Edit tour

Windows Analysis Report
j1gw88aHdL.exe

Overview

General Information

Sample name:	j1gw88aHdL.exe renamed because original name is a hash value
Original sample name:	fd682a2c1ed42403a8e943010f660f79.exe
Analysis ID:	1580957
MD5:	fd682a2c1ed42403a8e943010f660f79
SHA1:	0c20c808746dd38cffe1d474ade5031d1611f041
SHA256:	131a0064f14f3bad96b0be6d61638f0ef51d110109d4242134af9261a191ffc1
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Program does not show much activity (idle)

Classification

Process Tree

System is w10x64

j1gw88aHdL.exe (PID: 7428 cmdline: "C:\Users\user\Desktop\j1gw88aHdL.exe" MD5: FD682A2C1ED42403A8E943010F660F79)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: j1gw88aHdL.exe

Virustotal: Detection: 9%

Perma Link

Source: j1gw88aHdL.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4BF9280 FindFirstFileExW,FindClose,	0_2_00007FF7D4BF9280
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4C11874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7D4C11874
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4BF83C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF7D4BF83C0

Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4BF1000	0_2_00007FF7D4BF1000
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4C16964	0_2_00007FF7D4C16964
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4C035A0	0_2_00007FF7D4C035A0
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4C0E570	0_2_00007FF7D4C0E570
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4C05D30	0_2_00007FF7D4C05D30
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4C01D54	0_2_00007FF7D4C01D54
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4C0DEF0	0_2_00007FF7D4C0DEF0
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4C09EA0	0_2_00007FF7D4C09EA0
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4C15E7C	0_2_00007FF7D4C15E7C
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4BF9800	0_2_00007FF7D4BF9800
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4C01F60	0_2_00007FF7D4C01F60
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4C08794	0_2_00007FF7D4C08794
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4C19728	0_2_00007FF7D4C19728
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4C01740	0_2_00007FF7D4C01740
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4C080E4	0_2_00007FF7D4C080E4
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4C140AC	0_2_00007FF7D4C140AC
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4C108C8	0_2_00007FF7D4C108C8
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4C11874	0_2_00007FF7D4C11874
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4BF89E0	0_2_00007FF7D4BF89E0
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4C039A4	0_2_00007FF7D4C039A4
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4C02164	0_2_00007FF7D4C02164
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4C01944	0_2_00007FF7D4C01944
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4BFA2DB	0_2_00007FF7D4BFA2DB
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4C0DA5C	0_2_00007FF7D4C0DA5C
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4C13C10	0_2_00007FF7D4C13C10
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4C02C10	0_2_00007FF7D4C02C10
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4C15C00	0_2_00007FF7D4C15C00
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4C01B50	0_2_00007FF7D4C01B50
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4BFACAD	0_2_00007FF7D4BFACAD
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4BFA47B	0_2_00007FF7D4BFA47B
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4C16418	0_2_00007FF7D4C16418
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4C108C8	0_2_00007FF7D4C108C8

Source: C:\Users\user\Desktop\j1gw88aHdL.exe

Code function: String function: 00007FF7D4BF2710 appears 52 times

Source: classification engine

Classification label: mal48.winEXE@1/0@0/0

Source: j1gw88aHdL.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\j1gw88aHdL.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: j1gw88aHdL.exe

Virustotal: Detection: 9%

Source: C:\Users\user\Desktop\j1gw88aHdL.exe

File read: C:\Users\user\Desktop\j1gw88aHdL.exe

Jump to behavior

Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Section loaded: wintypes.dll	Jump to behavior

Source: j1gw88aHdL.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: j1gw88aHdL.exe

Static file information: File size 17226969 > 1048576

Source: j1gw88aHdL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: j1gw88aHdL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: j1gw88aHdL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: j1gw88aHdL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: j1gw88aHdL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: j1gw88aHdL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: j1gw88aHdL.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: j1gw88aHdL.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: j1gw88aHdL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: j1gw88aHdL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: j1gw88aHdL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: j1gw88aHdL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: j1gw88aHdL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\j1gw88aHdL.exe

Code function: 0_2_00007FF7D4BF76C0 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

0_2_00007FF7D4BF76C0

Source: C:\Users\user\Desktop\j1gw88aHdL.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-17914

Source: C:\Users\user\Desktop\j1gw88aHdL.exe

API coverage: 5.2 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4BF9280 FindFirstFileExW,FindClose,	0_2_00007FF7D4BF9280
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4C11874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF7D4C11874
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4BF83C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF7D4BF83C0

Source: C:\Users\user\Desktop\j1gw88aHdL.exe

Code function: 0_2_00007FF7D4C0A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7D4C0A614

Source: C:\Users\user\Desktop\j1gw88aHdL.exe

Code function: 0_2_00007FF7D4C13480 GetProcessHeap,

0_2_00007FF7D4C13480

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4C0A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7D4C0A614
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4BFC8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7D4BFC8A0
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4BFD12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7D4BFD12C
Source: C:\Users\user\Desktop\j1gw88aHdL.exe	Code function: 0_2_00007FF7D4BFD30C SetUnhandledExceptionFilter,	0_2_00007FF7D4BFD30C

Source: C:\Users\user\Desktop\j1gw88aHdL.exe

Code function: 0_2_00007FF7D4C19570 cpuid

0_2_00007FF7D4C19570

Source: C:\Users\user\Desktop\j1gw88aHdL.exe

Code function: 0_2_00007FF7D4BFD010 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7D4BFD010

Source: C:\Users\user\Desktop\j1gw88aHdL.exe

Code function: 0_2_00007FF7D4C15E7C _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF7D4C15E7C

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 DLL Side-Loading	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
j1gw88aHdL.exe	10%	Virustotal		Browse

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580957
Start date and time:	2024-12-26 14:13:16 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	j1gw88aHdL.exe renamed because original name is a hash value
Original Sample Name:	fd682a2c1ed42403a8e943010f660f79.exe
Detection:	MAL
Classification:	mal48.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 21 Number of non-executed functions: 86
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, time.windows.com
Report size getting too big, too many NtSetInformationFile calls found.

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.991484004709739
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	j1gw88aHdL.exe
File size:	17'226'969 bytes
MD5:	fd682a2c1ed42403a8e943010f660f79
SHA1:	0c20c808746dd38cffe1d474ade5031d1611f041
SHA256:	131a0064f14f3bad96b0be6d61638f0ef51d110109d4242134af9261a191ffc1
SHA512:	3fdb186d1d8f3a2ba0e50803640083775c5db690e51c426acc944d6571e5c58dcc69dc73374013b9f0b53a7f102ade72eb9d84c5f6813d03355a599490e9b196
SSDEEP:	393216:wEkQc5SEaB1+TtIiFxcijMOGEt0V8IPSbLYY60XlimW:w9Sd1QtI4jMOi8IkLYYo
TLSH:	9E071274830BAA9EE32354B44B2067D7271122E6D543B87D23717CDF566B073F6E2A22
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Zpc.Zpc.Zpc...`.]pc...f..pc...g.Ppc.....Ypc...`.Spc...g.Kpc...f.rpc...b.Qpc.Zpb..pc.O.g.Cpc.O.a.[pc.RichZpc.........PE..d..

File Icon


Icon Hash:	4a464cd47461e179

Static PE Info

General

Entrypoint:	0x14000cdb0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x670BD14D [Sun Oct 13 13:55:25 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	72c4e339b7af8ab1ed2eb3821c98713a

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FD52CDEA0FCh
dec eax
add esp, 28h
jmp 00007FD52CDE9D1Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007FD52CDEA4C8h
test eax, eax
je 00007FD52CDE9EC3h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007FD52CDE9EA7h
dec eax
cmp ecx, eax
je 00007FD52CDE9EB6h
xor eax, eax
dec eax
cmpxchg dword ptr [0003577Ch], ecx
jne 00007FD52CDE9E90h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007FD52CDE9E99h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007FD52CDE9EA9h
mov byte ptr [00035765h], 00000001h
call 00007FD52CDE95F5h
call 00007FD52CDEA8E0h
test al, al
jne 00007FD52CDE9EA6h
xor al, al
jmp 00007FD52CDE9EB6h
call 00007FD52CDF73FFh
test al, al
jne 00007FD52CDE9EABh
xor ecx, ecx
call 00007FD52CDEA8F0h
jmp 00007FD52CDE9E8Ch
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [0003572Ch], 00000000h
mov ebx, ecx
jne 00007FD52CDE9F09h
cmp ecx, 01h
jnbe 00007FD52CDE9F0Ch
call 00007FD52CDEA43Eh
test eax, eax
je 00007FD52CDE9ECAh
test ebx, ebx
jne 00007FD52CDE9EC6h
dec eax
lea ecx, dword ptr [00035716h]
call 00007FD52CDF71F2h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ca5c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x47000	0xf41c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x44000	0x2250	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x57000	0x764	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a080	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39f40	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x4a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29f00	0x2a000	a6c3b829cc8eaabb1a474c227e90407f	False	0.5514206659226191	data	6.487493643901088	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12a50	0x12c00	bd1b0c418cef6d86056268b7be16a1df	False	0.52453125	data	5.752794169758469	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x53f8	0xe00	dba0caeecab624a0ccc0d577241601d1	False	0.134765625	data	1.8392217063172436	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x44000	0x2250	0x2400	181312260a85d10a1454ba38901c499b	False	0.4705946180555556	data	5.290347578351011	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x47000	0xf41c	0xf600	455788c285fcfdcb4008bc77e762818a	False	0.803099593495935	data	7.5549760623589695	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x57000	0x764	0x800	816c68eeb419ee2c08656c31c06a0fff	False	0.5576171875	data	5.2809528666624175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x47208	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.585820895522388
RT_ICON	0x480b0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.7360108303249098
RT_ICON	0x48958	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.755057803468208
RT_ICON	0x48ec0	0x952c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9975384937676757
RT_ICON	0x523ec	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.3887966804979253
RT_ICON	0x54994	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.49530956848030017
RT_ICON	0x55a3c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.7207446808510638
RT_GROUP_ICON	0x55ea4	0x68	data	0.7019230769230769
RT_MANIFEST	0x55f0c	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, ShutdownBlockReasonCreate, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, TranslateMessage, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, LCMapStringW, CompareStringW, FlsFree, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, GetEnvironmentStringsW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FlsSetValue, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, CreateDirectoryW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Target ID:	0
Start time:	08:14:21
Start date:	26/12/2024
Path:	C:\Users\user\Desktop\j1gw88aHdL.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\j1gw88aHdL.exe"
Imagebase:	0x7ff7d4bf0000
File size:	17'226'969 bytes
MD5 hash:	FD682A2C1ED42403A8E943010F660F79
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	26

Executed Functions

Function 00007FF7D4BF1000 Relevance: 60.0, APIs: 6, Strings: 28, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

pyi-disable-windowed-traceback, xrefs: 00007FF7D4BF3BB2
pyi-runtime-tmpdir, xrefs: 00007FF7D4BF3B68
VCRUNTIME140.dll, xrefs: 00007FF7D4BF3DA9
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF7D4BF3D12
Failed to convert DLL search path!, xrefs: 00007FF7D4BF3DD4
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF7D4BF3E02
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF7D4BF3882, 00007FF7D4BF38AF
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF7D4BF3971
_PYI_ARCHIVE_FILE, xrefs: 00007FF7D4BF38D2, 00007FF7D4BF39FF
Could not create temporary directory!, xrefs: 00007FF7D4BF3CBF
Failed to start splash screen!, xrefs: 00007FF7D4BF3ECC
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF7D4BF3A0B, 00007FF7D4BF3CD4, 00007FF7D4BF3F63
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF7D4BF3B32
_PYI_SPLASH_IPC, xrefs: 00007FF7D4BF3A23, 00007FF7D4BF3EED
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF7D4BF3EB3
pyi-python-flag, xrefs: 00007FF7D4BF3AD6
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF7D4BF3BE8
pkg, xrefs: 00007FF7D4BF39BE
Failed to load splash screen resources!, xrefs: 00007FF7D4BF3E7D
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF7D4BF39DE
Py_GIL_DISABLED, xrefs: 00007FF7D4BF3AF4
Failed to remove temporary directory: %s, xrefs: 00007FF7D4BF3FC7
pyi-contents-directory, xrefs: 00007FF7D4BF3B8D
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF7D4BF3C61
MEI, xrefs: 00007FF7D4BF3933
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF7D4BF3E9E
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF7D4BF3A17, 00007FF7D4BF3A2F, 00007FF7D4BF3A9B
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF7D4BF3D35

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: b74e8a98c54593439aa0340caf117dbcfb421d7150a5ef4d5d09467beb1d2dd6
Instruction ID: fd92c4e30c75df0ffac35321b8ac0ce9a1a0ce83a28034a64f15812869731a74
Opcode Fuzzy Hash: b74e8a98c54593439aa0340caf117dbcfb421d7150a5ef4d5d09467beb1d2dd6
Instruction Fuzzy Hash: 9A328B21A0E68291FA18FF22D4D42BDA6E1AF64780FC45073DA4D436C6EF2EE559C730

Function 00007FF7D4C16964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7D4C16698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C166D9
Part of subcall function 00007FF7D4C16698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C16757
Part of subcall function 00007FF7D4C16698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C167A8

CreateFileW.KERNELBASE ref: 00007FF7D4C16A6A
CreateFileW.KERNEL32 ref: 00007FF7D4C16ABA
GetLastError.KERNEL32 ref: 00007FF7D4C16AEA
GetFileType.KERNELBASE ref: 00007FF7D4C16AFF
GetLastError.KERNEL32 ref: 00007FF7D4C16B09
CloseHandle.KERNEL32 ref: 00007FF7D4C16B3C
CloseHandle.KERNEL32 ref: 00007FF7D4C16C9F
CreateFileW.KERNEL32 ref: 00007FF7D4C16CD4
GetLastError.KERNEL32 ref: 00007FF7D4C16CE3

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction ID: 1df3d2a87f81a99565f9fac19ed0c6a15e668d2e0c3b4dd94c6933c3d35e328d
Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction Fuzzy Hash: 2DC1BE36B28A4186EB10EF6AC4906AC7771EB49BD8F855237DE2E57794DF38E051C320

Function 00007FF7D4BF9280 Relevance: 3.0, APIs: 2, Instructions: 29
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF7D4BF92B3
FindClose.KERNELBASE ref: 00007FF7D4BF92C2

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction ID: 4d6f1465760cd0638633aa90f1321f23fcdb8aad76469c25edad619bbb745b18
Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction Fuzzy Hash: 8BF0A422A1964186FB60AFA1F4C976EB3A0AB94368FC40237D96D02AD4DF3CD0498A10

Function 00007FF7D4BF1950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7D4BF7F90: _fread_nolock.LIBCMT ref: 00007FF7D4BF803A

_fread_nolock.LIBCMT ref: 00007FF7D4BF1A1B

Part of subcall function 00007FF7D4BF2910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7D4BF1B6A), ref: 00007FF7D4BF295E

Strings

Could not allocate buffer for TOC!, xrefs: 00007FF7D4BF1B1B
Error on file., xrefs: 00007FF7D4BF1B8D
Failed to seek to cookie position!, xrefs: 00007FF7D4BF19EE
fseek, xrefs: 00007FF7D4BF19F5
calloc, xrefs: 00007FF7D4BF1A68
fread, xrefs: 00007FF7D4BF1A32, 00007FF7D4BF1B5C
malloc, xrefs: 00007FF7D4BF1B22
Could not read full TOC!, xrefs: 00007FF7D4BF1B55
Could not allocate memory for archive structure!, xrefs: 00007FF7D4BF1A61
MEI, xrefs: 00007FF7D4BF1991
Failed to read cookie!, xrefs: 00007FF7D4BF1A2B

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 63c30398f30ea4f79a670da16c10e9057635e87f15f1424072537686b1cc1600
Instruction ID: e5fdcfdfa8beb01ca3a4201102eddda0513574a4708e32d40c790fbc3dc9fec5
Opcode Fuzzy Hash: 63c30398f30ea4f79a670da16c10e9057635e87f15f1424072537686b1cc1600
Instruction Fuzzy Hash: B3817171A0D68685EB20EF26D0C42BDA3E0EF58784FC45433D98D57786EE3EE9458B60

Function 00007FF7D4BF36B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF7D4BF3804), ref: 00007FF7D4BF36E1
GetLastError.KERNEL32(?,00007FF7D4BF3804), ref: 00007FF7D4BF36EB

Part of subcall function 00007FF7D4BF2C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7D4BF3706,?,00007FF7D4BF3804), ref: 00007FF7D4BF2C9E
Part of subcall function 00007FF7D4BF2C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7D4BF3706,?,00007FF7D4BF3804), ref: 00007FF7D4BF2D63
Part of subcall function 00007FF7D4BF2C50: MessageBoxW.USER32 ref: 00007FF7D4BF2D99

Strings

Failed to obtain executable path., xrefs: 00007FF7D4BF36F3
Failed to resolve full path to executable %ls., xrefs: 00007FF7D4BF3739
\\?\, xrefs: 00007FF7D4BF375A
GetModuleFileNameW, xrefs: 00007FF7D4BF36FA
Failed to convert executable path to UTF-8., xrefs: 00007FF7D4BF3790

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction ID: f879f41508295897989f910ea3496c896e4f2d60f635bc9d34ab33585f245d7e
Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction Fuzzy Hash: 64219761B1DA4241FA20BF26E8953FEE2A0BF68394FC05133E55D825E5EE2DE504C720

Function 00007FF7D4C0BA5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C0BE89

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c3f57b6cd1f658b3a1cfdd45bc75f21d2f6c8be166295f0eb40444005b392bd6
Instruction ID: cbdb1429d93026cf417dadaf29fc13c423dd61328c31f7a3867daf1afdaa8a3c
Opcode Fuzzy Hash: c3f57b6cd1f658b3a1cfdd45bc75f21d2f6c8be166295f0eb40444005b392bd6
Instruction Fuzzy Hash: 04C1C32290C78692E660FF97D4882BDEB50EB81BC0FD54133EA5D27795EE7CE8458720

Function 00007FF7D4BF2710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF7D4BF1B99), ref: 00007FF7D4BF2760

Strings

Error, xrefs: 00007FF7D4BF27DE
[PYI-%d:%s] , xrefs: 00007FF7D4BF2768
Error [ANSI Fallback], xrefs: 00007FF7D4BF27CF
ERROR, xrefs: 00007FF7D4BF276F

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction ID: 87d32dd62996d86ff9e6e6f7de54d293b9b5e16de2a2160e54a1e4bebd6f69ef
Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction Fuzzy Hash: F8217F72A19B8152E620EF52F8817EAA2A4FB883C4FC01137EE8C53659EF7DD5458B50

Function 00007FF7D4BFCC3C Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7D4BFCE0C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7D4BFCE20

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7D4BFCC60
__scrt_release_startup_lock.LIBCMT ref: 00007FF7D4BFCCCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7D4BFCD21

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction ID: b920096afc64fbc52ed260e0bf488e3dd39e6be973b86fcd0aff6bd7b70c12cf
Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction Fuzzy Hash: 8C318B21E0A14341FA24BF67D4E53BD92E1AF61384FC44437EA4E472E3DE2EA9449A70

Function 00007FF7D4C09A30 Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF7D4C09A2C), ref: 00007FF7D4C09A41
TerminateProcess.KERNEL32(?,?,?,00007FF7D4C09A2C), ref: 00007FF7D4C09A4C
ExitProcess.KERNEL32 ref: 00007FF7D4C09A5B

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
Instruction ID: 69ec224c0ff19559d41d0ec7f977a1ea61f4af4fcef08c00d28f78942eb794f2
Opcode Fuzzy Hash: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
Instruction Fuzzy Hash: 75D09E14B0870642EB143F72DCD92BD92656F48781FD5143BC81F16397ED2CA8594730

Function 00007FF7D4C0013C Relevance: 3.2, APIs: 2, Instructions: 177
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C00180
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C00277

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction ID: 000d353d04f4e73b1310f7598f84d50b7f3af4907026d13c0020e0c9150f6771
Opcode Fuzzy Hash: e80cfa20b6c7ebf2f27a6dba6ddb06cb01cda21135ba71ef9e2cf3b7629ca058
Instruction Fuzzy Hash: 1451F421B0964186E729BE27E48867EA291BF44BE4FDA4737DD6D277C5CE3CE4018720

Function 00007FF7D4C0C134 Relevance: 3.0, APIs: 2, Instructions: 46
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF7D4C0C2CD), ref: 00007FF7D4C0C180
GetLastError.KERNEL32(?,?,?,?,?,00007FF7D4C0C2CD), ref: 00007FF7D4C0C18A

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction ID: 394cc1892ebd43eb298096cbc4606e54c311c9d8ed5eb8e6c8b3fbf85ee0cd96
Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction Fuzzy Hash: 0711B265608A8181DA20AF26E89816DE361AB45FF4FD44333EEBD177D9DE3CD0118B50

Function 00007FF7D4BF2620 Relevance: 3.0, APIs: 2, Instructions: 38
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7D4BF9390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7D4BF45F4,00000000,00007FF7D4BF1985), ref: 00007FF7D4BF93C9

MessageBoxW.USER32 ref: 00007FF7D4BF267B
MessageBoxA.USER32 ref: 00007FF7D4BF268A

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID:
API String ID: 1878133881-0
Opcode ID: 516091698330144c171d35b2bbe34a92ef9056074b99cc756242dd1ed7aaaa5e
Instruction ID: 38b39917d7d7871007e440c7a70ceb881dfe09f641dd7775f1795c8e97772986
Opcode Fuzzy Hash: 516091698330144c171d35b2bbe34a92ef9056074b99cc756242dd1ed7aaaa5e
Instruction Fuzzy Hash: 4F01DF62B05B8184E624AF16E4892BDA3A5AF5DBC4FC44036DE4D07756EE2CE548CA20

Function 00007FF7D4C0AB58 Relevance: 2.6, APIs: 2, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF7D4C0A9D5,?,?,00000000,00007FF7D4C0AA8A), ref: 00007FF7D4C0ABC6
GetLastError.KERNEL32(?,?,?,00007FF7D4C0A9D5,?,?,00000000,00007FF7D4C0AA8A), ref: 00007FF7D4C0ABD0

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction ID: 9f99bf13b6b0e12cffb410bccd94a98c2e5c492e7393b97519af954777e1e0cb
Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction Fuzzy Hash: C021F620B1868242FEA0BF57D4D837D92829F94BD0FC4423BEA6E577C5CE6DE4414320

Function 00007FF7D4C0BEAC Relevance: 1.6, APIs: 1, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C0BED4

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction ID: a35ab1c50d09035511b2617995939811c03b502bdd00a376af881142ea00f137
Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction Fuzzy Hash: 0941B23690824187EA34EE9AE58827DB3A0EF55BC0FD01133D68E676D1DF6DE502CB60

Function 00007FF7D4BF7F90 Relevance: 1.6, APIs: 1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fread_nolock.LIBCMT ref: 00007FF7D4BF803A

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 0748e9379ee1a24a6dd361f3a2547f707c71d81643cc4b02aa9d5a9a64da41ab
Instruction ID: bd3b038fc293a3a81580f39922753286c7cc4dd272be7a77e2034f215453b6e8
Opcode Fuzzy Hash: 0748e9379ee1a24a6dd361f3a2547f707c71d81643cc4b02aa9d5a9a64da41ab
Instruction Fuzzy Hash: 78219C21B5AA5246EA10BE33E8843BED691BF55BC4FC84432EE4C17786CF7EE041C220

Function 00007FF7D4C0B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C0B9C2

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction ID: 44cb21c11f683ad79774b486704639e37c887eabec05c11203a314ceead8b6e0
Opcode Fuzzy Hash: c2d01373d3233558d420055387ebca2c39d1ce99b2c1a08127fa32cb0ba5fec2
Instruction Fuzzy Hash: F7316022A1861286E711BF97D88937DA6A0AF80BE5FC10137EA5D273D2DE7CA4418735

Function 00007FF7D4C09961 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7D4C0998F

Part of subcall function 00007FF7D4C09A88: GetModuleHandleExW.KERNEL32 ref: 00007FF7D4C09AAD
Part of subcall function 00007FF7D4C09A88: GetProcAddress.KERNEL32 ref: 00007FF7D4C09AC3
Part of subcall function 00007FF7D4C09A88: FreeLibrary.KERNEL32 ref: 00007FF7D4C09AEA

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
Instruction ID: 08ffea56a4cb63d576c0c8695b246619a9503eb498ded28f83e2d113501394e9
Opcode Fuzzy Hash: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
Instruction Fuzzy Hash: 53218B72A057458AEF24AFA5C4883AC73A0EB04758FC44637D76C26AD5DF38D584CB60

Function 00007FF7D4C05F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C05EF9

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: c1dd79dade2e7e78a7187928088ce11b1fe3c247361f9c4176f4d8c73f267baf
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 8D115E31A1C64283EA60FF52D48827EE664AF95BC4FC44433EA8C77A96CF7DE5418760

Function 00007FF7D4C16354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C16377

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction ID: 47c8447b6a91996acdc512d3b708ed361d1805ea63cabdb3e6c1028433661735
Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction Fuzzy Hash: 0B214132718A4187DB61AF19D48037DB6B0BB84B94FD84236E69D476D5DF3DD4118B20

Function 00007FF7D4C003BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C00410

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: d8c4958b7fee5446a2197512e02afc26466dc2d2439f70b2d49a283e1184e28e
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: F1018221A0874541E604EF93E9840ADE695AF95FE0FC94633DE5C27BD7CE3CD4014714

Function 00007FF7D4C0D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF7D4C00C90,?,?,?,00007FF7D4C022FA,?,?,?,?,?,00007FF7D4C03AE9), ref: 00007FF7D4C0D63A

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction ID: 6799208c33ce761fef5978e9a02b0322fbec8fe477df07fbeade6896cd69cea0
Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction Fuzzy Hash: CCF0FE10B1968645FE547F73D8D967D91905F84BE1FC80B33ED2E652D2EE2DA4808630

Non-executed Functions

Function 00007FF7D4BF76C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7D4BF76D7
GetLastError.KERNEL32 ref: 00007FF7D4BF76E9
GetProcAddress.KERNEL32 ref: 00007FF7D4BF7725
GetLastError.KERNEL32 ref: 00007FF7D4BF7737
GetProcAddress.KERNEL32 ref: 00007FF7D4BF7750
GetLastError.KERNEL32 ref: 00007FF7D4BF7762
GetProcAddress.KERNEL32 ref: 00007FF7D4BF777B
GetLastError.KERNEL32 ref: 00007FF7D4BF778D
GetProcAddress.KERNEL32 ref: 00007FF7D4BF77A9
GetLastError.KERNEL32 ref: 00007FF7D4BF77BB
GetProcAddress.KERNEL32 ref: 00007FF7D4BF77D7
GetLastError.KERNEL32 ref: 00007FF7D4BF77E9
GetProcAddress.KERNEL32 ref: 00007FF7D4BF7805
GetLastError.KERNEL32 ref: 00007FF7D4BF7817
GetProcAddress.KERNEL32 ref: 00007FF7D4BF7833
GetLastError.KERNEL32 ref: 00007FF7D4BF7845
GetProcAddress.KERNEL32 ref: 00007FF7D4BF7861
GetLastError.KERNEL32 ref: 00007FF7D4BF7873

Strings

Tcl_Finalize, xrefs: 00007FF7D4BF779F, 00007FF7D4BF77C1
Tcl_GetString, xrefs: 00007FF7D4BF7AAD, 00007FF7D4BF7ACF
Tcl_Init, xrefs: 00007FF7D4BF76D0, 00007FF7D4BF76EF
Tcl_FindExecutable, xrefs: 00007FF7D4BF7746, 00007FF7D4BF7768
Tcl_MutexUnlock, xrefs: 00007FF7D4BF78E1, 00007FF7D4BF7903
Tk_Init, xrefs: 00007FF7D4BF7C79, 00007FF7D4BF7C9B
Tcl_CreateInterp, xrefs: 00007FF7D4BF771B, 00007FF7D4BF773D
Tcl_DoOneEvent, xrefs: 00007FF7D4BF7771, 00007FF7D4BF7793
Tcl_CreateObjCommand, xrefs: 00007FF7D4BF7A7F, 00007FF7D4BF7AA1
Tcl_GetObjResult, xrefs: 00007FF7D4BF7B65, 00007FF7D4BF7B87
Tcl_NewByteArrayObj, xrefs: 00007FF7D4BF7B09, 00007FF7D4BF7B2B
Tcl_DeleteInterp, xrefs: 00007FF7D4BF77FB, 00007FF7D4BF781D
Tcl_GetCurrentThread, xrefs: 00007FF7D4BF7857, 00007FF7D4BF7879
Tcl_SetVar2Ex, xrefs: 00007FF7D4BF7B37, 00007FF7D4BF7B59
Tcl_EvalFile, xrefs: 00007FF7D4BF7B93, 00007FF7D4BF7BB5
Tcl_SetVar2, xrefs: 00007FF7D4BF7A51, 00007FF7D4BF7A73
Tcl_JoinThread, xrefs: 00007FF7D4BF7885, 00007FF7D4BF78A7
Tcl_ThreadQueueEvent, xrefs: 00007FF7D4BF79C7, 00007FF7D4BF79E9
Tcl_ConditionFinalize, xrefs: 00007FF7D4BF793D, 00007FF7D4BF795F
Tcl_Alloc, xrefs: 00007FF7D4BF7C1D, 00007FF7D4BF7C3F
Tcl_FinalizeThread, xrefs: 00007FF7D4BF77CD, 00007FF7D4BF77EF
Tcl_EvalObjv, xrefs: 00007FF7D4BF7BEF, 00007FF7D4BF7C11
Tcl_CreateThread, xrefs: 00007FF7D4BF7829, 00007FF7D4BF784B
Tcl_ThreadAlert, xrefs: 00007FF7D4BF79F5, 00007FF7D4BF7A17
Tcl_MutexFinalize, xrefs: 00007FF7D4BF790F, 00007FF7D4BF7931
Failed to get address for %hs, xrefs: 00007FF7D4BF76F8
Tcl_GetVar2, xrefs: 00007FF7D4BF7A23, 00007FF7D4BF7A45
Tcl_ConditionWait, xrefs: 00007FF7D4BF7999, 00007FF7D4BF79BB
Tcl_Free, xrefs: 00007FF7D4BF7C4B, 00007FF7D4BF7C6D
Tk_GetNumMainWindows, xrefs: 00007FF7D4BF7CA7, 00007FF7D4BF7CC9
Tcl_MutexLock, xrefs: 00007FF7D4BF78B3, 00007FF7D4BF78D5
Tcl_NewStringObj, xrefs: 00007FF7D4BF7ADB, 00007FF7D4BF7AFD
GetProcAddress, xrefs: 00007FF7D4BF76FF
Tcl_ConditionNotify, xrefs: 00007FF7D4BF796B, 00007FF7D4BF798D
Tcl_EvalEx, xrefs: 00007FF7D4BF7BC1, 00007FF7D4BF7BE3

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction ID: 39245cd247208f4cd85973194ebfa16e5865a21863bd389fa04aea26950782f7
Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction Fuzzy Hash: A3029A64E0AB4791FA15FF57E8945BCA2B1AF197C5BC41077D82E022A0FF3CB5498670

Function 00007FF7D4BF89E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7D4BF9390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7D4BF45F4,00000000,00007FF7D4BF1985), ref: 00007FF7D4BF93C9

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF7D4BF3F77), ref: 00007FF7D4BF8A3B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF7D4BF3F77), ref: 00007FF7D4BF8A56

Part of subcall function 00007FF7D4C0A47C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C0A490

Part of subcall function 00007FF7D4C0871C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C08783

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF7D4BF3F77), ref: 00007FF7D4BF8AE6
CreateProcessW.KERNEL32 ref: 00007FF7D4BF8B1E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7D4BF3F77), ref: 00007FF7D4BF8B28

Part of subcall function 00007FF7D4BF2C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7D4BF3706,?,00007FF7D4BF3804), ref: 00007FF7D4BF2C9E
Part of subcall function 00007FF7D4BF2C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7D4BF3706,?,00007FF7D4BF3804), ref: 00007FF7D4BF2D63
Part of subcall function 00007FF7D4BF2C50: MessageBoxW.USER32 ref: 00007FF7D4BF2D99

RegisterClassW.USER32 ref: 00007FF7D4BF8B80
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7D4BF3F77), ref: 00007FF7D4BF8B8B
CreateWindowExW.USER32 ref: 00007FF7D4BF8BD5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7D4BF3F77), ref: 00007FF7D4BF8BE7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7D4BF3F77), ref: 00007FF7D4BF8C02
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7D4BF3F77), ref: 00007FF7D4BF8C15
PeekMessageW.USER32 ref: 00007FF7D4BF8C39
TranslateMessage.USER32 ref: 00007FF7D4BF8C47
DispatchMessageW.USER32(?,FFFFFFFF,00007FF7D4BF3F77), ref: 00007FF7D4BF8C51
PeekMessageW.USER32 ref: 00007FF7D4BF8C6C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7D4BF3F77), ref: 00007FF7D4BF8C7E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7D4BF3F77), ref: 00007FF7D4BF8C99
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF7D4BF3F77), ref: 00007FF7D4BF8CAF
GetLastError.KERNEL32(?,FFFFFFFF,00007FF7D4BF3F77), ref: 00007FF7D4BF8CB9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF7D4BF3F77), ref: 00007FF7D4BF8CC7
DestroyWindow.USER32(?,FFFFFFFF,00007FF7D4BF3F77), ref: 00007FF7D4BF8E04
GetExitCodeProcess.KERNEL32 ref: 00007FF7D4BF8E19
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF7D4BF3F77), ref: 00007FF7D4BF8E22
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF7D4BF3F77), ref: 00007FF7D4BF8E2F

Strings

PyInstaller Onefile Hidden Window, xrefs: 00007FF7D4BF8B95
Failed to create child process!, xrefs: 00007FF7D4BF8B30
PyInstallerOnefileHiddenWindow, xrefs: 00007FF7D4BF8B54
CreateProcessW, xrefs: 00007FF7D4BF8B37

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction ID: 755537664c515fe93d050d135a0079858969d4002174cfbc24b3c06379dee24a
Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction Fuzzy Hash: F9D17431A09A8286EB10EF36E8942ADB7B0FF94798FD04137DA5D52A94EF3CD155C720

Function 00007FF7D4C140AC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF7D4C140FA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C14766
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C148DC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C14B9A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C14DBA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C14FF7
memcpy_s.LIBCPMT ref: 00007FF7D4C150D2
memcpy_s.LIBCPMT ref: 00007FF7D4C1517D
memcpy_s.LIBCPMT ref: 00007FF7D4C1524C

Strings

1#SNAN, xrefs: 00007FF7D4C1420A
1#QNAN, xrefs: 00007FF7D4C14213
1#IND, xrefs: 00007FF7D4C141E7
1#INF, xrefs: 00007FF7D4C14223

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
Instruction ID: 0734f125faf5268d050807c82c41ff0777f2b1c3f8fcce1e79ffeff8261c13b1
Opcode Fuzzy Hash: 7da0388417e7c773b0aab48e07e342724827a26e5879d16e5decf6c79e081c8c
Instruction Fuzzy Hash: 30B2C772A182928BE7259F66D4807FDB7B1FB543C8FD05137DA0D67A88DB38A500CB64

Function 00007FF7D4BF83C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00007FF7D4BF8919,00007FF7D4BF3F9D), ref: 00007FF7D4BF842B
RemoveDirectoryW.KERNEL32(?,00007FF7D4BF8919,00007FF7D4BF3F9D), ref: 00007FF7D4BF84AE
DeleteFileW.KERNEL32(?,00007FF7D4BF8919,00007FF7D4BF3F9D), ref: 00007FF7D4BF84CD
FindNextFileW.KERNEL32(?,00007FF7D4BF8919,00007FF7D4BF3F9D), ref: 00007FF7D4BF84DB
FindClose.KERNEL32(?,00007FF7D4BF8919,00007FF7D4BF3F9D), ref: 00007FF7D4BF84EC
RemoveDirectoryW.KERNEL32(?,00007FF7D4BF8919,00007FF7D4BF3F9D), ref: 00007FF7D4BF84F5

Strings

%s\*, xrefs: 00007FF7D4BF83F2

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction ID: 23dd78fdbc31c48d49440ea6188063e6fc4c4fdc65c5cfeba2f502776e06f1ea
Opcode Fuzzy Hash: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction Fuzzy Hash: 4F415321A4D94285EA20BF66E4D41BEE3A0FBA4794FD00233E99D436D8EF3DE545C720

Function 00007FF7D4BFACAD Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

invalid distances set, xrefs: 00007FF7D4BFB1A0
invalid literal/lengths set, xrefs: 00007FF7D4BFB133
invalid code lengths set, xrefs: 00007FF7D4BFAE2D
invalid bit length repeat, xrefs: 00007FF7D4BFB099
too many length or distance symbols, xrefs: 00007FF7D4BFAE46
invalid code -- missing end-of-block, xrefs: 00007FF7D4BFB0C6
invalid distance code, xrefs: 00007FF7D4BFB5B4
invalid distance too far back, xrefs: 00007FF7D4BFB670
invalid literal/length code, xrefs: 00007FF7D4BFB3E2

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 14409f6b5173d9f28888b9fb9c68bcc2b54b8e7def706e6c40ef53002486e1ba
Instruction ID: 0502953b82c674d1dd82427bcc92bb3551ae856a2eb7803f15ab6fa2c965c774
Opcode Fuzzy Hash: 14409f6b5173d9f28888b9fb9c68bcc2b54b8e7def706e6c40ef53002486e1ba
Instruction Fuzzy Hash: 57521772A196A54BD7A89F15C498B7DBBE9FB94340F81813AE74E87780DB3DD840CB10

Function 00007FF7D4BFD12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7D4BFD148
RtlCaptureContext.KERNEL32 ref: 00007FF7D4BFD175
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7D4BFD18F
RtlVirtualUnwind.KERNEL32 ref: 00007FF7D4BFD1D0
IsDebuggerPresent.KERNEL32 ref: 00007FF7D4BFD224
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7D4BFD241
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7D4BFD24C

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction ID: 1cd44acb9bfd4df2cc606734ec479c20ae5cc0b05f7375f165a904c287af4a0d
Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction Fuzzy Hash: 71311F72609B8186EB609F61E8803EDA3B4FB94744F84403BDA4E47B95EF7DD548C720

Function 00007FF7D4C15C00 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7D4C15C45

Part of subcall function 00007FF7D4C15598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C155AC

Part of subcall function 00007FF7D4C0A948: HeapFree.KERNEL32(?,?,?,00007FF7D4C12D22,?,?,?,00007FF7D4C12D5F,?,?,00000000,00007FF7D4C13225,?,?,?,00007FF7D4C13157), ref: 00007FF7D4C0A95E
Part of subcall function 00007FF7D4C0A948: GetLastError.KERNEL32(?,?,?,00007FF7D4C12D22,?,?,?,00007FF7D4C12D5F,?,?,00000000,00007FF7D4C13225,?,?,?,00007FF7D4C13157), ref: 00007FF7D4C0A968

Part of subcall function 00007FF7D4C0A900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7D4C0A8DF,?,?,?,?,?,00007FF7D4C0A7CA), ref: 00007FF7D4C0A909
Part of subcall function 00007FF7D4C0A900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7D4C0A8DF,?,?,?,?,?,00007FF7D4C0A7CA), ref: 00007FF7D4C0A92E

_get_daylight.LIBCMT ref: 00007FF7D4C15C34

Part of subcall function 00007FF7D4C155F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C1560C

_get_daylight.LIBCMT ref: 00007FF7D4C15EAA
_get_daylight.LIBCMT ref: 00007FF7D4C15EBB
_get_daylight.LIBCMT ref: 00007FF7D4C15ECC
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7D4C1610C), ref: 00007FF7D4C15EF3

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: 677ea417f3249c8bdb60afb6413c0575e0f743ff33606516b420b369f71394b1
Instruction ID: 03b4bac47291b463a54755cf3a3c9a6f0b6114b742e0bfe8261eb0a7c5243ac8
Opcode Fuzzy Hash: 677ea417f3249c8bdb60afb6413c0575e0f743ff33606516b420b369f71394b1
Instruction Fuzzy Hash: C3D19A26B0824286E720BF27D8C55BDA6A1EF947D4FC48037EA0D47AA6DF3DE4418770

Function 00007FF7D4C0A614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7D4C0A68D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7D4C0A6A5
RtlVirtualUnwind.KERNEL32 ref: 00007FF7D4C0A6E0
IsDebuggerPresent.KERNEL32 ref: 00007FF7D4C0A719
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7D4C0A723
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7D4C0A72E

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction ID: d51236e140f59fb04270d79e997f907b86094c3f0f0f29d2d9d8dcb97fbcaa75
Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction Fuzzy Hash: 7B317F32608B8186DB20DF26E8842AEB3B4FB98794F900137EA8D43B54EF3CC155CB10

Function 00007FF7D4C11874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C118C0
FindFirstFileExW.KERNEL32 ref: 00007FF7D4C119CA

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 471de8175ffa50438b20796c5ba06e190623de8bcba55c14971da5e7bf2bc1ae
Instruction ID: 590360484a459faba2d279453d96bdc60181f7465a9a77616748bc2876396cf6
Opcode Fuzzy Hash: 471de8175ffa50438b20796c5ba06e190623de8bcba55c14971da5e7bf2bc1ae
Instruction Fuzzy Hash: 90B1C262B1869241EA60AF23D4945BDE7B1EB48BE4FC45133EA5D17B89EE3CE441C730

Function 00007FF7D4C15E7C Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7D4C15EAA

Part of subcall function 00007FF7D4C155F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C1560C

_get_daylight.LIBCMT ref: 00007FF7D4C15EBB

Part of subcall function 00007FF7D4C15598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C155AC

_get_daylight.LIBCMT ref: 00007FF7D4C15ECC

Part of subcall function 00007FF7D4C155C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C155DC

Part of subcall function 00007FF7D4C0A948: HeapFree.KERNEL32(?,?,?,00007FF7D4C12D22,?,?,?,00007FF7D4C12D5F,?,?,00000000,00007FF7D4C13225,?,?,?,00007FF7D4C13157), ref: 00007FF7D4C0A95E
Part of subcall function 00007FF7D4C0A948: GetLastError.KERNEL32(?,?,?,00007FF7D4C12D22,?,?,?,00007FF7D4C12D5F,?,?,00000000,00007FF7D4C13225,?,?,?,00007FF7D4C13157), ref: 00007FF7D4C0A968

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7D4C1610C), ref: 00007FF7D4C15EF3

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 179af59534a267e8b56f66eebf2dbf2058aebcf107c16e98e161f461d30bd41f
Instruction ID: d3dc03d76b6cb7a26f05f41d17c4320dfbd9d0e87d94f5aa38308331d77b9770
Opcode Fuzzy Hash: 179af59534a267e8b56f66eebf2dbf2058aebcf107c16e98e161f461d30bd41f
Instruction Fuzzy Hash: 1D516A22A0864286E710FF23D8C55ADE760BB987D4FC48137EA4E47AA6DF3DE4418770

Function 00007FF7D4BFD010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7D4BFD03C
GetCurrentThreadId.KERNEL32 ref: 00007FF7D4BFD04A
GetCurrentProcessId.KERNEL32 ref: 00007FF7D4BFD056
QueryPerformanceCounter.KERNEL32 ref: 00007FF7D4BFD066

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction ID: 25004a2437947bf3dd39038b02e7556ac077153b6cb1a1dc1a183f643ed8da8f
Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction Fuzzy Hash: FA114C26B14B058AEB00DF71E8942BD73B4FB19798F840E32DA2D46BA4EF7CD1598350

Function 00007FF7D4C13C10 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF7D4C13C76
memcpy_s.LIBCPMT ref: 00007FF7D4C13CA1

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: af608285285afcd6478307b3643bc455f8ca752feb9b34af7441f5de9a3c2571
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: 9BC1C372B1868687EB24DF16E08466EF7A1F784BC8FC48136DB4E53794DA3DE9018B50

Function 00007FF7D4BFA47B Relevance: 4.1, Strings: 3, Instructions: 397COMMON

Download Yara Rule

Strings

unknown header flags set, xrefs: 00007FF7D4BFA4C5
header crc mismatch, xrefs: 00007FF7D4BFA921
, xrefs: 00007FF7D4BFA55B

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: e32b299fc273864699ec3bddfbf8fc958dab4a7742ffdf8f0166f3b43fcc42d1
Instruction ID: 3e823eadd1d3eda3cb2441113fe83f18fedb725bdf34e5fe6349986d4185b3ca
Opcode Fuzzy Hash: e32b299fc273864699ec3bddfbf8fc958dab4a7742ffdf8f0166f3b43fcc42d1
Instruction Fuzzy Hash: EEF19472A193C54BE7A9AF16C0C8A3EBAE9EF98740FC54136DA4D07790CB39E441C750

Function 00007FF7D4C19728 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF7D4C19977
RaiseException.KERNEL32 ref: 00007FF7D4C19988

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
Instruction ID: 9e8bbae426dddccc33b5fcf74ba6a4667cd9e5e8503f8d00f30bdc767980773a
Opcode Fuzzy Hash: a4cc0e8a2f7e024105bf8074fef1866164229a93701b52dcf00f6f20498becf3
Instruction Fuzzy Hash: 3AB15E73A04B858BEB15DF2AC88636CBBB0F744B88F558923DA5D837A4CB39D451C720

Function 00007FF7D4C039A4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF7D4C03D54
, xrefs: 00007FF7D4C03B12

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
Instruction ID: 984a1acdc10b4a6048e98aa5497d8c552a7962071335ce189283eafb7ddd5dbb
Opcode Fuzzy Hash: e57f1980f4491aea9eb328a1e81193c2bccc9a7e68d1918bb9b7207cf9600634
Instruction Fuzzy Hash: 8DE1A432A1864685EB78AF66C0D813DB360FF45BC8FD45237DA0E676A4DF29E851C720

Function 00007FF7D4BFA2DB Relevance: 2.7, Strings: 2, Instructions: 218COMMON

Download Yara Rule

Strings

invalid window size, xrefs: 00007FF7D4BFA449
incorrect header check, xrefs: 00007FF7D4BFA462

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: e8ec78490181e4ccec650f854842bb3e08bcfae3bf2db5596c2af0d8e2ff5899
Instruction ID: f2777ad79ea9835017cf5fa42e18a82e6965e5db43294bc6757a5cac5446f29c
Opcode Fuzzy Hash: e8ec78490181e4ccec650f854842bb3e08bcfae3bf2db5596c2af0d8e2ff5899
Instruction Fuzzy Hash: 63919972A192C587E7A49E16C4D8B3EBAE9FB64350FD1813ADA4E46790CB39E540CB10

Function 00007FF7D4C0DEF0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF7D4C0E07A
e+000, xrefs: 00007FF7D4C0DFFD

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
Instruction ID: 4ca50e0e95a6df380c8fc98c34520072e824e40e4b9a8c32c86b5b623c1bbb98
Opcode Fuzzy Hash: c8a24eaff8c968987b4d031b15ae93849e98bcf9eddb8930961e84febef9b5bc
Instruction Fuzzy Hash: 3A515522B182C186E7259E36D88876DAB92E744BD4FC8C233DBAC47AC5DE7DD000C711

Function 00007FF7D4C108C8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 1f02906f64a0705243f8a934690fc57de62aec8e174562db1634478312f225fa
Instruction ID: 05e17d3c2eb0fb12adf7cd296fce26f3a5956d4ca0030ffaab9b918e304e6385
Opcode Fuzzy Hash: 1f02906f64a0705243f8a934690fc57de62aec8e174562db1634478312f225fa
Instruction Fuzzy Hash: E402DA21B1E64241FE51BF13E49827DA6A0AF41BE4FC58637EE6D56BD2DE3DA4018330

Function 00007FF7D4C0DA5C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF7D4C0DD9E

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction ID: 5baaafeb9a4d6c90c0fe8ccf0868e53a51cfd3587e28b0e4ec3e59136f6fa454
Opcode Fuzzy Hash: bcab6200947a377332474fa44b4677218d40dcace4b26705986274372b0e4f91
Instruction Fuzzy Hash: FFA15762B087C546EB21DF26E4847ADBB91AB51BC4F848133EE4D57785EE3DD401C721

Function 00007FF7D4C08794 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF7D4C087B3

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 405b9769b8a986946faf73e500ffb4ce1780379e6f9b934ce1cdce4b063a5bb7
Instruction ID: 1922835609f86ef23b3cbdb8c050034351323b532e389592380127fb43c810b5
Opcode Fuzzy Hash: 405b9769b8a986946faf73e500ffb4ce1780379e6f9b934ce1cdce4b063a5bb7
Instruction Fuzzy Hash: 4B518C11B0861241FA74BE27D98917ED290AF54BD4FC88537DE8E67796EE3CE4428230

Function 00007FF7D4C13480 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7D4C13484

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
Instruction ID: 1b891e8e86e14f4309ae6926570764f94dec0e72cf2251cc58f1de1a5af51596
Opcode Fuzzy Hash: 1f9e0516fd534d967cb731c121838b59470578846d262458ea046ba55ab40ebf
Instruction Fuzzy Hash: 3DB09220E07A02C2EA087F22ACCA22C62A47F48741FD8013BC40C40331EE2C20E99B20

Function 00007FF7D4C035A0 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
Instruction ID: b44c713324fb85c4dd662f82fa19551a0c9c5275755f3adf4f6d44cb6ad3dc72
Opcode Fuzzy Hash: 5eca4e5ff3e7205525bf20f3b63783aa462e3e7adb0228d62bb7e98ab9f5e9bb
Instruction Fuzzy Hash: A7D1C662A0864245EB78AE2BC58827DA7A0BB45BC8FD44237CE0D277E5DF3DD845C760

Function 00007FF7D4BF9800 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
Instruction ID: a0916d99f21e7611a9bd7d0f72ac5ffccf3f4c6b7d4dedacf0559699c063812e
Opcode Fuzzy Hash: e75d751cc15dfd510e55d83c6141b0e8cb11d18cbed01e0c543b372a0114c593
Instruction Fuzzy Hash: 24C18D762181E08BD289EB29E8B947A73D1F78934DBD5406BEF8747685C73CA414DB20

Function 00007FF7D4C02C10 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
Instruction ID: c5dfc646a65553e7d3c0116e8bb34303bb3967b54b814f4c338e8729ca7ecaa6
Opcode Fuzzy Hash: aa73bfa000bc8cd66a05f12d530b76a597660d7bda6a6781f52cf2f49ffced0b
Instruction Fuzzy Hash: 34B16D7290879586EB649F2AC09823CBBA0E749F89FE44137CA4E67395CF39DC41C764

Function 00007FF7D4C0E570 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
Instruction ID: 0d7887d7a80040c217f937edead7f8f11bbf5f2f1cb64cf4ccec76ff303a4264
Opcode Fuzzy Hash: 9611c2e0762efa78d7f6da3d8515592aa8d86601c49200b7335873453b670326
Instruction Fuzzy Hash: E381D272A4878186E774EF1AE48836EAA91FB557D4FD04237DB8D53B89DE3DE4008B10

Function 00007FF7D4C16418 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 21aaab296e2e64a79b20cf98ea2699a9ab0529386423cc159892306e5cd43e00
Instruction ID: c2c01a06538262e907c4d6ffceadcf437ab9d1b865f5ee28087639ec0d0140a3
Opcode Fuzzy Hash: 21aaab296e2e64a79b20cf98ea2699a9ab0529386423cc159892306e5cd43e00
Instruction Fuzzy Hash: 1961E662F0825247F764AE6AD4D463DE6A0AF507E0FDD423BD61E42AC5DE7DE8018730

Function 00007FF7D4C01D54 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: 8dbf74f8d11ed2d92f2a72d11a545299cb7d87d49506f2857b2ffa3a39d32efd
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: 84517436A1865186E7259F2AC08822CF3A0EB45B98FE44133DE4D27798CF3BE853C750

Function 00007FF7D4C02164 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: 224aa51299025f02853dc0653a1481b299ace41515650258e84e643a1259cc37
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: B7518576A1865182E7649F6AC48833CB3A5EB54BA9FE44133CE4D27794CB3AEC43C750

Function 00007FF7D4C01944 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: 968827b063c6f939831a866aebc063840d7c3a06f671f64676fb2278f4c9a50a
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: C6514676A1865185E7249F1AC08822CF7A0EB45B98FE44233DA8D2779CDF3BE853C750

Function 00007FF7D4C01F60 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction ID: 4c57a4d982c3647ece7f21241dade05f85df970b198034fc404ab6edad905189
Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction Fuzzy Hash: 97517236A1865585E7249F2AC08833CA7A1EB45B99FE44133CE4D277A9CF3AEC43C750

Function 00007FF7D4C01740 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction ID: f431553d5af4d48e0ea6410b3bcd17a66a428e6b2cd643762b666a364dea5a16
Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction Fuzzy Hash: C3517236A1865186E7349F2AC08832CE7A1EB45B98FE54133CE4D67799CF3BE942C750

Function 00007FF7D4C01B50 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction ID: c56cf61024b7fb57282771368f358ea64662bbd6cd2b1a6100189066787b089c
Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction Fuzzy Hash: A1518676A1865185E7259F2AC08822CF7A1EB45B98FE85133CE4C27798DF3BE842C750

Function 00007FF7D4C05D30 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: 186ef352168a0dcf277536a5c3e1e3112bf4f06153e1ee20c3a09e144bca551a
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: 12418562C0974B07E999DD1A864C6BC9A809F127E0DD852B7DDED373D7CD0D6987C220

Function 00007FF7D4C09EA0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: e2fd4559255f10fba12f2fe7c3826a5d8d64873a79dc25e0e9bc72c34cfb8264
Instruction ID: 6eb1c0f2d17f0470482ffcb25ae4d01effd6bbe0cff57ff1cb351cf6d9f2c947
Opcode Fuzzy Hash: e2fd4559255f10fba12f2fe7c3826a5d8d64873a79dc25e0e9bc72c34cfb8264
Instruction Fuzzy Hash: 2141E262714A5582EF04DF2BD99866DB3A1BB48FD4BC99037EE0DA7B58DE7DD0428300

Function 00007FF7D4C080E4 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a33e2c8dffc1328ccb3c79931647987677b9da288923bf574ced27deaffa7ee3
Instruction ID: eed00443949d0d5f41c000cc91a98b9aedf91574c13f299b29c80b055bfd8a73
Opcode Fuzzy Hash: a33e2c8dffc1328ccb3c79931647987677b9da288923bf574ced27deaffa7ee3
Instruction Fuzzy Hash: 8A31B432708B4141E664AF27E48413EA6D5AF85BD0FD4823BEA9D63BD5DF3CD0018724

Function 00007FF7D4C19570 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction ID: ad059c0820bcd99f386284cdc459f69b69a1efe507a9bd0572c49b6462fd7ce4
Opcode Fuzzy Hash: 5d3ac10822f6242d2b374fc0e1218152d8e80c351f0dfcd4fab21387456caa74
Instruction Fuzzy Hash: 2BF044717182958ADB98AF69E44262977D0F7483C0FC0C03BD58D83A24DA3C90528F14

Function 00007FF7D4BFD30C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
Instruction ID: b51727c19ce920c105c702c0cc290b215380527e55dd9d5f1755e1c38095afcc
Opcode Fuzzy Hash: 3c3909751b2697c6481bc0460501d6177e5cf72f77169ad8285d6e0cd944102a
Instruction Fuzzy Hash: F5A00221D0DC4BD0E644AF02E8D003DA374FB68341BC00033E50E514B1AF3DA409E730

Function 00007FF7D4BF5830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF7D4BF64CF,?,00007FF7D4BF336E), ref: 00007FF7D4BF5840
GetLastError.KERNEL32(?,00007FF7D4BF64CF,?,00007FF7D4BF336E), ref: 00007FF7D4BF5852
GetProcAddress.KERNEL32(?,00007FF7D4BF64CF,?,00007FF7D4BF336E), ref: 00007FF7D4BF5889
GetLastError.KERNEL32(?,00007FF7D4BF64CF,?,00007FF7D4BF336E), ref: 00007FF7D4BF589B
GetProcAddress.KERNEL32(?,00007FF7D4BF64CF,?,00007FF7D4BF336E), ref: 00007FF7D4BF58B4
GetLastError.KERNEL32(?,00007FF7D4BF64CF,?,00007FF7D4BF336E), ref: 00007FF7D4BF58C6
GetProcAddress.KERNEL32(?,00007FF7D4BF64CF,?,00007FF7D4BF336E), ref: 00007FF7D4BF58DF
GetLastError.KERNEL32(?,00007FF7D4BF64CF,?,00007FF7D4BF336E), ref: 00007FF7D4BF58F1
GetProcAddress.KERNEL32(?,00007FF7D4BF64CF,?,00007FF7D4BF336E), ref: 00007FF7D4BF590D
GetLastError.KERNEL32(?,00007FF7D4BF64CF,?,00007FF7D4BF336E), ref: 00007FF7D4BF591F
GetProcAddress.KERNEL32(?,00007FF7D4BF64CF,?,00007FF7D4BF336E), ref: 00007FF7D4BF593B
GetLastError.KERNEL32(?,00007FF7D4BF64CF,?,00007FF7D4BF336E), ref: 00007FF7D4BF594D
GetProcAddress.KERNEL32(?,00007FF7D4BF64CF,?,00007FF7D4BF336E), ref: 00007FF7D4BF5969
GetLastError.KERNEL32(?,00007FF7D4BF64CF,?,00007FF7D4BF336E), ref: 00007FF7D4BF597B
GetProcAddress.KERNEL32(?,00007FF7D4BF64CF,?,00007FF7D4BF336E), ref: 00007FF7D4BF5997
GetLastError.KERNEL32(?,00007FF7D4BF64CF,?,00007FF7D4BF336E), ref: 00007FF7D4BF59A9
GetProcAddress.KERNEL32(?,00007FF7D4BF64CF,?,00007FF7D4BF336E), ref: 00007FF7D4BF59C5
GetLastError.KERNEL32(?,00007FF7D4BF64CF,?,00007FF7D4BF336E), ref: 00007FF7D4BF59D7

Strings

PyConfig_SetWideStringList, xrefs: 00007FF7D4BF5A73, 00007FF7D4BF5A95
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF7D4BF5DDD, 00007FF7D4BF5DFF
Py_PreInitialize, xrefs: 00007FF7D4BF595F, 00007FF7D4BF5981
PyErr_Restore, xrefs: 00007FF7D4BF5B87, 00007FF7D4BF5BA9
Py_DecodeLocale, xrefs: 00007FF7D4BF587F, 00007FF7D4BF58A1
Py_InitializeFromConfig, xrefs: 00007FF7D4BF5903, 00007FF7D4BF5925
Py_Finalize, xrefs: 00007FF7D4BF58D5, 00007FF7D4BF58F7
Py_DecRef, xrefs: 00007FF7D4BF5836, 00007FF7D4BF5858
PySys_SetObject, xrefs: 00007FF7D4BF5E95, 00007FF7D4BF5EB7
PyEval_EvalCode, xrefs: 00007FF7D4BF5BB5, 00007FF7D4BF5BD7
PyMem_RawFree, xrefs: 00007FF7D4BF5C9B, 00007FF7D4BF5CBD
PyConfig_SetBytesString, xrefs: 00007FF7D4BF5A17, 00007FF7D4BF5A39
PyErr_Print, xrefs: 00007FF7D4BF5B59, 00007FF7D4BF5B7B
PyConfig_SetString, xrefs: 00007FF7D4BF5A45, 00007FF7D4BF5A67
PyImport_ExecCodeModule, xrefs: 00007FF7D4BF5C11, 00007FF7D4BF5C33
PyConfig_Read, xrefs: 00007FF7D4BF59E9, 00007FF7D4BF5A0B
PyStatus_Exception, xrefs: 00007FF7D4BF5E39, 00007FF7D4BF5E5B
PyConfig_Clear, xrefs: 00007FF7D4BF598D, 00007FF7D4BF59AF
Py_ExitStatusException, xrefs: 00007FF7D4BF58AA, 00007FF7D4BF58CC
PyErr_Fetch, xrefs: 00007FF7D4BF5ACF, 00007FF7D4BF5AF1
PyImport_ImportModule, xrefs: 00007FF7D4BF5C3F, 00007FF7D4BF5C61
PyConfig_InitIsolatedConfig, xrefs: 00007FF7D4BF59BB, 00007FF7D4BF59DD
PyObject_SetAttrString, xrefs: 00007FF7D4BF5D81, 00007FF7D4BF5DA3
PyUnicode_Join, xrefs: 00007FF7D4BF5FA9, 00007FF7D4BF5FCB
Py_IsInitialized, xrefs: 00007FF7D4BF5931, 00007FF7D4BF5953
PyUnicode_FromString, xrefs: 00007FF7D4BF5F7B, 00007FF7D4BF5F9D
PyUnicode_Replace, xrefs: 00007FF7D4BF5FD7, 00007FF7D4BF5FF9
PyModule_GetDict, xrefs: 00007FF7D4BF5CC9, 00007FF7D4BF5CEB
PyUnicode_Decode, xrefs: 00007FF7D4BF5EF1, 00007FF7D4BF5F13
PyUnicode_AsUTF8, xrefs: 00007FF7D4BF5EC3, 00007FF7D4BF5EE5
Failed to get address for %hs, xrefs: 00007FF7D4BF5861
PyObject_Str, xrefs: 00007FF7D4BF5DAF, 00007FF7D4BF5DD1
PyUnicode_DecodeFSDefault, xrefs: 00007FF7D4BF5F1F, 00007FF7D4BF5F41
PyErr_Occurred, xrefs: 00007FF7D4BF5B2B, 00007FF7D4BF5B4D
PyObject_CallFunctionObjArgs, xrefs: 00007FF7D4BF5D25, 00007FF7D4BF5D47
PyObject_CallFunction, xrefs: 00007FF7D4BF5CF7, 00007FF7D4BF5D19
PyRun_SimpleStringFlags, xrefs: 00007FF7D4BF5E0B, 00007FF7D4BF5E2D
PyObject_GetAttrString, xrefs: 00007FF7D4BF5D53, 00007FF7D4BF5D75
PyUnicode_FromFormat, xrefs: 00007FF7D4BF5F4D, 00007FF7D4BF5F6F
PyImport_AddModule, xrefs: 00007FF7D4BF5BE3, 00007FF7D4BF5C05
PyErr_NormalizeException, xrefs: 00007FF7D4BF5AFD, 00007FF7D4BF5B1F
PyMarshal_ReadObjectFromString, xrefs: 00007FF7D4BF5C6D, 00007FF7D4BF5C8F
GetProcAddress, xrefs: 00007FF7D4BF5868
PySys_GetObject, xrefs: 00007FF7D4BF5E67, 00007FF7D4BF5E89
PyErr_Clear, xrefs: 00007FF7D4BF5AA1, 00007FF7D4BF5AC3

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction ID: 83fa063cda382caf27c69529a1c89f5f33e147206b71c3788dd660447b513541
Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction Fuzzy Hash: C3228EA4A0EB0792FA05FF57E8D45BCA2B0AF197D1FC45437D81E02261BF7DA5488A70

Function 00007FF7D4BF81D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7D4BF9390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7D4BF45F4,00000000,00007FF7D4BF1985), ref: 00007FF7D4BF93C9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF7D4BF86B7,?,?,00000000,00007FF7D4BF3CBB), ref: 00007FF7D4BF822C

Part of subcall function 00007FF7D4BF2810: MessageBoxW.USER32 ref: 00007FF7D4BF28EA

Strings

LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF7D4BF8373
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF7D4BF8203
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF7D4BF829D
%.*s, xrefs: 00007FF7D4BF830C
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF7D4BF82D9
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF7D4BF8240
\, xrefs: 00007FF7D4BF8261
CreateDirectory, xrefs: 00007FF7D4BF837C

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 34679b23be2e6a85bad270fe565fa16c5e09c528fb77942a9d4832d630ea4d55
Instruction ID: 2e28ad4086776c65654f868e9cbbf242a4afb1e1eba5008452b6cf59fa83d9fa
Opcode Fuzzy Hash: 34679b23be2e6a85bad270fe565fa16c5e09c528fb77942a9d4832d630ea4d55
Instruction Fuzzy Hash: A9515311A1AA8241EA54BF26D8D52BDE2A1AF647C0FC45433E64E426D5FF2DF5048770

Function 00007FF7D4BF1600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON

Download Yara Rule

Strings

fopen, xrefs: 00007FF7D4BF1663
Failed to extract %s: failed to open archive file!, xrefs: 00007FF7D4BF16A2
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF7D4BF17CA
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF7D4BF1742
Failed to create symbolic link %s!, xrefs: 00007FF7D4BF1622
fseek, xrefs: 00007FF7D4BF16E1
fread, xrefs: 00007FF7D4BF17E6
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7D4BF16DA
malloc, xrefs: 00007FF7D4BF1749
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7D4BF17DF
fwrite, xrefs: 00007FF7D4BF17D1
Failed to extract %s: failed to open target file!, xrefs: 00007FF7D4BF165C

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: e3708a70641f4c25eddad747f271709fc7d2310b412025799ca2ceeb596927eb
Instruction ID: ee3837f1dfcca2dda76a30370d16a02d97d217a44d1a4126c5bdfbb3dcec8f82
Opcode Fuzzy Hash: e3708a70641f4c25eddad747f271709fc7d2310b412025799ca2ceeb596927eb
Instruction Fuzzy Hash: 55518061A0964392EA14BF63E4801AEA3A0BF547D4FC44533ED0C17796EE3EF9458720

Function 00007FF7D4BF2180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7D4BF21AB
SelectObject.GDI32 ref: 00007FF7D4BF21F2
DrawTextW.USER32 ref: 00007FF7D4BF2215
SelectObject.GDI32 ref: 00007FF7D4BF222B
ReleaseDC.USER32 ref: 00007FF7D4BF223B
MoveWindow.USER32 ref: 00007FF7D4BF228B
MoveWindow.USER32 ref: 00007FF7D4BF22CB
MoveWindow.USER32 ref: 00007FF7D4BF231E
MoveWindow.USER32 ref: 00007FF7D4BF2366

Strings

P%, xrefs: 00007FF7D4BF21FF

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: 13c1baf5d1a888199f5c6aba053cb1cd2a1f6d2f78880d1e30f783302df881a3
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: ED51D7266047A186D6349F26F4581BEF7A1FB98BA1F404126EBDE43694EF3CD045DB20

Function 00007FF7D4BF80C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF7D4BF80FF
GetWindowLongPtrW.USER32 ref: 00007FF7D4BF817F
ShutdownBlockReasonCreate.USER32 ref: 00007FF7D4BF8192
GetLastError.KERNEL32 ref: 00007FF7D4BF819C
SetWindowLongPtrW.USER32 ref: 00007FF7D4BF81B3

Strings

Needs to remove its temporary files., xrefs: 00007FF7D4BF8185

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction ID: 0633e3e686f6544d95d6b2ba43c9df32eacdd78d5c5a8f9e9f317c387814cad5
Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction Fuzzy Hash: 53217425B09A4281E741AF7BE88417DE2A0EF9CBD0FD84233DE5D43398EE2CD5918630

Function 00007FF7D4C06290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C062D3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C066C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C0695C

Strings

:, xrefs: 00007FF7D4C0648C
p, xrefs: 00007FF7D4C06385
p, xrefs: 00007FF7D4C063FD
-, xrefs: 00007FF7D4C06369
f, xrefs: 00007FF7D4C063F5

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: dd0752c162f035b21ef2f9be379e031df7670d98d080f804f14266976a8f9f70
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 83126061F0824386FB24BE16D19A67DF691FB50794FCC4137E68D66AC4DB3CE5808B24

Function 00007FF7D4C00FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C01008
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C013D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C0166F

Strings

p, xrefs: 00007FF7D4C010AD
p, xrefs: 00007FF7D4C01112
f, xrefs: 00007FF7D4C01255
f, xrefs: 00007FF7D4C0110A
f, xrefs: 00007FF7D4C010A0

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: 8b5953a87f2de0b8910487f5b3ffd024a69c45841b3e0fb6f543353467b70b90
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: CA127262E0C14386FB246E56E09827DF6A5FB407D4FC44137E69E56AC8DF7EE5808B20

Function 00007FF7D4BF1050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF7D4BF1098
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7D4BF1108
fseek, xrefs: 00007FF7D4BF10D3
fread, xrefs: 00007FF7D4BF11FD
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7D4BF10CC
malloc, xrefs: 00007FF7D4BF110F
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7D4BF11F6

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 2e822f8cd24891b1059a3a79b168aacb6a69fa12a2733a925039993d87a111eb
Instruction ID: 8fd81f433cec8018ccd9b17e89ddb854afd3ece4eaf03a9c2bab66ea715a9386
Opcode Fuzzy Hash: 2e822f8cd24891b1059a3a79b168aacb6a69fa12a2733a925039993d87a111eb
Instruction Fuzzy Hash: 5D414B21A0965282EA10FF13E8846BEE3A1AF54BC4FC45833ED4C57796DE3DE9058760

Function 00007FF7D4BF8660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF7D4BF3CBB), ref: 00007FF7D4BF8704
GetCurrentProcessId.KERNEL32(?,00000000,00007FF7D4BF3CBB), ref: 00007FF7D4BF870A
CreateDirectoryW.KERNEL32(?,00000000,00007FF7D4BF3CBB), ref: 00007FF7D4BF874C

Part of subcall function 00007FF7D4BF8830: GetEnvironmentVariableW.KERNEL32(00007FF7D4BF388E), ref: 00007FF7D4BF8867
Part of subcall function 00007FF7D4BF8830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF7D4BF8889

Part of subcall function 00007FF7D4C08238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C08251

Part of subcall function 00007FF7D4BF2810: MessageBoxW.USER32 ref: 00007FF7D4BF28EA

Strings

_MEI%d, xrefs: 00007FF7D4BF8712
TMP, xrefs: 00007FF7D4BF869C, 00007FF7D4BF87A3
LOADER: failed to set the TMP environment variable., xrefs: 00007FF7D4BF86DC
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF7D4BF877E
TMP, xrefs: 00007FF7D4BF86C2

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: e09d7b167afd2147c660aa35db8091a51c6906773476d98e2344c67e24741bda
Instruction ID: bc3e3603f86c2d870d6c43cf202836b89008edfd8988a43c1616fb855c4e50b1
Opcode Fuzzy Hash: e09d7b167afd2147c660aa35db8091a51c6906773476d98e2344c67e24741bda
Instruction Fuzzy Hash: 9C41AE11A1EA4244FA24BF27E8D92BE92A1AF947C0FC04133ED4D577DAEE3DE5058760

Function 00007FF7D4BF1470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF7D4BF149F
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF7D4BF1518
fseek, xrefs: 00007FF7D4BF14E5
fread, xrefs: 00007FF7D4BF15E6
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF7D4BF14DE
malloc, xrefs: 00007FF7D4BF151F
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF7D4BF15DF

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 6e0dbdf68ebac07b8e07dae572509d1bc59e12a4c4e352d5f88c3b4cbd2dc1c0
Instruction ID: 949bc1a8573f16bad3fbe07b6e67744e7846f3d55000dd86f1a5573a8ef79d15
Opcode Fuzzy Hash: 6e0dbdf68ebac07b8e07dae572509d1bc59e12a4c4e352d5f88c3b4cbd2dc1c0
Instruction Fuzzy Hash: 04415D21A0964286EA10FF23E4815BDE3A0AF547D4FC49933ED4D17B95EE3DF9068B24

Function 00007FF7D4BFEA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF7D4BFEA65

Part of subcall function 00007FF7D4BFF9BC: __GetUnwindTryBlock.LIBCMT ref: 00007FF7D4BFF9FF
Part of subcall function 00007FF7D4BFF9BC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF7D4BFFA24

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7D4BFEB3D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF7D4BFED8B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7D4BFEE98

Strings

csm, xrefs: 00007FF7D4BFEA7F
csm, xrefs: 00007FF7D4BFEAE6
csm, xrefs: 00007FF7D4BFEB60

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction ID: 69294884ae0872cd2b9012ea3b8b84a05b8c5e9ef7182350ea766f9271b4202b
Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction Fuzzy Hash: 2CD16D32A0974186EB60AF26D4C03BDB7E0FB65788F900536EA4D57B9ADF39E091C710

Function 00007FF7D4BF1210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158COMMON

Download Yara Rule

Strings

Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF7D4BF141E
1.3.1, xrefs: 00007FF7D4BF1249
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF7D4BF12EF
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF7D4BF1276
malloc, xrefs: 00007FF7D4BF12C1, 00007FF7D4BF12F6
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF7D4BF12BA

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 7498d34eb7022638204d509c16463b156d406bb9cf128f30b27a0aca8b7a9da8
Instruction ID: bab3fcb3970cc4c3ef234a41564822f9c7db8a7ab7de70ed8b76c56a4385820a
Opcode Fuzzy Hash: 7498d34eb7022638204d509c16463b156d406bb9cf128f30b27a0aca8b7a9da8
Instruction Fuzzy Hash: BC51D122A0A64281EA20BF17E4803BEA2E1BF94794FC44533ED4D577C5EE3DE905CB20

Function 00007FF7D4C0ED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF7D4C0F0AA,?,?,-00000018,00007FF7D4C0AD53,?,?,?,00007FF7D4C0AC4A,?,?,?,00007FF7D4C05F3E), ref: 00007FF7D4C0EE8C
GetProcAddress.KERNEL32(?,?,?,00007FF7D4C0F0AA,?,?,-00000018,00007FF7D4C0AD53,?,?,?,00007FF7D4C0AC4A,?,?,?,00007FF7D4C05F3E), ref: 00007FF7D4C0EE98

Strings

ext-ms-, xrefs: 00007FF7D4C0EDE9
api-ms-, xrefs: 00007FF7D4C0EDD6

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction ID: f8885b68728758850e1d12efc8db36abd1494a9cc9bd80fe3aca9d7d8f126ca0
Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction Fuzzy Hash: 1341E262B19A1641EB15EF27D88857DA291FF48BD0FC8453BDD2D67794EE3CE4058220

Function 00007FF7D4BF2C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF7D4BF3706,?,00007FF7D4BF3804), ref: 00007FF7D4BF2C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF7D4BF3706,?,00007FF7D4BF3804), ref: 00007FF7D4BF2D63
MessageBoxW.USER32 ref: 00007FF7D4BF2D99

Strings

Error, xrefs: 00007FF7D4BF2D8C
%ls: , xrefs: 00007FF7D4BF2D22
<FormatMessageW failed.>, xrefs: 00007FF7D4BF2D70
[PYI-%d:ERROR] , xrefs: 00007FF7D4BF2CA6

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction ID: 486772491ba50209ba961a48e7ce98e5dd2dcb054b4dc721a8308fdb76316d73
Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction Fuzzy Hash: D331F826708A4142E624BF26E8942BEA6A1BF987D8FC00137EF4D53759EF3DD546C720

Function 00007FF7D4BFDCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF7D4BFDF7A,?,?,?,00007FF7D4BFDC6C,?,?,?,00007FF7D4BFD869), ref: 00007FF7D4BFDD4D
GetLastError.KERNEL32(?,?,?,00007FF7D4BFDF7A,?,?,?,00007FF7D4BFDC6C,?,?,?,00007FF7D4BFD869), ref: 00007FF7D4BFDD5B
LoadLibraryExW.KERNEL32(?,?,?,00007FF7D4BFDF7A,?,?,?,00007FF7D4BFDC6C,?,?,?,00007FF7D4BFD869), ref: 00007FF7D4BFDD85
FreeLibrary.KERNEL32(?,?,?,00007FF7D4BFDF7A,?,?,?,00007FF7D4BFDC6C,?,?,?,00007FF7D4BFD869), ref: 00007FF7D4BFDDF3
GetProcAddress.KERNEL32(?,?,?,00007FF7D4BFDF7A,?,?,?,00007FF7D4BFDC6C,?,?,?,00007FF7D4BFD869), ref: 00007FF7D4BFDDFF

Strings

api-ms-, xrefs: 00007FF7D4BFDD6D

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction ID: 3a814992f5fe1a854c59251548a32b96b5cc15cacb4d55450fe4d190674c24bc
Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction Fuzzy Hash: 1A31A025B1B68291EE11EF17D8801ADA3E8FF58BA4FD90537DD1E06394EF3DE4448220

Function 00007FF7D4BF6360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

LoadLibrary, xrefs: 00007FF7D4BF64AE
Failed to load Python DLL '%ls'., xrefs: 00007FF7D4BF64A7
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF7D4BF6407
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF7D4BF6456
ucrtbase.dll, xrefs: 00007FF7D4BF63DD
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF7D4BF63C7

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 2c49d70b8cf5be1e73da3264635f3f4e48fda49976f17b757535f0242ee4fe1a
Instruction ID: 3a9cfc93f902a4b8df8c80586f582827a83d53f42c7d7e0c91c4e9ba3e0d1c67
Opcode Fuzzy Hash: 2c49d70b8cf5be1e73da3264635f3f4e48fda49976f17b757535f0242ee4fe1a
Instruction Fuzzy Hash: E7418431A19A8691EA15FF26E4941EDA3A1FF64384FC00133EA5C436D5EF3DE516C760

Function 00007FF7D4BF2A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF7D4BF351A,?,00000000,00007FF7D4BF3F1B), ref: 00007FF7D4BF2AA0

Strings

Warning, xrefs: 00007FF7D4BF2B1E
0, xrefs: 00007FF7D4BF2B16
[PYI-%d:%s] , xrefs: 00007FF7D4BF2AA8
Warning [ANSI Fallback], xrefs: 00007FF7D4BF2B0F
WARNING, xrefs: 00007FF7D4BF2AAF

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction ID: 20a5b637b9a10aa5f4b487e849bf6c08031d5ee918b70beb859d95678057fc9d
Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction Fuzzy Hash: F2217F32A19B8152E620AF52F8817EAA2A4FB887C4FC01137EE8C53659EF7CD5458A50

Function 00007FF7D4BF8570 Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7D4BF8590
OpenProcessToken.ADVAPI32 ref: 00007FF7D4BF85A3
GetTokenInformation.ADVAPI32 ref: 00007FF7D4BF85C8
GetLastError.KERNEL32 ref: 00007FF7D4BF85D2
GetTokenInformation.ADVAPI32 ref: 00007FF7D4BF8612
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7D4BF862E
CloseHandle.KERNEL32 ref: 00007FF7D4BF8646

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: fa90e23b90d603ff8a1fc3170628a297920662056bab6e12f28c88f429b12389
Instruction ID: d8160b06aaf222c53edf1eb2560728f341e4b1332ab9f28d1253493b393710d4
Opcode Fuzzy Hash: fa90e23b90d603ff8a1fc3170628a297920662056bab6e12f28c88f429b12389
Instruction Fuzzy Hash: 9C212421A0DA4242EA50AF56F58422EE3B0EB957E0FD00637EAAD43BD4DF7DD4558B20

Function 00007FF7D4C0B150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7D4C0B15F
FlsGetValue.KERNEL32 ref: 00007FF7D4C0B174
FlsSetValue.KERNEL32 ref: 00007FF7D4C0B195
FlsSetValue.KERNEL32 ref: 00007FF7D4C0B1C2
FlsSetValue.KERNEL32 ref: 00007FF7D4C0B1D3
FlsSetValue.KERNEL32 ref: 00007FF7D4C0B1E4
SetLastError.KERNEL32 ref: 00007FF7D4C0B1FF

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: bd40692f84e3da01acd5c9e715af8932c2ff4b5b564443a413d720313231dc09
Instruction ID: ec0dc97e345aeb7aed0f3fb7f045ab1dcc6ed5511a96f658db6ba5e56fa1b663
Opcode Fuzzy Hash: bd40692f84e3da01acd5c9e715af8932c2ff4b5b564443a413d720313231dc09
Instruction Fuzzy Hash: E9212F28B0C64242F958BF63D5D913DE1565F447F0FD44637D93E66ACAED6CA4408720

Function 00007FF7D4C17D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF7D4C17D9D
GetLastError.KERNEL32 ref: 00007FF7D4C17DA9
CloseHandle.KERNEL32 ref: 00007FF7D4C17DC1
CreateFileW.KERNEL32 ref: 00007FF7D4C17DEC
WriteConsoleW.KERNEL32 ref: 00007FF7D4C17E0B

Strings

CONOUT$, xrefs: 00007FF7D4C17DCD

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction ID: f91132153b749e0719175ea675b49c9ab07e56bca72dcbbef381cbc0f2ca4855
Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction Fuzzy Hash: 7B117F21B18A4186E750AF53E8D432DB2A0BB98BE4FC00237EA5D87794DF7CD8148B60

Function 00007FF7D4BF8ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF7D4BF3FA9), ref: 00007FF7D4BF8EFD
K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF7D4BF3FA9), ref: 00007FF7D4BF8F5A

Part of subcall function 00007FF7D4BF9390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF7D4BF45F4,00000000,00007FF7D4BF1985), ref: 00007FF7D4BF93C9

K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF7D4BF3FA9), ref: 00007FF7D4BF8FE5
K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF7D4BF3FA9), ref: 00007FF7D4BF9044
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF7D4BF3FA9), ref: 00007FF7D4BF9055
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF7D4BF3FA9), ref: 00007FF7D4BF906A

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 51e73ccb600dcf9d750c353d1e93921ada3daf916e275faff0d4d54491eeaa6f
Instruction ID: 6e8121c7dd6a669bd29f79b22df184f7605774419bbf29d1a970fb120dfb46c5
Opcode Fuzzy Hash: 51e73ccb600dcf9d750c353d1e93921ada3daf916e275faff0d4d54491eeaa6f
Instruction Fuzzy Hash: A9416362A1A68141EA20AE23E5802BEB3E4FB95BD4FC50136DF4D57789DE3DD541CB20

Function 00007FF7D4BF90E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7D4BF8570: GetCurrentProcess.KERNEL32 ref: 00007FF7D4BF8590
Part of subcall function 00007FF7D4BF8570: OpenProcessToken.ADVAPI32 ref: 00007FF7D4BF85A3
Part of subcall function 00007FF7D4BF8570: GetTokenInformation.ADVAPI32 ref: 00007FF7D4BF85C8
Part of subcall function 00007FF7D4BF8570: GetLastError.KERNEL32 ref: 00007FF7D4BF85D2
Part of subcall function 00007FF7D4BF8570: GetTokenInformation.ADVAPI32 ref: 00007FF7D4BF8612
Part of subcall function 00007FF7D4BF8570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7D4BF862E
Part of subcall function 00007FF7D4BF8570: CloseHandle.KERNEL32 ref: 00007FF7D4BF8646

LocalFree.KERNEL32(?,00007FF7D4BF3C55), ref: 00007FF7D4BF916C
LocalFree.KERNEL32(?,00007FF7D4BF3C55), ref: 00007FF7D4BF9175

Strings

Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF7D4BF9183
D:(A;;FA;;;%s), xrefs: 00007FF7D4BF9157
S-1-3-4, xrefs: 00007FF7D4BF9121
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF7D4BF9142

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction ID: 12cea9c4e6514d43866c8324fabdbef17958acca9c02247fcb17a6e4a5906eb2
Opcode Fuzzy Hash: 0222097b9c90264a1a2c87a2a2fde68e1a94831f5278aced0db9eca26447961c
Instruction Fuzzy Hash: A6216D21A09A8291F610BF12E5952FEA2A0FF98780FC44033EA4D53796EF3DE9458760

Function 00007FF7D4C0B2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7D4C04F11,?,?,?,?,00007FF7D4C0A48A,?,?,?,?,00007FF7D4C0718F), ref: 00007FF7D4C0B2D7
FlsSetValue.KERNEL32(?,?,?,00007FF7D4C04F11,?,?,?,?,00007FF7D4C0A48A,?,?,?,?,00007FF7D4C0718F), ref: 00007FF7D4C0B30D
FlsSetValue.KERNEL32(?,?,?,00007FF7D4C04F11,?,?,?,?,00007FF7D4C0A48A,?,?,?,?,00007FF7D4C0718F), ref: 00007FF7D4C0B33A
FlsSetValue.KERNEL32(?,?,?,00007FF7D4C04F11,?,?,?,?,00007FF7D4C0A48A,?,?,?,?,00007FF7D4C0718F), ref: 00007FF7D4C0B34B
FlsSetValue.KERNEL32(?,?,?,00007FF7D4C04F11,?,?,?,?,00007FF7D4C0A48A,?,?,?,?,00007FF7D4C0718F), ref: 00007FF7D4C0B35C
SetLastError.KERNEL32(?,?,?,00007FF7D4C04F11,?,?,?,?,00007FF7D4C0A48A,?,?,?,?,00007FF7D4C0718F), ref: 00007FF7D4C0B377

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 511c86220214880ca4b01c77dd55d0a7de68e458561f726588d357ec3f22002e
Instruction ID: 36dfb4f6d8652856941409170e8944a07b8cd99fca1db875f6cc100b1312c6cd
Opcode Fuzzy Hash: 511c86220214880ca4b01c77dd55d0a7de68e458561f726588d357ec3f22002e
Instruction Fuzzy Hash: A4118E24B0C64282FA58BF63D6D913DE1469F48BF0FD44737D92E676D6EE6CA4414320

Function 00007FF7D4BF2910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF7D4BF1B6A), ref: 00007FF7D4BF295E

Strings

Error, xrefs: 00007FF7D4BF2A0E
[PYI-%d:ERROR] , xrefs: 00007FF7D4BF2966
%s: %s, xrefs: 00007FF7D4BF29E8
Error [ANSI Fallback], xrefs: 00007FF7D4BF29FF

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction ID: f4228989cd7811dc98604ae63d993f9aeb25e9650c58a2bda6c8a3b9b17e730a
Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction Fuzzy Hash: 1831E922B1968152E710BB62E8816EFA2D4BF987D4FC04133EE8D53755EF3DD5468620

Function 00007FF7D4BF2390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7D4BF23C8
DialogBoxIndirectParamW.USER32 ref: 00007FF7D4BF248E
DeleteObject.GDI32 ref: 00007FF7D4BF24C1
DestroyIcon.USER32 ref: 00007FF7D4BF24D3

Strings

Unhandled exception in script, xrefs: 00007FF7D4BF23F8

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 1a8653f9ef4157c26f2335c81c204ff7a5d47729ffdf6617f9212c2ec85f79f4
Instruction ID: b13f25a6e0d9347482a745e228ebda35176cb4a2514f6ad515302e93d1e21a83
Opcode Fuzzy Hash: 1a8653f9ef4157c26f2335c81c204ff7a5d47729ffdf6617f9212c2ec85f79f4
Instruction Fuzzy Hash: E231607261968189EB24EF22E8952FEA3A0FF88784FC40137EA4D57B59DF3CD1058720

Function 00007FF7D4BF2B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF7D4BF918F,?,00007FF7D4BF3C55), ref: 00007FF7D4BF2BA0
MessageBoxW.USER32 ref: 00007FF7D4BF2C2A

Strings

WARNING, xrefs: 00007FF7D4BF2BAF
Warning, xrefs: 00007FF7D4BF2C1D
[PYI-%d:%ls] , xrefs: 00007FF7D4BF2BA8

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction ID: 2aeb1e7240cf30573f8d9135d8a53bb795d5683a67e8fada7df18452873bc05a
Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction Fuzzy Hash: D821BC22709B4182E710AF26F8857AEA3A4FB887C0FC00137EE8D5365AEE3CD645C750

Function 00007FF7D4C09A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7D4C09AAD
GetProcAddress.KERNEL32 ref: 00007FF7D4C09AC3
FreeLibrary.KERNEL32 ref: 00007FF7D4C09AEA

Strings

mscoree.dll, xrefs: 00007FF7D4C09AA4
CorExitProcess, xrefs: 00007FF7D4C09ABC

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction ID: 031acd8ca4f06a9b200d2dc2e806a0b78afd3b3116213c15d60e3dedcc110c65
Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction Fuzzy Hash: 3EF04F61A0960681EA10AF26E4D837EA330AF497E1FD40237DA6E462E4DF6CD145C730

Function 00007FF7D4C19368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7D4C19390
_set_statfp.LIBCMT ref: 00007FF7D4C193AB
_set_statfp.LIBCMT ref: 00007FF7D4C193C7
_set_statfp.LIBCMT ref: 00007FF7D4C19403

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: f973ca3645580d085923c9f6c763d9b52df95856d2028533d2cca350261cab06
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: F1118222E5CA0301FA643D67E4D137D9070AF593E0FC80677EA6F162E68E6CA846C131

Function 00007FF7D4C0B390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7D4C0A5A3,?,?,00000000,00007FF7D4C0A83E,?,?,?,?,?,00007FF7D4C0A7CA), ref: 00007FF7D4C0B3AF
FlsSetValue.KERNEL32(?,?,?,00007FF7D4C0A5A3,?,?,00000000,00007FF7D4C0A83E,?,?,?,?,?,00007FF7D4C0A7CA), ref: 00007FF7D4C0B3CE
FlsSetValue.KERNEL32(?,?,?,00007FF7D4C0A5A3,?,?,00000000,00007FF7D4C0A83E,?,?,?,?,?,00007FF7D4C0A7CA), ref: 00007FF7D4C0B3F6
FlsSetValue.KERNEL32(?,?,?,00007FF7D4C0A5A3,?,?,00000000,00007FF7D4C0A83E,?,?,?,?,?,00007FF7D4C0A7CA), ref: 00007FF7D4C0B407
FlsSetValue.KERNEL32(?,?,?,00007FF7D4C0A5A3,?,?,00000000,00007FF7D4C0A83E,?,?,?,?,?,00007FF7D4C0A7CA), ref: 00007FF7D4C0B418

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 6f944022d23edc1c4acf36ee41aa723466f994e0e1af3fb98e05b0010e79b0d5
Instruction ID: fa482daf633637e3f57b1585e942008f61879b83b0966950328d55ea660c7ea4
Opcode Fuzzy Hash: 6f944022d23edc1c4acf36ee41aa723466f994e0e1af3fb98e05b0010e79b0d5
Instruction Fuzzy Hash: AD115C20A0C60241FA58BBA7D5D913DA1419F447E0FD84637EA2D666C6EE6CA5418220

Function 00007FF7D4C0B224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF7D4C0B235
FlsSetValue.KERNEL32 ref: 00007FF7D4C0B254
FlsSetValue.KERNEL32 ref: 00007FF7D4C0B27C
FlsSetValue.KERNEL32 ref: 00007FF7D4C0B28D
FlsSetValue.KERNEL32 ref: 00007FF7D4C0B29E

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: cf61fb6c00b1796c5bed08ecf7b6551a73a14dc995a044f45feadad5ae41d3ad
Instruction ID: a0af070aa7bce752f6e9c92650c2e4d031e17ada67ae5d5b42642c586cab814c
Opcode Fuzzy Hash: cf61fb6c00b1796c5bed08ecf7b6551a73a14dc995a044f45feadad5ae41d3ad
Instruction Fuzzy Hash: 09111824E0920782F958BEA3C4DA57EA1424F457F4FC44737DA3E7A6C2ED6CB4408231

Function 00007FF7D4C05FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C05FDC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C06106
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C061BC

Strings

verbose, xrefs: 00007FF7D4C05FB0

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: 495cfa1e67124da363cbc695c7fa59e9869294893957242aba39fe52abe88d27
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: CE91D332B0864681FB60AE26D49A37DB7A5AF40BD4FC84137DA5D673D6DE3DE4058320

Function 00007FF7D4C0FBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C0FEA7

Part of subcall function 00007FF7D4C07A3C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C07A59

Strings

ccs, xrefs: 00007FF7D4C0FDE2
UTF-16LEUNICODE, xrefs: 00007FF7D4C0FE45
UTF-8, xrefs: 00007FF7D4C0FE26

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction ID: a4f32502f7afffaccdb06ba2aa2a64eaf9a2a5ab373edd4914971697125bded6
Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction Fuzzy Hash: 19819172E0C24285F7657F2BC1D927CB6A0AB11BC4FD54037CA0DA7295CBADE9829721

Function 00007FF7D4BFD648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7D4BFD673
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7D4BFD70A
RtlUnwindEx.KERNEL32 ref: 00007FF7D4BFD764

Strings

csm, xrefs: 00007FF7D4BFD6F1

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction ID: 79a34c4690f907c41517df622cd0856f0807c64ae346ce9f3e54ad59f87f58f3
Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction Fuzzy Hash: 5651A236B1AA828ADB14EF16D084A7CB3D9EB54B98FD04136DA4E47748DF7EE841C710

Function 00007FF7D4BFEED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7D4BFEF37
_CallSETranslator.LIBVCRUNTIME ref: 00007FF7D4BFEF83

Strings

RCC, xrefs: 00007FF7D4BFEF53
MOC, xrefs: 00007FF7D4BFEF4B

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction ID: 5cfae5ff94cc6be98f7c61fb475aed6baed7a502484adb4994519a03e0972092
Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction Fuzzy Hash: BD617132909BC585E760AF26E4803AEFBA0FB95794F844226EB9D03B55DF7DD190CB10

Function 00007FF7D4BFF288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7D4BFF2B0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF7D4BFF398

Strings

csm, xrefs: 00007FF7D4BFF2D2
csm, xrefs: 00007FF7D4BFF3EA

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction ID: 46bd9ef804a1f3e83a9f272f988e7a513c733640019c7b4ba1bbafdba47cee37
Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction Fuzzy Hash: 75517D32A0928286EB74AE2BD0C426CBBE0EB65B84FD44137DA4D47B85CF3EE451C711

Function 00007FF7D4BF7E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF7D4BF352C,?,00000000,00007FF7D4BF3F1B), ref: 00007FF7D4BF7F32

Strings

%s%c, xrefs: 00007FF7D4BF7EA4
\, xrefs: 00007FF7D4BF7E97
%.*s, xrefs: 00007FF7D4BF7EEB

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: a1c59376f93c8b4c6db0aee125681cb96c2ab9e1787ffa8cf6eb7b68f1c1c36c
Instruction ID: f0a57657b9894909c3a38b17ab714d844fff59cd727e0e343778669a090ead79
Opcode Fuzzy Hash: a1c59376f93c8b4c6db0aee125681cb96c2ab9e1787ffa8cf6eb7b68f1c1c36c
Instruction Fuzzy Hash: 0631EC2161AAC145EA21AF12E4907EEA394EF94BE0FC01632EE6D477C5EF3DD5458710

Function 00007FF7D4BF2810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF7D4BF28EA

Strings

Error, xrefs: 00007FF7D4BF28DD
ERROR, xrefs: 00007FF7D4BF286F
[PYI-%d:%ls] , xrefs: 00007FF7D4BF2868

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction ID: 90a1ecb6b30e64e759f2b2bc3457b42b33fef3a678c4e09f7457cb4c774d7604
Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction Fuzzy Hash: 8A21BF62B09B4192E710AF26F8857AEA3A0FB887C0FC04137EA8D53659EE3CD645C750

Function 00007FF7D4C0C5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF7D4C0C61F
WriteFile.KERNEL32 ref: 00007FF7D4C0C8E7
WriteFile.KERNEL32 ref: 00007FF7D4C0C92D
GetLastError.KERNEL32 ref: 00007FF7D4C0C9E3

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction ID: 832b9ead7a8ad2875ec2d5618f2f720c220ce5ed0c0a01933050c067ea5e44e5
Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction Fuzzy Hash: 9BD1F172B08A418AE714DF6AD4842AC77B1FB147D8BC44227DE5DA7BD9DE38D006CB10

Function 00007FF7D4C0CF60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7D4C0CF4B), ref: 00007FF7D4C0D07C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7D4C0CF4B), ref: 00007FF7D4C0D107

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction ID: 7305d066d396f2dacb0782c4ffbb0667c8c025c153e6a497ea54e7706baec015
Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction Fuzzy Hash: 8991B636E1869185F750AF66D4C827DABA0AB44BD8FD44137EE0E67694DF38D442C720

Function 00007FF7D4C0F98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7D4C0FA7C
_get_daylight.LIBCMT ref: 00007FF7D4C0FA8D
_get_daylight.LIBCMT ref: 00007FF7D4C0FA9E
_isindst.LIBCMT ref: 00007FF7D4C0FB69

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction ID: 9d7cbbc14247942d3deb48bbf64635fd5b099ac6d482b955d12edbb94110b580
Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction Fuzzy Hash: C5513772F042118AEB14EF65C9D96BCA761AB043D8FD01237DD1E62AE4DF38A542CB10

Function 00007FF7D4C0577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF7D4C057AF
GetFileInformationByHandle.KERNEL32 ref: 00007FF7D4C05811
GetLastError.KERNEL32 ref: 00007FF7D4C058A2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7D4C056B4), ref: 00007FF7D4C058EE

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction ID: 412731dd1a2170b733001fd064df7abc476d863e38ead39547c95d0a98a1b425
Opcode Fuzzy Hash: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction Fuzzy Hash: 40517D62E086418AFB20EF72D4943BDB7A5AB48B98FD44537DE0D67689DF38D441C720

Function 00007FF7D4C05628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C05655
CreateFileW.KERNEL32 ref: 00007FF7D4C05694
CloseHandle.KERNEL32 ref: 00007FF7D4C056C9

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction ID: 81f46c07dad49079ff3ca9d3e0a2a8fa575d5b3cdb03b445afd4b6b96edc68f6
Opcode Fuzzy Hash: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction Fuzzy Hash: C841A322D2878183E710EF22D59836DA260FB947E4F909337EA5C13AD5DF7CA5E08720

Function 00007FF7D4BF20C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF7D4BF20F4
SetWindowLongPtrW.USER32 ref: 00007FF7D4BF2116
GetWindowLongPtrW.USER32 ref: 00007FF7D4BF2140
InvalidateRect.USER32 ref: 00007FF7D4BF2160

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: c2300b04c215560969d27953d6c78ed5601bc2fbc9608505c44df617557f4c9d
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: D8118A21A1C14242F658AF6BE5C427D92A1EB987C0FC48032DB4D07B99DD3FD5A58624

Function 00007FF7D4C15B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7D4C11760: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C11793

_get_daylight.LIBCMT ref: 00007FF7D4C15C34
_get_daylight.LIBCMT ref: 00007FF7D4C15C45

Strings

?, xrefs: 00007FF7D4C15BC5

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 34aa9ba053483d92f686c00bb3d23c2ed0895a5cb55bf09a4ef316522e0c30cf
Instruction ID: 30065cdb0fe2620c5e18fb7d57c6d315f331896488219b8072ba214ddad8e690
Opcode Fuzzy Hash: 34aa9ba053483d92f686c00bb3d23c2ed0895a5cb55bf09a4ef316522e0c30cf
Instruction Fuzzy Hash: AE41E512A0828286FB64AF27D49577EE6B0EB84BE4FD44237EE5D06AD5DF3CD4418720

Function 00007FF7D4C09014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C09046

Part of subcall function 00007FF7D4C0A948: HeapFree.KERNEL32(?,?,?,00007FF7D4C12D22,?,?,?,00007FF7D4C12D5F,?,?,00000000,00007FF7D4C13225,?,?,?,00007FF7D4C13157), ref: 00007FF7D4C0A95E
Part of subcall function 00007FF7D4C0A948: GetLastError.KERNEL32(?,?,?,00007FF7D4C12D22,?,?,?,00007FF7D4C12D5F,?,?,00000000,00007FF7D4C13225,?,?,?,00007FF7D4C13157), ref: 00007FF7D4C0A968

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF7D4BFCBA5), ref: 00007FF7D4C09064

Strings

C:\Users\user\Desktop\j1gw88aHdL.exe, xrefs: 00007FF7D4C09052

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\j1gw88aHdL.exe
API String ID: 3580290477-3630012993
Opcode ID: 652ac8178d02f9bf502bb0dac840cc2c27021cfa98e1c84195502d2d1921a3a9
Instruction ID: 3dff8463e8264c3f01ff7a9f284275cc49ce5368565a19213fb3ad926cfbaa2d
Opcode Fuzzy Hash: 652ac8178d02f9bf502bb0dac840cc2c27021cfa98e1c84195502d2d1921a3a9
Instruction Fuzzy Hash: 4E417236A08B0286EB15FF26D4C81BDA7A4EF45BD4BD54037E94D53B85DE3DE4818320

Function 00007FF7D4C0CC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF7D4C0CD4F
GetLastError.KERNEL32 ref: 00007FF7D4C0CD71

Strings

U, xrefs: 00007FF7D4C0CCFB

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction ID: fc9b919dccb88e36fbac99816fd51955c1971a7bc3fdf557472f3bc73f3bc5ec
Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction Fuzzy Hash: 6641A222618A4181DB209F26E4883BEA7A0FB987C4FC04133EA4D97794EF3CD441CB50

Function 00007FF7D4C0F5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF7D4C0F5F8
GetCurrentDirectoryW.KERNEL32 ref: 00007FF7D4C0F64A

Strings

:, xrefs: 00007FF7D4C0F60E

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: e8d367c4ea258391d160676196091cc4497c978f166048fd005a5cb1bdaac227
Instruction ID: 2aa43886a07d6dd1d2d2ff897fc8662964f7ef5dd83be91e44f3feda04e534d8
Opcode Fuzzy Hash: e8d367c4ea258391d160676196091cc4497c978f166048fd005a5cb1bdaac227
Instruction Fuzzy Hash: FE21B672A0864181EB20EF16D08827DB3B1FB98BC4FD54137D64D53694DFBCE9858B61

Function 00007FF7D4BFFD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF7D4BFFD98
RaiseException.KERNEL32 ref: 00007FF7D4BFFDD9

Strings

csm, xrefs: 00007FF7D4BFFDC6

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction ID: 6f79bff387d7b1d042fe1bf3c2afe428e880b64ec11f16273393bbc58b1f1f65
Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction Fuzzy Hash: A0115136609B4182DB119F16E48026DB7E4FB88B84F984236DB8D07754DF3DC551CB10

Function 00007FF7D4C1073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7D4C1076C
GetDriveTypeW.KERNEL32 ref: 00007FF7D4C107AC

Strings

:, xrefs: 00007FF7D4C10795

Memory Dump Source

Source File: 00000000.00000002.1386205347.00007FF7D4BF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7D4BF0000, based on PE: true

Associated: 00000000.00000002.1386183045.00007FF7D4BF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386232769.00007FF7D4C1B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C2E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386254291.00007FF7D4C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1386301703.00007FF7D4C34000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7d4bf0000_j1gw88aHdL.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction ID: fc129123845e95f33779db6648b4ce616fdac83e1a37a4ef154992778b061de7
Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction Fuzzy Hash: C1018F2291860286F720BF63E4AA27EA3B0EF487C4FC00437D54D56A85EF2CE5048B34

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report j1gw88aHdL.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: j1gw88aHdL.exePID: 7428, Parent PID: 4056

General

Chronological Activities

Disassembly

Analysis Process: j1gw88aHdL.exePID: 7428, Parent PID: 4056COMMON

Execution Graph

Graph

Executed Functions

Function 00007FF7D4BF1000 Relevance: 60.0, APIs: 6, Strings: 28, Instructions: 509COMMON

Control-flow Graph

Function 00007FF7D4C16964 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON

Control-flow Graph

Function 00007FF7D4BF9280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Control-flow Graph

Windows Analysis Report
j1gw88aHdL.exe

Function 00007FF7D4BF1000 Relevance: 60.0, APIs: 6, Strings: 28, Instructions: 509
COMMON

Function 00007FF7D4C16964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Function 00007FF7D4BF9280 Relevance: 3.0, APIs: 2, Instructions: 29
COMMON

Function 00007FF7D4BF1950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Function 00007FF7D4BF36B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Function 00007FF7D4C0BA5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Function 00007FF7D4BF2710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64
COMMON

Function 00007FF7D4BFCC3C Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Function 00007FF7D4C09A30 Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Function 00007FF7D4C0013C Relevance: 3.2, APIs: 2, Instructions: 177
COMMONLIBRARYCODE

Function 00007FF7D4C0C134 Relevance: 3.0, APIs: 2, Instructions: 46
COMMONLIBRARYCODE

Function 00007FF7D4BF2620 Relevance: 3.0, APIs: 2, Instructions: 38
windowCOMMON

Function 00007FF7D4C0AB58 Relevance: 2.6, APIs: 2, Instructions: 59
COMMON

Function 00007FF7D4C0BEAC Relevance: 1.6, APIs: 1, Instructions: 112
COMMONLIBRARYCODE

Function 00007FF7D4BF7F90 Relevance: 1.6, APIs: 1, Instructions: 85
COMMON