRCMTozGxu8C0ibfz6e57xeBOxIg:uUDn87UTLJ4W+e5RLoztZ026e5VeM2g
TLSH:	8EE63389929009F5E6A1D13D15464D6FE232B0600394F6B72375F22A2FB73A24F3DB5B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.Q...?...?...?.Z.<...?.Z.:...?.Z.;...?.......?...:.9.?...;...?...<...?.Z.>...?...>...?.+.;...?.+.=...?.Rich..?................

File Icon


Icon Hash:	4a464cd47461e179

Static PE Info

General

Entrypoint:	0x14000c2f0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F02D25 [Sun Sep 22 14:43:49 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	1af6c885af093afc55142c2f1761dbe8

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FBD6123014Ch
dec eax
add esp, 28h
jmp 00007FBD6122FD5Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007FBD612306C4h
test eax, eax
je 00007FBD6122FF03h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007FBD6122FEE7h
dec eax
cmp ecx, eax
je 00007FBD6122FEF6h
xor eax, eax
dec eax
cmpxchg dword ptr [0003418Ch], ecx
jne 00007FBD6122FED0h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007FBD6122FED9h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
movzx eax, byte ptr [00034177h]
test ecx, ecx
mov ebx, 00000001h
cmove eax, ebx
mov byte ptr [00034167h], al
call 00007FBD612304C3h
call 00007FBD612315E2h
test al, al
jne 00007FBD6122FEE6h
xor al, al
jmp 00007FBD6122FEF6h
call 00007FBD6123E581h
test al, al
jne 00007FBD6122FEEBh
xor ecx, ecx
call 00007FBD612315F2h
jmp 00007FBD6122FECCh
mov al, bl
dec eax
add esp, 20h
pop ebx
ret
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [0003412Ch], 00000000h
mov ebx, ecx
jne 00007FBD6122FF49h
cmp ecx, 01h
jnbe 00007FBD6122FF4Ch
call 00007FBD6123062Ah
test eax, eax
je 00007FBD6122FF0Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3cee4	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x46000	0xf41c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x42000	0x22c8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x56000	0x758	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a420	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3a2e0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x420	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29d90	0x29e00	15c814a42215e290d8bab54e3db4f28e	False	0.5531133395522388	data	6.488360740396217	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12d0c	0x12e00	377d3e0f7c95bb22c4f7a316a5b04f1b	False	0.5158319536423841	data	5.820062241150467	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x3348	0xe00	e1f21cabb4e5e084c6e11e610d715023	False	0.13253348214285715	Matlab v4 mat-file (little endian) f\324\377\3772\242\337-\231+, text, rows 4294967295, columns 0	1.8227234993173287	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x42000	0x22c8	0x2400	b142de92a6283807ff34839c180f053c	False	0.4743923611111111	data	5.326103127679494	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x45000	0x15c	0x200	ee29821d11e5dd21c3e807a502fa5813	False	0.38671875	data	2.83326547900447	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x46000	0xf41c	0xf600	c654ab5a3bc06ebf8c554f36c31153c0	False	0.8030837144308943	data	7.554967714213712	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x56000	0x758	0x800	7813f7270f60606010808eaa88aee14b	False	0.5439453125	data	5.24418466384704	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x46208	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.585820895522388
RT_ICON	0x470b0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.7360108303249098
RT_ICON	0x47958	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.755057803468208
RT_ICON	0x47ec0	0x952c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9975384937676757
RT_ICON	0x513ec	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.3887966804979253
RT_ICON	0x53994	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.49530956848030017
RT_ICON	0x54a3c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.7207446808510638
RT_GROUP_ICON	0x54ea4	0x68	data	0.7019230769230769
RT_MANIFEST	0x54f0c	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	IsValidCodePage, GetStringTypeW, GetFileAttributesExW, HeapReAlloc, FlushFileBuffers, GetCurrentDirectoryW, GetACP, GetOEMCP, GetModuleHandleW, MulDiv, GetLastError, SetDllDirectoryW, GetModuleFileNameW, CreateSymbolicLinkW, GetProcAddress, GetCommandLineW, GetEnvironmentVariableW, GetCPInfo, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, SetConsoleCtrlHandler, FindClose, FindFirstFileExW, CloseHandle, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, WriteConsoleW, SetEndOfFile, SetEnvironmentVariableW, RtlUnwindEx, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Network Behavior

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 26, 2024 12:56:25.071598053 CET	1.1.1.1	192.168.2.6	0x52ba	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 26, 2024 12:56:25.071598053 CET	1.1.1.1	192.168.2.6	0x52ba	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	06:56:28
Start date:	26/12/2024
Path:	C:\Users\user\Desktop\G6xnfES308.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\G6xnfES308.exe"
Imagebase:	0x7ff787040000
File size:	14'186'081 bytes
MD5 hash:	727E4F3A96A22E109E3345E0C54CAFCC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	37

Executed Functions

Function 00007FF7870673BC Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7870670F0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF787067131
Part of subcall function 00007FF7870670F0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7870671AF
Part of subcall function 00007FF7870670F0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF787067200

CreateFileW.KERNELBASE ref: 00007FF7870674C2
CreateFileW.KERNEL32 ref: 00007FF787067512
GetLastError.KERNEL32 ref: 00007FF787067542
GetFileType.KERNELBASE ref: 00007FF787067557
GetLastError.KERNEL32 ref: 00007FF787067561
CloseHandle.KERNEL32 ref: 00007FF787067594
CloseHandle.KERNEL32 ref: 00007FF7870676F7
CreateFileW.KERNEL32 ref: 00007FF78706772C
GetLastError.KERNEL32 ref: 00007FF78706773B

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 3a34930d5f91773cec3df5f99ae8c8b4927d9c8c66a9e1d3c980e3b08bacfc22
Instruction ID: 261c07e368507eb14eee250af1664b34453211d769aec27c1fc88181005d7b24
Opcode Fuzzy Hash: 3a34930d5f91773cec3df5f99ae8c8b4927d9c8c66a9e1d3c980e3b08bacfc22
Instruction Fuzzy Hash: A4C1D172B24B4285EB10EF64C4A02AC7761FB49BA8BA55235DA2FD73D5CF38D052C310

Function 00007FF787041AA0 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7870482C0: _fread_nolock.LIBCMT ref: 00007FF78704836A

_fread_nolock.LIBCMT ref: 00007FF787041B54

Part of subcall function 00007FF787042890: MessageBoxW.USER32 ref: 00007FF78704299B

Strings

malloc, xrefs: 00007FF787041BDD
MEI, xrefs: 00007FF787041AE2
Error on file., xrefs: 00007FF787041C36
Could not read full TOC!, xrefs: 00007FF787041C09
Failed to read cookie!, xrefs: 00007FF787041B5F
Could not allocate buffer for TOC!, xrefs: 00007FF787041BD6
Failed to seek to cookie position!, xrefs: 00007FF787041B2C
fseek, xrefs: 00007FF787041B33
fread, xrefs: 00007FF787041B66, 00007FF787041C10

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: _fread_nolock$Message
String ID: Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 677216364-1384898525
Opcode ID: 39b48819520bc35b7f99ae839b6e2eafbc663665763a5edf1abbaa61daf94d82
Instruction ID: 1b4846197b26a58cc72b72f8bf8a444ccad572d4ac6f7829d59839a5fa614766
Opcode Fuzzy Hash: 39b48819520bc35b7f99ae839b6e2eafbc663665763a5edf1abbaa61daf94d82
Instruction Fuzzy Hash: E9519FB1B4960286EB24EF28D45117DB7A0FF48B88BB08135D91EC7799DE3CE442CB64

Function 00007FF787041000 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 269
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF787043ED0: GetModuleFileNameW.KERNEL32(?,00007FF7870439EA), ref: 00007FF787043F01

SetDllDirectoryW.KERNEL32 ref: 00007FF787043BF5

Part of subcall function 00007FF787047B70: GetEnvironmentVariableW.KERNEL32(00007FF787043A1F), ref: 00007FF787047BAA
Part of subcall function 00007FF787047B70: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF787047BC7

Strings

Cannot side-load external archive %s (code %d)!, xrefs: 00007FF787043B3F
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF787043B73
MEI, xrefs: 00007FF787043AFA
_MEIPASS2, xrefs: 00007FF787043A0B, 00007FF787043A74, 00007FF787043D27, 00007FF787043D33
Failed to convert DLL search path!, xrefs: 00007FF787043BE5
Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF787043AC6
_PYI_ONEDIR_MODE, xrefs: 00007FF787043A34, 00007FF787043A5F

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-1544818733
Opcode ID: 3c017d0b3639bc96ed264c2cea0ad7036811798b0c58c9f5a9dfd195ef997cdf
Instruction ID: 738bc05e90b1b95cfcb853224af9a586948230b8d69f1ab98edef85d70a2102e
Opcode Fuzzy Hash: 3c017d0b3639bc96ed264c2cea0ad7036811798b0c58c9f5a9dfd195ef997cdf
Instruction Fuzzy Hash: 8CB1A021B9C64351EA24FB2194522BDE390BF8478CFE05135EA4FD7696EF2CE506C7A0

Function 00007FF78705C11C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78705C549

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 700fa2322a5b373321a2e7ed848750029968f91a5ee85a64e34c26a04be16f04
Instruction ID: 953c739816eaa142abdc48d0419455619b4a90f73a18ea594e5f0353fc2b1e2c
Opcode Fuzzy Hash: 700fa2322a5b373321a2e7ed848750029968f91a5ee85a64e34c26a04be16f04
Instruction Fuzzy Hash: 03C1D322A48B8781EB51AB5494446BEB751FF81B80FE54131DA4FD7391CE7CE846C722

Function 00007FF78704C17C Relevance: 6.1, APIs: 4, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF78704C18B

Part of subcall function 00007FF78704C34C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF78704C36E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF78704C1A0
__scrt_release_startup_lock.LIBCMT ref: 00007FF78704C20E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF78704C261

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: 3d27f789a7b910ea95b37f95ae633beb093259f17e851dcbb1d336e671b45e8f
Instruction ID: 08de5949a6dcf264b2a920875914720258ee204d0a231893a93c5f17cd342b13
Opcode Fuzzy Hash: 3d27f789a7b910ea95b37f95ae633beb093259f17e851dcbb1d336e671b45e8f
Instruction Fuzzy Hash: 65311B51A8D64241FA14BBA4D5133BAA391BF5174CFF45035D90FD72D7DEACA406C232

Function 00007FF787042B30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF787048BE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF787042ABB), ref: 00007FF787048C1A

MessageBoxW.USER32 ref: 00007FF787042C05
MessageBoxA.USER32 ref: 00007FF787042C21

Strings

Fatal error detected, xrefs: 00007FF787042BDB, 00007FF787042C13

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Fatal error detected
API String ID: 1878133881-4025702859
Opcode ID: 851903317bfc7efaf1ad6cdea84b2df33a0253a3527f03e892242bbcad957f63
Instruction ID: 55b93c58b5cb9f7a242eea41d082bdf402684c9f1579ff2926faba1a77e9da46
Opcode Fuzzy Hash: 851903317bfc7efaf1ad6cdea84b2df33a0253a3527f03e892242bbcad957f63
Instruction Fuzzy Hash: 8921767276868191E620E710E4516EAB364FF84788FD05135D64EC7A65DF3CD206C750

Function 00007FF78705A0C0 Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF78705A0BC), ref: 00007FF78705A0D1
TerminateProcess.KERNEL32(?,?,?,00007FF78705A0BC), ref: 00007FF78705A0DC
ExitProcess.KERNEL32 ref: 00007FF78705A0EB

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: bc294a5152b5297a0dc7ed9991a70bb9c76c91c314002c4bf8d40204f2aa0a87
Instruction ID: 724bd2dc36269c1c7b15a5ed2fc8e3e487ee87141b1d224f2436a35882051908
Opcode Fuzzy Hash: bc294a5152b5297a0dc7ed9991a70bb9c76c91c314002c4bf8d40204f2aa0a87
Instruction Fuzzy Hash: 4DD09ED0B9C70642EA543B715C69078A7567F88705FF0A838D94BE6393CD2DA84FD360

Function 00007FF78705037C Relevance: 3.2, APIs: 2, Instructions: 177
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7870503C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7870504B7

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7abeb8fe783ee1c87e05308e58bf334fc2d3c30e054771bdd4fe3d83d7422279
Instruction ID: 686d04abfdde6ceb0bbbb67d61c967f0d21b1981254c83f185b1c063569ae4f6
Opcode Fuzzy Hash: 7abeb8fe783ee1c87e05308e58bf334fc2d3c30e054771bdd4fe3d83d7422279
Instruction Fuzzy Hash: 8E51F661B49642C6FB24AA35950067EE681BF44BA4FF44634DE7EE77C5CE3CE442CA20

Function 00007FF78705C7F4 Relevance: 3.0, APIs: 2, Instructions: 46
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF78705C98D), ref: 00007FF78705C840
GetLastError.KERNEL32(?,?,?,?,?,00007FF78705C98D), ref: 00007FF78705C84A

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 1615d75b8a55ba2077c919f2c6a9a881aeaa4cd5e18bf0385e0e14deb18ebfea
Instruction ID: 2465418667f61c8fce77bd4d7eaad9500e107088328156a18f62896e0a6121ac
Opcode Fuzzy Hash: 1615d75b8a55ba2077c919f2c6a9a881aeaa4cd5e18bf0385e0e14deb18ebfea
Instruction Fuzzy Hash: 0F119061B08B8281EA10AB25A84407AA761FB44BF4FE44331EE7ED77D9CE78D052C740

Function 00007FF78705B21C Relevance: 2.6, APIs: 2, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF78705B099,?,?,00000000,00007FF78705B14E), ref: 00007FF78705B28A
GetLastError.KERNEL32(?,?,?,00007FF78705B099,?,?,00000000,00007FF78705B14E), ref: 00007FF78705B294

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 5686df961ce5be01fcc4af8e545b06247c6cca85e683b4a0316bb757e052fe91
Instruction ID: 26029d7d0193eb3407fbe5a876f03d193aac8056de3048e1238d1f8cfa7ce583
Opcode Fuzzy Hash: 5686df961ce5be01fcc4af8e545b06247c6cca85e683b4a0316bb757e052fe91
Instruction Fuzzy Hash: 7721C520B5868201FE90BB60949027D9682BF84798FF44634DA2FD73D5CE2CF443D231

Function 00007FF78705C56C Relevance: 1.6, APIs: 1, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78705C594

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6b5c5ab8eeff71e39afe9fda2295d49407cb2b42678b128b0c7397afbf7fbff2
Instruction ID: dbed931ac5b27bef16a868b32aed30170545e76c3aba4117f19337e784e714aa
Opcode Fuzzy Hash: 6b5c5ab8eeff71e39afe9fda2295d49407cb2b42678b128b0c7397afbf7fbff2
Instruction Fuzzy Hash: E741E37294824283EA24EA19A55017AB7A1FB55B85FE01231D78FD3691CF3CE543C7B2

Function 00007FF7870482C0 Relevance: 1.6, APIs: 1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fread_nolock.LIBCMT ref: 00007FF78704836A

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 775812263eca2c32790788e7de421684f94aa67458782be604b6f84100317f81
Instruction ID: d1c7c65f4c5910df54645b97a17ad122337fdb6f399c589f6269cbe61c74ae58
Opcode Fuzzy Hash: 775812263eca2c32790788e7de421684f94aa67458782be604b6f84100317f81
Instruction Fuzzy Hash: 1221D622B4865285FA50BB2268453BAE651BF45BD9FE85830EE4E977C6DE7CE403C310

Function 00007FF78705BFFC Relevance: 1.6, APIs: 1, Instructions: 79
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78705C082

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 991c086762b97ce1bf58a0820ab8ed553d2cc556ed1ebb985c1376564fde346c
Instruction ID: 2c33a59c2b3419a1f7eadab4fe839f4bc3bc95a2ae2203aa295176e1ec11354f
Opcode Fuzzy Hash: 991c086762b97ce1bf58a0820ab8ed553d2cc556ed1ebb985c1376564fde346c
Instruction Fuzzy Hash: 0931A121A48A4286F751BF558841379A651BF44B91FE10235EA5EE73D2CEBCE843C732

Function 00007FF787059FF1 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF78705A01F

Part of subcall function 00007FF78705A118: GetModuleHandleExW.KERNEL32 ref: 00007FF78705A13D
Part of subcall function 00007FF78705A118: GetProcAddress.KERNEL32 ref: 00007FF78705A153
Part of subcall function 00007FF78705A118: FreeLibrary.KERNEL32 ref: 00007FF78705A17A

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 0855724a644142b9d5d18c3619865a8123e2457de56b2178a4ec6799866f0427
Instruction ID: 343e9897e8cda4c12a16270fd7a6399e2ea60d5877a3d693aa29ee9ce94c62ca
Opcode Fuzzy Hash: 0855724a644142b9d5d18c3619865a8123e2457de56b2178a4ec6799866f0427
Instruction Fuzzy Hash: D7218D72A187458AEB24AF74C4402BC7BA0FB0471CFA41635D61ED7AC5DF38D556CB60

Function 00007FF7870565A8 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78705650D

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c06f943cf2cfad6cae40bb945918742757c954c3eb67e691afc5a150f41a7f23
Instruction ID: 86333c81a2720194ff11f8b696703fde16d0120a0769e7442dba36b56bc8dc37
Opcode Fuzzy Hash: c06f943cf2cfad6cae40bb945918742757c954c3eb67e691afc5a150f41a7f23
Instruction Fuzzy Hash: B3116F61E9C64181EA61FF519410279E265BF86F84FE44431EA8EE768ADF7CE442CB20

Function 00007FF787066DAC Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF787066DCF

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 513e03f871098e076a65fb8bab8bb253d597a6200523e68a4e261718b8ca4e46
Instruction ID: 185317e7fb50501033d11a07a5ddf375dd8894a93db76d716986f41af8bff772
Opcode Fuzzy Hash: 513e03f871098e076a65fb8bab8bb253d597a6200523e68a4e261718b8ca4e46
Instruction Fuzzy Hash: F221AF32B08B8186DB61AF18D450369B6A0FB85B54FA48234EB5FC66D9DF3DD812CB10

Function 00007FF7870505FC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF787050650

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e4e6805aeaf9884a68cba76bd798531beecc2a98c7129b287afec428eebc8cdc
Instruction ID: f829599f7b9f271867e772e7996b8b199598b3d51056c2ec03e1363b8fbff244
Opcode Fuzzy Hash: e4e6805aeaf9884a68cba76bd798531beecc2a98c7129b287afec428eebc8cdc
Instruction Fuzzy Hash: 2001A561B4874181EA04EB62590006DE695BF85FE4FF84631DEADE7BD6CE3CD502C710

Non-executed Functions

Function 00007FF787046F00 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 263libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF787046F17
GetProcAddress.KERNEL32 ref: 00007FF787046F56
GetProcAddress.KERNEL32 ref: 00007FF787046F7B
GetProcAddress.KERNEL32 ref: 00007FF787046FA0
GetProcAddress.KERNEL32 ref: 00007FF787046FC8
GetProcAddress.KERNEL32 ref: 00007FF787046FF0
GetProcAddress.KERNEL32 ref: 00007FF787047018
GetProcAddress.KERNEL32 ref: 00007FF787047040
GetProcAddress.KERNEL32 ref: 00007FF787047068

Strings

Tcl_ThreadAlert, xrefs: 00007FF787047176
Failed to get address for Tcl_MutexLock, xrefs: 00007FF7870470A2
Failed to get address for Tcl_Free, xrefs: 00007FF78704739A
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF78704716A
Failed to get address for Tcl_SetVar2, xrefs: 00007FF7870471E2
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF787047002
Tcl_CreateObjCommand, xrefs: 00007FF7870471EE
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF787047142
Tk_Init, xrefs: 00007FF7870473A6
Failed to get address for Tcl_GetVar2, xrefs: 00007FF7870471BA
Tcl_EvalFile, xrefs: 00007FF7870472DE
Tcl_NewStringObj, xrefs: 00007FF78704723E
Tcl_CreateInterp, xrefs: 00007FF787046F4C
Failed to get address for Tk_Init, xrefs: 00007FF7870473C2
Tcl_Free, xrefs: 00007FF78704737E
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF7870470F2
Tcl_ConditionNotify, xrefs: 00007FF7870470FE
Tcl_GetCurrentThread, xrefs: 00007FF78704705E
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF7870473EA
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF787047192
Tcl_FinalizeThread, xrefs: 00007FF787046FE6
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF78704711A
Tcl_ConditionWait, xrefs: 00007FF787047126
Failed to get address for Tcl_Alloc, xrefs: 00007FF787047372
Tcl_Init, xrefs: 00007FF787046F10
Failed to get address for Tcl_EvalFile, xrefs: 00007FF7870472FA
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF78704734A
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF7870472AA
Tcl_GetString, xrefs: 00007FF787047216
Tcl_DeleteInterp, xrefs: 00007FF78704700E
Failed to get address for Tcl_EvalEx, xrefs: 00007FF787047322
Tcl_GetObjResult, xrefs: 00007FF7870472B6
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF78704707A
Tcl_NewByteArrayObj, xrefs: 00007FF787047266
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF78704720A
Failed to get address for Tcl_CreateThread, xrefs: 00007FF787047052
Tcl_CreateThread, xrefs: 00007FF787047036
Failed to get address for Tcl_GetString, xrefs: 00007FF787047232
Tcl_DoOneEvent, xrefs: 00007FF787046F96
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF787046F8D
Tk_GetNumMainWindows, xrefs: 00007FF7870473CE
Failed to get address for Tcl_Finalize, xrefs: 00007FF787046FDA
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF7870470CA
Tcl_Finalize, xrefs: 00007FF787046FBE
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF78704702A
Failed to get address for Tcl_Init, xrefs: 00007FF787046F29
Tcl_FindExecutable, xrefs: 00007FF787046F71
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF7870472D2
Tcl_EvalObjv, xrefs: 00007FF78704732E
GetProcAddress, xrefs: 00007FF787046F30
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF78704725A
Tcl_EvalEx, xrefs: 00007FF787047306
Tcl_SetVar2Ex, xrefs: 00007FF78704728E
Tcl_MutexUnlock, xrefs: 00007FF7870470AE
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF787046FB2
Tcl_Alloc, xrefs: 00007FF787047356
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF787046F68
Tcl_ConditionFinalize, xrefs: 00007FF7870470D6
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF787047282
Tcl_SetVar2, xrefs: 00007FF7870471C6
Tcl_GetVar2, xrefs: 00007FF78704719E
Tcl_ThreadQueueEvent, xrefs: 00007FF78704714E
Tcl_MutexLock, xrefs: 00007FF787047086

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-2208601799
Opcode ID: 08011e4291223f8c8b87355f84bdba84e3d11561fc99f88d49761070ad3606f6
Instruction ID: 3f08869d2d8a0c597fe22b5a2a3582063d2b3275859694fb039eb9c2792c8de3
Opcode Fuzzy Hash: 08011e4291223f8c8b87355f84bdba84e3d11561fc99f88d49761070ad3606f6
Instruction Fuzzy Hash: E1E1B860A9EB0791FE19FB05A861174A7A1BF05788BF49535C84FC63A4FF7CB54AC220

Function 00007FF787041F50 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188windowCOMMON

Download Yara Rule

APIs

GetDialogBaseUnits.USER32 ref: 00007FF787041F9E
MulDiv.KERNEL32 ref: 00007FF787041FB2
MulDiv.KERNEL32 ref: 00007FF787041FD3
SystemParametersInfoW.USER32 ref: 00007FF78704201B
CreateFontIndirectW.GDI32 ref: 00007FF78704202F
#380.COMCTL32 ref: 00007FF787042053
CreateWindowExW.USER32 ref: 00007FF7870420A6
CreateWindowExW.USER32 ref: 00007FF787042100
CreateWindowExW.USER32 ref: 00007FF78704215D
CreateWindowExW.USER32 ref: 00007FF7870421BF
SendMessageW.USER32 ref: 00007FF7870421DF
SendMessageW.USER32 ref: 00007FF7870421F9
SendMessageW.USER32 ref: 00007FF787042218
SendMessageW.USER32 ref: 00007FF787042237
SendMessageW.USER32 ref: 00007FF787042255
SendMessageW.USER32 ref: 00007FF787042273
SendMessageW.USER32 ref: 00007FF787042291
SendMessageW.USER32 ref: 00007FF7870422A9
SendMessageW.USER32 ref: 00007FF7870422C1
GetClientRect.USER32 ref: 00007FF7870422D0

Part of subcall function 00007FF7870423F0: GetDC.USER32 ref: 00007FF78704241B
Part of subcall function 00007FF7870423F0: SelectObject.GDI32 ref: 00007FF787042462
Part of subcall function 00007FF7870423F0: DrawTextW.USER32 ref: 00007FF787042485
Part of subcall function 00007FF7870423F0: SelectObject.GDI32 ref: 00007FF78704249B
Part of subcall function 00007FF7870423F0: ReleaseDC.USER32 ref: 00007FF7870424AB
Part of subcall function 00007FF7870423F0: MoveWindow.USER32 ref: 00007FF7870424FB
Part of subcall function 00007FF7870423F0: MoveWindow.USER32 ref: 00007FF78704253B
Part of subcall function 00007FF7870423F0: MoveWindow.USER32 ref: 00007FF78704258E

Strings

Failed to execute script '%ls' due to unhandled exception: %ls, xrefs: 00007FF787041F7D
STATIC, xrefs: 00007FF78704205C, 00007FF7870420B1
BUTTON, xrefs: 00007FF787042176
EDIT, xrefs: 00007FF78704210B
Close, xrefs: 00007FF787042168

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
API String ID: 2446303242-1601438679
Opcode ID: 2b11bbb19a83a086465840dcd7a103c40d81e06c4cc6566eb68c4ee1e4e9da55
Instruction ID: 514ec63550fae6678f96f2b2742df2da0621f5db8654624612fe8e03e16f027c
Opcode Fuzzy Hash: 2b11bbb19a83a086465840dcd7a103c40d81e06c4cc6566eb68c4ee1e4e9da55
Instruction Fuzzy Hash: CBA18A76308B8587E7149F11E4547AAB770F788B88FA08129DB9E83B24CF7DE165CB50

Function 00007FF78706481C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF78706486A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF787064ED6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78706504C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78706530A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78706552A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF787065767
memcpy_s.LIBCPMT ref: 00007FF787065842
memcpy_s.LIBCPMT ref: 00007FF7870658ED
memcpy_s.LIBCPMT ref: 00007FF7870659BC

Strings

1#IND, xrefs: 00007FF787064957
1#QNAN, xrefs: 00007FF787064983
1#INF, xrefs: 00007FF787064993
1#SNAN, xrefs: 00007FF78706497A

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 1922c43916b7ae2b1956b00aa5dfceaf9999fbe18ebc65017c42f663bf9222a2
Instruction ID: 7e91458003c7901f4de8f18b2a496846d457dab485da76c36f4c2ed32dfc069a
Opcode Fuzzy Hash: 1922c43916b7ae2b1956b00aa5dfceaf9999fbe18ebc65017c42f663bf9222a2
Instruction Fuzzy Hash: FAB2D772B583828BE764DE64D4507FDB7A1FB44348FA09135DA4EDBA84DB38E602CB50

Function 00007FF787048570 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF787042A5E,?,?,?,?,?,?,?,?,?,?,?,00007FF78704101D), ref: 00007FF787048597
FormatMessageW.KERNEL32 ref: 00007FF7870485C6
WideCharToMultiByte.KERNEL32 ref: 00007FF78704861C

Part of subcall function 00007FF7870429E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7870488F2,?,?,?,?,?,?,?,?,?,?,?,00007FF78704101D), ref: 00007FF787042A14
Part of subcall function 00007FF7870429E0: MessageBoxW.USER32 ref: 00007FF787042AF0

Strings

WideCharToMultiByte, xrefs: 00007FF78704862D
PyInstaller: FormatMessageW failed., xrefs: 00007FF7870485E3
Failed to encode wchar_t as UTF-8., xrefs: 00007FF787048626
No error messages generated., xrefs: 00007FF7870485D0
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF787048639
FormatMessageW, xrefs: 00007FF7870485D7

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: ErrorLastMessage$ByteCharFormatMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2920928814-2573406579
Opcode ID: f8b909e9681ff6aa95198e912ee695dc1f7db9a724790c30e57e4941c2966439
Instruction ID: 81cc746562b1433efe16381586b7754901b870d1c751c1641585ec8c6c671d5a
Opcode Fuzzy Hash: f8b909e9681ff6aa95198e912ee695dc1f7db9a724790c30e57e4941c2966439
Instruction Fuzzy Hash: 35216D71B4CB4692EA60BB11E89127AA361BF88788FE44035D64EC66A4EF3CD546C720

Function 00007FF787047960 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 141COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000000,?,00000000,00000000,?,00007FF78704154F), ref: 00007FF7870479F7

Part of subcall function 00007FF787047B70: GetEnvironmentVariableW.KERNEL32(00007FF787043A1F), ref: 00007FF787047BAA
Part of subcall function 00007FF787047B70: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF787047BC7

Part of subcall function 00007FF787057EEC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF787057F05

SetEnvironmentVariableW.KERNEL32 ref: 00007FF787047AB1

Part of subcall function 00007FF787042B30: MessageBoxW.USER32 ref: 00007FF787042C05

Strings

_MEI%d, xrefs: 00007FF787047A05
TMP, xrefs: 00007FF7870479C0
TMP, xrefs: 00007FF78704799A, 00007FF787047A59, 00007FF787047AE7
LOADER: Failed to set the TMP environment variable., xrefs: 00007FF7870479DA

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 3752271684-1116378104
Opcode ID: 959ec632602e32b9f4aface6cbaef3761ff97cf9d17901cd6379361e10be984f
Instruction ID: 9d2d792c3fba03b2466b1daf6323230b7073acd491974f6be5e46aad618c6e9d
Opcode Fuzzy Hash: 959ec632602e32b9f4aface6cbaef3761ff97cf9d17901cd6379361e10be984f
Instruction Fuzzy Hash: 56515B51B9D60245FE14F62698222BAD241BF88BC4FE86430ED0FDB797ED2CE503C260

Function 00007FF78704C67C Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF78704C698
RtlCaptureContext.KERNEL32 ref: 00007FF78704C6C5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF78704C6DF
RtlVirtualUnwind.KERNEL32 ref: 00007FF78704C720
IsDebuggerPresent.KERNEL32 ref: 00007FF78704C774
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF78704C795
UnhandledExceptionFilter.KERNEL32 ref: 00007FF78704C7A0

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: be1c9f70274c1bfa0c57ec5397cb0351ad5ab78a1ed88338b70abc701b0ce300
Instruction ID: ebc2d8da656a92a3ed804de8642b3e9a70fd6c8c4d4dec016e4b2dd532acd87e
Opcode Fuzzy Hash: be1c9f70274c1bfa0c57ec5397cb0351ad5ab78a1ed88338b70abc701b0ce300
Instruction Fuzzy Hash: 233162B2749B8196EB609F60E8503EE7365FB44748F94403ADA4E87B94DF38D649C710

Function 00007FF787066470 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7870664B5

Part of subcall function 00007FF787065E08: _invalid_parameter_noinfo.LIBCMT ref: 00007FF787065E1C

Part of subcall function 00007FF78705B00C: HeapFree.KERNEL32(?,?,?,00007FF787063492,?,?,?,00007FF7870634CF,?,?,00000000,00007FF787063995,?,?,00000000,00007FF7870638C7), ref: 00007FF78705B022
Part of subcall function 00007FF78705B00C: GetLastError.KERNEL32(?,?,?,00007FF787063492,?,?,?,00007FF7870634CF,?,?,00000000,00007FF787063995,?,?,00000000,00007FF7870638C7), ref: 00007FF78705B02C

Part of subcall function 00007FF78705AFC4: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF78705AFA3,?,?,?,?,?,00007FF7870531CC), ref: 00007FF78705AFCD
Part of subcall function 00007FF78705AFC4: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF78705AFA3,?,?,?,?,?,00007FF7870531CC), ref: 00007FF78705AFF2

_get_daylight.LIBCMT ref: 00007FF7870664A4

Part of subcall function 00007FF787065E68: _invalid_parameter_noinfo.LIBCMT ref: 00007FF787065E7C

_get_daylight.LIBCMT ref: 00007FF78706671A
_get_daylight.LIBCMT ref: 00007FF78706672B
_get_daylight.LIBCMT ref: 00007FF78706673C
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF78706697C), ref: 00007FF787066763

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: bbcac37ccba8d4fb81487e2dc58aab96d0fddb0f5958181c110f5c0263e0c824
Instruction ID: 5e340f2fa1cc2f603d7722b83772cfbbca3eae9ea7b1ac3a979e0de6d6d50d01
Opcode Fuzzy Hash: bbcac37ccba8d4fb81487e2dc58aab96d0fddb0f5958181c110f5c0263e0c824
Instruction Fuzzy Hash: A0D19D26F5824286E720FF25D8611B9A761FF45798FE08139EA4FC7A95DE3CE442C360

Function 00007FF78705ACD8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF78705AD51
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF78705AD69
RtlVirtualUnwind.KERNEL32 ref: 00007FF78705ADA4
IsDebuggerPresent.KERNEL32 ref: 00007FF78705ADDD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF78705ADE7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF78705ADF2

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 008726ea591ffa8193f39527e8fee48c852db3d8167e5981d4ed2afc12fe266b
Instruction ID: fb8e45be4f533376faa05d4c2850ba29e162d072a77561f2d6a48c77f4cad578
Opcode Fuzzy Hash: 008726ea591ffa8193f39527e8fee48c852db3d8167e5981d4ed2afc12fe266b
Instruction Fuzzy Hash: 0A31A672648B8196DB60DF24E8402AEB7A0FB84758FA04135EE8EC7B64DF3CC546CB10

Function 00007FF787061FE4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF787062030
FindFirstFileExW.KERNEL32 ref: 00007FF78706213A

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 524e51f0921ab816a8e947fcf7c0d96cffb913f518e40e1861c067ce2dfcbe45
Instruction ID: ef61c1f257dcb994fe2e17b4e17e32ae2440dd704fd65177ac0c4b713846aad7
Opcode Fuzzy Hash: 524e51f0921ab816a8e947fcf7c0d96cffb913f518e40e1861c067ce2dfcbe45
Instruction Fuzzy Hash: F9B1D662B5879641EA60BB21D8241B9A391FB54BE4FE49131DE5FC7B85DF3CE482C310

Function 00007FF7870666EC Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF78706671A

Part of subcall function 00007FF787065E68: _invalid_parameter_noinfo.LIBCMT ref: 00007FF787065E7C

_get_daylight.LIBCMT ref: 00007FF78706672B

Part of subcall function 00007FF787065E08: _invalid_parameter_noinfo.LIBCMT ref: 00007FF787065E1C

_get_daylight.LIBCMT ref: 00007FF78706673C

Part of subcall function 00007FF787065E38: _invalid_parameter_noinfo.LIBCMT ref: 00007FF787065E4C

Part of subcall function 00007FF78705B00C: HeapFree.KERNEL32(?,?,?,00007FF787063492,?,?,?,00007FF7870634CF,?,?,00000000,00007FF787063995,?,?,00000000,00007FF7870638C7), ref: 00007FF78705B022
Part of subcall function 00007FF78705B00C: GetLastError.KERNEL32(?,?,?,00007FF787063492,?,?,?,00007FF7870634CF,?,?,00000000,00007FF787063995,?,?,00000000,00007FF7870638C7), ref: 00007FF78705B02C

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF78706697C), ref: 00007FF787066763

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 111214f05bee2973e4e588afc78e556d255684e42b25d281897c943451d46a64
Instruction ID: f29a4aaf77c360720e912d3fc93fc4d6298116569404634eefc907560aed867e
Opcode Fuzzy Hash: 111214f05bee2973e4e588afc78e556d255684e42b25d281897c943451d46a64
Instruction Fuzzy Hash: E8512C32B5864286E720FF21D8A15A9A760FF49784FE08139EA4FC7695DF3CE452C760

Function 00007FF78704C560 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF78704C58C
GetCurrentThreadId.KERNEL32 ref: 00007FF78704C59A
GetCurrentProcessId.KERNEL32 ref: 00007FF78704C5A6
QueryPerformanceCounter.KERNEL32 ref: 00007FF78704C5B6

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: b9418945c21ca9359366919164a8697e450450899f1773ca7228eb8eaa6a9b3b
Instruction ID: 6af3ebb5753c6aaf98c4eb1c58bc17fe03f023a4182fed973b658e1edce7d763
Opcode Fuzzy Hash: b9418945c21ca9359366919164a8697e450450899f1773ca7228eb8eaa6a9b3b
Instruction Fuzzy Hash: FB117062B54F0689EB00EF60E8542BD73A4FB18758F940E31DA6ECA7A4DF78D195C390

Function 00007FF787064380 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF7870643E6
memcpy_s.LIBCPMT ref: 00007FF787064411

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: d69929eb0f1c2ea96ebe763afdeefebac63be8288a2457cbbf8acc12ab256b51
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: CBC10472B5838687E724DF19A05466AF791F784B84F94C134EB4B8BB44DB3DEA06CB00

Function 00007FF78706A0F8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF78706A347
RaiseException.KERNEL32 ref: 00007FF78706A358

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 9ceb1b6cde6f3b2eda1c2fc70bd7e1e7d126a653b4f6510e73c9dfb920cedcd9
Instruction ID: c801cc9f6d92f7c77e74e6a53aba0e3e846b12ba97000cad7d11a2a8a285e7e4
Opcode Fuzzy Hash: 9ceb1b6cde6f3b2eda1c2fc70bd7e1e7d126a653b4f6510e73c9dfb920cedcd9
Instruction Fuzzy Hash: 4AB16CB3648B858BEB15EF29C8563697BA0F784B48F24C821DB5E837A4CF39D452D710

Function 00007FF787048B00 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF787048B31
FindClose.KERNEL32 ref: 00007FF787048B40

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 8cbeafd55435480eb4b41ebb52a05d3ef2c4ced4829aa63b63a0783ab33de0ca
Instruction ID: f385992220c3b8105267b6c59a44f922fdf58ad7956076fa3e3d4bba76460399
Opcode Fuzzy Hash: 8cbeafd55435480eb4b41ebb52a05d3ef2c4ced4829aa63b63a0783ab33de0ca
Instruction Fuzzy Hash: E6F0F9726183418AF7609F60E485365F390BB4472CF904735D56E867D4DF3CD009CA10

Function 00007FF787053BE4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF787053F94
, xrefs: 00007FF787053D52

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: c4872f1e0598d0dbbdaab36ff9640d642bec52225eb732dc17c9982f250c6bea
Instruction ID: 60987b8aa1283aeff9a5c6d9b9433b20ec659d567e555e2fe91b47dcf97b2e12
Opcode Fuzzy Hash: c4872f1e0598d0dbbdaab36ff9640d642bec52225eb732dc17c9982f250c6bea
Instruction Fuzzy Hash: 07E1B032A4864682EB68AA29905017DE7B0FF45B4CFF45235DA0FE7694DF39E853C720

Function 00007FF78705E5B0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 00007FF78705E6BD
gfff, xrefs: 00007FF78705E73A

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: dcea56467776434e5e52420c9f77f7819282e5f197dea1188040280776680b59
Instruction ID: 48aa6e0eef32663f287d4041752899b6a0f0d0687202f615fc3ecc40c101638a
Opcode Fuzzy Hash: dcea56467776434e5e52420c9f77f7819282e5f197dea1188040280776680b59
Instruction Fuzzy Hash: 90515762B1C2C546E724DA359802769EB91F744BD4FD88232CBADCBAD5DE3DD002C710

Function 00007FF787061038 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 97f539a7fe7fc551e0c66836eb46f4a9937a07ec542780b0bb5d867a01fb23bb
Instruction ID: 8d3b2ec05783141509b238b2a48a69c78c62de55b30caf29a5abb9e33eca0b82
Opcode Fuzzy Hash: 97f539a7fe7fc551e0c66836eb46f4a9937a07ec542780b0bb5d867a01fb23bb
Instruction Fuzzy Hash: DF029E21B8974681FA61BB919824279E690BF41BA1FF48635DD6FC67D2DE7CE403C320

Function 00007FF78705E11C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF78705E45E

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: da57d4f04fe3a59080078ae7a8b70c1646e0beb0550e210eb96496c016bfbe06
Instruction ID: d909d2bfc417f24a6d736c236b8cef7b0bc03303fb4a52d641fa077906183d7c
Opcode Fuzzy Hash: da57d4f04fe3a59080078ae7a8b70c1646e0beb0550e210eb96496c016bfbe06
Instruction Fuzzy Hash: 8DA15762A087C586EB21DF25A0017ADBB91FB50B84FA48031DE8EDB7A5DE3DD502C711

Function 00007FF7870587D0 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF7870587EF

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 7780e97ada7a9ff30298cfab53455dab2563e18515febd93890c54f10b8bac38
Instruction ID: 28544a4ebd4ff7f047346818a71da9bfdb54a0b6795a70d87ab3fe9cd17d1330
Opcode Fuzzy Hash: 7780e97ada7a9ff30298cfab53455dab2563e18515febd93890c54f10b8bac38
Instruction Fuzzy Hash: AA51AC11B8860281FA64BB26595157AE291BF44BD4FE84035CE6FE77D6EE3DF403E220

Function 00007FF787063BF0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF787063BF4

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 7569e3696a4862237eb2d75a5d3254d27d2728382b8d3a4fb7a9071d2e6cb06f
Instruction ID: ffdfbc013dd793879d5e88b64deca6fbf3bffe9b4b5cc34f06b0e55360e64ffd
Opcode Fuzzy Hash: 7569e3696a4862237eb2d75a5d3254d27d2728382b8d3a4fb7a9071d2e6cb06f
Instruction Fuzzy Hash: 5AB09260F97B46C2EB483B116C9621462A5BF48701FF48038C10EC1320DE3C20B68720

Function 00007FF7870537E0 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1b45cc5b539c2f4a44f5a431b63c23698d5cd8cc6c74fd81da4f2666c4fe2f5
Instruction ID: 3a20227e49c887ded89cf21ba493ed220c6d56fc479b27d49bb9474f5bd79ee7
Opcode Fuzzy Hash: e1b45cc5b539c2f4a44f5a431b63c23698d5cd8cc6c74fd81da4f2666c4fe2f5
Instruction Fuzzy Hash: 37D1E566A4864682FB68AA25805027DF7A0FB05B4CFF41239DE0FE7694CF39D856C360

Function 00007FF7870490D0 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84ec6a3f320757ef13b53a77f9400a9296092c401b576f7c6112a1c9e532824b
Instruction ID: 03b38a660830657b4701542ccca93085f7a8978040c37f828a92c51b59d09de0
Opcode Fuzzy Hash: 84ec6a3f320757ef13b53a77f9400a9296092c401b576f7c6112a1c9e532824b
Instruction Fuzzy Hash: 96C1B1722141E04BD2C9EB29E45957A73E1F78834DBE4443AEB8B97B89C63CE415D720

Function 00007FF787052E50 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4004e6f7831e6380f0c7a9c187e4f56c2fba6a50471e57e5591c0e9cd6f9eb67
Instruction ID: 36deb974e6c8b4420d51863f3e5d9d7ca5745bbe425a096e38fb9bc50ea4422e
Opcode Fuzzy Hash: 4004e6f7831e6380f0c7a9c187e4f56c2fba6a50471e57e5591c0e9cd6f9eb67
Instruction Fuzzy Hash: 23B1887294878585EB64AF39D05023DBBA0FB49B4CFE81135DA4EE7395CF29D482C724

Function 00007FF78705EC30 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84378e74e3abe4b2e50357a3cae6d1c9f133da408f6cd3af500eca0aac5fc0e9
Instruction ID: 0a844154082efac6843eefa7646e127ff7d1296dda41ef6ebd26a58e066174f4
Opcode Fuzzy Hash: 84378e74e3abe4b2e50357a3cae6d1c9f133da408f6cd3af500eca0aac5fc0e9
Instruction Fuzzy Hash: CC811372A4C38146EB74DB19904237AAA91FB45794FE44235DACEDBBA9CF3DD402CB10

Function 00007FF787066E70 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 970fa9c1e70947ae83e04df9520a0fb1810d06995f6d4a160b1c2f03216b318c
Instruction ID: 1f966678c63d31efdb560a5c0f4d4522f08f2dce2226cd51fe3ee2ac16e70fa7
Opcode Fuzzy Hash: 970fa9c1e70947ae83e04df9520a0fb1810d06995f6d4a160b1c2f03216b318c
Instruction Fuzzy Hash: E761EA62F5C34286F765BA288874739E681BF41760FB88639D61FC76D1DE7DE802C620

Function 00007FF787051F94 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa1e8384b8f9ed93a652e40ff1fad70abf09339abefc5cb7d3385a95e3869c9a
Instruction ID: ef67f4f4b441bc49944396b66738c231272f3085db1198fa8f8848b82c7d2d78
Opcode Fuzzy Hash: fa1e8384b8f9ed93a652e40ff1fad70abf09339abefc5cb7d3385a95e3869c9a
Instruction Fuzzy Hash: 8B51E4B6A5865186E7249B28C440239B3A0FF54B68FF45131CE4EE77A5CF3AE893C750

Function 00007FF787051B84 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51394bb55acd0354c6b54540f03649d9a1ed653df3d59b65c3bbefa0f3d6b76a
Instruction ID: db65baf54ae279375e35f7d668dd4b43b72be074183642541288bdca1c9166ac
Opcode Fuzzy Hash: 51394bb55acd0354c6b54540f03649d9a1ed653df3d59b65c3bbefa0f3d6b76a
Instruction Fuzzy Hash: CD518376A5865182E7249B29D04423CB7A0FB49B69FF44131CE4EE77D4CB3AE843C760

Function 00007FF7870523A4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c25247ae15e209603ec1042d904b34171e82564d0ea1a98edeaeffe93ffac02
Instruction ID: f455511a341ca1e7f9cd7057769fb8115ad61ca8ddc0e6370d87b3977610f8b7
Opcode Fuzzy Hash: 3c25247ae15e209603ec1042d904b34171e82564d0ea1a98edeaeffe93ffac02
Instruction Fuzzy Hash: 9D51A4B6A5865182E7249B29D044238B7A0FF54B68FF44131DE4EE7794CB7AE8C3CB50

Function 00007FF787051D90 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4595b9fb9fef9db7488d00d8b5cf28c2737f3b7c2e6c847ec82cdef55389f28
Instruction ID: 2da91e0ff0a8988d016513ee288833a09fbc0bf8d69f75652480e20c95c09478
Opcode Fuzzy Hash: d4595b9fb9fef9db7488d00d8b5cf28c2737f3b7c2e6c847ec82cdef55389f28
Instruction Fuzzy Hash: 27519076A5865186E7249B29C044338B7A1FB48B5DFF44131CE4EE7794CB3AE883C790

Function 00007FF787051980 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbef8b130d79a7ad9bd62ede7a83548c92a3f011a0e32d449ba268992e3839f7
Instruction ID: 527ba47de606590d5865f65531a2819abba13e2d0cc6b2e4a88fe7af9e981fe0
Opcode Fuzzy Hash: cbef8b130d79a7ad9bd62ede7a83548c92a3f011a0e32d449ba268992e3839f7
Instruction Fuzzy Hash: 3D51CF36A58A5182E7259B29C040238B7A1FB44B59FF44131CE4EE77A4DF3AEC83C750

Function 00007FF7870521A0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8494ecf62f03c1d3943c1d589e4c29644468de266d09ee5189585ab02985f6c2
Instruction ID: cdd55183b9c8f05cbddbaf6ed7041ddb32aed2841511eb16ed51dba09af47cf0
Opcode Fuzzy Hash: 8494ecf62f03c1d3943c1d589e4c29644468de266d09ee5189585ab02985f6c2
Instruction Fuzzy Hash: E25190B6A5865185E7249B29C04023CB7A0FF58B58FF84131CE4EE7798CB3AE893C750

Function 00007FF787056030 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: 04f2f3868b52e2f94a6c42cacbdaa82512e367d6a2f4acb704fba4f52d06935b
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: 1F417152DD964A04F9A5991805146B9E680BF23FA0DF863B4DD9BF73D3CD0E698BC220

Function 00007FF78705A530 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 7207d2828b21fefb3f30a877494a06cb20516b4d86b30a5eda9c739e5360529e
Instruction ID: c351152003b3cc82dbb5504ba943803640afebe10c774c35630a53697304a5fb
Opcode Fuzzy Hash: 7207d2828b21fefb3f30a877494a06cb20516b4d86b30a5eda9c739e5360529e
Instruction Fuzzy Hash: 24411562B18A5881FF14DF2AD924169B391B748FD0B989032DE0EDBB68DE3DD482C350

Function 00007FF787057D98 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a995e5fc84bafd528f225b35c170f98e6cc3b92f214e8a834a3db34d2346d02
Instruction ID: f3f6dbc7c14fa17223959e490a70c3e8559ce3bf2076e8113202c54cc8da7d7d
Opcode Fuzzy Hash: 9a995e5fc84bafd528f225b35c170f98e6cc3b92f214e8a834a3db34d2346d02
Instruction Fuzzy Hash: 3F31B332B58B4281E764EF25644013EA6D5BB84B90FA85238EA5EE3BD6DF3CD402D714

Function 00007FF787069F40 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9053913a188439c949862f5252d0d96588d6a3198c5220388b8f4d277b857ee
Instruction ID: 5f78039fd7df482c486b0c2cc2dda80eeab43d241f7fa3d2d24ff180f06f7c5d
Opcode Fuzzy Hash: d9053913a188439c949862f5252d0d96588d6a3198c5220388b8f4d277b857ee
Instruction Fuzzy Hash: 12F068717682558ADB949F29E80262977D0FB483C1FD0803DE58DC3F04D63C9052CF14

Function 00007FF78704C860 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfc8547ea6af2cfbec2828df990cd3d0a6205bb3f5e3ae253026f3a9dd74dc92
Instruction ID: 66014a8015977c60aff5065bd10bc20e044b3e57ba3d76271d93476e570d086b
Opcode Fuzzy Hash: cfc8547ea6af2cfbec2828df990cd3d0a6205bb3f5e3ae253026f3a9dd74dc92
Instruction Fuzzy Hash: 7FA001A1A89902E1E644AB50A861071A261BB51308BF04035D40EC51A0EF2CE543C221

Function 00007FF7870451F0 Relevance: 233.1, APIs: 44, Strings: 89, Instructions: 363libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF78704346E), ref: 00007FF787045200
GetProcAddress.KERNEL32(?,?,00000000,00007FF78704346E), ref: 00007FF78704523A
GetProcAddress.KERNEL32(?,?,00000000,00007FF78704346E), ref: 00007FF78704525F
GetProcAddress.KERNEL32(?,?,00000000,00007FF78704346E), ref: 00007FF787045284
GetProcAddress.KERNEL32(?,?,00000000,00007FF78704346E), ref: 00007FF7870452AC
GetProcAddress.KERNEL32(?,?,00000000,00007FF78704346E), ref: 00007FF7870452D4
GetProcAddress.KERNEL32(?,?,00000000,00007FF78704346E), ref: 00007FF7870452FC
GetProcAddress.KERNEL32(?,?,00000000,00007FF78704346E), ref: 00007FF787045324
GetProcAddress.KERNEL32(?,?,00000000,00007FF78704346E), ref: 00007FF78704534C
GetProcAddress.KERNEL32(?,?,00000000,00007FF78704346E), ref: 00007FF787045374

Strings

Failed to get address for PyConfig_SetBytesString, xrefs: 00007FF7870453AE
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF7870457E6
PyUnicode_Replace, xrefs: 00007FF7870458BA
Failed to get address for Py_IsInitialized, xrefs: 00007FF7870452E6
Py_Finalize, xrefs: 00007FF78704527A
Failed to get address for PyUnicode_FromString, xrefs: 00007FF787045886
Failed to get address for PySys_GetObject, xrefs: 00007FF787045796
Failed to get address for Py_PreInitialize, xrefs: 00007FF78704530E
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF7870456A6
Failed to get address for PyConfig_Clear, xrefs: 00007FF787045336
Failed to get address for PyUnicode_Join, xrefs: 00007FF7870458AE
PySys_GetObject, xrefs: 00007FF78704577A
Failed to get address for PyModule_GetDict, xrefs: 00007FF78704562E
PyErr_Print, xrefs: 00007FF7870454AA
Failed to get address for PyErr_Print, xrefs: 00007FF7870454C6
PyEval_EvalCode, xrefs: 00007FF7870454FA
Py_DecodeLocale, xrefs: 00007FF787045230
Failed to get address for PyErr_Occurred, xrefs: 00007FF78704549E
Failed to get address for PySys_SetObject, xrefs: 00007FF7870457BE
PyMarshal_ReadObjectFromString, xrefs: 00007FF7870455C2
Failed to get address for PyConfig_SetString, xrefs: 00007FF7870453D6
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF787045836
PyErr_NormalizeException, xrefs: 00007FF78704545A
Py_IsInitialized, xrefs: 00007FF7870452CA
Failed to get address for PyStatus_Exception, xrefs: 00007FF78704576E
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF787045566
PyConfig_Clear, xrefs: 00007FF78704531A
PyUnicode_FromFormat, xrefs: 00007FF787045842
Py_DecRef, xrefs: 00007FF7870451F6
Failed to get address for PyConfig_InitIsolatedConfig, xrefs: 00007FF78704535E
PyUnicode_Join, xrefs: 00007FF787045892
PyObject_CallFunctionObjArgs, xrefs: 00007FF787045662
Failed to get address for Py_Finalize, xrefs: 00007FF787045296
PyObject_SetAttrString, xrefs: 00007FF7870456B2
Failed to get address for Py_DecRef, xrefs: 00007FF787045212
PyList_Append, xrefs: 00007FF78704559A
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF7870455DE
PyConfig_InitIsolatedConfig, xrefs: 00007FF787045342
PyImport_ImportModule, xrefs: 00007FF787045572
Failed to get address for PyObject_Str, xrefs: 00007FF7870456F6
Failed to get address for PyPreConfig_InitIsolatedConfig, xrefs: 00007FF78704571E
Failed to get address for PyObject_CallFunction, xrefs: 00007FF787045656
Failed to get address for PyEval_EvalCode, xrefs: 00007FF787045516
Failed to get address for PyErr_Restore, xrefs: 00007FF7870454EE
PyUnicode_AsUTF8, xrefs: 00007FF7870457CA
Failed to get address for Py_InitializeFromConfig, xrefs: 00007FF7870452BE
Failed to get address for PyConfig_Read, xrefs: 00007FF787045386
Failed to get address for PyErr_Clear, xrefs: 00007FF787045426
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF78704585E
PyErr_Restore, xrefs: 00007FF7870454D2
PyConfig_Read, xrefs: 00007FF78704536A
PyErr_Clear, xrefs: 00007FF78704540A
PySys_SetObject, xrefs: 00007FF7870457A2
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF787045746
GetProcAddress, xrefs: 00007FF787045219
Failed to get address for Py_DecodeLocale, xrefs: 00007FF78704524C
PyUnicode_DecodeFSDefault, xrefs: 00007FF78704581A
PyErr_Occurred, xrefs: 00007FF787045482
Py_ExitStatusException, xrefs: 00007FF787045255
PyConfig_SetWideStringList, xrefs: 00007FF7870453E2
Py_InitializeFromConfig, xrefs: 00007FF7870452A2
PyUnicode_Decode, xrefs: 00007FF7870457F2
Failed to get address for PyConfig_SetWideStringList, xrefs: 00007FF7870453FE
Failed to get address for PyUnicode_Decode, xrefs: 00007FF78704580E
PyMem_RawFree, xrefs: 00007FF7870455EA
PyImport_ExecCodeModule, xrefs: 00007FF78704554A
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF78704567E
Failed to get address for PyList_Append, xrefs: 00007FF7870455B6
Failed to get address for PyUnicode_Replace, xrefs: 00007FF7870458D6
PyModule_GetDict, xrefs: 00007FF787045612
PyUnicode_FromString, xrefs: 00007FF78704586A
PyStatus_Exception, xrefs: 00007FF787045752
Failed to get address for PyErr_Fetch, xrefs: 00007FF78704544E
PyConfig_SetBytesString, xrefs: 00007FF787045392
PyRun_SimpleStringFlags, xrefs: 00007FF78704572A
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF7870456CE
Failed to get address for PyMem_RawFree, xrefs: 00007FF787045606
PyObject_CallFunction, xrefs: 00007FF78704563A
PyImport_AddModule, xrefs: 00007FF787045522
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF787045702
PyObject_Str, xrefs: 00007FF7870456DA
PyErr_Fetch, xrefs: 00007FF787045432
PyObject_GetAttrString, xrefs: 00007FF78704568A
Failed to get address for PyImport_AddModule, xrefs: 00007FF78704553E
PyConfig_SetString, xrefs: 00007FF7870453BA
Failed to get address for PyImport_ImportModule, xrefs: 00007FF78704558E
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF787045476
Py_PreInitialize, xrefs: 00007FF7870452F2
Failed to get address for Py_ExitStatusException, xrefs: 00007FF787045271

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyConfig_Clear$Failed to get address for PyConfig_InitIsolatedConfig$Failed to get address for PyConfig_Read$Failed to get address for PyConfig_SetBytesString$Failed to get address for PyConfig_SetString$Failed to get address for PyConfig_SetWideStringList$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyPreConfig_InitIsolatedConfig$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PyStatus_Exception$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetObject$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_ExitStatusException$Failed to get address for Py_Finalize$Failed to get address for Py_InitializeFromConfig$Failed to get address for Py_IsInitialized$Failed to get address for Py_PreInitialize$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 190572456-4266016200
Opcode ID: f2f88704c5d1e061734efcee993fe9c6dd7b1185595c7391647c05c7e9d36fbf
Instruction ID: ac3b685d3c66b35f40626eb50fb285860dc1ee6b5efefc90d13a9a03beee75c8
Opcode Fuzzy Hash: f2f88704c5d1e061734efcee993fe9c6dd7b1185595c7391647c05c7e9d36fbf
Instruction Fuzzy Hash: 52129764BCAB0390FA15FB04EC61175A7A1BF05798BF49436C84FC62A4EF7CB54AC221

Function 00007FF787041710 Relevance: 24.6, APIs: 1, Strings: 13, Instructions: 148COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF787041866
malloc, xrefs: 00007FF78704186D
fwrite, xrefs: 00007FF7870418EC
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7870418E5
pyi_arch_extract2fs was called before temporary directory was initialized!, xrefs: 00007FF787041726
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7870417D9
fopen, xrefs: 00007FF787041797
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF787041806
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7870418F5
Failed to extract %s: failed to open target file!, xrefs: 00007FF787041790
fseek, xrefs: 00007FF78704180D
fread, xrefs: 00007FF7870418FC
Failed to create symbolic link %s!, xrefs: 00007FF787041753

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: Message
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc$pyi_arch_extract2fs was called before temporary directory was initialized!
API String ID: 2030045667-3833288071
Opcode ID: 71416f08d0115de5e9be55a7f71c4a67e8cf22d25efc3be865573d17d420391b
Instruction ID: 6cab75308c08d4461ed46226ca9ee82ff7d1c77ec29b4da1652fbc80a9380db8
Opcode Fuzzy Hash: 71416f08d0115de5e9be55a7f71c4a67e8cf22d25efc3be865573d17d420391b
Instruction Fuzzy Hash: 41519161B8864385EA10FB25E8512B9E391BF44B98FF44435DE0EC7696EF3CE546C720

Function 00007FF7870412B0 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF787042B30: MessageBoxW.USER32 ref: 00007FF787042C05

_fread_nolock.LIBCMT ref: 00007FF787041499

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF78704132B
malloc, xrefs: 00007FF787041377
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7870414BF
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF787041370
%s%c%s, xrefs: 00007FF7870413EE
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7870412FE
fseek, xrefs: 00007FF787041332
fread, xrefs: 00007FF7870414C6
\, xrefs: 00007FF7870413F5

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: Message_fread_nolock
String ID: %s%c%s$Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$\$fread$fseek$malloc
API String ID: 3065259568-2316137593
Opcode ID: fe5706f6e31b9bb9e24bd14d35a9aad1094ff34984450d040fa2bf53573d028d
Instruction ID: 7084ccd087eb73e59b60e5425c2c061704983d9f19431dc708db3f7c3cdfa345
Opcode Fuzzy Hash: fe5706f6e31b9bb9e24bd14d35a9aad1094ff34984450d040fa2bf53573d028d
Instruction Fuzzy Hash: E0519461B8968345EA20B721A4522BAA394BF447C8FF04031EE5FC7A86EE7CE543C750

Function 00007FF7870423F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF78704241B
SelectObject.GDI32 ref: 00007FF787042462
DrawTextW.USER32 ref: 00007FF787042485
SelectObject.GDI32 ref: 00007FF78704249B
ReleaseDC.USER32 ref: 00007FF7870424AB
MoveWindow.USER32 ref: 00007FF7870424FB
MoveWindow.USER32 ref: 00007FF78704253B
MoveWindow.USER32 ref: 00007FF78704258E
MoveWindow.USER32 ref: 00007FF7870425D6

Strings

P%, xrefs: 00007FF78704246F

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 7645c0c2d2fce03d3aab2d1fd33ee4a3925b53edade4cf92fedf68089910dc30
Instruction ID: 1abd27f8a47f5b6f8b5dd79974f6fe1177ff143419abd8d1171560012716352b
Opcode Fuzzy Hash: 7645c0c2d2fce03d3aab2d1fd33ee4a3925b53edade4cf92fedf68089910dc30
Instruction Fuzzy Hash: CC51F8666147A186D634AF26A0181BAF7A1FB98B65F104121EBCFC3694DF7CD086DB20

Function 00007FF7870568A4 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7870568E7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF787056CD4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF787056F70

Strings

f, xrefs: 00007FF787056A09
p, xrefs: 00007FF787056A11
p, xrefs: 00007FF787056999
:, xrefs: 00007FF787056AA0
-, xrefs: 00007FF78705697D

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 17c3eaeb34264a701bb66d7ce4ab8a897af2982fe98c3a48157bd34433a5c608
Instruction ID: f6ecf11980ffac16c734cea0f38c942f97061c107c91f26183ef0d88c9335073
Opcode Fuzzy Hash: 17c3eaeb34264a701bb66d7ce4ab8a897af2982fe98c3a48157bd34433a5c608
Instruction Fuzzy Hash: AF12B462E4C14386FB20BA14D1542B9F6A1FB42B54FE44435E68BE76C4DF3DE882DB24

Function 00007FF787051208 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF787051248
_invalid_parameter_noinfo.LIBCMT ref: 00007FF787051610
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7870518AF

Strings

p, xrefs: 00007FF7870512ED
f, xrefs: 00007FF7870512E0
f, xrefs: 00007FF78705134A
p, xrefs: 00007FF787051352
f, xrefs: 00007FF787051495

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 7160b50ef5c5d9843a5fd5f0d5cd643ebb1f382f7049b3f2f81a6a7c29ab944c
Instruction ID: 35e6e167adde4fc5caa96c41d9dcf29b6d8d9b3d32315f1060566de577a325ed
Opcode Fuzzy Hash: 7160b50ef5c5d9843a5fd5f0d5cd643ebb1f382f7049b3f2f81a6a7c29ab944c
Instruction Fuzzy Hash: 50129172E4C14386FB20BB14D0546B9F262FB40756FE84135E69BE66C4DB7CE886CB21

Function 00007FF7870415A0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 99COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF787041609
malloc, xrefs: 00007FF787041640
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7870416C2
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF787041639
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7870415D3
fseek, xrefs: 00007FF787041610
fread, xrefs: 00007FF7870416C9

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 805e2a61b0ec11e1e273d69fb2577a02836caa060e39109d3b34f2006f9c3b9a
Instruction ID: 934083da33ccc1fc7033de12101979525cb3bd7123f03e890c4719cfb8486b60
Opcode Fuzzy Hash: 805e2a61b0ec11e1e273d69fb2577a02836caa060e39109d3b34f2006f9c3b9a
Instruction Fuzzy Hash: 7D316F61B8864295EA20BB51A4115BAE391BF04BD8FF84031DE4FD7A55EE3CE543C720

Function 00007FF787048090 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90processsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF787048BE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF787042ABB), ref: 00007FF787048C1A

SetConsoleCtrlHandler.KERNEL32(00000000,00007FF787043D57), ref: 00007FF7870480DF
GetStartupInfoW.KERNEL32 ref: 00007FF7870480FE

Part of subcall function 00007FF78705AB14: _invalid_parameter_noinfo.LIBCMT ref: 00007FF78705AB28

Part of subcall function 00007FF787058730: _invalid_parameter_noinfo.LIBCMT ref: 00007FF787058797

GetCommandLineW.KERNEL32 ref: 00007FF78704819E
CreateProcessW.KERNEL32 ref: 00007FF7870481E0
WaitForSingleObject.KERNEL32 ref: 00007FF7870481F4
GetExitCodeProcess.KERNEL32 ref: 00007FF787048204

Strings

CreateProcessW, xrefs: 00007FF787048217
Error creating child process!, xrefs: 00007FF787048210

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 2895956056-3524285272
Opcode ID: 08988cee581fa2f1300347ff32b1d9c8d82b1f49edf068ad7517d4b354b7a22a
Instruction ID: 001c138eafcd4d5d0239172db5daa8f1536a19e16c9f5e1de644c0f586bb1fb4
Opcode Fuzzy Hash: 08988cee581fa2f1300347ff32b1d9c8d82b1f49edf068ad7517d4b354b7a22a
Instruction Fuzzy Hash: 6D418471A48B8681DA20EB24E4552AAF361FF94364FA00735E6AEC77D5DF7CD045CB10

Function 00007FF78704EC00 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF78704EC5D

Part of subcall function 00007FF78704FB70: __GetUnwindTryBlock.LIBCMT ref: 00007FF78704FBB3
Part of subcall function 00007FF78704FB70: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF78704FBD8

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF78704ED35
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF78704EF8A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF78704F096

Strings

csm, xrefs: 00007FF78704EC77
csm, xrefs: 00007FF78704ED58
csm, xrefs: 00007FF78704ECDE

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 5b2106ab85fd7efcab108e3077ecf48f9db79865e243ba23a6eb4b146be1c4dd
Instruction ID: 4eb87ca77c2b810db6cdde83f4af445e311166ac414ccf1f784a75c0fd59ac48
Opcode Fuzzy Hash: 5b2106ab85fd7efcab108e3077ecf48f9db79865e243ba23a6eb4b146be1c4dd
Instruction Fuzzy Hash: 4DE1A372A4874186EB20AF65D4422ADB7A0FB4479CFA40535EE4ED7B96CF38E182C750

Function 00007FF787041050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156COMMON

Download Yara Rule

Strings

Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7870410B4
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF787041249
malloc, xrefs: 00007FF7870410F8, 00007FF787041126
1.3.1, xrefs: 00007FF78704107E
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF78704111F
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7870410F1

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: Message
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-2813020118
Opcode ID: 55ccc0727fab39dc9bb8f633fc671205a05622b8bc078318a810c7f653032360
Instruction ID: 49daf224633b1ad1a05b6e756c1ff7f49a5badb5336ee59c50f4f0472af1643e
Opcode Fuzzy Hash: 55ccc0727fab39dc9bb8f633fc671205a05622b8bc078318a810c7f653032360
Instruction Fuzzy Hash: D151E162B49A8281EA20BB11E4513BAE391FF84798FE44131EE4FC7795EE3CE556C710

Function 00007FF78705F2D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF78705F66A,?,?,-00000018,00007FF78705B417,?,?,?,00007FF78705B30E,?,?,?,00007FF787056552), ref: 00007FF78705F44C
GetProcAddress.KERNEL32(?,?,?,00007FF78705F66A,?,?,-00000018,00007FF78705B417,?,?,?,00007FF78705B30E,?,?,?,00007FF787056552), ref: 00007FF78705F458

Strings

ext-ms-, xrefs: 00007FF78705F3A9
api-ms-, xrefs: 00007FF78705F396

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: d9a2a87bd09a281b138f83e486683d1d3e88d7d7cd724ecba9763c018ac5b270
Instruction ID: 0749daf315a17f4fc6329acd60d625b83dae9f650c205f209c5c135bd3201b51
Opcode Fuzzy Hash: d9a2a87bd09a281b138f83e486683d1d3e88d7d7cd724ecba9763c018ac5b270
Instruction Fuzzy Hash: F941E261B99A4241FB15EB16A804575A391BF44BE0FF84635DD1EEB784DE3CF48BC220

Function 00007FF7870487B0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF78704101D), ref: 00007FF787048847
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF78704101D), ref: 00007FF78704889E

Strings

WideCharToMultiByte, xrefs: 00007FF7870488E6
Failed to encode wchar_t as UTF-8., xrefs: 00007FF7870488C6
Failed to get UTF-8 buffer size., xrefs: 00007FF7870488DF
win32_utils_to_utf8, xrefs: 00007FF7870488D6
Out of memory., xrefs: 00007FF7870488CF

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: cebc729a5b9297ab91709ea31429c1993552edd1e928e0a6d012630ecbb99c6d
Instruction ID: 89ed03ffa73ed652faadaba44ac3f555295e6c30e1ec90860ebd49448876e064
Opcode Fuzzy Hash: cebc729a5b9297ab91709ea31429c1993552edd1e928e0a6d012630ecbb99c6d
Instruction Fuzzy Hash: D7419232A4CB8282E660EF15B88117AF7A1FB84794FA44535DA8EC7B94DF3CE446D710

Function 00007FF787048CF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00007FF7870439EA), ref: 00007FF787048D31

Part of subcall function 00007FF7870429E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7870488F2,?,?,?,?,?,?,?,?,?,?,?,00007FF78704101D), ref: 00007FF787042A14
Part of subcall function 00007FF7870429E0: MessageBoxW.USER32 ref: 00007FF787042AF0

WideCharToMultiByte.KERNEL32(?,00007FF7870439EA), ref: 00007FF787048DA5

Strings

WideCharToMultiByte, xrefs: 00007FF787048D45, 00007FF787048DB6
Failed to encode wchar_t as UTF-8., xrefs: 00007FF787048DAF
Failed to get UTF-8 buffer size., xrefs: 00007FF787048D3E
win32_utils_to_utf8, xrefs: 00007FF787048D72
Out of memory., xrefs: 00007FF787048D6B

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 3723044601-27947307
Opcode ID: e6417f1fd93d5a3f3fa94280b6e7ffe8603b6bf672e9512117038c3495c1cbe3
Instruction ID: 2b0abc61ec07a2fc61d2ec810f4b4f735d9d3767509ef53ffb402004262990c7
Opcode Fuzzy Hash: e6417f1fd93d5a3f3fa94280b6e7ffe8603b6bf672e9512117038c3495c1cbe3
Instruction Fuzzy Hash: AB218921B4DB4695EA10FF12A851068B761BB94B84FA48535CA4EC7794EF3CE542C310

Function 00007FF7870475B0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 136COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF787047726

Part of subcall function 00007FF787050350: _invalid_parameter_noinfo.LIBCMT ref: 00007FF787050364

Part of subcall function 00007FF787050324: _invalid_parameter_noinfo.LIBCMT ref: 00007FF787050338

Strings

PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF787047642
WARNING: file already exists but should not: %s, xrefs: 00007FF7870476A8
\, xrefs: 00007FF7870475FC
%s%c%s, xrefs: 00007FF7870475F5
ERROR: file already exists but should not: %s, xrefs: 00007FF78704768C

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_fread_nolock
String ID: %s%c%s$ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s$\
API String ID: 3231891352-3501660386
Opcode ID: 09136e9433c03fe3f7d45f26f8c4a6b4af7ddc229976618ec4ccfee91dd6a0ed
Instruction ID: 222a3407fd18095f9db04d5610e1b6a065798c5bce3ee42427c0ae88471ac0dc
Opcode Fuzzy Hash: 09136e9433c03fe3f7d45f26f8c4a6b4af7ddc229976618ec4ccfee91dd6a0ed
Instruction Fuzzy Hash: CC518E60A8D64345FA20B72599122B9E291BF847D8FF85031E91FC66D7EE2CE403C360

Function 00007FF78704DEB8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF78704E16A,?,?,?,00007FF78704DE5C,?,?,00000001,00007FF78704DA79), ref: 00007FF78704DF3D
GetLastError.KERNEL32(?,?,?,00007FF78704E16A,?,?,?,00007FF78704DE5C,?,?,00000001,00007FF78704DA79), ref: 00007FF78704DF4B
LoadLibraryExW.KERNEL32(?,?,?,00007FF78704E16A,?,?,?,00007FF78704DE5C,?,?,00000001,00007FF78704DA79), ref: 00007FF78704DF75
FreeLibrary.KERNEL32(?,?,?,00007FF78704E16A,?,?,?,00007FF78704DE5C,?,?,00000001,00007FF78704DA79), ref: 00007FF78704DFBB
GetProcAddress.KERNEL32(?,?,?,00007FF78704E16A,?,?,?,00007FF78704DE5C,?,?,00000001,00007FF78704DA79), ref: 00007FF78704DFC7

Strings

api-ms-, xrefs: 00007FF78704DF5D

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 9872d352a920fe7d45116cdfab482bad5ae926fb7a0a3cc3bdcd692ff81b7137
Instruction ID: c07bdf4b7c8176df76be10e8db34eae89f7d4e34a7ce30649fbba579ed4f0213
Opcode Fuzzy Hash: 9872d352a920fe7d45116cdfab482bad5ae926fb7a0a3cc3bdcd692ff81b7137
Instruction Fuzzy Hash: CB31CE61A5E74690EA21BB02A801674A3D4BF48BA8FB90534DE1FDA794DF3CE042C320

Function 00007FF787047430 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF787048BE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF787042ABB), ref: 00007FF787048C1A

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF7870479B1,00000000,?,00000000,00000000,?,00007FF78704154F), ref: 00007FF78704748F

Part of subcall function 00007FF787042B30: MessageBoxW.USER32 ref: 00007FF787042C05

Strings

LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF787047466
LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7870474A3
LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7870474EA

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 1662231829-3498232454
Opcode ID: a6769069b43094e92c25388bb7d575f5882588fe847eb7774431a04802112af4
Instruction ID: edcc2116df662cfb14954fe3cbca1065bda49ed78b198a3f7a459584095d76e1
Opcode Fuzzy Hash: a6769069b43094e92c25388bb7d575f5882588fe847eb7774431a04802112af4
Instruction Fuzzy Hash: DE318451B9C78241FA20F721A5623BA9251BF987C8FE85431DA4FC6696EE6CE106C620

Function 00007FF787048BE0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF787042ABB), ref: 00007FF787048C1A

Part of subcall function 00007FF7870429E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7870488F2,?,?,?,?,?,?,?,?,?,?,?,00007FF78704101D), ref: 00007FF787042A14
Part of subcall function 00007FF7870429E0: MessageBoxW.USER32 ref: 00007FF787042AF0

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF787042ABB), ref: 00007FF787048CA0

Strings

win32_utils_from_utf8, xrefs: 00007FF787048C69
MultiByteToWideChar, xrefs: 00007FF787048C2E, 00007FF787048CB1
Failed to decode wchar_t from UTF-8, xrefs: 00007FF787048CAA
Failed to get wchar_t buffer size., xrefs: 00007FF787048C27
Out of memory., xrefs: 00007FF787048C62

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 3723044601-876015163
Opcode ID: 09c1cb52e29b37b13c815ee5671634a1c58a10b3f0e15c01f1b1ef5aa1f1899b
Instruction ID: f0ebbd10492cff714b98ca3243f1d9e50f9ee9c1d1b212923894f797d3e5c44f
Opcode Fuzzy Hash: 09c1cb52e29b37b13c815ee5671634a1c58a10b3f0e15c01f1b1ef5aa1f1899b
Instruction Fuzzy Hash: 89215066B4CA4681EA50EB16F851069E361BB887C8FA84531DB4DC3BA9EE2DD542C710

Function 00007FF787048660 Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF787048680
OpenProcessToken.ADVAPI32 ref: 00007FF787048691
GetTokenInformation.ADVAPI32 ref: 00007FF7870486B6
GetLastError.KERNEL32 ref: 00007FF7870486C0
GetTokenInformation.ADVAPI32 ref: 00007FF787048700
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF78704871C
CloseHandle.KERNEL32 ref: 00007FF787048734

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 33ba570f6722ec1355749e7399f5cd2e29d667ed8d9e30a05122691428ccf913
Instruction ID: b74bce88c92ae8aacabd4ac151e66ed274497892519aee02456cf386b38265ea
Opcode Fuzzy Hash: 33ba570f6722ec1355749e7399f5cd2e29d667ed8d9e30a05122691428ccf913
Instruction Fuzzy Hash: 3821843174874242EA10AB55E49112AF7A0FF857E8FB04631DAAEC3BE4DF6CE446C720

Function 00007FF78705B810 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF78705B81F
FlsGetValue.KERNEL32 ref: 00007FF78705B834
FlsSetValue.KERNEL32 ref: 00007FF78705B855
FlsSetValue.KERNEL32 ref: 00007FF78705B882
FlsSetValue.KERNEL32 ref: 00007FF78705B893
FlsSetValue.KERNEL32 ref: 00007FF78705B8A4
SetLastError.KERNEL32 ref: 00007FF78705B8BF

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 139d7bc547cb1cb8962b7901dc7ecb8c361af24a82b12e2272b260804a9b77c7
Instruction ID: a14396f23c80eea598e87838d4c3f3f8eff5696f964fb1c60ac1a8d871e96349
Opcode Fuzzy Hash: 139d7bc547cb1cb8962b7901dc7ecb8c361af24a82b12e2272b260804a9b77c7
Instruction Fuzzy Hash: 19213924E8924241FA687B615652139E2827F447B8FF45738E93FEA7D6DE2CB403C320

Function 00007FF7870686BC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7870686ED
GetLastError.KERNEL32 ref: 00007FF7870686F9
CloseHandle.KERNEL32 ref: 00007FF787068711
CreateFileW.KERNEL32 ref: 00007FF78706873C
WriteConsoleW.KERNEL32 ref: 00007FF78706875B

Strings

CONOUT$, xrefs: 00007FF78706871D

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: dc1a3cb66a96e2c92b05876df44f34e6b44b08b84d7dcdae92150d4fed606b6a
Instruction ID: 973c1e1a38c19d0b3f4afbc968480fa287bc9bed74c4cbcf0c4ab8d978c132c6
Opcode Fuzzy Hash: dc1a3cb66a96e2c92b05876df44f34e6b44b08b84d7dcdae92150d4fed606b6a
Instruction Fuzzy Hash: 22119661B58B4186E750AB42E864329B7A0FB88FE8FA44234D95FC77A4DF3CD445C750

Function 00007FF787048980 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF787048660: GetCurrentProcess.KERNEL32 ref: 00007FF787048680
Part of subcall function 00007FF787048660: OpenProcessToken.ADVAPI32 ref: 00007FF787048691
Part of subcall function 00007FF787048660: GetTokenInformation.ADVAPI32 ref: 00007FF7870486B6
Part of subcall function 00007FF787048660: GetLastError.KERNEL32 ref: 00007FF7870486C0
Part of subcall function 00007FF787048660: GetTokenInformation.ADVAPI32 ref: 00007FF787048700
Part of subcall function 00007FF787048660: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF78704871C
Part of subcall function 00007FF787048660: CloseHandle.KERNEL32 ref: 00007FF787048734

LocalFree.KERNEL32(00000000,00007FF787043B6E), ref: 00007FF787048A0C
LocalFree.KERNEL32 ref: 00007FF787048A15

Strings

D:(A;;FA;;;%s), xrefs: 00007FF7870489F7
Security descriptor string length exceeds PATH_MAX!, xrefs: 00007FF787048A23
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF7870489E2
S-1-3-4, xrefs: 00007FF7870489C1

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PATH_MAX!
API String ID: 6828938-1817031585
Opcode ID: 205b7d1dfb2922ffea14e43b9fff2feb2a6941106c301a2985194d40b60a609a
Instruction ID: 215eb794ef5c3e60ac827038152f6b4692947e01ea741d2419de4f647af3cbc8
Opcode Fuzzy Hash: 205b7d1dfb2922ffea14e43b9fff2feb2a6941106c301a2985194d40b60a609a
Instruction Fuzzy Hash: B6218E21A8C78A91FA14BB20E4962F9A361BF54788FE44531E90FD77D2DE3CE546C260

Function 00007FF78705B988 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7870555CD,?,?,?,?,00007FF78705F2BF,?,?,00000000,00007FF78705BAA6,?,?,?), ref: 00007FF78705B997
FlsSetValue.KERNEL32(?,?,?,00007FF7870555CD,?,?,?,?,00007FF78705F2BF,?,?,00000000,00007FF78705BAA6,?,?,?), ref: 00007FF78705B9CD
FlsSetValue.KERNEL32(?,?,?,00007FF7870555CD,?,?,?,?,00007FF78705F2BF,?,?,00000000,00007FF78705BAA6,?,?,?), ref: 00007FF78705B9FA
FlsSetValue.KERNEL32(?,?,?,00007FF7870555CD,?,?,?,?,00007FF78705F2BF,?,?,00000000,00007FF78705BAA6,?,?,?), ref: 00007FF78705BA0B
FlsSetValue.KERNEL32(?,?,?,00007FF7870555CD,?,?,?,?,00007FF78705F2BF,?,?,00000000,00007FF78705BAA6,?,?,?), ref: 00007FF78705BA1C
SetLastError.KERNEL32(?,?,?,00007FF7870555CD,?,?,?,?,00007FF78705F2BF,?,?,00000000,00007FF78705BAA6,?,?,?), ref: 00007FF78705BA37

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 312b5f2dcd4511434fc9e888aff7e7a4818cf3686b871577b38ae952f3f4b727
Instruction ID: 72c3124ddf8c65e66eee4ed08f9cb973de0be08dbb6730c52a3af1499557c393
Opcode Fuzzy Hash: 312b5f2dcd4511434fc9e888aff7e7a4818cf3686b871577b38ae952f3f4b727
Instruction Fuzzy Hash: 5F114D24A8964242FA557B315655139E2927F447B4FF44734D83FE67D6DE2CB403C220

Function 00007FF78704D878 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF78704D8A3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF78704D938
RtlUnwindEx.KERNEL32 ref: 00007FF78704D987

Strings

csm, xrefs: 00007FF78704D91E
f, xrefs: 00007FF78704D8B6

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 693f609b9fae876419381cc446d630854629708ee6e32f1efd9795666748e69d
Instruction ID: c9c2345f784b8284402b48542b1985f7c125edc23a5b6fd8d1fa4c61c84b7575
Opcode Fuzzy Hash: 693f609b9fae876419381cc446d630854629708ee6e32f1efd9795666748e69d
Instruction Fuzzy Hash: A851B132B5D60686D714EF15E405A29B795FB80B8CFA08174DB4F87748DF78E842C724

Function 00007FF787042600 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00007FF7870427EF), ref: 00007FF787042638
DialogBoxIndirectParamW.USER32 ref: 00007FF7870426FC
DeleteObject.GDI32 ref: 00007FF78704272F
DestroyIcon.USER32 ref: 00007FF787042741

Strings

Unhandled exception in script, xrefs: 00007FF787042668

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: a12303a3c26076ce2175f5d492329d921759a703778d83afdb375b2ac0be3d2c
Instruction ID: 14c148cd19061d00335e973dd00ff133d4a79151ffbde3986cb0083485b03fbf
Opcode Fuzzy Hash: a12303a3c26076ce2175f5d492329d921759a703778d83afdb375b2ac0be3d2c
Instruction Fuzzy Hash: EA314E72659A8285EB20EB21E8551F9A360FF88788FA40135EA4ECBB59DF3CD146C710

Function 00007FF7870429E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7870488F2,?,?,?,?,?,?,?,?,?,?,?,00007FF78704101D), ref: 00007FF787042A14

Part of subcall function 00007FF787048570: GetLastError.KERNEL32(00000000,00007FF787042A5E,?,?,?,?,?,?,?,?,?,?,?,00007FF78704101D), ref: 00007FF787048597
Part of subcall function 00007FF787048570: FormatMessageW.KERNEL32 ref: 00007FF7870485C6

Part of subcall function 00007FF787048BE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF787042ABB), ref: 00007FF787048C1A

MessageBoxW.USER32 ref: 00007FF787042AF0
MessageBoxA.USER32 ref: 00007FF787042B0C

Strings

Fatal error detected, xrefs: 00007FF787042AC6, 00007FF787042AFE
%s%s: %s, xrefs: 00007FF787042A6B

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: Message$ErrorLast$ByteCharFormatMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 2806210788-2410924014
Opcode ID: 17bde7baa48798fc9044701dc9e2f5590094afa9c40027f5b89001a931553ba1
Instruction ID: a014dadbde3fe6e777d3dfdca4cf0a3caef1b544e245d93e588001b55f225989
Opcode Fuzzy Hash: 17bde7baa48798fc9044701dc9e2f5590094afa9c40027f5b89001a931553ba1
Instruction Fuzzy Hash: 2831547276868191E630BB10E4516EAB364FF847C8F904036EA8E86A99DF3CD746CB50

Function 00007FF78705A118 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF78705A13D
GetProcAddress.KERNEL32 ref: 00007FF78705A153
FreeLibrary.KERNEL32 ref: 00007FF78705A17A

Strings

CorExitProcess, xrefs: 00007FF78705A14C
mscoree.dll, xrefs: 00007FF78705A134

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 6d37f3dc48988a17a5a16ca308b3de1e776b5d3bd2cbadce22e8a62f3d793b7e
Instruction ID: 68f004facb1f64c48226c475bac6b3d63adaa97b613769e13870029968df266b
Opcode Fuzzy Hash: 6d37f3dc48988a17a5a16ca308b3de1e776b5d3bd2cbadce22e8a62f3d793b7e
Instruction Fuzzy Hash: 67F04FA1B4970291EB10AB24E854379A760FF887A5FF45235C56FCA2E4CF3CD486C364

Function 00007FF787069D40 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF787069D68
_set_statfp.LIBCMT ref: 00007FF787069D83
_set_statfp.LIBCMT ref: 00007FF787069D9F
_set_statfp.LIBCMT ref: 00007FF787069DDB

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
Instruction ID: 4f17307572dd77b04819ce8da0f928d6af164a69b088a251309892b1c243a307
Opcode Fuzzy Hash: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
Instruction Fuzzy Hash: E3118666FACB0341F69431A8D46E37690407FA5374FA48639E76F86AD6CE6C6843D120

Function 00007FF78705BA50 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF78705AC67,?,?,00000000,00007FF78705AF02,?,?,?,?,?,00007FF7870531CC), ref: 00007FF78705BA6F
FlsSetValue.KERNEL32(?,?,?,00007FF78705AC67,?,?,00000000,00007FF78705AF02,?,?,?,?,?,00007FF7870531CC), ref: 00007FF78705BA8E
FlsSetValue.KERNEL32(?,?,?,00007FF78705AC67,?,?,00000000,00007FF78705AF02,?,?,?,?,?,00007FF7870531CC), ref: 00007FF78705BAB6
FlsSetValue.KERNEL32(?,?,?,00007FF78705AC67,?,?,00000000,00007FF78705AF02,?,?,?,?,?,00007FF7870531CC), ref: 00007FF78705BAC7
FlsSetValue.KERNEL32(?,?,?,00007FF78705AC67,?,?,00000000,00007FF78705AF02,?,?,?,?,?,00007FF7870531CC), ref: 00007FF78705BAD8

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: f70ee7c89560e3a3f945a0093c6d62eaa63281c746b4319ca03f88377ac2e8f0
Instruction ID: 3d66e0708884dad32471475fe43868b40e119c7a0912c7e1a0e7c730bdc0971c
Opcode Fuzzy Hash: f70ee7c89560e3a3f945a0093c6d62eaa63281c746b4319ca03f88377ac2e8f0
Instruction Fuzzy Hash: B6116D24E8924241FA59BB35955127A92917F443B4FF45334E83FE67E6DE2CB403C220

Function 00007FF78705B8E4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF78705B8F5
FlsSetValue.KERNEL32 ref: 00007FF78705B914
FlsSetValue.KERNEL32 ref: 00007FF78705B93C
FlsSetValue.KERNEL32 ref: 00007FF78705B94D
FlsSetValue.KERNEL32 ref: 00007FF78705B95E

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 3273ad673f3a21db5857e5805e11896850ae06cc08c5864d6916b14b2a868b9d
Instruction ID: 11069803a8db8c8d439d1ccecbe281c0b7a95e0c6ae10aed3a2dd07de5fa2e80
Opcode Fuzzy Hash: 3273ad673f3a21db5857e5805e11896850ae06cc08c5864d6916b14b2a868b9d
Instruction Fuzzy Hash: 1C11F764E8920741FA687A3154622BA92817F45378EF81734E93FEA3E2DD2DB443C231

Function 00007FF7870565B4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7870565F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF78705671A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7870567D0

Strings

verbose, xrefs: 00007FF7870565C4

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: ad3fface7d4b2ce3aa9510f497705372120eac90acd968bb25d3a192cbea6c12
Instruction ID: 8d0d0fb9e0f2e69c8f2b54588df0c74e80535f3e245f86a32e8b46d3c14178da
Opcode Fuzzy Hash: ad3fface7d4b2ce3aa9510f497705372120eac90acd968bb25d3a192cbea6c12
Instruction Fuzzy Hash: A991C032E48A4A81E721AA25D45077DB7A1BB02F54FE44236DA5FE73D5DE3CE846C320

Function 00007FF7870606A8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF787060987

Part of subcall function 00007FF787066AC4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF787066AE1

Strings

UTF-8, xrefs: 00007FF787060906
UTF-16LEUNICODE, xrefs: 00007FF787060925
ccs, xrefs: 00007FF7870608C2

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 8562a2ddaa4935eebf24a1799f06cf0f98d553335d1454eb5137ecb29e0aa9bc
Instruction ID: 4f79049a80fb6667169e9591839a32d011316a4351cf9c96b228e656b1be953d
Opcode Fuzzy Hash: 8562a2ddaa4935eebf24a1799f06cf0f98d553335d1454eb5137ecb29e0aa9bc
Instruction Fuzzy Hash: A381A472FCC30289FB64AE258130A78A690FB11B44FF5C035DA9BD7295DA2DE903D761

Function 00007FF78704F0D8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF78704F124
_CallSETranslator.LIBVCRUNTIME ref: 00007FF78704F173

Strings

RCC, xrefs: 00007FF78704F141
MOC, xrefs: 00007FF78704F138

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 93df84ad8f7e49cea4bf2fe45b974ce3ad7a793f20ece70ff6f590e0afe80a83
Instruction ID: c603ade787927d79dc127d5c1354413d7cab3f04b718ea448ef62351c3c025d6
Opcode Fuzzy Hash: 93df84ad8f7e49cea4bf2fe45b974ce3ad7a793f20ece70ff6f590e0afe80a83
Instruction Fuzzy Hash: 80618E36A08B458AE710EF65D4413ADB7A0FB44B8CF684225EF4E57BA5CF78E146C710

Function 00007FF78704F434 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF78704F45C
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF78704F544

Strings

csm, xrefs: 00007FF78704F47E
csm, xrefs: 00007FF78704F596

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: bb0dbae594e6361f888f3677e997f8fccf17b68f1c0f59f7e08c923b6417c7cb
Instruction ID: 8b300c3ee5211f2345ccce90b2b4cc94ee5322e631f8cb6e4d06c8dbe88a7727
Opcode Fuzzy Hash: bb0dbae594e6361f888f3677e997f8fccf17b68f1c0f59f7e08c923b6417c7cb
Instruction Fuzzy Hash: 8E51B17294824286EB64AF159146368B7A1FB54B8CFA84135DB8EC7BD5CF3CF452CB10

Function 00007FF787042890 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF787048BE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF787042ABB), ref: 00007FF787048C1A

MessageBoxW.USER32 ref: 00007FF78704299B
MessageBoxA.USER32 ref: 00007FF7870429B7

Strings

Fatal error detected, xrefs: 00007FF787042971, 00007FF7870429A9
%s%s: %s, xrefs: 00007FF787042916

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 1878133881-2410924014
Opcode ID: 6a476509950944f0bc5995eed920a659af08b50e3adf8d3da3d7a8787779b220
Instruction ID: 7a3cd5dc70273c504e15c903c00f0d6f3a9d7782710b9d4a5010444a859d2758
Opcode Fuzzy Hash: 6a476509950944f0bc5995eed920a659af08b50e3adf8d3da3d7a8787779b220
Instruction Fuzzy Hash: 90314472768A8191E620F710E4516EAA364FF847C8FD04136E68EC7A99DF3CD746CB50

Function 00007FF787043ED0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7870439EA), ref: 00007FF787043F01

Part of subcall function 00007FF7870429E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF7870488F2,?,?,?,?,?,?,?,?,?,?,?,00007FF78704101D), ref: 00007FF787042A14
Part of subcall function 00007FF7870429E0: MessageBoxW.USER32 ref: 00007FF787042AF0

Strings

Failed to convert executable path to UTF-8., xrefs: 00007FF787043F3A
Failed to get executable path., xrefs: 00007FF787043F0B
GetModuleFileNameW, xrefs: 00007FF787043F12

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: ErrorFileLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2581892565-1977442011
Opcode ID: c9992ac3e2ed13633c6ba0b01859201a2f46c5392c0b9f9a2e333adda7e2bc80
Instruction ID: 340179a183696405aed77e8331b42152a729115be9443a6f3cd41abb265c4639
Opcode Fuzzy Hash: c9992ac3e2ed13633c6ba0b01859201a2f46c5392c0b9f9a2e333adda7e2bc80
Instruction Fuzzy Hash: F3017121B9D74280FE60B720D8563B6D291BF5878CFE01431D94FC6692EE2CE146C720

Function 00007FF78705CC60 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF78705CCDF
WriteFile.KERNEL32 ref: 00007FF78705CFA7
WriteFile.KERNEL32 ref: 00007FF78705CFED
GetLastError.KERNEL32 ref: 00007FF78705D0A3

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: ac6203f977c47ba8bc2a8f0cb0d6a0086fe2a36fe5d42d2389b6d07504d3a7ef
Instruction ID: afa55c529ca550285ccb7d665d9dfa507d76efa7f8bf621da27a352b8ffed931
Opcode Fuzzy Hash: ac6203f977c47ba8bc2a8f0cb0d6a0086fe2a36fe5d42d2389b6d07504d3a7ef
Instruction Fuzzy Hash: 89D10532B18B8589E710EF65D4402ADB7B1FB45798BA44236CE5EE7B99DE38D407C320

Function 00007FF78705D620 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF78705D60B), ref: 00007FF78705D73C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF78705D60B), ref: 00007FF78705D7C7

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fbcfe551b9719c6229bed95fc105e51a183c6d2ac5964edc4a317e2464c7d24a
Instruction ID: 3765a0a5f80e3534242bed732f390cf31ca85895ffacaab9227ac9072f7b93cc
Opcode Fuzzy Hash: fbcfe551b9719c6229bed95fc105e51a183c6d2ac5964edc4a317e2464c7d24a
Instruction Fuzzy Hash: 68919462E4C65A85F750EF6594802BDABA0FB44B88FF44136DE4FE6685DE38D483C320

Function 00007FF78705FDEC Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF78705FEDC
_get_daylight.LIBCMT ref: 00007FF78705FEED
_get_daylight.LIBCMT ref: 00007FF78705FEFE
_isindst.LIBCMT ref: 00007FF78705FFC9

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: e30f49420ffe1712ec5869c52a61b1ecc0c505d60627fe33813fae1700624dd7
Instruction ID: 640bc2e99a690a5884239d9e72f306a79bc49336483fc838e1188e88b5d0d267
Opcode Fuzzy Hash: e30f49420ffe1712ec5869c52a61b1ecc0c505d60627fe33813fae1700624dd7
Instruction Fuzzy Hash: 9A51D172F442118AEB18EB6499556BCA7A1BF01358FE04235EE1FE6BE5DB3CA403C710

Function 00007FF787055954 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF787055987
GetFileInformationByHandle.KERNEL32 ref: 00007FF7870559E9
GetLastError.KERNEL32 ref: 00007FF787055A7A
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,?,00007FF78705588C), ref: 00007FF787055AC6

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 7cecb9a12d6adc5d813f4c9389116544f81f9d0d17ef3f6385b803a39347ee18
Instruction ID: d55b0f5dca8569ad442dc5a520846084c372f49c8e69f9d617806649b6344264
Opcode Fuzzy Hash: 7cecb9a12d6adc5d813f4c9389116544f81f9d0d17ef3f6385b803a39347ee18
Instruction Fuzzy Hash: 70516122A54A4189FB10EF61D4903BD77A2BF48B58FA48534DE4ED7689DF38D442C720

Function 00007FF787055800 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78705582D
CreateFileW.KERNEL32 ref: 00007FF78705586C
CloseHandle.KERNEL32 ref: 00007FF7870558A1

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: b420e0b7dfce32a53a9c2cc964ca12eee711143eb7a99abbae090e51473720b6
Instruction ID: 3875d3835441e1cd73feae168fdfabdb03152de21b6a3d5356cae140b341e1c8
Opcode Fuzzy Hash: b420e0b7dfce32a53a9c2cc964ca12eee711143eb7a99abbae090e51473720b6
Instruction Fuzzy Hash: 7541B462D58B8283E710EB209510379A361FF94764FA08335E69DE7AD1DF6CA5A2C720

Function 00007FF787042330 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF787042364
SetWindowLongPtrW.USER32 ref: 00007FF787042386
GetWindowLongPtrW.USER32 ref: 00007FF7870423B0
InvalidateRect.USER32 ref: 00007FF7870423D0

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: ecac84c754e5eddc26d74cef75c58701df5fcac281216c238072f9f7c8686c02
Instruction ID: 60f16d8806d1e3a4379a7d93dda077eff6c8490dbdeeb6cb93f9b4450815f575
Opcode Fuzzy Hash: ecac84c754e5eddc26d74cef75c58701df5fcac281216c238072f9f7c8686c02
Instruction Fuzzy Hash: B711A961F5825242F654AB6AF545279A2A1FF84B85FE4C030DA4A86B9ECD2CD4C2C610

Function 00007FF78706638C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF787061ED0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF787061F03

_get_daylight.LIBCMT ref: 00007FF7870664A4
_get_daylight.LIBCMT ref: 00007FF7870664B5

Strings

?, xrefs: 00007FF787066435

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: befcc0e810349c4ed10c4da0c5a0000f7d95c3550f016c8dbfb5e48fc73a8369
Instruction ID: 60b438c199ea9f8718d445208576b20cf9f306c846cdd225cc2c2f7ca4611d82
Opcode Fuzzy Hash: befcc0e810349c4ed10c4da0c5a0000f7d95c3550f016c8dbfb5e48fc73a8369
Instruction Fuzzy Hash: 3641F622F4838242FB64AB25A4613799A60FF817A4FB48235EF5F86AD5DE7CD442C710

Function 00007FF7870596A4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7870596D6

Part of subcall function 00007FF78705B00C: HeapFree.KERNEL32(?,?,?,00007FF787063492,?,?,?,00007FF7870634CF,?,?,00000000,00007FF787063995,?,?,00000000,00007FF7870638C7), ref: 00007FF78705B022
Part of subcall function 00007FF78705B00C: GetLastError.KERNEL32(?,?,?,00007FF787063492,?,?,?,00007FF7870634CF,?,?,00000000,00007FF787063995,?,?,00000000,00007FF7870638C7), ref: 00007FF78705B02C

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF78704C0E5), ref: 00007FF7870596F4

Strings

C:\Users\user\Desktop\G6xnfES308.exe, xrefs: 00007FF7870596E2

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\G6xnfES308.exe
API String ID: 3580290477-1140060590
Opcode ID: cbff3703d0eb5d814c918169503ff03d4f262caf6a9cc0de81f89f8799812d0b
Instruction ID: b05e1396dcf33cdb03f2b71990ae390fb843fb3d0500c863ad399472f00fc0e3
Opcode Fuzzy Hash: cbff3703d0eb5d814c918169503ff03d4f262caf6a9cc0de81f89f8799812d0b
Instruction Fuzzy Hash: 55418176A98B1286EB54FF6198500B9A794FF44794BF44036EA4FD3B85DE3DE482C320

Function 00007FF78705D2F8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF78705D40F
GetLastError.KERNEL32 ref: 00007FF78705D431

Strings

U, xrefs: 00007FF78705D3BB

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 58f62ff0c7f7b6be9e4ecb54e809448fa16189ed2b231f8d6d1ca058d2495b08
Instruction ID: 88a4729119370f13bce08cdf1ab2620825598083c8fe908bf9c12ff31b0ce1d4
Opcode Fuzzy Hash: 58f62ff0c7f7b6be9e4ecb54e809448fa16189ed2b231f8d6d1ca058d2495b08
Instruction Fuzzy Hash: D741B362B19B4582EB20AF25E4843A9A760FB84794FE04032EE4ED7798DF7CD442CB50

Function 00007FF78705FA18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF78705FA58
GetCurrentDirectoryW.KERNEL32 ref: 00007FF78705FAAA

Strings

:, xrefs: 00007FF78705FA6E

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: c120b864dc14cbd6235dd72bea219c1032bae1501d376cd0c3e10e350c6f3e5b
Instruction ID: 054cdb4955284e2c1cc18aa39aa761b15c651177745a07ced24feae70ad742a3
Opcode Fuzzy Hash: c120b864dc14cbd6235dd72bea219c1032bae1501d376cd0c3e10e350c6f3e5b
Instruction Fuzzy Hash: 8221E6B2B4868181FB20AB11D04426EB3B1FB84B48FE54135DA4ED7784DF7CE946C761

Function 00007FF787042C50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF787048BE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF787042ABB), ref: 00007FF787048C1A

MessageBoxW.USER32 ref: 00007FF787042D25
MessageBoxA.USER32 ref: 00007FF787042D41

Strings

Error detected, xrefs: 00007FF787042CFB, 00007FF787042D33

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error detected
API String ID: 1878133881-3513342764
Opcode ID: 6f9a1586ca547a3c2f77bf815536a5540435ab6ab19a441e761cc5e7daea12c4
Instruction ID: b849417f784ff0835041365c5ec136d00aba656cbac1e83f23e586489e41d887
Opcode Fuzzy Hash: 6f9a1586ca547a3c2f77bf815536a5540435ab6ab19a441e761cc5e7daea12c4
Instruction Fuzzy Hash: 2021367276868591EB20E710F4916EAB364FF84788FE05135E68EC7AA5DF3CD206C760

Function 00007FF78704FF80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF78704FFD0
RaiseException.KERNEL32 ref: 00007FF787050011

Strings

csm, xrefs: 00007FF78704FFFE

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 5da07f41cc1f2f0249302dc9aa2704e59a17d1d76e31cb25285a30e0af08f503
Instruction ID: 39bdb73fc4a319e8d298c368fedc0871eb8f39c84f8f741c1c6ace1d68fb6860
Opcode Fuzzy Hash: 5da07f41cc1f2f0249302dc9aa2704e59a17d1d76e31cb25285a30e0af08f503
Instruction Fuzzy Hash: D5113332618B4182DB519F15F450259B7E5FB88B88F684234DE8D87764DF3CD552C700

Function 00007FF78706051C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF78706054C
GetDriveTypeW.KERNEL32 ref: 00007FF78706058C

Strings

:, xrefs: 00007FF787060575

Memory Dump Source

Source File: 00000000.00000002.2184363066.00007FF787041000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF787040000, based on PE: true

Associated: 00000000.00000002.2184348939.00007FF787040000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184386615.00007FF78706B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF78707E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184436289.00007FF787080000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2184469018.00007FF787082000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff787040000_G6xnfES308.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 0484c027a31e3174e61c97ce986110c8cc183ac5b324247cdaa72bb813f071bc
Instruction ID: d23b0c3e12cf76ee3231e3f6baa211e5e474b8631a12e2b54c81e04fd14b2b0f
Opcode Fuzzy Hash: 0484c027a31e3174e61c97ce986110c8cc183ac5b324247cdaa72bb813f071bc
Instruction Fuzzy Hash: EA017C61AA874286FB21BF60947167EA3A0FF44708FE04035D55EC6695DE2CE546CA24

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report G6xnfES308.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

DNS Answers

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: G6xnfES308.exePID: 4896, Parent PID: 4004

General

Chronological Activities

Disassembly

Analysis Process: G6xnfES308.exePID: 4896, Parent PID: 4004COMMON

Execution Graph

Graph

Executed Functions

Function 00007FF7870673BC Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON

Control-flow Graph

Function 00007FF787041AA0 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 135COMMON

Control-flow Graph

Windows Analysis Report
G6xnfES308.exe

Function 00007FF7870673BC Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Function 00007FF787041AA0 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 135
COMMON

Function 00007FF787041000 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 269
COMMON

Function 00007FF78705C11C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Function 00007FF78704C17C Relevance: 6.1, APIs: 4, Instructions: 94
COMMON

Function 00007FF787042B30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57
windowCOMMON

Function 00007FF78705A0C0 Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Function 00007FF78705037C Relevance: 3.2, APIs: 2, Instructions: 177
COMMONLIBRARYCODE

Function 00007FF78705C7F4 Relevance: 3.0, APIs: 2, Instructions: 46
COMMONLIBRARYCODE

Function 00007FF78705B21C Relevance: 2.6, APIs: 2, Instructions: 59
COMMON

Function 00007FF78705C56C Relevance: 1.6, APIs: 1, Instructions: 112
COMMONLIBRARYCODE

Function 00007FF7870482C0 Relevance: 1.6, APIs: 1, Instructions: 85
COMMON

Function 00007FF78705BFFC Relevance: 1.6, APIs: 1, Instructions: 79
COMMONLIBRARYCODE

Function 00007FF787059FF1 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Function 00007FF7870565A8 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON