Edit tour

Windows Analysis Report
1fi2LiofgW.exe

Overview

General Information

Sample name:	1fi2LiofgW.exe renamed because original name is a hash value
Original sample name:	0d85f603e33a017ed5067d14eb13954a.exe
Analysis ID:	1581222
MD5:	0d85f603e33a017ed5067d14eb13954a
SHA1:	8d317b1fc2bd28e333ffad3c6fc6b881f2e92939
SHA256:	79033b26b6d11e41e284d9c2702ebb58d32bf044e26fd27e14095f861465f8db
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains an invalid checksum

Program does not show much activity (idle)

Classification

Process Tree

System is w10x64

1fi2LiofgW.exe (PID: 7580 cmdline: "C:\Users\user\Desktop\1fi2LiofgW.exe" MD5: 0D85F603E33A017ED5067D14EB13954A)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1fi2LiofgW.exe

ReversingLabs: Detection: 21%

Source: 1fi2LiofgW.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E91285A0 FindFirstFileExW,FindClose,	0_2_00007FF6E91285A0
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E91279B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF6E91279B0
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E9140B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF6E9140B84

Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E9145C74	0_2_00007FF6E9145C74
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E9121000	0_2_00007FF6E9121000
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E9130A60	0_2_00007FF6E9130A60
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E9148A38	0_2_00007FF6E9148A38
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E9137AAC	0_2_00007FF6E9137AAC
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E9131280	0_2_00007FF6E9131280
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E9128B20	0_2_00007FF6E9128B20
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E91391B0	0_2_00007FF6E91391B0
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E914518C	0_2_00007FF6E914518C
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E913D200	0_2_00007FF6E913D200
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E9130C64	0_2_00007FF6E9130C64
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E9131484	0_2_00007FF6E9131484
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E9132CC4	0_2_00007FF6E9132CC4
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E9140B84	0_2_00007FF6E9140B84
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E913FBD8	0_2_00007FF6E913FBD8
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E91373F4	0_2_00007FF6E91373F4
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E91433BC	0_2_00007FF6E91433BC
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E9130E70	0_2_00007FF6E9130E70
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E9142F20	0_2_00007FF6E9142F20
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E9145728	0_2_00007FF6E9145728
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E9131F30	0_2_00007FF6E9131F30
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E913FBD8	0_2_00007FF6E913FBD8
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E9144F10	0_2_00007FF6E9144F10
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E913CD6C	0_2_00007FF6E913CD6C
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E91295FB	0_2_00007FF6E91295FB
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E9131074	0_2_00007FF6E9131074
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E9135040	0_2_00007FF6E9135040
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E913D880	0_2_00007FF6E913D880
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E91328C0	0_2_00007FF6E91328C0
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E912979B	0_2_00007FF6E912979B
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E9129FCD	0_2_00007FF6E9129FCD

Source: C:\Users\user\Desktop\1fi2LiofgW.exe

Code function: String function: 00007FF6E91225F0 appears 50 times

Source: classification engine

Classification label: mal48.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\1fi2LiofgW.exe

Code function: 0_2_00007FF6E91229E0 GetLastError,FormatMessageW,MessageBoxW,

0_2_00007FF6E91229E0

Source: 1fi2LiofgW.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\1fi2LiofgW.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1fi2LiofgW.exe

ReversingLabs: Detection: 21%

Source: C:\Users\user\Desktop\1fi2LiofgW.exe

File read: C:\Users\user\Desktop\1fi2LiofgW.exe

Jump to behavior

Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Section loaded: wintypes.dll	Jump to behavior

Source: 1fi2LiofgW.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 1fi2LiofgW.exe

Static file information: File size 9696768 > 1048576

Source: 1fi2LiofgW.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 1fi2LiofgW.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 1fi2LiofgW.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 1fi2LiofgW.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 1fi2LiofgW.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 1fi2LiofgW.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 1fi2LiofgW.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: 1fi2LiofgW.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: 1fi2LiofgW.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 1fi2LiofgW.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 1fi2LiofgW.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 1fi2LiofgW.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 1fi2LiofgW.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: 1fi2LiofgW.exe

Static PE information: real checksum: 0x1847e96 should be: 0x947f94

Source: C:\Users\user\Desktop\1fi2LiofgW.exe

Code function: 0_2_00007FF6E9126EA0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF6E9126EA0

Source: C:\Users\user\Desktop\1fi2LiofgW.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-17552

Source: C:\Users\user\Desktop\1fi2LiofgW.exe

API coverage: 6.4 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E91285A0 FindFirstFileExW,FindClose,	0_2_00007FF6E91285A0
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E91279B0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00007FF6E91279B0
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E9140B84 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF6E9140B84

Source: C:\Users\user\Desktop\1fi2LiofgW.exe

Code function: 0_2_00007FF6E912C44C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6E912C44C

Source: C:\Users\user\Desktop\1fi2LiofgW.exe

Code function: 0_2_00007FF6E9142790 GetProcessHeap,

0_2_00007FF6E9142790

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E912C44C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6E912C44C
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E912BBC0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6E912BBC0
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E912C62C SetUnhandledExceptionFilter,	0_2_00007FF6E912C62C
Source: C:\Users\user\Desktop\1fi2LiofgW.exe	Code function: 0_2_00007FF6E9139924 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6E9139924

Source: C:\Users\user\Desktop\1fi2LiofgW.exe

Code function: 0_2_00007FF6E9148880 cpuid

0_2_00007FF6E9148880

Source: C:\Users\user\Desktop\1fi2LiofgW.exe

Code function: 0_2_00007FF6E912C330 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6E912C330

Source: C:\Users\user\Desktop\1fi2LiofgW.exe

Code function: 0_2_00007FF6E914518C _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF6E914518C

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 DLL Side-Loading	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1fi2LiofgW.exe	21%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581222
Start date and time:	2024-12-27 08:46:00 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1fi2LiofgW.exe renamed because original name is a hash value
Original Sample Name:	0d85f603e33a017ed5067d14eb13954a.exe
Detection:	MAL
Classification:	mal48.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 20 Number of non-executed functions: 83
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: 1fi2LiofgW.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0035.t-0009.t-msedge.net	zi042476Iv.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	54861 Proforma Invoice AMC2273745.xlam.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.63
	TAX INVOICE - NBO2506000632.xlam.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.63
	installer.bat	Get hash	malicious	Vidar	Browse	13.107.246.63
	din.exe	Get hash	malicious	Vidar	Browse	13.107.246.63
	lem.exe	Get hash	malicious	Vidar	Browse	13.107.246.63
	atw3.dll	Get hash	malicious	Gozi, Ursnif	Browse	13.107.246.63
	WRD1792.docx.doc	Get hash	malicious	Dynamer	Browse	13.107.246.63
	0zBsv1tnt4.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	pVbAZEFIpI.exe	Get hash	malicious	LummaC	Browse	13.107.246.63

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.99292771027448
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	1fi2LiofgW.exe
File size:	9'696'768 bytes
MD5:	0d85f603e33a017ed5067d14eb13954a
SHA1:	8d317b1fc2bd28e333ffad3c6fc6b881f2e92939
SHA256:	79033b26b6d11e41e284d9c2702ebb58d32bf044e26fd27e14095f861465f8db
SHA512:	f97f505d93e119bbdc7bf806bbd9530da2a77fae8c48e23135b7fe67a0e2f55497d198b45a11905f0855a3f27d7633ba8c779746e46c5a7353679074431c9ead
SSDEEP:	196608:P/EkQuj27vgKaVx0sKYu/PaQts8v1kZ5R8yqEDPzMV:nEkQnvgKeQtss27CyDe
TLSH:	52A63347139209A2EA50513E400186295732BC41377CF7FB5B38F9791FBFEAEAA65B01
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Xhc.Xhc.Xhc...`._hc...f..hc...g.Rhc.....[hc...`.Qhc...g.Ihc...f.phc...b.Shc.Xhb..hc.K.g.Ahc.K.a.Yhc.RichXhc.........PE..d..

File Icon


Icon Hash:	44b27170b2706807

Static PE Info

General

Entrypoint:	0x14000c0d0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66B0ECA1 [Mon Aug 5 15:15:45 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	456e8615ad4320c9f54e50319a19df9c

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FCA655BCB0Ch
dec eax
add esp, 28h
jmp 00007FCA655BC72Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007FCA655BCED8h
test eax, eax
je 00007FCA655BC8D3h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007FCA655BC8B7h
dec eax
cmp ecx, eax
je 00007FCA655BC8C6h
xor eax, eax
dec eax
cmpxchg dword ptr [0003843Ch], ecx
jne 00007FCA655BC8A0h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007FCA655BC8A9h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007FCA655BC8B9h
mov byte ptr [00038425h], 00000001h
call 00007FCA655BC005h
call 00007FCA655BD2F0h
test al, al
jne 00007FCA655BC8B6h
xor al, al
jmp 00007FCA655BC8C6h
call 00007FCA655C9DFFh
test al, al
jne 00007FCA655BC8BBh
xor ecx, ecx
call 00007FCA655BD300h
jmp 00007FCA655BC89Ch
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [000383ECh], 00000000h
mov ebx, ecx
jne 00007FCA655BC919h
cmp ecx, 01h
jnbe 00007FCA655BC91Ch
call 00007FCA655BCE4Eh
test eax, eax
je 00007FCA655BC8DAh
test ebx, ebx
jne 00007FCA655BC8D6h
dec eax
lea ecx, dword ptr [000383D6h]
call 00007FCA655C9BF2h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3c76c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x49000	0xce34	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x46000	0x2208	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x56000	0x768	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x39dc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x39c80	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x450	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29210	0x29400	aca64598002ecff9eefbc96554edf015	False	0.5511067708333334	data	6.4784482217419175	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12642	0x12800	66146420f548cf2acca472542a84c0d8	False	0.5245460304054054	data	5.750861752432239	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x73d8	0xe00	d0a288978c66419b180b35f625b6dce7	False	0.13532366071428573	data	1.8378139998458343	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x46000	0x2208	0x2400	74cf3ea22e0a1756984435d6f80f7da5	False	0.4671223958333333	data	5.259201915045256	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x49000	0xce34	0xd000	d717912eb54292316bc235b3159acb50	False	0.042367788461538464	data	3.816041843179243	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x56000	0x768	0x800	71de9271648326ec88350e903470cf3e	False	0.5576171875	data	5.283119454571673	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x490e8	0xc828	Device independent bitmap graphic, 128 x 256 x 24, image size 51200	0.02777127244340359
RT_GROUP_ICON	0x55910	0x14	data	1.15
RT_MANIFEST	0x55924	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	GetACP, IsValidCodePage, GetStringTypeW, GetFileAttributesExW, SetEnvironmentVariableW, FlushFileBuffers, GetCurrentDirectoryW, GetOEMCP, GetCPInfo, GetModuleHandleW, MulDiv, GetLastError, FormatMessageW, GetModuleFileNameW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, CreateDirectoryW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, GetEnvironmentStringsW, FindClose, FindFirstFileW, FindNextFileW, GetDriveTypeW, RemoveDirectoryW, GetTempPathW, CloseHandle, WaitForSingleObject, Sleep, GetCurrentProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, LocalFree, SetConsoleCtrlHandler, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, HeapReAlloc, WriteConsoleW, SetEndOfFile, DeleteFileW, IsProcessorFeaturePresent, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Network Behavior

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 27, 2024 08:46:50.520677090 CET	1.1.1.1	192.168.2.9	0xffa2	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 27, 2024 08:46:50.520677090 CET	1.1.1.1	192.168.2.9	0xffa2	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	02:46:53
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\1fi2LiofgW.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\1fi2LiofgW.exe"
Imagebase:	0x7ff6e9120000
File size:	9'696'768 bytes
MD5 hash:	0D85F603E33A017ED5067D14EB13954A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	25

Executed Functions

Function 00007FF6E9121000 Relevance: 40.6, APIs: 5, Strings: 18, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF6E9123905
Failed to convert DLL search path!, xrefs: 00007FF6E91238A3
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF6E912391A
pkg, xrefs: 00007FF6E91237CF
pyi-runtime-tmpdir, xrefs: 00007FF6E91235D3
_MEIPASS2, xrefs: 00007FF6E91236A2, 00007FF6E91236AE, 00007FF6E91239AC
Could not create temporary directory!, xrefs: 00007FF6E9123838
WARNING: failed to remove temporary directory: %s, xrefs: 00007FF6E9123A31
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF6E912378C
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF6E9123653
Failed to start splash screen!, xrefs: 00007FF6E9123933
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF6E91237EF
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF6E9123820
pyi-disable-windowed-traceback, xrefs: 00007FF6E912361D
ERROR: failed to remove temporary directory: %s, xrefs: 00007FF6E9123A12
pyi-contents-directory, xrefs: 00007FF6E91235F8
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF6E91236FC
MEI, xrefs: 00007FF6E912374E

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: FileModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$ERROR: failed to remove temporary directory: %s$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$MEI$PYINSTALLER_STRICT_UNPACK_MODE$Path exceeds PYI_PATH_MAX limit.$WARNING: failed to remove temporary directory: %s$_MEIPASS2$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-runtime-tmpdir
API String ID: 514040917-585287483
Opcode ID: ec9c6756989ef5fd9ea5977df3e9171bdd9129db5db0c6cc95fad3a29ce92e3f
Instruction ID: 3fbb25fdfdd975bca5c8ef5d1985caef85a14086cad3790b2e19eb8120948467
Opcode Fuzzy Hash: ec9c6756989ef5fd9ea5977df3e9171bdd9129db5db0c6cc95fad3a29ce92e3f
Instruction Fuzzy Hash: E2F19023B0C68291FA18EF21D5543F96261AF56B84F844032DE1DC36D6EF3EE556E30A

Function 00007FF6E9145C74 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6E91459A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E91459E9
Part of subcall function 00007FF6E91459A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9145A67
Part of subcall function 00007FF6E91459A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9145AB8

CreateFileW.KERNELBASE ref: 00007FF6E9145D7A
CreateFileW.KERNEL32 ref: 00007FF6E9145DCA
GetLastError.KERNEL32 ref: 00007FF6E9145DFA
GetFileType.KERNELBASE ref: 00007FF6E9145E0F
GetLastError.KERNEL32 ref: 00007FF6E9145E19
CloseHandle.KERNEL32 ref: 00007FF6E9145E4C
CloseHandle.KERNEL32 ref: 00007FF6E9145FAF
CreateFileW.KERNEL32 ref: 00007FF6E9145FE4
GetLastError.KERNEL32 ref: 00007FF6E9145FF3

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
Instruction ID: 5543846b9053a2525dbe9d10dee74c2ffd2ad5b6ab43ecca1171954e0b07d056
Opcode Fuzzy Hash: a69f399e4b06a5e248c6b703f60b2f721b94672e004abf856287656fc91ee5b6
Instruction Fuzzy Hash: 0EC1AE37B28A4686EB10CF69C4907AC3771FB49BA8B011235DA2E977D5CF3AE452C705

Function 00007FF6E91285A0 Relevance: 3.0, APIs: 2, Instructions: 29
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF6E91285D3
FindClose.KERNELBASE ref: 00007FF6E91285E2

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
Instruction ID: 60c9442fda6edfa452fe0b2455528178d2d86188e459c76f57f0df0e3ad2e1b6
Opcode Fuzzy Hash: ca66ee6ee850f25a53d0c9653a43f1313d0231bc46844eb151e3c2d0b1a3e355
Instruction Fuzzy Hash: 37F0C823A1C64186F7609F60B4483EA73A0BF45728F440335D96E826D4CF3DD0599A09

Function 00007FF6E91218F0 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6E91276A0: _fread_nolock.LIBCMT ref: 00007FF6E912774A

_fread_nolock.LIBCMT ref: 00007FF6E91219B4

Part of subcall function 00007FF6E9122760: MessageBoxW.USER32 ref: 00007FF6E912283B

Strings

calloc, xrefs: 00007FF6E91219F5
Failed to read cookie!, xrefs: 00007FF6E91219BF
Could not allocate buffer for TOC!, xrefs: 00007FF6E9121AA1
fseek, xrefs: 00007FF6E9121990
malloc, xrefs: 00007FF6E9121AA8
Error on file., xrefs: 00007FF6E9121B0A
fread, xrefs: 00007FF6E91219C6, 00007FF6E9121ADB
Failed to seek to cookie position!, xrefs: 00007FF6E9121989
Could not allocate memory for archive structure!, xrefs: 00007FF6E91219EE
Could not read full TOC!, xrefs: 00007FF6E9121AD4
MEI, xrefs: 00007FF6E9121931

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: _fread_nolock$Message
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 677216364-3497178890
Opcode ID: 13a0f64d29e36a252706f5b53b21b28111f50ffc545313b1ad9e8f0af8fc9de4
Instruction ID: 20a06976d6e0f6f18a37cac898949656659c4bb6d650f1d5dbfdb818c8d4bc54
Opcode Fuzzy Hash: 13a0f64d29e36a252706f5b53b21b28111f50ffc545313b1ad9e8f0af8fc9de4
Instruction Fuzzy Hash: 1071A133A0C68689EB20EF24E4503F923A1FF4A784F544035D98DC7799EE3EE5459B0A

Function 00007FF6E913AD6C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E913B199

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 68a47ba86f230bb5d63a3bd262fc543bc7d5861b4e9f61d57eff9af495398285
Instruction ID: 94a94b7cc87061b62a86ed71fb26107f4ee75ebb704728b755cfbc9d8c5b155a
Opcode Fuzzy Hash: 68a47ba86f230bb5d63a3bd262fc543bc7d5861b4e9f61d57eff9af495398285
Instruction Fuzzy Hash: 28C1E323A0C686A1E660DF3594483FD3BB4FF91B80F160131DA5E83791DE7EE855830A

Function 00007FF6E91233E0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF6E9123534), ref: 00007FF6E9123411

Part of subcall function 00007FF6E91229E0: GetLastError.KERNEL32(?,?,?,00007FF6E912342E,?,00007FF6E9123534), ref: 00007FF6E9122A14
Part of subcall function 00007FF6E91229E0: FormatMessageW.KERNEL32(?,?,?,00007FF6E912342E), ref: 00007FF6E9122A7D
Part of subcall function 00007FF6E91229E0: MessageBoxW.USER32 ref: 00007FF6E9122ACF

Strings

Failed to convert executable path to UTF-8., xrefs: 00007FF6E91234B8
Failed to obtain executable path., xrefs: 00007FF6E912341B
GetModuleFileNameW, xrefs: 00007FF6E9123422
\\?\, xrefs: 00007FF6E9123482
Failed to resolve full path to executable %ls., xrefs: 00007FF6E9123461

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: Message$ErrorFileFormatLastModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 517058245-2863816727
Opcode ID: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
Instruction ID: dabae9fc2de49ad6c2dc478125e87b92e55b859e2b44f7a35cf8d3ba266dd82b
Opcode Fuzzy Hash: 4333ea13b7f7892cb13c7834fe0fbc8b7cb0659b0560af6bfa7ef98de9a8054c
Instruction Fuzzy Hash: FB219223B0C68291FE26AF24E8153FA6250BF4A784F800532DA5DC75D5EE3EE106D70A

Function 00007FF6E91225F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6E91286B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6E9123FA4,00000000,00007FF6E9121925), ref: 00007FF6E91286E9

MessageBoxW.USER32 ref: 00007FF6E9122686
MessageBoxA.USER32 ref: 00007FF6E912269A

Strings

Error/warning (ANSI fallback), xrefs: 00007FF6E912268E
Error, xrefs: 00007FF6E9122677

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error$Error/warning (ANSI fallback)
API String ID: 1878133881-653037927
Opcode ID: f4c9aea142df8fc367965a88b37001c6795115f60fce42f8f88369c54fa23369
Instruction ID: d37c25e4d5e0d3dc2c50ef1bd7f5d862aec34397033415eb3949735feca3ee8a
Opcode Fuzzy Hash: f4c9aea142df8fc367965a88b37001c6795115f60fce42f8f88369c54fa23369
Instruction Fuzzy Hash: 76118B73628A8581FA249F10F451BED3364FF48B88F901136DA5C87644DF3ED60ACB09

Function 00007FF6E912BF5C Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6E912C12C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6E912C140

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6E912BF80
__scrt_release_startup_lock.LIBCMT ref: 00007FF6E912BFEE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6E912C041

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
Instruction ID: ad97e1577449036e35cb59f8c3c83838538fc5c683c5c5bf3c554f97d4c4ed47
Opcode Fuzzy Hash: 51e2e4cc4e0defacebf1dac919e01b91b6d5e84f1fe25dd37a2b49ce45fe95ab
Instruction Fuzzy Hash: 73314927E4C64341FA25BF6494163FA2291AF46788F4400B5FA0EC72D3DE3FA905A65F

Function 00007FF6E9138D48 Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6E9138D44), ref: 00007FF6E9138D59
TerminateProcess.KERNEL32(?,?,?,00007FF6E9138D44), ref: 00007FF6E9138D64
ExitProcess.KERNEL32 ref: 00007FF6E9138D73

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 824606f6feba241c18d37bd9947fb033388d99e3127919417550cde66a1966b4
Instruction ID: 251f7384ff0893be073fc70fcf2d4da864bb500d9b8f338052363c7c57d9a4f8
Opcode Fuzzy Hash: 824606f6feba241c18d37bd9947fb033388d99e3127919417550cde66a1966b4
Instruction Fuzzy Hash: D3D09E12F5960687EB547F716C5D3FD12215F5C705F152478D84BC6393CD2EA80E4A4A

Function 00007FF6E912F45C Relevance: 3.2, APIs: 2, Instructions: 177
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E912F4A0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E912F597

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9ca15b9002a87b72fd1966d073ee072d8ab2af6885046d3198ed673a4b76404c
Instruction ID: 8d2e68b80aab4f757ae466348cbfca103c4000a2d8fb6be20698f532e334d9dd
Opcode Fuzzy Hash: 9ca15b9002a87b72fd1966d073ee072d8ab2af6885046d3198ed673a4b76404c
Instruction Fuzzy Hash: 5B51F723B092C246FA28AE3694007FA6291FF47BB4F144734DD6D877D5CE3ED481A60A

Function 00007FF6E913B444 Relevance: 3.0, APIs: 2, Instructions: 46
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF6E913B5DD), ref: 00007FF6E913B490
GetLastError.KERNEL32(?,?,?,?,?,00007FF6E913B5DD), ref: 00007FF6E913B49A

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
Instruction ID: 4879f91f8e41848f10b6aac4b3b898c4156492b843eb448d0f2695323bd3eaa3
Opcode Fuzzy Hash: cd3a9f3ea8ef265e1697b25d2233ff7099ae2ab5e22e5ab4fa41e006c1c379b1
Instruction Fuzzy Hash: 7211BF62B18A8181DA10CF25A8482B96361AF44BF4F584331EE7E877EADE3DD0518709

Function 00007FF6E9139E68 Relevance: 2.6, APIs: 2, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF6E9139CE5,?,?,00000000,00007FF6E9139D9A), ref: 00007FF6E9139ED6
GetLastError.KERNEL32(?,?,?,00007FF6E9139CE5,?,?,00000000,00007FF6E9139D9A), ref: 00007FF6E9139EE0

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
Instruction ID: acf613137e6bbd57f77c48791d4bfb50fed78a904024dc09bd65c107c9b2907d
Opcode Fuzzy Hash: 65da2f67be20623dd6870cbeabcb199f1b77c363b63baf0d8a802715797da709
Instruction Fuzzy Hash: D221A423F1C68281FF50DF71A5883FD26A15F84BA0F1A4235D92EC73D2CE6EA441830A

Function 00007FF6E913B1BC Relevance: 1.6, APIs: 1, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E913B1E4

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: aa739a885bc1dd54b6575df94a709b393c0322d321e92581108345db9e2bb901
Instruction ID: 7b7c67425e61d0fed183fc0bde65a048e77c50011f208cb14b5b8dff6205201d
Opcode Fuzzy Hash: aa739a885bc1dd54b6575df94a709b393c0322d321e92581108345db9e2bb901
Instruction Fuzzy Hash: 6241AF33A4820187EA24DE26A5493BD77B0EF56B80F150231DA9EC76D1DF3EE502C75A

Function 00007FF6E91276A0 Relevance: 1.6, APIs: 1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fread_nolock.LIBCMT ref: 00007FF6E912774A

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 3d01016cc9a5f4d9cb71fb7abf1551689f881e3384e479ff43f26caf71626a79
Instruction ID: b639939db64826948491266bf980cd78ccda506bc6a6501f75904ca36e63d103
Opcode Fuzzy Hash: 3d01016cc9a5f4d9cb71fb7abf1551689f881e3384e479ff43f26caf71626a79
Instruction Fuzzy Hash: 2A219422B0875146FA10BE56A9083FAA691BF47BD4F884430EE0D87786DE7EF041D709

Function 00007FF6E913AC4C Relevance: 1.6, APIs: 1, Instructions: 79
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E913ACD2

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 49c1b702f419c8ad0ef71248902cf9a0cc608428026b1214a1a74e14a7199740
Instruction ID: d465d4727ce89c3d5a885839236c57e88faba70242a0dbd3f95cbd3fb11d9fa9
Opcode Fuzzy Hash: 49c1b702f419c8ad0ef71248902cf9a0cc608428026b1214a1a74e14a7199740
Instruction Fuzzy Hash: D1319C23A1865292E611DF3588493FD7674AF50BA1F420235DA6D833D2CEBEA441831A

Function 00007FF6E9138C79 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6E9138CA7

Part of subcall function 00007FF6E9138DA0: GetModuleHandleExW.KERNEL32 ref: 00007FF6E9138DC5
Part of subcall function 00007FF6E9138DA0: GetProcAddress.KERNEL32 ref: 00007FF6E9138DDB
Part of subcall function 00007FF6E9138DA0: FreeLibrary.KERNEL32 ref: 00007FF6E9138E02

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: ce8bbb5f42c0c70f8d6cb0f644a2b9beff4cd55938d93e86477bcb8353de4fc0
Instruction ID: c95db6578b1277c94c142947f539c6f3f2af91e0e0a6edc9fb236c568a98a7b3
Opcode Fuzzy Hash: ce8bbb5f42c0c70f8d6cb0f644a2b9beff4cd55938d93e86477bcb8353de4fc0
Instruction Fuzzy Hash: F6218932A156068AEB24DF74C4483EC33B0FF04358F45467AD62C86AC9EF39E484CB45

Function 00007FF6E91352A4 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9135209

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
Instruction ID: e085fde3e9dd35f737000a71c87da4f90464d842c0096a5c822e2996a75b30cc
Opcode Fuzzy Hash: c73ce0dbb369862aa70d4e112b5ce78fdf9595fecbc559d5a15d5b25d9b89295
Instruction Fuzzy Hash: CD119623A1C68181FA60DF6194043FEA6B4AF55F80F464031EA4DD7796CF3ED440874A

Function 00007FF6E9145664 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9145687

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
Instruction ID: cfbf77d66eec9b2cd514abfeefcbc7ab769243ea8e17efd58ff96e2f438e9fae
Opcode Fuzzy Hash: eb818cef5f83307f6059fb404af21ab2d8804f19963bc1c1518551d96bb4d1ba
Instruction Fuzzy Hash: 3321A73361868286DB618F28D4403BD76A1EF88B98F544234E65DCB6D9DF3ED411CF05

Function 00007FF6E912F6DC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E912F730

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
Instruction ID: f55fa50e02874d2561b42a705d6d5c2f23472505b409a36fd151f05f8c7faa3d
Opcode Fuzzy Hash: 1d48df8ff45913ef4d2fe20e3a196162e4d6dc571d0fb1b63797b01b1d6529e7
Instruction Fuzzy Hash: 31010822A087C240E900EF6258012F9A6A5FF57FE0F084230DE5C83BD6DE3ED0428305

Function 00007FF6E913C90C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF6E912FFB0,?,?,?,00007FF6E913161A,?,?,?,?,?,00007FF6E9132E09), ref: 00007FF6E913C94A

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
Instruction ID: 844c4d725e84efb45c50056db443f30521c08a81dc0292d89846262aba880b02
Opcode Fuzzy Hash: b18cfb789f6bc806f768d700ed4d2a41d5d7e56d76a43a128583cd408f8141a4
Instruction Fuzzy Hash: 39F05813F1824784FE14AFB258193F912A05F99BA0F0B4630DC2EC62C2DE2EA481861B

Non-executed Functions

Function 00007FF6E9126EA0 Relevance: 119.3, APIs: 33, Strings: 35, Instructions: 280libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6E9126EB7
GetProcAddress.KERNEL32 ref: 00007FF6E9126EFD
GetProcAddress.KERNEL32 ref: 00007FF6E9126F22
GetProcAddress.KERNEL32 ref: 00007FF6E9126F47
GetProcAddress.KERNEL32 ref: 00007FF6E9126F6F
GetProcAddress.KERNEL32 ref: 00007FF6E9126F97
GetProcAddress.KERNEL32 ref: 00007FF6E9126FBF
GetProcAddress.KERNEL32 ref: 00007FF6E9126FE7
GetProcAddress.KERNEL32 ref: 00007FF6E912700F

Strings

Tcl_Free, xrefs: 00007FF6E9127375, 00007FF6E9127391
Failed to get address for %hs, xrefs: 00007FF6E9126ED0
Tcl_MutexFinalize, xrefs: 00007FF6E91270A5, 00007FF6E91270C1
Tcl_EvalEx, xrefs: 00007FF6E91272FD, 00007FF6E9127319
Tcl_ConditionFinalize, xrefs: 00007FF6E91270CD, 00007FF6E91270E9
Tcl_ThreadQueueEvent, xrefs: 00007FF6E9127145, 00007FF6E9127161
Tcl_SetVar2, xrefs: 00007FF6E91271BD, 00007FF6E91271D9
Tcl_ConditionNotify, xrefs: 00007FF6E91270F5, 00007FF6E9127111
Tcl_FindExecutable, xrefs: 00007FF6E9126F18, 00007FF6E9126F34
Tcl_NewStringObj, xrefs: 00007FF6E9127235, 00007FF6E9127251
Tcl_ConditionWait, xrefs: 00007FF6E912711D, 00007FF6E9127139
Tcl_CreateThread, xrefs: 00007FF6E9126FDD, 00007FF6E9126FF9
Tcl_Alloc, xrefs: 00007FF6E912734D, 00007FF6E9127369
Tcl_EvalObjv, xrefs: 00007FF6E9127325, 00007FF6E9127341
Tcl_MutexUnlock, xrefs: 00007FF6E912707D, 00007FF6E9127099
Tcl_CreateObjCommand, xrefs: 00007FF6E91271E5, 00007FF6E9127201
Tcl_GetObjResult, xrefs: 00007FF6E91272AD, 00007FF6E91272C9
Tcl_EvalFile, xrefs: 00007FF6E91272D5, 00007FF6E91272F1
Tcl_DeleteInterp, xrefs: 00007FF6E9126FB5, 00007FF6E9126FD1
Tcl_NewByteArrayObj, xrefs: 00007FF6E912725D, 00007FF6E9127279
Tcl_SetVar2Ex, xrefs: 00007FF6E9127285, 00007FF6E91272A1
Tcl_MutexLock, xrefs: 00007FF6E9127055, 00007FF6E9127071
Tcl_CreateInterp, xrefs: 00007FF6E9126EF3, 00007FF6E9126F0F
Tcl_GetVar2, xrefs: 00007FF6E9127195, 00007FF6E91271B1
Tcl_ThreadAlert, xrefs: 00007FF6E912716D, 00007FF6E9127189
Tcl_Finalize, xrefs: 00007FF6E9126F65, 00007FF6E9126F81
Tcl_JoinThread, xrefs: 00007FF6E912702D, 00007FF6E9127049
Tcl_GetString, xrefs: 00007FF6E912720D, 00007FF6E9127229
Tcl_GetCurrentThread, xrefs: 00007FF6E9127005, 00007FF6E9127021
GetProcAddress, xrefs: 00007FF6E9126ED7
Tcl_DoOneEvent, xrefs: 00007FF6E9126F3D, 00007FF6E9126F59
Tk_Init, xrefs: 00007FF6E912739D, 00007FF6E91273B9
Tcl_FinalizeThread, xrefs: 00007FF6E9126F8D, 00007FF6E9126FA9
Tcl_Init, xrefs: 00007FF6E9126EB0, 00007FF6E9126EC9
Tk_GetNumMainWindows, xrefs: 00007FF6E91273C5, 00007FF6E91273E1

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-3427451314
Opcode ID: ea7dfca1e90abb6d4d8c6eb1b798acaf406610e772db9aaa2d8df727af0780f5
Instruction ID: 1e7a7081ac91dd26dde2bf12a668a202fa7db208bca814946695ef036ebf854a
Opcode Fuzzy Hash: ea7dfca1e90abb6d4d8c6eb1b798acaf406610e772db9aaa2d8df727af0780f5
Instruction Fuzzy Hash: 02E1BB6AA1DB4390FE15EF15A8103F82365AF19795F841036C80EC72A4EF3EB54AD64B

Function 00007FF6E91433BC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF6E914340A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9143A76
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9143BEC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9143EAA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E91440CA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9144307
memcpy_s.LIBCPMT ref: 00007FF6E91443E2
memcpy_s.LIBCPMT ref: 00007FF6E914448D
memcpy_s.LIBCPMT ref: 00007FF6E914455C

Strings

1#IND, xrefs: 00007FF6E91434F7
1#QNAN, xrefs: 00007FF6E9143523
1#INF, xrefs: 00007FF6E9143533
1#SNAN, xrefs: 00007FF6E914351A

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 006b587dceb6a8e5448b800068f928c3aefb42c20130fc8eaa47f3b19415637c
Instruction ID: 3e46270a8935c51dbafef238f6986096da863c5114d37baec1e7db995a94d6d1
Opcode Fuzzy Hash: 006b587dceb6a8e5448b800068f928c3aefb42c20130fc8eaa47f3b19415637c
Instruction Fuzzy Hash: 10B2C073A182828AE7258E64D5407FD37A2FF5878CF505135DA0A97B84DF3AAA02CF45

Function 00007FF6E91279B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00007FF6E9127EF9,00007FF6E91239E6), ref: 00007FF6E9127A1B
RemoveDirectoryW.KERNEL32(?,00007FF6E9127EF9,00007FF6E91239E6), ref: 00007FF6E9127A9E
DeleteFileW.KERNEL32(?,00007FF6E9127EF9,00007FF6E91239E6), ref: 00007FF6E9127ABD
FindNextFileW.KERNEL32(?,00007FF6E9127EF9,00007FF6E91239E6), ref: 00007FF6E9127ACB
FindClose.KERNEL32(?,00007FF6E9127EF9,00007FF6E91239E6), ref: 00007FF6E9127ADC
RemoveDirectoryW.KERNEL32(?,00007FF6E9127EF9,00007FF6E91239E6), ref: 00007FF6E9127AE5

Strings

%s\*, xrefs: 00007FF6E91279E2

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 37c75c647de740c4d03e434983ba542f23ef98c0d39288f6f50529afbb256bed
Instruction ID: 3d84b7b7f79e2f315e449afa7cd98b484fa9a1f4b46e8e4d655a98224d03d193
Opcode Fuzzy Hash: 37c75c647de740c4d03e434983ba542f23ef98c0d39288f6f50529afbb256bed
Instruction Fuzzy Hash: 71418323A0C64291EA20AF24E4447FE6360FF99764F440632D55EC36C4DF3EE64A9B0A

Function 00007FF6E9129FCD Relevance: 12.0, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

invalid distances set, xrefs: 00007FF6E912A4C0
invalid bit length repeat, xrefs: 00007FF6E912A3B9
invalid code -- missing end-of-block, xrefs: 00007FF6E912A3E6
invalid literal/lengths set, xrefs: 00007FF6E912A453
invalid distance too far back, xrefs: 00007FF6E912A990
invalid literal/length code, xrefs: 00007FF6E912A702
too many length or distance symbols, xrefs: 00007FF6E912A166
invalid code lengths set, xrefs: 00007FF6E912A14D
invalid distance code, xrefs: 00007FF6E912A8D4

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 7289e34dee421d23927a0f8f8a094fde9ef8b8d5e9feb20e52711e481e6fcba8
Instruction ID: 48944cf453cc0ce19a10167cdfeef86c3199e8098debcd0e72ba034e0dd47d22
Opcode Fuzzy Hash: 7289e34dee421d23927a0f8f8a094fde9ef8b8d5e9feb20e52711e481e6fcba8
Instruction Fuzzy Hash: D352E073A186A68BE7949F14C558BBE3BA9EF85340F014139E64A877C0DF3ED840DB45

Function 00007FF6E912C44C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6E912C468
RtlCaptureContext.KERNEL32 ref: 00007FF6E912C495
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6E912C4AF
RtlVirtualUnwind.KERNEL32 ref: 00007FF6E912C4F0
IsDebuggerPresent.KERNEL32 ref: 00007FF6E912C544
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6E912C561
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6E912C56C

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
Instruction ID: 1f62dc9675f082946408421ef1187b590d3e875cf2426d1abbfd2a57b228545a
Opcode Fuzzy Hash: 59201671b846c18328c4c6cdbad1e823a2b0fec8eaed916d44c3dc4e1cb48f19
Instruction Fuzzy Hash: D2314C73608B8186EB609F60E8807EE7360FB89748F44403ADB4E87B95DF39D549CB19

Function 00007FF6E91229E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6E912342E,?,00007FF6E9123534), ref: 00007FF6E9122A14
FormatMessageW.KERNEL32(?,?,?,00007FF6E912342E), ref: 00007FF6E9122A7D
MessageBoxW.USER32 ref: 00007FF6E9122ACF

Strings

<FormatMessageW failed.>, xrefs: 00007FF6E9122A83
%ls%ls: %ls, xrefs: 00007FF6E9122A96
Error, xrefs: 00007FF6E9122ABE

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: Message$ErrorFormatLast
String ID: %ls%ls: %ls$<FormatMessageW failed.>$Error
API String ID: 3971115935-1149178304
Opcode ID: 0ded6d4e5eeb2df7dd6c32992adf891535d6bffb348d119068df09e90069f5ad
Instruction ID: 9296204f7f9fc91b02b92a6d0eee241de50fcfcb2cbdd9ea73282e989c2fe1eb
Opcode Fuzzy Hash: 0ded6d4e5eeb2df7dd6c32992adf891535d6bffb348d119068df09e90069f5ad
Instruction Fuzzy Hash: 52216B73608A8182E7209F51F4407EA73A4FF89788F400136EACD93A98DF3DD246CB49

Function 00007FF6E9144F10 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6E9144F55

Part of subcall function 00007FF6E91448A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E91448BC

Part of subcall function 00007FF6E9139C58: HeapFree.KERNEL32(?,?,?,00007FF6E9142032,?,?,?,00007FF6E914206F,?,?,00000000,00007FF6E9142535,?,?,?,00007FF6E9142467), ref: 00007FF6E9139C6E
Part of subcall function 00007FF6E9139C58: GetLastError.KERNEL32(?,?,?,00007FF6E9142032,?,?,?,00007FF6E914206F,?,?,00000000,00007FF6E9142535,?,?,?,00007FF6E9142467), ref: 00007FF6E9139C78

Part of subcall function 00007FF6E9139C10: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6E9139BEF,?,?,?,?,?,00007FF6E9139ADA), ref: 00007FF6E9139C19
Part of subcall function 00007FF6E9139C10: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6E9139BEF,?,?,?,?,?,00007FF6E9139ADA), ref: 00007FF6E9139C3E

_get_daylight.LIBCMT ref: 00007FF6E9144F44

Part of subcall function 00007FF6E9144908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E914491C

_get_daylight.LIBCMT ref: 00007FF6E91451BA
_get_daylight.LIBCMT ref: 00007FF6E91451CB
_get_daylight.LIBCMT ref: 00007FF6E91451DC
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6E914541C), ref: 00007FF6E9145203

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: ec3da476d7abf2ffb0f6397319154e28f094a84f5b0708b50d9998a811af1003
Instruction ID: c88b161d5a633518f88377d0bb326363bef5cebe193f9d474e71f8b245d4c21d
Opcode Fuzzy Hash: ec3da476d7abf2ffb0f6397319154e28f094a84f5b0708b50d9998a811af1003
Instruction Fuzzy Hash: 95D1A037E1825286EB20DF26D4413FD63A1EF48B98F454135EA0D87686DF3EE442CB4A

Function 00007FF6E9139924 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6E913999D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6E91399B5
RtlVirtualUnwind.KERNEL32 ref: 00007FF6E91399F0
IsDebuggerPresent.KERNEL32 ref: 00007FF6E9139A29
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6E9139A33
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6E9139A3E

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
Instruction ID: 545c3ed7c4e85029e6605950830cdc1ab1088fe55312b13a8ace9d157e29d1b2
Opcode Fuzzy Hash: f336cc4ee628281f12481126c86b188c106f14650002c00baa1860decbda2c10
Instruction Fuzzy Hash: DE315B37618B8186DB20CF25E8407EE73A4FB88758F500135EA8D83B55DF39D156CB05

Function 00007FF6E9140B84 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9140BD0
FindFirstFileExW.KERNEL32 ref: 00007FF6E9140CDA

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 537ca4dcf685df196dbb745ebf7a8e3eb288cf6b089b90446fc853c3fde494ee
Instruction ID: 79a9bf8b4522020566ff963451a146a6f56f1cd4ee8cc2ce620253c2d275605b
Opcode Fuzzy Hash: 537ca4dcf685df196dbb745ebf7a8e3eb288cf6b089b90446fc853c3fde494ee
Instruction Fuzzy Hash: F0B1C7A3B1869681EB60DF2395047F96360EF48BE8F444135ED5D87B85DE3DE842CB06

Function 00007FF6E914518C Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6E91451BA

Part of subcall function 00007FF6E9144908: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E914491C

_get_daylight.LIBCMT ref: 00007FF6E91451CB

Part of subcall function 00007FF6E91448A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E91448BC

_get_daylight.LIBCMT ref: 00007FF6E91451DC

Part of subcall function 00007FF6E91448D8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E91448EC

Part of subcall function 00007FF6E9139C58: HeapFree.KERNEL32(?,?,?,00007FF6E9142032,?,?,?,00007FF6E914206F,?,?,00000000,00007FF6E9142535,?,?,?,00007FF6E9142467), ref: 00007FF6E9139C6E
Part of subcall function 00007FF6E9139C58: GetLastError.KERNEL32(?,?,?,00007FF6E9142032,?,?,?,00007FF6E914206F,?,?,00000000,00007FF6E9142535,?,?,?,00007FF6E9142467), ref: 00007FF6E9139C78

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6E914541C), ref: 00007FF6E9145203

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 246ddfbbe37c4787f9720b27dc9f743496b3bb1ed6dcb5155dd6029a6c9a153e
Instruction ID: f1982e2e1d59a206aad17a469baa7ddfd4910b9d54492d71893bc53cc2fbd3fd
Opcode Fuzzy Hash: 246ddfbbe37c4787f9720b27dc9f743496b3bb1ed6dcb5155dd6029a6c9a153e
Instruction Fuzzy Hash: 9E513033E1864286E720DF21E8817ED67A1BF48788F454139DA4DC7696DF3EE442CB4A

Function 00007FF6E912C330 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6E912C35C
GetCurrentThreadId.KERNEL32 ref: 00007FF6E912C36A
GetCurrentProcessId.KERNEL32 ref: 00007FF6E912C376
QueryPerformanceCounter.KERNEL32 ref: 00007FF6E912C386

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
Instruction ID: e428ca4d1249f4676d84ba21f8b4de3dc2cb68394dd66b16510294e1e0e46132
Opcode Fuzzy Hash: 0f32e5fb6c1657f40c76225ea380b4ebd78bc5beffa0738dce661fe11625e8f4
Instruction Fuzzy Hash: FF111822B58B058AEB008F60E8553AD33A4FB59758F441E31EA6D86BA4DF7CE1998341

Function 00007FF6E9142F20 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF6E9142F86
memcpy_s.LIBCPMT ref: 00007FF6E9142FB1

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: b41cb84a548d2e61bdeb7bb10330278f5fecde395d7a0ce6ff99175555b28b3c
Instruction ID: 15bc2accf868aa980ea37368b57347dcea2f56724b17c413b254641fb3712d77
Opcode Fuzzy Hash: b41cb84a548d2e61bdeb7bb10330278f5fecde395d7a0ce6ff99175555b28b3c
Instruction Fuzzy Hash: 6BC1B373B1868687E7248F55A1447AAB791FB98B88F448135DF4A87784DE3EE8038F44

Function 00007FF6E912979B Relevance: 4.1, Strings: 3, Instructions: 397COMMON

Download Yara Rule

Strings

header crc mismatch, xrefs: 00007FF6E9129C41
, xrefs: 00007FF6E912987B
unknown header flags set, xrefs: 00007FF6E91297E5

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: 6a55f11302ef793728786adf415505d571280719f8ef56880a9f0a37636d8ec0
Instruction ID: 754f68e6cd5d2c6cfb07c4e55ae21a6a4e0bbfbbf90df1080797227e12aeae54
Opcode Fuzzy Hash: 6a55f11302ef793728786adf415505d571280719f8ef56880a9f0a37636d8ec0
Instruction Fuzzy Hash: 0FF1B073A183C54BEBA5AF19C188BBA3AE9FF46740F054938DA4987390CF3AD540D749

Function 00007FF6E9148A38 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF6E9148C87
RaiseException.KERNEL32 ref: 00007FF6E9148C98

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 4367feba8b0fb5a89db2d79700bffb7903d016d74ce2a4ac284103265cf95646
Instruction ID: b64dc7ddbfef29fd71ae4648949afdcf50c8d98b4ba59454aca8a48275c6a686
Opcode Fuzzy Hash: 4367feba8b0fb5a89db2d79700bffb7903d016d74ce2a4ac284103265cf95646
Instruction Fuzzy Hash: 37B15B77605B898BE715CF29C8463A83BA0FB48B4CF148961DB6D837A4CF3AD452CB05

Function 00007FF6E9132CC4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF6E9132E32
, xrefs: 00007FF6E9133074

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 25965de2e6678be5c8c686b25b3b835ec4bf2bfab2b797158b347abdb642f747
Instruction ID: ab0a85793fe085e4972d3f7deabd0e892aa69a6bc17e4f7618153334be63a882
Opcode Fuzzy Hash: 25965de2e6678be5c8c686b25b3b835ec4bf2bfab2b797158b347abdb642f747
Instruction Fuzzy Hash: 62E1A133A0864281EB68DE3581582BD23B0FF45F48F664635DE4E87694DF2BE852C74B

Function 00007FF6E91295FB Relevance: 2.7, Strings: 2, Instructions: 218COMMON

Download Yara Rule

Strings

invalid window size, xrefs: 00007FF6E9129769
incorrect header check, xrefs: 00007FF6E9129782

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: 226024973a440a2a6261c5f164d8bafa30541a105b972a390c392a8354fe07a0
Instruction ID: 656a841a36f627e5a94120f1d476af19494877637e4950c512278e0b4332dbac
Opcode Fuzzy Hash: 226024973a440a2a6261c5f164d8bafa30541a105b972a390c392a8354fe07a0
Instruction Fuzzy Hash: 5E91B373A182868BE7A49F18C548BBE3BADFF42350F114539DA5A876C0CF3AE540DB45

Function 00007FF6E913D200 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF6E913D38A
e+000, xrefs: 00007FF6E913D30D

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 1324d18368fb7be0dec1b44ace24e6b174879433860390047f5d35653063db2a
Instruction ID: 6185f2e6995a7d4ff6ca96808f116b170f4948e36688ab4cab08ea9e605b55d0
Opcode Fuzzy Hash: 1324d18368fb7be0dec1b44ace24e6b174879433860390047f5d35653063db2a
Instruction Fuzzy Hash: E0515867B1C3C186E725CE3698097A96BA1FB44B94F499231CBA8C7AC1CF3ED445C706

Function 00007FF6E913FBD8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 5b606b63c70e86b5db4eecb07275e8e9c3e0e1f08e56a2b99ea5de7f73ebbe88
Instruction ID: 99ba76cb85751eadd3eb6ef258cf770e95729dae5d1cbf565a8c995a11ced318
Opcode Fuzzy Hash: 5b606b63c70e86b5db4eecb07275e8e9c3e0e1f08e56a2b99ea5de7f73ebbe88
Instruction Fuzzy Hash: ED02B123E1D68780FA54EF3294093F916A0AF0AB90F464539DD6DC73D2DE3FA841870A

Function 00007FF6E913CD6C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF6E913D0AE

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: ee332c23296b8dd3ed29fdb42bef122adb490463d0c8b601810d73b835641fc7
Instruction ID: 5f3cf25cc9b5c09a4bfe67873e4d964f0ba8306294c1dd36f2e98a460cbeca17
Opcode Fuzzy Hash: ee332c23296b8dd3ed29fdb42bef122adb490463d0c8b601810d73b835641fc7
Instruction Fuzzy Hash: 7EA13563B0878586EB21CF39A4047E97BA5EF54B84F068132DE8D87785DE3ED501C706

Function 00007FF6E9137AAC Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF6E9137ACB

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: fa9fc3ba0f2a0ca574b62e3049f007bc07c74431d5877200bfd71a39e50ac507
Instruction ID: 137038616606193cbfcf1d8e81154ca95510bfc7be8c41097d4df682ef8b900e
Opcode Fuzzy Hash: fa9fc3ba0f2a0ca574b62e3049f007bc07c74431d5877200bfd71a39e50ac507
Instruction Fuzzy Hash: A1519F13B0874781FA64EE3799493FA52B1AF44B94F4A4434DE1EC77D5EE3EE442820A

Function 00007FF6E9142790 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6E9142794

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: fe1a72d78314f5032ff6e3f3402ce84269ae1386cefa971ca0fc6f511f9bbc55
Instruction ID: f7efbd857131b624c798c0cafef732f50bae73f74b8ba3da4ad341c3bb23cd00
Opcode Fuzzy Hash: fe1a72d78314f5032ff6e3f3402ce84269ae1386cefa971ca0fc6f511f9bbc55
Instruction Fuzzy Hash: 5CB09231E27A86C2EA082F217C8635822A87F88B04FA48038C40EC1320DE3D20A68B06

Function 00007FF6E91328C0 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b05403af9c31de739a9311cbf741df56ce5de8bb6a66a9cc9bcf40cf40427d0b
Instruction ID: de10b8facf9145441b398110ddf4a5205b3e39cf4fcc891f2cbf419ab4492c13
Opcode Fuzzy Hash: b05403af9c31de739a9311cbf741df56ce5de8bb6a66a9cc9bcf40cf40427d0b
Instruction Fuzzy Hash: 53D1C223A1865286EB78DE3984583BD37B0AF45B48F164A35CE0D87694DF3EE841C34B

Function 00007FF6E9128B20 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6de572fc7ea0867e481f021e98a3cee959a95ba6dd1d6718a656c0f39a4e480
Instruction ID: 88d5f719c73279516c4d588c04f4e616cf50985096de4a33ae6ff04c8b567935
Opcode Fuzzy Hash: b6de572fc7ea0867e481f021e98a3cee959a95ba6dd1d6718a656c0f39a4e480
Instruction Fuzzy Hash: 91C1C1732142F14FD288FB29E4599BA73D1FB99309BD4402AEB8747B85CA3CE414E791

Function 00007FF6E9131F30 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54646038064d7a6353eabae39e6447674b1691c16f4822fec46df2a19c6da082
Instruction ID: 35fb0496b6119c805db3f79525592c0d4e375640a5d400a5a9cd472bb32c92c5
Opcode Fuzzy Hash: 54646038064d7a6353eabae39e6447674b1691c16f4822fec46df2a19c6da082
Instruction Fuzzy Hash: 6EB15973A08A8585EB65DF39C4582AC3BB0EB49B48F264535CB4E87395CF3AE445C70A

Function 00007FF6E913D880 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5cf27518f3756e107451e616d5c43acfc5497bdc9406be32d6656a2e3ee85f8
Instruction ID: 2b44a039331a5f018c7da77a54a07e25052abd81a0e770610443c2ddc47ffdcb
Opcode Fuzzy Hash: c5cf27518f3756e107451e616d5c43acfc5497bdc9406be32d6656a2e3ee85f8
Instruction Fuzzy Hash: BF81E477A1C78146EB74CF3998483AA76A1FF46794F154235DA8D87B89CF3EE4008B05

Function 00007FF6E9145728 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7a9558e86fa8b462753dac68b64cf5067dc6b1cda5ab5f882eee36bb89ede29b
Instruction ID: d4c86f2c0393813374c7fff6d93ce10270e8b0ca9a8cbf36603beaf7b7fa89d0
Opcode Fuzzy Hash: 7a9558e86fa8b462753dac68b64cf5067dc6b1cda5ab5f882eee36bb89ede29b
Instruction Fuzzy Hash: 7961F523E0C28286FB64CE2984543FC6691AF48778F554239D65DC6AD5DE7FE8028F0A

Function 00007FF6E9130C64 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: bfbe3942a132a76d2d29d772e5680b62970262f597f28e31ef69367763d6a2bf
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: 5D516DB7A18A5186E724CF39C0483A927F0EF45B68F264139CA5D87795CF3BE842C749

Function 00007FF6E9131484 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: 73a8d35dac144e2c18e8a163d983c85f973adfca1adcc5409a9300a1b070b4e3
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: FD515F77A18651C6E724CF39C0483A827B0EF4AB68F294131DA4E97B94CF3BE842C745

Function 00007FF6E9131074 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: d41ea9c04fa31c2d7671e2c13b1cb500555ab590169ed9a470eb190c91c98dc8
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: 54513B77A18691C6E724CF39C0483B827B1EF49B68F264131CA4D97794CF6BE842C749

Function 00007FF6E9130A60 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction ID: 7378c9b5e040026b129439881bff511a094d3537052d252243fbe8f39d6a7836
Opcode Fuzzy Hash: 3943df286285c50b07f09d339b53caaa0afa34ddfac4fad96d8a3f7ffd6ad23b
Instruction Fuzzy Hash: AE517DB7A2865186E724CF39D0483A837F1EF44B58F2A4139CA4C97798CF2BE842C745

Function 00007FF6E9131280 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction ID: c702323e595ce0b4b89a3fef34197bb8cde07bc300544ea7408474dfa0eea84f
Opcode Fuzzy Hash: e734bc54909bdf7d9c6fd1772be64da5dc64d4f5bf3044a39ac3ba7850561882
Instruction Fuzzy Hash: 7B513937A18651C6E725CF39C0483A827B1EF49B68F264131CE4D97BA8CF2BE852C745

Function 00007FF6E9130E70 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction ID: e3895f48f2ff7fe94abaa8bcb179ff5f6a112f76e943762987b6570df42511bc
Opcode Fuzzy Hash: dc981bf603441a130e1c6ba5e96f77be0c3c60e19ec03e3d560a09712d731568
Instruction Fuzzy Hash: CF517AB7A18A5186E724CF39C0483AC27B1EF44B58F264139CA4C97795CF3BE842C749

Function 00007FF6E9135040 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: 090046dc36900367290887c19651bef2bea71e337676adc2d2f612a7c41bd55a
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: 5341A453D4978A04E995CD38051C7FC26E0AF13FA0D6A52B4DDAED33C3CD2F69868246

Function 00007FF6E91391B0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4c2069438db7bd6821668209f3bed185f6ed925e7f6c63ba07488e81febeb59c
Instruction ID: 476be80c87385226dbe58a901f3a295eff48491c9f345c0d27eb5cb1a92b0172
Opcode Fuzzy Hash: 4c2069438db7bd6821668209f3bed185f6ed925e7f6c63ba07488e81febeb59c
Instruction Fuzzy Hash: 3941D563B18A5582EF08CF3AD9182A973A1BF48FD0B4A9436DE0DD7B58DE3DD0428305

Function 00007FF6E91373F4 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6955196b928ea369f318f1367a91d651b99cb7ed2675060227c8542cf7a82c4a
Instruction ID: 14bb6a561e5d602a13f22d10315ed88eb5a7da16dd00b9257fe8b25108478030
Opcode Fuzzy Hash: 6955196b928ea369f318f1367a91d651b99cb7ed2675060227c8542cf7a82c4a
Instruction Fuzzy Hash: 5B31B433718B8281E725DF3568442BE7AE5AF84B90F154238EA9D93BD5DF3DE0128709

Function 00007FF6E9148880 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b45f31a2a70b9ba878c3a12fffa6905b3575b51dadbfc3a0cbe7f45b87496cea
Instruction ID: 6032793356c420f9e1205fda48c88dce4be17573aa305acbabac83f621fd3e59
Opcode Fuzzy Hash: b45f31a2a70b9ba878c3a12fffa6905b3575b51dadbfc3a0cbe7f45b87496cea
Instruction Fuzzy Hash: F9F06272F282958EDBA48F29A80276D77D0FB08384F80803DE68DC3B04DA7D9061CF09

Function 00007FF6E912C62C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84fb9023dc3cd78644239ae856a17877a0dfc2a7c85af1c48b0789cc2cde0ccb
Instruction ID: 591a547cf513d429b41d0404a6c7901542da908d96d2a60877f3923cdac3a10d
Opcode Fuzzy Hash: 84fb9023dc3cd78644239ae856a17877a0dfc2a7c85af1c48b0789cc2cde0ccb
Instruction Fuzzy Hash: E2A0022395DC26D0E6689F24F8507B97331FF65304B802071E10DC21A09F3EB401D75A

Function 00007FF6E91250B0 Relevance: 157.9, APIs: 44, Strings: 46, Instructions: 364libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF6E9125C57,?,00007FF6E912308E), ref: 00007FF6E91250C0
GetProcAddress.KERNEL32(?,00007FF6E9125C57,?,00007FF6E912308E), ref: 00007FF6E9125101
GetProcAddress.KERNEL32(?,00007FF6E9125C57,?,00007FF6E912308E), ref: 00007FF6E9125126
GetProcAddress.KERNEL32(?,00007FF6E9125C57,?,00007FF6E912308E), ref: 00007FF6E912514B
GetProcAddress.KERNEL32(?,00007FF6E9125C57,?,00007FF6E912308E), ref: 00007FF6E9125173
GetProcAddress.KERNEL32(?,00007FF6E9125C57,?,00007FF6E912308E), ref: 00007FF6E912519B
GetProcAddress.KERNEL32(?,00007FF6E9125C57,?,00007FF6E912308E), ref: 00007FF6E91251C3
GetProcAddress.KERNEL32(?,00007FF6E9125C57,?,00007FF6E912308E), ref: 00007FF6E91251EB
GetProcAddress.KERNEL32(?,00007FF6E9125C57,?,00007FF6E912308E), ref: 00007FF6E9125213

Strings

Py_PreInitialize, xrefs: 00007FF6E91251B9, 00007FF6E91251D5
PyConfig_SetWideStringList, xrefs: 00007FF6E91252A9, 00007FF6E91252C5
PyObject_GetAttrString, xrefs: 00007FF6E9125551, 00007FF6E912556D
PyConfig_SetString, xrefs: 00007FF6E9125281, 00007FF6E912529D
Failed to get address for %hs, xrefs: 00007FF6E91250D9
Py_InitializeFromConfig, xrefs: 00007FF6E9125169, 00007FF6E9125185
PyErr_Print, xrefs: 00007FF6E9125371, 00007FF6E912538D
PyUnicode_FromFormat, xrefs: 00007FF6E9125709, 00007FF6E9125725
PyConfig_InitIsolatedConfig, xrefs: 00007FF6E9125209, 00007FF6E9125225
Py_ExitStatusException, xrefs: 00007FF6E912511C, 00007FF6E9125138
PyObject_CallFunctionObjArgs, xrefs: 00007FF6E9125529, 00007FF6E9125545
Py_IsInitialized, xrefs: 00007FF6E9125191, 00007FF6E91251AD
PyUnicode_AsUTF8, xrefs: 00007FF6E9125691, 00007FF6E91256AD
PyModule_GetDict, xrefs: 00007FF6E91254D9, 00007FF6E91254F5
PyUnicode_Join, xrefs: 00007FF6E9125759, 00007FF6E9125775
PyUnicode_Replace, xrefs: 00007FF6E9125781, 00007FF6E912579D
PyErr_Fetch, xrefs: 00007FF6E91252F9, 00007FF6E9125315
Py_Finalize, xrefs: 00007FF6E9125141, 00007FF6E912515D
PyEval_EvalCode, xrefs: 00007FF6E91253C1, 00007FF6E91253DD
Py_DecRef, xrefs: 00007FF6E91250B6, 00007FF6E91250D2
PyErr_Occurred, xrefs: 00007FF6E9125349, 00007FF6E9125365
Py_DecodeLocale, xrefs: 00007FF6E91250F7, 00007FF6E9125113
PyImport_AddModule, xrefs: 00007FF6E91253E9, 00007FF6E9125405
PyList_Append, xrefs: 00007FF6E9125461, 00007FF6E912547D
PyObject_CallFunction, xrefs: 00007FF6E9125501, 00007FF6E912551D
PyErr_NormalizeException, xrefs: 00007FF6E9125321, 00007FF6E912533D
PyUnicode_DecodeFSDefault, xrefs: 00007FF6E91256E1, 00007FF6E91256FD
PyErr_Clear, xrefs: 00007FF6E91252D1, 00007FF6E91252ED
PyConfig_Read, xrefs: 00007FF6E9125231, 00007FF6E912524D
PyErr_Restore, xrefs: 00007FF6E9125399, 00007FF6E91253B5
PyStatus_Exception, xrefs: 00007FF6E9125619, 00007FF6E9125635
PyUnicode_Decode, xrefs: 00007FF6E91256B9, 00007FF6E91256D5
PySys_SetObject, xrefs: 00007FF6E9125669, 00007FF6E9125685
PyImport_ExecCodeModule, xrefs: 00007FF6E9125411, 00007FF6E912542D
GetProcAddress, xrefs: 00007FF6E91250E0
PyMarshal_ReadObjectFromString, xrefs: 00007FF6E9125489, 00007FF6E91254A5
PyObject_Str, xrefs: 00007FF6E91255A1, 00007FF6E91255BD
PyImport_ImportModule, xrefs: 00007FF6E9125439, 00007FF6E9125455
PyObject_SetAttrString, xrefs: 00007FF6E9125579, 00007FF6E9125595
PyRun_SimpleStringFlags, xrefs: 00007FF6E91255F1, 00007FF6E912560D
PyUnicode_FromString, xrefs: 00007FF6E9125731, 00007FF6E912574D
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF6E91255C9, 00007FF6E91255E5
PySys_GetObject, xrefs: 00007FF6E9125641, 00007FF6E912565D
PyMem_RawFree, xrefs: 00007FF6E91254B1, 00007FF6E91254CD
PyConfig_SetBytesString, xrefs: 00007FF6E9125259, 00007FF6E9125275
PyConfig_Clear, xrefs: 00007FF6E91251E1, 00007FF6E91251FD

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 190572456-2007157414
Opcode ID: 3c804ccaf4812c993b4970aca99c844c8aa25bcf6244ab31ff714926eb913965
Instruction ID: 11c4bb499f891fa6062f2c8b9d3bb855099737fa42e2c751512b78dd847634c5
Opcode Fuzzy Hash: 3c804ccaf4812c993b4970aca99c844c8aa25bcf6244ab31ff714926eb913965
Instruction Fuzzy Hash: 7812D666D4EB0391FA15AF05A8503FC23A4AF0A759B941435C80ED23A4FF3EB54AD64F

Function 00007FF6E91215C0 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 137COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6E9121785
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF6E91216EF
fseek, xrefs: 00007FF6E9121695
fopen, xrefs: 00007FF6E912161E
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6E912168E
malloc, xrefs: 00007FF6E91216F6
Failed to create symbolic link %s!, xrefs: 00007FF6E91215E2
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF6E9121775
fwrite, xrefs: 00007FF6E912177C
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6E912165B
fread, xrefs: 00007FF6E912178C
Failed to extract %s: failed to open target file!, xrefs: 00007FF6E9121617

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: Message
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2030045667-1550345328
Opcode ID: 63e7821261bdbcd545cb89ff9d6ef705dc686717b2c5037f278b81823427e60c
Instruction ID: bc02b160c0c3d45ec77d1123573dd81b5ab6f287044274eb4d1f1553876956b1
Opcode Fuzzy Hash: 63e7821261bdbcd545cb89ff9d6ef705dc686717b2c5037f278b81823427e60c
Instruction Fuzzy Hash: 51518D63B0864392EA14AF25E8003F92360BF46B98F844131EE0DC7795EE3EE555A70A

Function 00007FF6E91277D0 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E91286B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6E9123FA4,00000000,00007FF6E9121925), ref: 00007FF6E91286E9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF6E9127C97,?,?,FFFFFFFF,00007FF6E9123834), ref: 00007FF6E912782C

Part of subcall function 00007FF6E91226C0: MessageBoxW.USER32 ref: 00007FF6E9122736

Strings

LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF6E912789D
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF6E91278D9
LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF6E912796D
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF6E9127840
\, xrefs: 00007FF6E9127861
CreateDirectory, xrefs: 00007FF6E9127974
%.*s, xrefs: 00007FF6E912790C
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF6E9127803

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 5adf1a7b4f365c991e592d6daa758356e56cb82b092043d5b28c068608273831
Instruction ID: 1aaa6ffc2b111dfba3a346d910fc99e0ef082f5c23e4a7883559b8208e71758f
Opcode Fuzzy Hash: 5adf1a7b4f365c991e592d6daa758356e56cb82b092043d5b28c068608273831
Instruction Fuzzy Hash: 7B41B023B1D74381FB10BF25E8513FA62A1AF86784F844431EA4EC3695EE3EF105974A

Function 00007FF6E91220F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6E912211B
SelectObject.GDI32 ref: 00007FF6E9122162
DrawTextW.USER32 ref: 00007FF6E9122185
SelectObject.GDI32 ref: 00007FF6E912219B
ReleaseDC.USER32 ref: 00007FF6E91221AB
MoveWindow.USER32 ref: 00007FF6E91221FB
MoveWindow.USER32 ref: 00007FF6E912223B
MoveWindow.USER32 ref: 00007FF6E912228E
MoveWindow.USER32 ref: 00007FF6E91222D6

Strings

P%, xrefs: 00007FF6E912216F

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: d5dd136cfe9f7ccbcb0fe4cae99cf14dfe1cc9f89db7d8019ba122c6a34f6d98
Instruction ID: f68be3945bb36af984ad78611505172d6db0afce667471a1732f0f85510f5cc3
Opcode Fuzzy Hash: d5dd136cfe9f7ccbcb0fe4cae99cf14dfe1cc9f89db7d8019ba122c6a34f6d98
Instruction Fuzzy Hash: A651F726604BA186D6389F22B4182BEB7A1FB98B65F044131EBDF83794DF3DD045DB14

Function 00007FF6E91355A0 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 493COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E91355E3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E91359D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9135C6C

Strings

p, xrefs: 00007FF6E9135695
f, xrefs: 00007FF6E9135705
p, xrefs: 00007FF6E913570D
:, xrefs: 00007FF6E913579C
-, xrefs: 00007FF6E9135679

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 21cbc72c7e6dc269be11e21f83bf2085e3383c5e1ad4ae35147280bf7774980f
Instruction ID: 30230dbc22aed62cb07e18cfca632995410bce344821afc921bb77d25329c87f
Opcode Fuzzy Hash: 21cbc72c7e6dc269be11e21f83bf2085e3383c5e1ad4ae35147280bf7774980f
Instruction Fuzzy Hash: 78129063A1824386FB20DE3590583FD76B6FF40B54F964035D69E866C8DF3EE5908B0A

Function 00007FF6E91302E8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9130328
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E91306F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E913098F

Strings

p, xrefs: 00007FF6E9130432
f, xrefs: 00007FF6E913042A
p, xrefs: 00007FF6E91303CD
f, xrefs: 00007FF6E9130575
f, xrefs: 00007FF6E91303C0

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 1ce7302e2fd45bb0c0c54093c0ec2c5d292275181cf657796836d36714c503ba
Instruction ID: 905d9d5c16d59b6c93ce8b35c884ead100ae1ad53dce2a63f0bbea43b28992f4
Opcode Fuzzy Hash: 1ce7302e2fd45bb0c0c54093c0ec2c5d292275181cf657796836d36714c503ba
Instruction Fuzzy Hash: 0D1284A3E0D14386FB24DE24E0587FA76F1EF80754F864139D689865C4DF3EE9808B4A

Function 00007FF6E9121050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 111COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6E91211D0
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6E91210F5
fseek, xrefs: 00007FF6E91210CC
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6E91210C5
malloc, xrefs: 00007FF6E91210FC
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6E9121097
fread, xrefs: 00007FF6E91211D7

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: eb8929c7a717523ea7c5dbdd2b8df762904df810c2407b2455a08332a40905b2
Instruction ID: e3c7703a352ff5e9b95f2c7cda6c3ef909eae0baf2e7e6908367dad8e1d3d262
Opcode Fuzzy Hash: eb8929c7a717523ea7c5dbdd2b8df762904df810c2407b2455a08332a40905b2
Instruction Fuzzy Hash: 0A418023B0864782EA24EF22A8407FA6391BF56BC4F444031DD4EC7795DE3EE445974A

Function 00007FF6E9121440 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 100COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6E912159A
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6E91214D9
fseek, xrefs: 00007FF6E91214B0
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6E91214A9
malloc, xrefs: 00007FF6E91214E0
Failed to extract %s: failed to open archive file!, xrefs: 00007FF6E912146F
fread, xrefs: 00007FF6E91215A1

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: ab735088dece392ba015fe9887ac25182eb0ff937d9945326d1deb4be678b5f1
Instruction ID: 98a10f8a32922f88a27802f0e361b1e85822559f0d5ec4ed37d74a1980105113
Opcode Fuzzy Hash: ab735088dece392ba015fe9887ac25182eb0ff937d9945326d1deb4be678b5f1
Instruction Fuzzy Hash: 65418423B0864785EA24EF15A8407F963A0FF1A7D4F544031DE4EC7A95EE3EE542970A

Function 00007FF6E9127FC0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 89processsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E91286B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6E9123FA4,00000000,00007FF6E9121925), ref: 00007FF6E91286E9

SetConsoleCtrlHandler.KERNEL32(?,00007FF6E91239C0), ref: 00007FF6E912800A
GetStartupInfoW.KERNEL32(?,00007FF6E91239C0), ref: 00007FF6E912802B

Part of subcall function 00007FF6E913978C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E91397A0

Part of subcall function 00007FF6E9137A2C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9137A93

GetCommandLineW.KERNEL32(?,00007FF6E91239C0), ref: 00007FF6E91280CD
CreateProcessW.KERNEL32 ref: 00007FF6E912810F
WaitForSingleObject.KERNEL32(?,00007FF6E91239C0), ref: 00007FF6E9128123
GetExitCodeProcess.KERNEL32 ref: 00007FF6E9128133

Strings

CreateProcessW, xrefs: 00007FF6E9128146
Failed to create child process!, xrefs: 00007FF6E912813F

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Failed to create child process!
API String ID: 2895956056-699529898
Opcode ID: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
Instruction ID: 939f96e202db8ced680f1de6b965e36bda23ae6eb16f7ea6bdbd3062e8cf78d5
Opcode Fuzzy Hash: 2d8580ce5d81a01d0f8683f73fef31206a84e7faf833a053d17f215ed92b6c27
Instruction Fuzzy Hash: DC412B32A08B8282DA20AF64F4453EE72A1FF89364F540335E6AD877D5DF7DD0458B05

Function 00007FF6E912DD28 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF6E912DD85

Part of subcall function 00007FF6E912ECDC: __GetUnwindTryBlock.LIBCMT ref: 00007FF6E912ED1F
Part of subcall function 00007FF6E912ECDC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF6E912ED44

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6E912DE5D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF6E912E0AB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6E912E1B8

Strings

csm, xrefs: 00007FF6E912DE06
csm, xrefs: 00007FF6E912DE80
csm, xrefs: 00007FF6E912DD9F

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 9e3578d2910a1de3a92e15cd58e24121979594cfb80c91fc1a566261b89881c5
Instruction ID: 29b4786cc359ccba031182d52e25ba196cb4fd3633a816a483fc6aaa32bb7d04
Opcode Fuzzy Hash: 9e3578d2910a1de3a92e15cd58e24121979594cfb80c91fc1a566261b89881c5
Instruction Fuzzy Hash: 56D17C33A087418AEB20AF65D4403ED37A0FF56788F100135EA4D97B9ADF3AE481D74A

Function 00007FF6E91211F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 154COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF6E9121295
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF6E91212C3
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF6E91213EE
1.3.1, xrefs: 00007FF6E9121229
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF6E9121256
malloc, xrefs: 00007FF6E912129C, 00007FF6E91212CA

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: Message
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-2813020118
Opcode ID: 5f86db0b88a8597635f99d5b4cac90fa4f731a3afe8888101c8cea5847f0d3ec
Instruction ID: 6923c529e5185f8d8c570fd367743ce6f600a5884005b158dd5bf7366744b5d2
Opcode Fuzzy Hash: 5f86db0b88a8597635f99d5b4cac90fa4f731a3afe8888101c8cea5847f0d3ec
Instruction Fuzzy Hash: C151F223B0868281EA24EF16A4403FA6291FF86798F544135ED4DC7BC5EF3EE542D70A

Function 00007FF6E913E020 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF6E913E3BA,?,?,-00000018,00007FF6E913A063,?,?,?,00007FF6E9139F5A,?,?,?,00007FF6E913524E), ref: 00007FF6E913E19C
GetProcAddress.KERNEL32(?,?,?,00007FF6E913E3BA,?,?,-00000018,00007FF6E913A063,?,?,?,00007FF6E9139F5A,?,?,?,00007FF6E913524E), ref: 00007FF6E913E1A8

Strings

api-ms-, xrefs: 00007FF6E913E0E6
ext-ms-, xrefs: 00007FF6E913E0F9

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
Instruction ID: 0cb239f9aee264cfe3917462c39263b125bf20d361f09b8a0a2720a2a31d4097
Opcode Fuzzy Hash: 400d167c79677b3a1b331b2dd1a2c4ed1cd7dec94f3cf9f9612a621c3bffedbb
Instruction Fuzzy Hash: 7941D423B1970292FB16CF26A8047F562A2BF55BA0F0A4135DD1EC7784EE3EE405830A

Function 00007FF6E9127C40 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 116COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(?,?,FFFFFFFF,00007FF6E9123834), ref: 00007FF6E9127CE4
CreateDirectoryW.KERNEL32(?,?,FFFFFFFF,00007FF6E9123834), ref: 00007FF6E9127D2C

Part of subcall function 00007FF6E9127E10: GetEnvironmentVariableW.KERNEL32(00007FF6E912365F), ref: 00007FF6E9127E47
Part of subcall function 00007FF6E9127E10: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6E9127E69

Part of subcall function 00007FF6E9137548: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9137561

Part of subcall function 00007FF6E91226C0: MessageBoxW.USER32 ref: 00007FF6E9122736

Strings

TMP, xrefs: 00007FF6E9127C7C, 00007FF6E9127D83
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF6E9127D5E
LOADER: failed to set the TMP environment variable., xrefs: 00007FF6E9127CBC
TMP, xrefs: 00007FF6E9127CA2
_MEI%d, xrefs: 00007FF6E9127CF2

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: Environment$CreateDirectoryExpandMessagePathStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 740614611-1339014028
Opcode ID: 11860e683bfeec2df00dcc2c56da5dbb6591d5702bb717516bbb2bb41ff9b0e3
Instruction ID: ab927c636f0e5c3a970d49bd486f40007993dedfc0c680072ce1e88294295f82
Opcode Fuzzy Hash: 11860e683bfeec2df00dcc2c56da5dbb6591d5702bb717516bbb2bb41ff9b0e3
Instruction Fuzzy Hash: F841BE13B09B4280EA24FF71A9553FA2261AF4A784F840031DD0ED77D6EE3EF505974A

Function 00007FF6E912CFE8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF6E912D29A,?,?,?,00007FF6E912CF8C,?,?,?,00007FF6E912CB89), ref: 00007FF6E912D06D
GetLastError.KERNEL32(?,?,?,00007FF6E912D29A,?,?,?,00007FF6E912CF8C,?,?,?,00007FF6E912CB89), ref: 00007FF6E912D07B
LoadLibraryExW.KERNEL32(?,?,?,00007FF6E912D29A,?,?,?,00007FF6E912CF8C,?,?,?,00007FF6E912CB89), ref: 00007FF6E912D0A5
FreeLibrary.KERNEL32(?,?,?,00007FF6E912D29A,?,?,?,00007FF6E912CF8C,?,?,?,00007FF6E912CB89), ref: 00007FF6E912D113
GetProcAddress.KERNEL32(?,?,?,00007FF6E912D29A,?,?,?,00007FF6E912CF8C,?,?,?,00007FF6E912CB89), ref: 00007FF6E912D11F

Strings

api-ms-, xrefs: 00007FF6E912D08D

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
Instruction ID: 1095655779e7ba7fd5d8df40363be1b187052228e8554b5fb1084ba0c7e328e6
Opcode Fuzzy Hash: ae36e00ef30d4e956021163d7a0c1bae911f6c658fcf96311cd3d9d96979b27c
Instruction Fuzzy Hash: A8318026A1AB4281EA11EF12A4007A923D4FF0ABA4F590535DD1D87394EE3EE446D70E

Function 00007FF6E9127B50 Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6E9127B70
OpenProcessToken.ADVAPI32 ref: 00007FF6E9127B83
GetTokenInformation.ADVAPI32 ref: 00007FF6E9127BA8
GetLastError.KERNEL32 ref: 00007FF6E9127BB2
GetTokenInformation.ADVAPI32 ref: 00007FF6E9127BF2
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6E9127C0E
CloseHandle.KERNEL32 ref: 00007FF6E9127C26

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 8356e17e6427c03366acad688ef96df5430cd8c67dfe58d52091e88c81740b7d
Instruction ID: e27f09efe32a067d2c23f7073e877e25bb60dd53ff351e9cf30d2fa2edb2d462
Opcode Fuzzy Hash: 8356e17e6427c03366acad688ef96df5430cd8c67dfe58d52091e88c81740b7d
Instruction Fuzzy Hash: E2212122A0CB4341EB209F65B4443AAA3A1EF867A4F140235DA7DC3BD4DF7DE4558B05

Function 00007FF6E913A460 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6E913A46F
FlsGetValue.KERNEL32 ref: 00007FF6E913A484
FlsSetValue.KERNEL32 ref: 00007FF6E913A4A5
FlsSetValue.KERNEL32 ref: 00007FF6E913A4D2
FlsSetValue.KERNEL32 ref: 00007FF6E913A4E3
FlsSetValue.KERNEL32 ref: 00007FF6E913A4F4
SetLastError.KERNEL32 ref: 00007FF6E913A50F

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f1009f36f4b7e41e642a617816a0843c7a4fdcae41be86a1245b23186b7dd2e
Instruction ID: e0133b6ea1cb11280681aa877e5fa998347f69e49c5e8fbe54ed00608d2b16b1
Opcode Fuzzy Hash: 4f1009f36f4b7e41e642a617816a0843c7a4fdcae41be86a1245b23186b7dd2e
Instruction Fuzzy Hash: C6215922B4C24252FA55EB31564D3B931A25F487A0F0A0734E93ECBAD6DE2EA401470B

Function 00007FF6E914707C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF6E91470AD
GetLastError.KERNEL32 ref: 00007FF6E91470B9
CloseHandle.KERNEL32 ref: 00007FF6E91470D1
CreateFileW.KERNEL32 ref: 00007FF6E91470FC
WriteConsoleW.KERNEL32 ref: 00007FF6E914711B

Strings

CONOUT$, xrefs: 00007FF6E91470DD

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 274174309ff0e3cf7757a3f5c883333dff1858e51aae267b9afc88cc39a62d3b
Instruction ID: f06b9da81547a9250a2605eeb6a990356d7d4a87c58bd67fbff1c277e4920af5
Opcode Fuzzy Hash: 274174309ff0e3cf7757a3f5c883333dff1858e51aae267b9afc88cc39a62d3b
Instruction Fuzzy Hash: ED118122A18B4186E7508F56F85436962A0FF8CFE8F000234EA1EC7794DF3DE405CB49

Function 00007FF6E91281F0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00000000,?,00007FF6E91239F2), ref: 00007FF6E912821D
K32EnumProcessModules.KERNEL32(?,00000000,?,00007FF6E91239F2), ref: 00007FF6E912827A

Part of subcall function 00007FF6E91286B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6E9123FA4,00000000,00007FF6E9121925), ref: 00007FF6E91286E9

K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF6E91239F2), ref: 00007FF6E9128305
K32GetModuleFileNameExW.KERNEL32(?,00000000,?,00007FF6E91239F2), ref: 00007FF6E9128364
FreeLibrary.KERNEL32(?,00000000,?,00007FF6E91239F2), ref: 00007FF6E9128375
FreeLibrary.KERNEL32(?,00000000,?,00007FF6E91239F2), ref: 00007FF6E912838A

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: c116373e2a09e68fc95a37a35a910f387ed59b49a7d0ab4690c2b7d3ff367989
Instruction ID: 97a0f51e3f36b238a70fc0e7152b123589a8ccd6e368a7740b07154bf7afd591
Opcode Fuzzy Hash: c116373e2a09e68fc95a37a35a910f387ed59b49a7d0ab4690c2b7d3ff367989
Instruction Fuzzy Hash: 07419E63B1968281EA30AF62A5003EA73A4FF86BC4F444135DF9D97789DE3DE401DB49

Function 00007FF6E9128400 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E9127B50: GetCurrentProcess.KERNEL32 ref: 00007FF6E9127B70
Part of subcall function 00007FF6E9127B50: OpenProcessToken.ADVAPI32 ref: 00007FF6E9127B83
Part of subcall function 00007FF6E9127B50: GetTokenInformation.ADVAPI32 ref: 00007FF6E9127BA8
Part of subcall function 00007FF6E9127B50: GetLastError.KERNEL32 ref: 00007FF6E9127BB2
Part of subcall function 00007FF6E9127B50: GetTokenInformation.ADVAPI32 ref: 00007FF6E9127BF2
Part of subcall function 00007FF6E9127B50: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6E9127C0E
Part of subcall function 00007FF6E9127B50: CloseHandle.KERNEL32 ref: 00007FF6E9127C26

LocalFree.KERNEL32(?,00007FF6E9123814), ref: 00007FF6E912848C
LocalFree.KERNEL32(?,00007FF6E9123814), ref: 00007FF6E9128495

Strings

D:(A;;FA;;;%s), xrefs: 00007FF6E9128477
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF6E91284A3
S-1-3-4, xrefs: 00007FF6E9128441
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF6E9128462

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 795f95526d0a951be163d7ee57e77295e71c5006ab84a191c0455a0dace466c7
Instruction ID: f5e75bbb212f64e8631b04742fd46b14a898691de322615f5df3df8cbd7f974e
Opcode Fuzzy Hash: 795f95526d0a951be163d7ee57e77295e71c5006ab84a191c0455a0dace466c7
Instruction Fuzzy Hash: 7D215323A0874282FA14BF60E4153FA62A4FF8A780F844435EA4DC3796DF3EE445D746

Function 00007FF6E913A5D8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6E91343FD,?,?,?,?,00007FF6E913979A,?,?,?,?,00007FF6E913649F), ref: 00007FF6E913A5E7
FlsSetValue.KERNEL32(?,?,?,00007FF6E91343FD,?,?,?,?,00007FF6E913979A,?,?,?,?,00007FF6E913649F), ref: 00007FF6E913A61D
FlsSetValue.KERNEL32(?,?,?,00007FF6E91343FD,?,?,?,?,00007FF6E913979A,?,?,?,?,00007FF6E913649F), ref: 00007FF6E913A64A
FlsSetValue.KERNEL32(?,?,?,00007FF6E91343FD,?,?,?,?,00007FF6E913979A,?,?,?,?,00007FF6E913649F), ref: 00007FF6E913A65B
FlsSetValue.KERNEL32(?,?,?,00007FF6E91343FD,?,?,?,?,00007FF6E913979A,?,?,?,?,00007FF6E913649F), ref: 00007FF6E913A66C
SetLastError.KERNEL32(?,?,?,00007FF6E91343FD,?,?,?,?,00007FF6E913979A,?,?,?,?,00007FF6E913649F), ref: 00007FF6E913A687

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 5dcac91248c0014d458aec840eea87d8b317a92cf5de5997ea3edf93bd94a031
Instruction ID: bf38425e6f64c74b6150a187c26b36c19f804e895c284da0c277791e12b29edc
Opcode Fuzzy Hash: 5dcac91248c0014d458aec840eea87d8b317a92cf5de5997ea3edf93bd94a031
Instruction Fuzzy Hash: 10113862F4C24292FA54EF3156993B922A25F587A0F468734D83ECB6D6DE2EB401470B

Function 00007FF6E9122300 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6E9122338
DialogBoxIndirectParamW.USER32 ref: 00007FF6E91223FE
DeleteObject.GDI32 ref: 00007FF6E9122431
DestroyIcon.USER32 ref: 00007FF6E9122443

Strings

Unhandled exception in script, xrefs: 00007FF6E9122368

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 43e0e9fc7257205e5ba4956726e7fb7afbd4954ec96d29d9005c09c1dc537ba6
Instruction ID: 5f10e9bf97ce5ae5e8ec4ae3f8538fe30ae8c643b1d0c0cd9ecc343b7245ab3d
Opcode Fuzzy Hash: 43e0e9fc7257205e5ba4956726e7fb7afbd4954ec96d29d9005c09c1dc537ba6
Instruction Fuzzy Hash: F0314E33A09A8289EB24EF61E8553F96360FF89798F440135EA4D87B59DF3DD105C706

Function 00007FF6E9122760 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E91286B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6E9123FA4,00000000,00007FF6E9121925), ref: 00007FF6E91286E9

MessageBoxW.USER32 ref: 00007FF6E912283B
MessageBoxA.USER32 ref: 00007FF6E912284F

Strings

%s%s: %s, xrefs: 00007FF6E91227EC
Error/warning (ANSI fallback), xrefs: 00007FF6E9122843
Error, xrefs: 00007FF6E912282C

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Error$Error/warning (ANSI fallback)
API String ID: 1878133881-640379615
Opcode ID: c7e22cebafa3b4081381e7f20538df90bc3c47857982eb0ae5879fef5a553f49
Instruction ID: 8aa456cbdfec2f92b4ed804d92f0b71724a78ceef1f1cb8b11d6d00e8af4bf9f
Opcode Fuzzy Hash: c7e22cebafa3b4081381e7f20538df90bc3c47857982eb0ae5879fef5a553f49
Instruction Fuzzy Hash: 4A217173628A8581E620EF10F4517EA6364FF85788F400036EA8C83699DF3DD646CB49

Function 00007FF6E9138DA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6E9138DC5
GetProcAddress.KERNEL32 ref: 00007FF6E9138DDB
FreeLibrary.KERNEL32 ref: 00007FF6E9138E02

Strings

CorExitProcess, xrefs: 00007FF6E9138DD4
mscoree.dll, xrefs: 00007FF6E9138DBC

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f1eb0c22b123c1cdb2873c61f44d146b1d21622817f8dd4d6a21f18b4a6e3d93
Instruction ID: c95118b2942438b908e8a8050f86f7944aa9ddefd942988a5d0430b608040b56
Opcode Fuzzy Hash: f1eb0c22b123c1cdb2873c61f44d146b1d21622817f8dd4d6a21f18b4a6e3d93
Instruction Fuzzy Hash: 4DF06263B1970282EB108F64E4483FD5330AF49B65F540635C56EC62F4CF2ED04AC70A

Function 00007FF6E9148678 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6E91486A0
_set_statfp.LIBCMT ref: 00007FF6E91486BB
_set_statfp.LIBCMT ref: 00007FF6E91486D7
_set_statfp.LIBCMT ref: 00007FF6E9148713

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 9fd0fb1090544565f15f63c872c39ebab23c54b083f05b3c10cb2c99cc97c12a
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 20112377E1CA0301F2941D29D5653F401416F5E3BCF5806B0EA2E9A3D6CE2EA843890E

Function 00007FF6E913A6A0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF6E91398B3,?,?,00000000,00007FF6E9139B4E,?,?,?,?,?,00007FF6E9139ADA), ref: 00007FF6E913A6BF
FlsSetValue.KERNEL32(?,?,?,00007FF6E91398B3,?,?,00000000,00007FF6E9139B4E,?,?,?,?,?,00007FF6E9139ADA), ref: 00007FF6E913A6DE
FlsSetValue.KERNEL32(?,?,?,00007FF6E91398B3,?,?,00000000,00007FF6E9139B4E,?,?,?,?,?,00007FF6E9139ADA), ref: 00007FF6E913A706
FlsSetValue.KERNEL32(?,?,?,00007FF6E91398B3,?,?,00000000,00007FF6E9139B4E,?,?,?,?,?,00007FF6E9139ADA), ref: 00007FF6E913A717
FlsSetValue.KERNEL32(?,?,?,00007FF6E91398B3,?,?,00000000,00007FF6E9139B4E,?,?,?,?,?,00007FF6E9139ADA), ref: 00007FF6E913A728

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 25d361a094b2c99e262beff41eaee06ac9464b6f74968b1c14d3cfe42ff85be4
Instruction ID: 190b00c7dabe05868dc9e647b5862077bf1f0de425e16d072110ba26a07ffbdd
Opcode Fuzzy Hash: 25d361a094b2c99e262beff41eaee06ac9464b6f74968b1c14d3cfe42ff85be4
Instruction Fuzzy Hash: B3114222F0C24252FA58EB3556893F971715F583A0F464334D83ED66D6DE2FB441470B

Function 00007FF6E913A534 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF6E913A545
FlsSetValue.KERNEL32 ref: 00007FF6E913A564
FlsSetValue.KERNEL32 ref: 00007FF6E913A58C
FlsSetValue.KERNEL32 ref: 00007FF6E913A59D
FlsSetValue.KERNEL32 ref: 00007FF6E913A5AE

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: a853173f6999e7d5ef833d9e4f06cbd56a904a1eb1d6261c936ae8f95b9bedb9
Instruction ID: 01bb026fbc4997bf6354964c7bdefbe58ea19cbff2a9f3259984a3f9fa330abe
Opcode Fuzzy Hash: a853173f6999e7d5ef833d9e4f06cbd56a904a1eb1d6261c936ae8f95b9bedb9
Instruction Fuzzy Hash: F611E823E4C20752FA58EF3555593F932A24F59370E164734D93ECA6D2ED2FB441424B

Function 00007FF6E91352B0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E91352EC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9135416
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E91354CC

Strings

verbose, xrefs: 00007FF6E91352C0

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
Instruction ID: d67e81edd5d5edf14fd9be75cc2e31e023fe712838d2352b791b038a05d6a278
Opcode Fuzzy Hash: f7ed0d29023b39033d3e63b48c2fcebc8df79207a036ffcb4dd83b8b3075c670
Instruction Fuzzy Hash: 4A91AF23A0CA4681E725CE35D4583BD36B1AF40F94F8A4136DA9E877D5EE3EE405830A

Function 00007FF6E913EED8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E913F1B7

Part of subcall function 00007FF6E9136D4C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9136D69

Strings

ccs, xrefs: 00007FF6E913F0F2
UTF-16LEUNICODE, xrefs: 00007FF6E913F155
UTF-8, xrefs: 00007FF6E913F136

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: f2afffe6052eb22f88312eb2a9052de40cf8af355caad6dfb5a285a3356e609b
Instruction ID: 98ae504c4e882027f6fe32be016b516714bb4ac94a299d1be6a7fc9647403eb5
Opcode Fuzzy Hash: f2afffe6052eb22f88312eb2a9052de40cf8af355caad6dfb5a285a3356e609b
Instruction Fuzzy Hash: 9E819E73E0C28395FB64EE39D1183F926B1AF11B44F568035DA0AD7395DE2FE885920B

Function 00007FF6E912C968 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6E912C993
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6E912CA2A
RtlUnwindEx.KERNEL32 ref: 00007FF6E912CA84

Strings

csm, xrefs: 00007FF6E912CA11

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
Instruction ID: 996bbf5850b090e861f2e459b720c95321ef42b381f324b5b03e210c93375f30
Opcode Fuzzy Hash: 8b87fa2c553d9157ee5c92b9fa7cd74c02d8a8cd0f0d05c46c7470457ee5a2ed
Instruction Fuzzy Hash: 5B519C33B196428ADB14EF15E844BB96791EF45B88F108170EB4E83788EF7EE841D709

Function 00007FF6E912E1F8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6E912E257
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6E912E2A3

Strings

MOC, xrefs: 00007FF6E912E26B
RCC, xrefs: 00007FF6E912E273

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 7372cc8c5436f01c7c5bf562e068c966f7e5f7c30121bdd0ddd9e56561cf3a97
Instruction ID: 63de3e25836c2c88daf22ca256a6e884cb79b176d4a4da2e30f0496569aaeece
Opcode Fuzzy Hash: 7372cc8c5436f01c7c5bf562e068c966f7e5f7c30121bdd0ddd9e56561cf3a97
Instruction Fuzzy Hash: 15617C3390CBC585DA21AF25E4407EAB7A0FB86798F044225EB9D83B95DF7DE190CB05

Function 00007FF6E912E5A8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6E912E5D0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF6E912E6B8

Strings

csm, xrefs: 00007FF6E912E5F2
csm, xrefs: 00007FF6E912E70A

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 35f1ba398413474562c31f87a28067be7b3dedf2abf1bb91a394967b9293af31
Instruction ID: c845ac556897b402bd69abbddd87fc89636d9b5f2a2bced331aee02178f2d2e9
Opcode Fuzzy Hash: 35f1ba398413474562c31f87a28067be7b3dedf2abf1bb91a394967b9293af31
Instruction Fuzzy Hash: 8951AE37A0C3428AEB64AF21D0483A877A0EF56B94F144135DA5D87BD5CF3EE450EB4A

Function 00007FF6E9127530 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF6E912324C,?,?,00007FF6E9123964), ref: 00007FF6E9127642

Strings

%s%c, xrefs: 00007FF6E91275B4
\, xrefs: 00007FF6E91275A7
%.*s, xrefs: 00007FF6E91275FB

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 1156698ca0d33aa8d2468b4f0fdefbfa17a3fd1640f2d1a941dba21d9585616c
Instruction ID: d8f0108e10685ef206590ff48d4245d846dda111d0a45c65b3294144a9b743e1
Opcode Fuzzy Hash: 1156698ca0d33aa8d2468b4f0fdefbfa17a3fd1640f2d1a941dba21d9585616c
Instruction Fuzzy Hash: F131D622B19AC149FA21AF25E4107EB6264FF45BE0F444231EE6DC37C9DE3DE2019705

Function 00007FF6E9122870 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E91286B0: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6E9123FA4,00000000,00007FF6E9121925), ref: 00007FF6E91286E9

MessageBoxW.USER32 ref: 00007FF6E9122906
MessageBoxA.USER32 ref: 00007FF6E912291A

Strings

Error/warning (ANSI fallback), xrefs: 00007FF6E912290E
Warning, xrefs: 00007FF6E91228F7

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error/warning (ANSI fallback)$Warning
API String ID: 1878133881-2698358428
Opcode ID: bedc3c020f71ec751042cc21f49bee78fdd2451348ef76e59aa444c99166d18b
Instruction ID: 9e046d37456d3a12c1e70b043ce2dbca257dfbff1ad384618c5fd955145ce9bc
Opcode Fuzzy Hash: bedc3c020f71ec751042cc21f49bee78fdd2451348ef76e59aa444c99166d18b
Instruction Fuzzy Hash: EA118B73628A8581FA249F10F451BED3368FF48B88F901136DA9C87644DF3ED606CB09

Function 00007FF6E913B8B0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF6E913B92F
WriteFile.KERNEL32 ref: 00007FF6E913BBF7
WriteFile.KERNEL32 ref: 00007FF6E913BC3D
GetLastError.KERNEL32 ref: 00007FF6E913BCF3

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: ce0c3b3fbf9f468b37350500bd40f597e2424e9246c9b6d769e6af97d5ebe549
Instruction ID: 551ab51b8368c7379f0ebd582f29295c2ece34c23f51462d4f5491bbb76eafcc
Opcode Fuzzy Hash: ce0c3b3fbf9f468b37350500bd40f597e2424e9246c9b6d769e6af97d5ebe549
Instruction Fuzzy Hash: 71D1DC73B18A8189E720CF79D4442FC37B1EB44B98B154236CE6E97B99EE39D006C309

Function 00007FF6E913C270 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E913C25B), ref: 00007FF6E913C38C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E913C25B), ref: 00007FF6E913C417

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 1f18d30cb6731d2276149ea46625d8d438ffcaf3b5eb5be8e43e25f336112fa7
Instruction ID: aca418d8617bed22e98effee9270e77b1f800acd05575a2b1ff1d24a80aef059
Opcode Fuzzy Hash: 1f18d30cb6731d2276149ea46625d8d438ffcaf3b5eb5be8e43e25f336112fa7
Instruction Fuzzy Hash: 0891AF73F0865285F751CF7594883FD2BB0AF54B88F154139DE0EA6A85DE3AD442C70A

Function 00007FF6E913EC9C Relevance: 6.2, APIs: 4, Instructions: 161COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6E913ED8C
_get_daylight.LIBCMT ref: 00007FF6E913ED9D
_get_daylight.LIBCMT ref: 00007FF6E913EDAE
_isindst.LIBCMT ref: 00007FF6E913EE79

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: fe74ad9a1dfbf97a60779a6b4eb4e3da65874cecf87de461c354fefb5b69a27d
Instruction ID: ed502c6bbe8d8e60ed2df9b26c7d04e2cdb19b1857ced57ef82ad6b13e60e502
Opcode Fuzzy Hash: fe74ad9a1dfbf97a60779a6b4eb4e3da65874cecf87de461c354fefb5b69a27d
Instruction Fuzzy Hash: BA51E573F082128BEB18DF749A497FC2BB1AF24758F510135DD1E92AE5DF3AA4028706

Function 00007FF6E9134A8C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF6E9134ABF
GetFileInformationByHandle.KERNEL32 ref: 00007FF6E9134B21
GetLastError.KERNEL32 ref: 00007FF6E9134BB2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6E91349C4), ref: 00007FF6E9134BFE

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 1ec8bf387a2241cb1ee0019bb6bb5a321e30a3d38cbcbe421edb0c1d83f6d5d9
Instruction ID: 4cdb147470e7e3161234bf11b4ba07b3325d54db7a5c7b48dd013f017ed2b11b
Opcode Fuzzy Hash: 1ec8bf387a2241cb1ee0019bb6bb5a321e30a3d38cbcbe421edb0c1d83f6d5d9
Instruction Fuzzy Hash: AA515623E086418AFB14DFB194583FD27B1AF48B98F128535DA4987B89DF39E481874A

Function 00007FF6E9134938 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9134965
CreateFileW.KERNEL32 ref: 00007FF6E91349A4
CloseHandle.KERNEL32 ref: 00007FF6E91349D9

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: ebea2a15e315379b7438f17c06ac6f564ef77e5ce815d722b4931623952d3bd6
Instruction ID: 074b873ba83cddd6c46664a519ab5a037cd84ee1c405a00cbd58982baa84f243
Opcode Fuzzy Hash: ebea2a15e315379b7438f17c06ac6f564ef77e5ce815d722b4931623952d3bd6
Instruction Fuzzy Hash: 9B418D23E1878283E710CF3195443A97260FFA87A4F119334EA9983BD5DF6DA1A08709

Function 00007FF6E9122030 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF6E9122064
SetWindowLongPtrW.USER32 ref: 00007FF6E9122086
GetWindowLongPtrW.USER32 ref: 00007FF6E91220B0
InvalidateRect.USER32 ref: 00007FF6E91220D0

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 4b9e5de1fbcf843bc779a4d54dee57f94c26a540a6e6e96758728fc1cf1e39ca
Instruction ID: 36265b2c741b4707e461b838d2a0c16255c693c46d8243d2600276fc36122172
Opcode Fuzzy Hash: 4b9e5de1fbcf843bc779a4d54dee57f94c26a540a6e6e96758728fc1cf1e39ca
Instruction Fuzzy Hash: 6811E922F0814242FA58AF6AF5443FD1291EF89B90F888431DE4987B8DCD3ED4C1960E

Function 00007FF6E9144E2C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6E9140A70: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6E9140AA3

_get_daylight.LIBCMT ref: 00007FF6E9144F44
_get_daylight.LIBCMT ref: 00007FF6E9144F55

Strings

?, xrefs: 00007FF6E9144ED5

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 03a08327e3a10131aa5bb8fa3ef37a2eed6d70488736d84a243644e572cc7fb3
Instruction ID: 97e11e84b45b3bb769d452f473ecb9a75d035a63ea3ffc14a450be8778d2d246
Opcode Fuzzy Hash: 03a08327e3a10131aa5bb8fa3ef37a2eed6d70488736d84a243644e572cc7fb3
Instruction Fuzzy Hash: B4412813B1868242FB209F25D5053F966A1EF84BA8F104234EE5D86BD5DF3ED442CB0A

Function 00007FF6E913832C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E913835E

Part of subcall function 00007FF6E9139C58: HeapFree.KERNEL32(?,?,?,00007FF6E9142032,?,?,?,00007FF6E914206F,?,?,00000000,00007FF6E9142535,?,?,?,00007FF6E9142467), ref: 00007FF6E9139C6E
Part of subcall function 00007FF6E9139C58: GetLastError.KERNEL32(?,?,?,00007FF6E9142032,?,?,?,00007FF6E914206F,?,?,00000000,00007FF6E9142535,?,?,?,00007FF6E9142467), ref: 00007FF6E9139C78

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6E912BEC5), ref: 00007FF6E913837C

Strings

C:\Users\user\Desktop\1fi2LiofgW.exe, xrefs: 00007FF6E913836A

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\1fi2LiofgW.exe
API String ID: 3580290477-23558427
Opcode ID: 53ad205ea1c6cb2f7bb7661613e3da0ecc1c0905bf47b453e04b3a6da8a19941
Instruction ID: 113d090a6850eae37e0bd3b9c9fc29db155a1093a68808f05f7f4e3ba76616d0
Opcode Fuzzy Hash: 53ad205ea1c6cb2f7bb7661613e3da0ecc1c0905bf47b453e04b3a6da8a19941
Instruction Fuzzy Hash: E9419D33A08B52C5EB15DF36A4852FC23B4FF45794B564035EA4E83B86DE3EE481830A

Function 00007FF6E913F8E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E913F916

Part of subcall function 00007FF6E913E8C8: GetCurrentDirectoryW.KERNEL32 ref: 00007FF6E913E908

Strings

., xrefs: 00007FF6E913F967
:, xrefs: 00007FF6E913F956

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: CurrentDirectory_invalid_parameter_noinfo
String ID: .$:
API String ID: 2020911589-4202072812
Opcode ID: 02917ae70002487e25aaa57807b70e18839398bc457e7bd9011200fb9d4eab61
Instruction ID: b4966ff43dd3f3d35506e7b07b8861e6b06e8048c19757f1ec329183906a8392
Opcode Fuzzy Hash: 02917ae70002487e25aaa57807b70e18839398bc457e7bd9011200fb9d4eab61
Instruction Fuzzy Hash: 77417123F0879298FB11EFB198553FC2674AF14358F560039EE4DA7B89DF3A9485830A

Function 00007FF6E913BF48 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF6E913C05F
GetLastError.KERNEL32 ref: 00007FF6E913C081

Strings

U, xrefs: 00007FF6E913C00B

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 0b7df1583adeec31525a7cba2b12c3ee68d62bc9877546cbea7757f0bce6ed29
Instruction ID: d30cea4b3639ba5902fcac206a0e13b06938b8c7f190c1f811770c34d29a061b
Opcode Fuzzy Hash: 0b7df1583adeec31525a7cba2b12c3ee68d62bc9877546cbea7757f0bce6ed29
Instruction Fuzzy Hash: E0418D23A18A8592EB20DF25E8483EA67A4FB98794F854031EE4DC7798EF3DD441CB45

Function 00007FF6E913E8C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF6E913E908
GetCurrentDirectoryW.KERNEL32 ref: 00007FF6E913E95A

Strings

:, xrefs: 00007FF6E913E91E

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: e37c33f8f2befd5fbd3c49cdc0b6d52123385b6fd944ea7372e41dd3f6ca63dc
Instruction ID: 6d9ae807c1ddff310f8b5d60be9ec407fa91786a0c4c0502ad194f287dcc3bb8
Opcode Fuzzy Hash: e37c33f8f2befd5fbd3c49cdc0b6d52123385b6fd944ea7372e41dd3f6ca63dc
Instruction Fuzzy Hash: 6B216F23B0C78282EB64DF2594483AD67B1FF98B84F464035DA8D83684DF7EE9458B46

Function 00007FF6E912F068 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF6E912F0B8
RaiseException.KERNEL32 ref: 00007FF6E912F0F9

Strings

csm, xrefs: 00007FF6E912F0E6

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 353d784395b77eefcba7ec404c7e4e47dbaba59ece92a9373595b893a828088a
Instruction ID: 65fa9809f4ff0147622cecf9eb89f52a6c1ce16bac807bdcd2fd1787a8f4ad2c
Opcode Fuzzy Hash: 353d784395b77eefcba7ec404c7e4e47dbaba59ece92a9373595b893a828088a
Instruction Fuzzy Hash: FF113736618B8482EB218F25F4402A9B7A5FF89B88F184230DB8D87768DF3DD5518B04

Function 00007FF6E913FA4C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6E913FA7C
GetDriveTypeW.KERNEL32 ref: 00007FF6E913FABC

Strings

:, xrefs: 00007FF6E913FAA5

Memory Dump Source

Source File: 00000000.00000002.1402711357.00007FF6E9121000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6E9120000, based on PE: true

Associated: 00000000.00000002.1402695099.00007FF6E9120000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402737364.00007FF6E914B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E915E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402759893.00007FF6E9164000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1402791210.00007FF6E9166000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6e9120000_1fi2LiofgW.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
Instruction ID: e68061acba0816f0e2637b784ad11b8885307e0f72ea8d81bead56bf113ab7af
Opcode Fuzzy Hash: 229dc5225c97c31120184e1c5c073253f760aebc87e6502baf4f3d3b6f3e4c47
Instruction Fuzzy Hash: F3017C23A2C28686FB20EF7094693FE76A0EF48708F410035D54DC2791DE3EE5448A1A

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1fi2LiofgW.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

DNS Answers

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: 1fi2LiofgW.exePID: 7580, Parent PID: 3504

General

Chronological Activities

Disassembly

Analysis Process: 1fi2LiofgW.exePID: 7580, Parent PID: 3504COMMON

Execution Graph

Graph

Executed Functions

Function 00007FF6E9121000 Relevance: 40.6, APIs: 5, Strings: 18, Instructions: 338COMMON

Control-flow Graph

Function 00007FF6E9145C74 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON

Control-flow Graph

Windows Analysis Report
1fi2LiofgW.exe

Function 00007FF6E9121000 Relevance: 40.6, APIs: 5, Strings: 18, Instructions: 338
COMMON

Function 00007FF6E9145C74 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Function 00007FF6E91285A0 Relevance: 3.0, APIs: 2, Instructions: 29
COMMON

Function 00007FF6E91218F0 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 172
COMMON

Function 00007FF6E913AD6C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Function 00007FF6E91233E0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 59
COMMON

Function 00007FF6E91225F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44
windowCOMMON

Function 00007FF6E912BF5C Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Function 00007FF6E9138D48 Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Function 00007FF6E912F45C Relevance: 3.2, APIs: 2, Instructions: 177
COMMONLIBRARYCODE

Function 00007FF6E913B444 Relevance: 3.0, APIs: 2, Instructions: 46
COMMONLIBRARYCODE

Function 00007FF6E9139E68 Relevance: 2.6, APIs: 2, Instructions: 59
COMMON

Function 00007FF6E913B1BC Relevance: 1.6, APIs: 1, Instructions: 112
COMMONLIBRARYCODE

Function 00007FF6E91276A0 Relevance: 1.6, APIs: 1, Instructions: 85
COMMON

Function 00007FF6E913AC4C Relevance: 1.6, APIs: 1, Instructions: 79
COMMONLIBRARYCODE