Edit tour

Windows Analysis Report
lmtyweWwbU.exe

Overview

General Information

Sample name:	lmtyweWwbU.exe renamed because original name is a hash value
Original sample name:	d3be4981a8db02dab1f214565fc5b0b6748ff6fa218b0bcc46a915229f8078f3.exe
Analysis ID:	1664472
MD5:	d436e0b4a9aa7b9a6641ea93c4dba8ae
SHA1:	a33e3e532dc90f08e111eab0762bce9158fd37e2
SHA256:	d3be4981a8db02dab1f214565fc5b0b6748ff6fa218b0bcc46a915229f8078f3
Tags:	96-9-125-200exeuser-JAMESWT_WT
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

Sigma detected: Potentially Suspicious Malware Callback Communication

Uses cmd line tools excessively to alter registry or file data

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

Program does not show much activity (idle)

Classification

Process Tree

System is w10x64

lmtyweWwbU.exe (PID: 6644 cmdline: "C:\Users\user\Desktop\lmtyweWwbU.exe" MD5: D436E0B4A9AA7B9A6641EA93C4DBA8AE)

conhost.exe (PID: 6656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 7076 cmdline: "attrib" +h +s C:\Users\user\Desktop\lmtyweWwbU.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

attrib.exe (PID: 7068 cmdline: "attrib" +h +s C:\Users\user\Desktop\SystemHelper.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

SystemHelper.exe (PID: 6284 cmdline: "C:\Users\user\Desktop\SystemHelper.exe" MD5: D436E0B4A9AA7B9A6641EA93C4DBA8AE)

attrib.exe (PID: 6256 cmdline: "attrib" +h +s C:\Users\user\Desktop\SystemHelper.exe MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

cleanup

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious Malware Callback Communication

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 96.9.125.200, DestinationIsIpv6: false, DestinationPort: 4443, EventID: 3, Image: C:\Users\user\Desktop\SystemHelper.exe, Initiated: true, ProcessId: 6284, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49692

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• Compliance
• Networking
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

Source: lmtyweWwbU.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: Freelancer_Contract_Viewer.pdb source: lmtyweWwbU.exe

Source: global traffic

TCP traffic: 192.168.2.8:49692 -> 96.9.125.200:4443

Source: Joe Sandbox View

ASN Name: 2ICSYSTEMSINCCA 2ICSYSTEMSINCCA

Source: unknown	TCP traffic detected without corresponding DNS query: 96.9.125.200
Source: unknown	TCP traffic detected without corresponding DNS query: 96.9.125.200
Source: unknown	TCP traffic detected without corresponding DNS query: 96.9.125.200
Source: unknown	TCP traffic detected without corresponding DNS query: 96.9.125.200
Source: unknown	TCP traffic detected without corresponding DNS query: 96.9.125.200

Source: C:\Users\user\Desktop\lmtyweWwbU.exe

Code function: 0_2_00007FF6D34DE250 recv,WSAGetLastError,

0_2_00007FF6D34DE250

Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Code function: 0_2_00007FF6D34E5D20 NtReadFile,WaitForSingleObject,RtlNtStatusToDosError,	0_2_00007FF6D34E5D20
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Code function: 0_2_00007FF6D34E59F0 NtReadFile,WaitForSingleObject,RtlNtStatusToDosError,	0_2_00007FF6D34E59F0
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Code function: 0_2_00007FF6D34E5E40 NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,	0_2_00007FF6D34E5E40

Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Code function: 0_2_00007FF6D34E80D0	0_2_00007FF6D34E80D0
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Code function: 0_2_00007FF6D34F0D10	0_2_00007FF6D34F0D10
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Code function: 0_2_00007FF6D34FA4C0	0_2_00007FF6D34FA4C0
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Code function: 0_2_00007FF6D34E4C00	0_2_00007FF6D34E4C00
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Code function: 0_2_00007FF6D34DD400	0_2_00007FF6D34DD400
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Code function: 0_2_00007FF6D34FDAC0	0_2_00007FF6D34FDAC0
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Code function: 0_2_00007FF6D34FAAC0	0_2_00007FF6D34FAAC0
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Code function: 0_2_00007FF6D34F11A0	0_2_00007FF6D34F11A0
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Code function: 0_2_00007FF6D34FE1C0	0_2_00007FF6D34FE1C0
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Code function: 0_2_00007FF6D34E2880	0_2_00007FF6D34E2880
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Code function: 0_2_00007FF6D34D60B0	0_2_00007FF6D34D60B0
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Code function: 0_2_00007FF6D34FB0C0	0_2_00007FF6D34FB0C0
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Code function: 0_2_00007FF6D34F2F20	0_2_00007FF6D34F2F20
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Code function: 0_2_00007FF6D34DE6C0	0_2_00007FF6D34DE6C0
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Code function: 0_2_00007FF6D34F9D90	0_2_00007FF6D34F9D90
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Code function: 0_2_00007FF6D34F8600	0_2_00007FF6D34F8600

Source: C:\Users\user\Desktop\lmtyweWwbU.exe

Code function: String function: 00007FF6D34FD430 appears 65 times

Source: classification engine

Classification label: mal48.winEXE@10/0@0/1

Source: C:\Users\user\Desktop\lmtyweWwbU.exe

Code function: 0_2_00007FF6D34E5F60 memset,GetModuleHandleW,FormatMessageW,GetLastError,

0_2_00007FF6D34E5F60

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6656:120:WilError_03

Source: lmtyweWwbU.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\lmtyweWwbU.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\lmtyweWwbU.exe "C:\Users\user\Desktop\lmtyweWwbU.exe"
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Process created: C:\Windows\System32\attrib.exe "attrib" +h +s C:\Users\user\Desktop\lmtyweWwbU.exe
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Process created: C:\Windows\System32\attrib.exe "attrib" +h +s C:\Users\user\Desktop\SystemHelper.exe
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Process created: C:\Users\user\Desktop\SystemHelper.exe "C:\Users\user\Desktop\SystemHelper.exe"
Source: C:\Users\user\Desktop\SystemHelper.exe	Process created: C:\Windows\System32\attrib.exe "attrib" +h +s C:\Users\user\Desktop\SystemHelper.exe
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Process created: C:\Windows\System32\attrib.exe "attrib" +h +s C:\Users\user\Desktop\lmtyweWwbU.exe	Jump to behavior
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Process created: C:\Windows\System32\attrib.exe "attrib" +h +s C:\Users\user\Desktop\SystemHelper.exe	Jump to behavior
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Process created: C:\Users\user\Desktop\SystemHelper.exe "C:\Users\user\Desktop\SystemHelper.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SystemHelper.exe	Process created: C:\Windows\System32\attrib.exe "attrib" +h +s C:\Users\user\Desktop\SystemHelper.exe	Jump to behavior

Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Users\user\Desktop\SystemHelper.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SystemHelper.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\SystemHelper.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SystemHelper.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior

Source: lmtyweWwbU.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: lmtyweWwbU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: lmtyweWwbU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: lmtyweWwbU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: lmtyweWwbU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: lmtyweWwbU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: lmtyweWwbU.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: lmtyweWwbU.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: lmtyweWwbU.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: Freelancer_Contract_Viewer.pdb source: lmtyweWwbU.exe

Source: lmtyweWwbU.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: lmtyweWwbU.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: lmtyweWwbU.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: lmtyweWwbU.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: lmtyweWwbU.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\lmtyweWwbU.exe

Code function: 0_2_00007FF6D34F1D30 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,memset,GetProcAddress,GetCurrentProcess,lstrlenW,GetCurrentProcessId,CreateMutexA,CloseHandle,GetProcAddress,GetCurrentProcess,GetProcAddress,GetCurrentProcess,ReleaseMutex,

0_2_00007FF6D34F1D30

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Process created: attrib.exe
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Process created: attrib.exe
Source: C:\Users\user\Desktop\SystemHelper.exe	Process created: attrib.exe
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Users\user\Desktop\SystemHelper.exe	Process created: attrib.exe	Jump to behavior

Source: C:\Users\user\Desktop\lmtyweWwbU.exe

API coverage: 9.6 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: SystemHelper.exe, 00000005.00000002.1112017135.0000020BCA2C4000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\lmtyweWwbU.exe

Code function: 0_2_00007FF6D3500124 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6D3500124

Source: C:\Users\user\Desktop\lmtyweWwbU.exe

0_2_00007FF6D34F1D30

Source: C:\Users\user\Desktop\lmtyweWwbU.exe

Code function: 0_2_00007FF6D34F04A0 GetProcessHeap,HeapAlloc,

0_2_00007FF6D34F04A0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Code function: 0_2_00007FF6D35002C8 SetUnhandledExceptionFilter,		0_2_00007FF6D35002C8
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Code function: 0_2_00007FF6D3500124 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00007FF6D3500124

Source: C:\Users\user\Desktop\lmtyweWwbU.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Process created: C:\Windows\System32\attrib.exe "attrib" +h +s C:\Users\user\Desktop\lmtyweWwbU.exe	Jump to behavior
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Process created: C:\Windows\System32\attrib.exe "attrib" +h +s C:\Users\user\Desktop\SystemHelper.exe	Jump to behavior
Source: C:\Users\user\Desktop\lmtyweWwbU.exe	Process created: C:\Users\user\Desktop\SystemHelper.exe "C:\Users\user\Desktop\SystemHelper.exe"	Jump to behavior
Source: C:\Users\user\Desktop\SystemHelper.exe	Process created: C:\Windows\System32\attrib.exe "attrib" +h +s C:\Users\user\Desktop\SystemHelper.exe	Jump to behavior

Source: C:\Users\user\Desktop\lmtyweWwbU.exe

Code function: 0_2_00007FF6D34FFFFC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6D34FFFFC

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
lmtyweWwbU.exe	1%	Virustotal		Browse
lmtyweWwbU.exe	0%	ReversingLabs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
96.9.125.200	unknown	Canada		30295	2ICSYSTEMSINCCA	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1664472
Start date and time:	2025-04-14 11:12:19 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	lmtyweWwbU.exe renamed because original name is a hash value
Original Sample Name:	d3be4981a8db02dab1f214565fc5b0b6748ff6fa218b0bcc46a915229f8078f3.exe
Detection:	MAL
Classification:	mal48.winEXE@10/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 93% Number of executed functions: 13 Number of non-executed functions: 51
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 184.28.213.193
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, otelrules.svc.static.microsoft, ctldl.windowsupdate.com, c.pki.goog, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
2ICSYSTEMSINCCA	nborepadiktad.exe	Get hash	malicious	WhiteSnake Stealer	Browse	96.9.124.250
	gopawdkrjgh.exe	Get hash	malicious	WhiteSnake Stealer	Browse	96.9.124.250
	sora.mpsl.elf	Get hash	malicious	Mirai	Browse	69.67.173.63
	f5m6aL0Mjl.exe	Get hash	malicious	RHADAMANTHYS	Browse	96.9.125.78
	9ua5N7dcBZ.exe	Get hash	malicious	Amadey, RHADAMANTHYS	Browse	96.9.125.78
	https://fingerlakesanglingzone.com/reports	Get hash	malicious	Unknown	Browse	96.9.124.200
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	69.67.161.49
	SecuriteInfo.com.Linux.Siggen.9999.32301.6786.elf	Get hash	malicious	Mirai	Browse	69.31.168.62
	4gMPx4n6iT.elf	Get hash	malicious	Mirai	Browse	69.31.181.10
	cX2zCKQ7Z2.elf	Get hash	malicious	Mirai	Browse	69.67.173.69

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.292428629980115
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	lmtyweWwbU.exe
File size:	278'016 bytes
MD5:	d436e0b4a9aa7b9a6641ea93c4dba8ae
SHA1:	a33e3e532dc90f08e111eab0762bce9158fd37e2
SHA256:	d3be4981a8db02dab1f214565fc5b0b6748ff6fa218b0bcc46a915229f8078f3
SHA512:	78b226f55a3087cfa12227247f92c6fdb4f27e1e9bc03eb8c903b8e7fe0ee863553a2047715d0c050456798b60df9619b52cb06c8fe821f631cdda0acb8166a6
SSDEEP:	6144:IiORg+StTT88UEaUpKU6lBITTIqY2nWcLOqlkY2ayjtdAVhHHK0/q0Mc:Iiu5j8UEkOrm
TLSH:	B5443A217A559CACD94AC07883468A736572B4CA1B32F9FF02C445393F6FEF52E38658
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........P.C.1...1...1...I...1.......1.......1.......1.......1...I...1...1..V1...1...1....s..1.......1..Rich.1..........PE..d...~4.g...

File Icon


Icon Hash:	39d2c0daeafad051

Static PE Info

General

Entrypoint:	0x14002fd1c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67FC347E [Sun Apr 13 22:02:38 2025 UTC]
TLS Callbacks:	0x40021b20, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	36a29e8472db44f83c8c0771c7937c8c

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FDFBC8C845Ch
dec eax
add esp, 28h
jmp 00007FDFBC8C7FF7h
int3
int3
int3
int3
int3
int3
int3
int3
nop word ptr [eax+eax+00000000h]
dec eax
sub esp, 10h
dec esp
mov dword ptr [esp], edx
dec esp
mov dword ptr [esp+08h], ebx
dec ebp
xor ebx, ebx
dec esp
lea edx, dword ptr [esp+18h]
dec esp
sub edx, eax
dec ebp
cmovb edx, ebx
dec esp
mov ebx, dword ptr [00000010h]
dec ebp
cmp edx, ebx
jnc 00007FDFBC8C8198h
inc cx
and edx, 8D4DF000h
wait
add al, dh

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3f71c	0x118	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x45000	0x18b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x42000	0x23a0	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x47000	0x4bc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x39700	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x39780	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x395c0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x32000	0x428	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x30b2f	0x30c00	57e8aa82890cfdcbe764b423637aea03	False	0.4995392628205128	data	6.285967484787889	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x32000	0xe622	0xe800	ded99f843977934864a950024b4575fd	False	0.3484307650862069	370 XA sysV pure executable	5.289124756054743	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x41000	0x310	0x200	0986951de0dd3ab6f041638c54850010	False	0.228515625	data	1.6518190552773089	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x42000	0x23a0	0x2400	e4b52d43f1cf63b59b3eb05bf27421d5	False	0.4940321180555556	data	5.373019336555336	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x45000	0x18b0	0x1a00	1c86f22f25022d87c713c84503e5e7fb	False	0.8236177884615384	data	7.040790659875909	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x47000	0x4bc	0x600	bcbca46df6e1a9d81082be75c10e9e02	False	0.5481770833333334	data	4.807697483412515	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x45310	0x1588	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9299709724238027
RT_GROUP_ICON	0x46898	0x14	data	English	United States	1.05
RT_VERSION	0x450f0	0x21c	data	English	United States	0.4703703703703704

Imports

DLL	Import
SHELL32.dll	SHChangeNotify
api-ms-win-core-synch-l1-2-0.dll	WaitOnAddress, WakeByAddressAll, WakeByAddressSingle
bcryptprimitives.dll	ProcessPrng
KERNEL32.dll	GetModuleHandleA, SetUnhandledExceptionFilter, UnhandledExceptionFilter, IsDebuggerPresent, InitializeSListHead, GetSystemTimeAsFileTime, GetCurrentThreadId, CloseHandle, GetConsoleWindow, FreeEnvironmentStringsW, CompareStringOrdinal, GetLastError, AddVectoredExceptionHandler, SetThreadStackGuarantee, GetCurrentThread, WaitForSingleObject, QueryPerformanceCounter, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, SetLastError, GetCurrentDirectoryW, GetEnvironmentStringsW, GetEnvironmentVariableW, SetFileInformationByHandle, GetCurrentProcess, DuplicateHandle, GetStdHandle, GetCurrentProcessId, SetHandleInformation, WriteFileEx, SleepEx, GetExitCodeProcess, GetProcessHeap, HeapFree, HeapReAlloc, lstrlenW, ReleaseMutex, CreateFileW, CreateEventW, GetOverlappedResult, MoveFileExW, ReadFile, CancelIo, GetModuleHandleW, FormatMessageW, GetModuleFileNameW, ExitProcess, CreateNamedPipeW, ReadFileEx, WaitForMultipleObjects, GetFullPathNameW, GetSystemDirectoryW, GetWindowsDirectoryW, CreateProcessW, GetFileAttributesW, GetConsoleMode, GetConsoleOutputCP, MultiByteToWideChar, WriteConsoleW, WideCharToMultiByte, CreateThread, IsProcessorFeaturePresent, GetProcAddress, HeapAlloc, WaitForSingleObjectEx, LoadLibraryA, CreateMutexA
USER32.dll	ShowWindow
ntdll.dll	RtlNtStatusToDosError, NtReadFile, NtWriteFile
WS2_32.dll	recv, send, WSASocketW, getaddrinfo, connect, WSAGetLastError, freeaddrinfo, WSACleanup, WSAStartup, closesocket
VCRUNTIME140.dll	__C_specific_handler, __current_exception_context, _CxxThrowException, memmove, memset, memcmp, __CxxFrameHandler3, memcpy, __current_exception
api-ms-win-crt-runtime-l1-1-0.dll	exit, _exit, _initterm_e, _initterm, _configure_narrow_argv, __p___argv, _cexit, _c_exit, _register_thread_local_exe_atexit_callback, _get_initial_narrow_environment, _set_app_type, _seh_filter_exe, _initialize_onexit_table, _register_onexit_function, _crt_atexit, terminate, __p___argc, _initialize_narrow_environment
api-ms-win-crt-math-l1-1-0.dll	__setusermatherr
api-ms-win-crt-stdio-l1-1-0.dll	_set_fmode, __p__commode
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale
api-ms-win-crt-heap-l1-1-0.dll	free, _set_new_mode

Version Infos

Description	Data
FileDescription	Freelancer_Contract_Viewer
ProductVersion	0.1.0
SubSystem	windows
FileVersion	0.1.0
ProductName	Freelancer_Contract_Viewer
Translation	0x0000 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Download Network PCAP: filtered – full

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 14, 2025 11:13:21.245634079 CEST	49692	4443	192.168.2.8	96.9.125.200
Apr 14, 2025 11:13:22.230652094 CEST	49692	4443	192.168.2.8	96.9.125.200
Apr 14, 2025 11:13:24.230693102 CEST	49692	4443	192.168.2.8	96.9.125.200
Apr 14, 2025 11:13:28.230592966 CEST	49692	4443	192.168.2.8	96.9.125.200
Apr 14, 2025 11:13:36.230555058 CEST	49692	4443	192.168.2.8	96.9.125.200

Statistics

Click to jump to process

Memory Usage

• lmtyweWwbU.exe
• conhost.exe
• attrib.exe
• attrib.exe
• SystemHelper.exe
• attrib.exe

Click to jump to process

High Level Behavior Distribution

• File
• Network

Click to dive into process behavior distribution

Behavior

• lmtyweWwbU.exe
• conhost.exe
• attrib.exe
• attrib.exe
• SystemHelper.exe
• attrib.exe

Click to jump to process

Target ID:	0
Start time:	05:13:19
Start date:	14/04/2025
Path:	C:\Users\user\Desktop\lmtyweWwbU.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\lmtyweWwbU.exe"
Imagebase:	0x7ff6d34d0000
File size:	278'016 bytes
MD5 hash:	D436E0B4A9AA7B9A6641EA93C4DBA8AE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:13:19
Start date:	14/04/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6e60e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:13:19
Start date:	14/04/2025
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	"attrib" +h +s C:\Users\user\Desktop\lmtyweWwbU.exe
Imagebase:	0x7ff762130000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:13:19
Start date:	14/04/2025
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	"attrib" +h +s C:\Users\user\Desktop\SystemHelper.exe
Imagebase:	0x7ff762130000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:13:20
Start date:	14/04/2025
Path:	C:\Users\user\Desktop\SystemHelper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SystemHelper.exe"
Imagebase:	0x7ff6d34d0000
File size:	278'016 bytes
MD5 hash:	D436E0B4A9AA7B9A6641EA93C4DBA8AE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:13:20
Start date:	14/04/2025
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	"attrib" +h +s C:\Users\user\Desktop\SystemHelper.exe
Imagebase:	0x7ff762130000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11.2%
Total number of Nodes:	374
Total number of Limit Nodes:	8

Executed Functions

Function 00007FF6D34E80D0 Relevance: 101.7, APIs: 48, Strings: 8, Instructions: 3730COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00007FF6D34E8153
FreeEnvironmentStringsW.KERNEL32 ref: 00007FF6D34E82F1
GetLastError.KERNEL32 ref: 00007FF6D34EC1F4

Strings

PATHlibrary\std\src\sys_common\process.rs, xrefs: 00007FF6D34EAE9E
.exeprogram not found, xrefs: 00007FF6D34E8DB7
assertion failed: is_code_point_boundary(self, new_len), xrefs: 00007FF6D34EA16C
\?\\, xrefs: 00007FF6D34E8BBA
exe\\.\NUL, xrefs: 00007FF6D34E9FDE, 00007FF6D34EA85A, 00007FF6D34EAA3C, 00007FF6D34EAD1C, 00007FF6D34EAF19
]?\\, xrefs: 00007FF6D34E8BC2
assertion failed: self.height > 0, xrefs: 00007FF6D34EB708
+h+s, xrefs: 00007FF6D34E80DA

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: EnvironmentStrings$ErrorFreeLast
String ID: +h+s$.exeprogram not found$PATHlibrary\std\src\sys_common\process.rs$\?\\$]?\\$assertion failed: is_code_point_boundary(self, new_len)$assertion failed: self.height > 0$exe\\.\NUL
API String ID: 2773867918-936566986
Opcode ID: 74e60ae3f312558d97e96cd270dbf014c8830b4e3e7a1ca416577275b99136a3
Instruction ID: 9bbcdca6a4a6b63a0c84e11fb8fe1232b45321facb6ab804dc19caa738ff1d8e
Opcode Fuzzy Hash: 74e60ae3f312558d97e96cd270dbf014c8830b4e3e7a1ca416577275b99136a3
Instruction Fuzzy Hash: D2836A62A19BD188EB70CF25D8563EEA7A0FB45789F005136CA4DEBB99DF7D9250C300

Function 00007FF6D34D1AE0 Relevance: 21.8, APIs: 8, Strings: 4, Instructions: 790
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNEL32 ref: 00007FF6D34D1B06
memcmp.VCRUNTIME140 ref: 00007FF6D34D1DD1
memset.VCRUNTIME140 ref: 00007FF6D34D203F

Strings

SystemHelper.exeattrib+h+s, xrefs: 00007FF6D34D1B6E
96.9.125.200:, xrefs: 00007FF6D34D1F4F
powershell-NoProfile-CommandFailed: , xrefs: 00007FF6D34D20BC
called `Result::unwrap()` on an `Err` valuesrc\main.rs, xrefs: 00007FF6D34D288E, 00007FF6D34D28C9

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: ConsoleWindowmemcmpmemset
String ID: 96.9.125.200:$SystemHelper.exeattrib+h+s$called `Result::unwrap()` on an `Err` valuesrc\main.rs$powershell-NoProfile-CommandFailed:
API String ID: 229161744-4265087233
Opcode ID: c8c1d68abef6f3159179bfb79c8e54515be5a4b3739bac9073881af563461858
Instruction ID: a7a0c4f54c37fe5537cab4124160f091f09254b860346886837305271b1deaf5
Opcode Fuzzy Hash: c8c1d68abef6f3159179bfb79c8e54515be5a4b3739bac9073881af563461858
Instruction Fuzzy Hash: AD924C66604AC588EB708F21EC523ED63A1FB8578CF444036CE4CEBB9ADF399265C740

Function 00007FF6D34E0E20 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 202
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6D34E80D0: GetEnvironmentStringsW.KERNEL32 ref: 00007FF6D34E8153

CloseHandle.KERNEL32 ref: 00007FF6D34E0EA9
CloseHandle.KERNEL32 ref: 00007FF6D34E0F82
WaitForSingleObject.KERNEL32 ref: 00007FF6D34E0FBC
GetLastError.KERNEL32 ref: 00007FF6D34E0FC6
GetExitCodeProcess.KERNELBASE ref: 00007FF6D34E1020
CloseHandle.KERNEL32 ref: 00007FF6D34E1053
CloseHandle.KERNEL32 ref: 00007FF6D34E105A
CloseHandle.KERNEL32 ref: 00007FF6D34E1130

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF6D34E0F3D, 00007FF6D34E10C0, 00007FF6D34E10EE
+h+s, xrefs: 00007FF6D34E0E2A

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: CloseHandle$CodeEnvironmentErrorExitLastObjectProcessSingleStringsWait
String ID: +h+s$called `Result::unwrap()` on an `Err` value
API String ID: 2735310334-1599662052
Opcode ID: 4d4f5c242cc3d4af45188a03a80120aefa6abb48eb4bbdade81a95a872c2f4c3
Instruction ID: 520bbdff145bf22eed2c1e1527e82f5b29cbacf174551d66d213e568dafdf610
Opcode Fuzzy Hash: 4d4f5c242cc3d4af45188a03a80120aefa6abb48eb4bbdade81a95a872c2f4c3
Instruction Fuzzy Hash: 48912A36A04B8699EB10CF62E8413EDB760FB4479CF144136EE5DA3A98DF79E1A5C340

Function 00007FF6D34D1000 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 273
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MoveFileExW.KERNELBASE ref: 00007FF6D34E551B
GetLastError.KERNEL32 ref: 00007FF6D34E5571

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF6D34E5761

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: ErrorFileLastMove
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 55378915-2333694755
Opcode ID: a8617a16626a3037c86329d4917c2494ec6af09127abfceec438aa53081fcd60
Instruction ID: 172180813b3611acfdef6a2acaabb2d6ed4ecc1cedc4fa84364e7b0f96d10655
Opcode Fuzzy Hash: a8617a16626a3037c86329d4917c2494ec6af09127abfceec438aa53081fcd60
Instruction Fuzzy Hash: B8A1DF66B04B5585EB10CF62E9423ADA7A1BB48BE8F044532ED5DFBB89DF3CD1618340

Function 00007FF6D34FFBA0 Relevance: 12.1, APIs: 8, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6D34FFBC9
__scrt_release_startup_lock.LIBCMT ref: 00007FF6D34FFC37
_register_thread_local_exe_atexit_callback.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D34FFC85
_get_initial_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D34FFC8A
__p___argv.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D34FFC92
__p___argc.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D34FFC9A
_cexit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D34FFCBC
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6D34FFD16

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: __p___argc__p___argv__scrt_acquire_startup_lock__scrt_release_startup_lock_cexit_exit_get_initial_narrow_environment_register_thread_local_exe_atexit_callback
String ID:
API String ID: 1133592946-0
Opcode ID: 90eaca60c96de90c4d48f7279ca6165ddfdf825a69647cdd433849f946516a16
Instruction ID: 557112cf6e3a8f0141ac68216658d5bafed0dd968b0674633ac8d98deb2625b5
Opcode Fuzzy Hash: 90eaca60c96de90c4d48f7279ca6165ddfdf825a69647cdd433849f946516a16
Instruction Fuzzy Hash: 89315222A0C59B42FA50AB26D4133BDD391AF85788F484137EA4EE72D7DF2DE425C750

Function 00007FF6D34E7680 Relevance: 10.7, APIs: 7, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6D34E79D0: CreateEventW.KERNEL32(?,?,?,?,00000000,00000001,?,00007FF6D34E76BD), ref: 00007FF6D34E7A00

CloseHandle.KERNEL32 ref: 00007FF6D34E76CF
WaitForMultipleObjects.KERNEL32 ref: 00007FF6D34E7771
GetOverlappedResult.KERNEL32 ref: 00007FF6D34E77AB

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: CloseCreateEventHandleMultipleObjectsOverlappedResultWait
String ID:
API String ID: 67592891-0
Opcode ID: 0a8052104270a8ad8137e5a62fd41aed2110fa1fef0e1f62bf8bf560bc9cdfa4
Instruction ID: 33a857d81ee7c649eacdbb8fcb6e94787824e18c9915003a3d5a7e5e27742bbd
Opcode Fuzzy Hash: 0a8052104270a8ad8137e5a62fd41aed2110fa1fef0e1f62bf8bf560bc9cdfa4
Instruction Fuzzy Hash: C6713F22E0879589FB10CB65DC423AD6BA0BB147A8F108936DE0DF6B99DF7CD5A4C350

Function 00007FF6D34E5210 Relevance: 10.6, APIs: 7, Instructions: 129
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF6D34E531D
GetLastError.KERNEL32 ref: 00007FF6D34E5344
SetFileInformationByHandle.KERNEL32 ref: 00007FF6D34E536B
SetFileInformationByHandle.KERNEL32 ref: 00007FF6D34E538F
GetLastError.KERNEL32 ref: 00007FF6D34E53A0
GetLastError.KERNEL32 ref: 00007FF6D34E53CE
CloseHandle.KERNEL32 ref: 00007FF6D34E53E1

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: ErrorFileHandleLast$Information$CloseCreate
String ID:
API String ID: 807093259-0
Opcode ID: 6d234da3b22784b09a0a0a0c0ad7ced8d87911eb9a247c201e6f4122e4485eaf
Instruction ID: 29883b99bcb8205db361e14a206e3b28405355a8c72583616f07d4e764ec95f9
Opcode Fuzzy Hash: 6d234da3b22784b09a0a0a0c0ad7ced8d87911eb9a247c201e6f4122e4485eaf
Instruction Fuzzy Hash: 4551E161F0C39283F7718721A50677EE6A19B54794F1441B2CA8EF3AC5CFACE8A5C710

Function 00007FF6D34DAD20 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AddVectoredExceptionHandler.KERNEL32 ref: 00007FF6D34DAD49
SetThreadStackGuarantee.KERNELBASE ref: 00007FF6D34DAD5A
GetCurrentThread.KERNEL32 ref: 00007FF6D34DAD60
SetThreadDescription.KERNELBASE ref: 00007FF6D34DAD77

Strings

main, xrefs: 00007FF6D34DAD6D

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: Thread$CurrentDescriptionExceptionGuaranteeHandlerStackVectored
String ID: main
API String ID: 3663057573-3207122276
Opcode ID: 33833b6c031e308096934f59b8d0a09351507286b2fd2f6400ff40e5924aa52a
Instruction ID: 35b50c73bc575ceee7bb0b51c25c8b8212faaf0a7a41584aa69cd65ac1172fd1
Opcode Fuzzy Hash: 33833b6c031e308096934f59b8d0a09351507286b2fd2f6400ff40e5924aa52a
Instruction Fuzzy Hash: C6416F35B05A8A85EB50CF56E8912BDB361BB88BA9F444233C91DE37A4DF3CD565C300

Function 00007FF6D34EE880 Relevance: 7.6, APIs: 5, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 00007FF6D34EE893
GetLastError.KERNEL32 ref: 00007FF6D34EE8A8
GetCurrentProcess.KERNEL32 ref: 00007FF6D34EE93F
DuplicateHandle.KERNELBASE ref: 00007FF6D34EE96A
GetLastError.KERNEL32 ref: 00007FF6D34EE97C

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: ErrorHandleLast$CurrentDuplicateProcess
String ID:
API String ID: 3697983210-0
Opcode ID: 5b7cff6705c8bfd35229831c3ec50f34cefd192835895f072371284ca78f0f57
Instruction ID: 5427474ab28407675684c86c69e53462bba65f8f311c6c908031d47017bafb6f
Opcode Fuzzy Hash: 5b7cff6705c8bfd35229831c3ec50f34cefd192835895f072371284ca78f0f57
Instruction Fuzzy Hash: 11316131B18B0585FB508B62D4563BE67A1BB84BA4F14863ACEADE77C4CF3DD0958710

Function 00007FF6D34EDBF0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,+h+s,?,?), ref: 00007FF6D34EDCEA

Strings

+h+s, xrefs: 00007FF6D34EDBF4

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: AttributesFile
String ID: +h+s
API String ID: 3188754299-2949623892
Opcode ID: 66e2604e2c0477ed7538994ef2a187748ebe69c79d80b5ea9034998717c53cd2
Instruction ID: dad542e0e508abe35fc6a70c5b33fe472bda0fe0cb1be4e908694f0003c0ab0b
Opcode Fuzzy Hash: 66e2604e2c0477ed7538994ef2a187748ebe69c79d80b5ea9034998717c53cd2
Instruction Fuzzy Hash: 05313D32B06B5588EB10CF65E8513ACA7B4BB45BA8F144536CE5DE7B95DF3CD0618310

Function 00007FF6D34E7C10 Relevance: 3.1, APIs: 2, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetOverlappedResult.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,FFFFFFFE,?,?), ref: 00007FF6D34E7C65
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,FFFFFFFE,?,?), ref: 00007FF6D34E7CB1

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: ErrorLastOverlappedResult
String ID:
API String ID: 185562886-0
Opcode ID: fd14382938965edaa474283f7af42ccaa5c6d18af4ec9f8d2be760deeb5437d6
Instruction ID: 5d4174ba516dd54902495fde5197d983ea4861d2b5bedd561bc3867dfd50a73c
Opcode Fuzzy Hash: fd14382938965edaa474283f7af42ccaa5c6d18af4ec9f8d2be760deeb5437d6
Instruction Fuzzy Hash: 72213E22B087A695FB24CB62995137DAE64BB487A8F148477CE0DF7784DE2CE5A18300

Function 00007FF6D34E6A70 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 00007FF6D34E6A7A

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: bb589b8c88dd0f620da579cd0f5e27c13e32509cb0d3174da0de9347dfbd15c3
Instruction ID: 68db0d2fa83080d3c144527135c2127e0e516bb16fbe558be2ea4d1e37b1b910
Opcode Fuzzy Hash: bb589b8c88dd0f620da579cd0f5e27c13e32509cb0d3174da0de9347dfbd15c3
Instruction Fuzzy Hash: D3A01221524C88C9E2306731D8090589334B758305F840021C18C004208E1CD1558600

Function 00007FF6D34EDF08 Relevance: 1.3, APIs: 1, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32 ref: 00007FF6D34EDF48

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 04c7abc5097deba932cc329b0e9186fb76f2ac2c722cd1b49e24ee1f39766a37
Instruction ID: 5b7c2f8e1ff58e35cf72144b0cc5993eb8f3291832b4927033ebec5574902690
Opcode Fuzzy Hash: 04c7abc5097deba932cc329b0e9186fb76f2ac2c722cd1b49e24ee1f39766a37
Instruction Fuzzy Hash: 2BF06D32A0478145EB218F25E9413AEA291AB44FE8F48C031CE4CEB7C5CE3DA5D9C300

Non-executed Functions

Function 00007FF6D34F1D30 Relevance: 45.8, APIs: 18, Strings: 8, Instructions: 340libraryloadersynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObjectEx.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF6D34F1D7B
LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF6D34F1D94
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF6D34F1DCD
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF6D34F1E07
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF6D34F1E3F
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF6D34F1E58
memset.VCRUNTIME140 ref: 00007FF6D34F1EBC
GetProcAddress.KERNEL32 ref: 00007FF6D34F1EF1
GetCurrentProcess.KERNEL32 ref: 00007FF6D34F1F0A
lstrlenW.KERNEL32 ref: 00007FF6D34F1F28
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF6D34F1F60
CreateMutexA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF6D34F1FF5
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF6D34F201B
GetProcAddress.KERNEL32 ref: 00007FF6D34F20D2
GetCurrentProcess.KERNEL32 ref: 00007FF6D34F20EB
GetProcAddress.KERNEL32 ref: 00007FF6D34F2154
GetCurrentProcess.KERNEL32 ref: 00007FF6D34F2169
ReleaseMutex.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF6D34F21DD

Strings

SymSetOptions, xrefs: 00007FF6D34F1E00
assertion failed: len >= 0, xrefs: 00007FF6D34F222C
EnumerateLoadedModulesW64, xrefs: 00007FF6D34F20CB
SymGetOptions, xrefs: 00007FF6D34F1DC3
SymGetSearchPathW, xrefs: 00007FF6D34F1EEA
SymSetSearchPathW, xrefs: 00007FF6D34F214D
dbghelp.dll, xrefs: 00007FF6D34F1D8D
SymInitializeW, xrefs: 00007FF6D34F1E38

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: AddressProc$CurrentProcess$Mutex$CloseCreateHandleLibraryLoadObjectReleaseSingleWaitlstrlenmemset
String ID: EnumerateLoadedModulesW64$SymGetOptions$SymGetSearchPathW$SymInitializeW$SymSetOptions$SymSetSearchPathW$assertion failed: len >= 0$dbghelp.dll
API String ID: 18767598-310313858
Opcode ID: 87b5e29da37547dccb3cdd2ebccb8dd45b43f35e05e89978e6d4aeecae1f1e85
Instruction ID: e8dd43f836acc71ca75b63af2d5b4580f01f62bff371fc22f3ab3733788a5364
Opcode Fuzzy Hash: 87b5e29da37547dccb3cdd2ebccb8dd45b43f35e05e89978e6d4aeecae1f1e85
Instruction Fuzzy Hash: 05E19C21B09A5686FB108F22E8467BDA3A0BF48798F084536DE5DE7794EF3DE164C304

Function 00007FF6D34F11A0 Relevance: 16.2, APIs: 7, Strings: 2, Instructions: 425COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF6D34F1361
GetFullPathNameW.KERNEL32 ref: 00007FF6D34F1372
GetLastError.KERNEL32 ref: 00007FF6D34F137F
GetLastError.KERNEL32 ref: 00007FF6D34F13A0

Strings

\\?\UNC\, xrefs: 00007FF6D34F160B
\\?\, xrefs: 00007FF6D34F150C, 00007FF6D34F15B4

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: ErrorLast$FullNamePath
String ID: \\?\$\\?\UNC\
API String ID: 2482867836-3019864461
Opcode ID: 856ddbaa7b32748b50f2c5b152b3a88fdb34e88d613bef07fa1273d73f1255e9
Instruction ID: 719e2fb0bd84b8ffba7782b1238b921ef1ff136aeda435c50155006f563c7f1d
Opcode Fuzzy Hash: 856ddbaa7b32748b50f2c5b152b3a88fdb34e88d613bef07fa1273d73f1255e9
Instruction Fuzzy Hash: C602C262A0868685EB708F55D4063BDA3A5FB04B98F088537DE5DEBB94DF3CD6A5C300

Function 00007FF6D3500124 Relevance: 13.6, APIs: 9, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6D3500140
memset.VCRUNTIME140 ref: 00007FF6D3500164
RtlCaptureContext.KERNEL32 ref: 00007FF6D350016D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6D3500187
RtlVirtualUnwind.KERNEL32 ref: 00007FF6D35001C8
memset.VCRUNTIME140 ref: 00007FF6D35001FB
IsDebuggerPresent.KERNEL32 ref: 00007FF6D350021C
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6D3500239
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6D3500244

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 6a807dc3b2c72e8a44790306001abe4d407ffcd024ff4738d933d91dcd268949
Instruction ID: 92c37bc80a642362eb65aae20080da69f0ee5b979f1c0c149e162a96fec86ef3
Opcode Fuzzy Hash: 6a807dc3b2c72e8a44790306001abe4d407ffcd024ff4738d933d91dcd268949
Instruction Fuzzy Hash: DF319E72608B8586EB608F62E8513EDB361FB84749F44403ADB4E97B98EF3DC258C700

Function 00007FF6D34E5F60 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 221windowCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF6D34E5FA3
GetModuleHandleW.KERNEL32 ref: 00007FF6D34E5FBC
FormatMessageW.KERNEL32 ref: 00007FF6D34E6004
GetLastError.KERNEL32 ref: 00007FF6D34E609E

Strings

NTDLL.DLL, xrefs: 00007FF6D34E5FB5

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: ErrorFormatHandleLastMessageModulememset
String ID: NTDLL.DLL
API String ID: 1434010500-1613819793
Opcode ID: 063ffaf93443631f2d478b7fbd1cdf2bd3c27428606a271180fe0f9e02669633
Instruction ID: df85d4d0c66ed10e0544a4f37a2c77ae5cb5ded15f9aa4c1777550270cb9d3e7
Opcode Fuzzy Hash: 063ffaf93443631f2d478b7fbd1cdf2bd3c27428606a271180fe0f9e02669633
Instruction Fuzzy Hash: 13A19C36A09BC284E736CF21D8057FCA6A0BB453A4F44413ACA9DE6B95DF7C96A5D300

Function 00007FF6D34D60B0 Relevance: 6.6, APIs: 3, Strings: 1, Instructions: 603COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140 ref: 00007FF6D34D6185
memcmp.VCRUNTIME140 ref: 00007FF6D34D61B2
memcmp.VCRUNTIME140 ref: 00007FF6D34D61D5

Strings

__rust_end_short_backtrace__rust_begin_short_backtraces [... omitted frame ...], xrefs: 00007FF6D34FD0A1

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: memcmp
String ID: __rust_end_short_backtrace__rust_begin_short_backtraces [... omitted frame ...]
API String ID: 1475443563-1231577002
Opcode ID: 5ebb8ceb033c0d7217db66242564321363cf5d67930480026b8f8ca6b474d52c
Instruction ID: 34769d6b34c299a2ec91fca5782f6a74d7127dcccd8641233a9bcd9eda6c76f0
Opcode Fuzzy Hash: 5ebb8ceb033c0d7217db66242564321363cf5d67930480026b8f8ca6b474d52c
Instruction Fuzzy Hash: 19322662E0869685FB118B65A402AFCA751BB557E8F844733EE8EF3689DF3CD155C300

Function 00007FF6D34FFFFC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6D3500028
GetCurrentThreadId.KERNEL32 ref: 00007FF6D3500036
GetCurrentProcessId.KERNEL32 ref: 00007FF6D3500042
QueryPerformanceCounter.KERNEL32 ref: 00007FF6D3500052

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: a48d8addc7e316d515ad7bb4e0af664b66e390c9a172f2212fe5bf00532013a0
Instruction ID: 2f13763c1e7ffb340ef645bbe226b57113bfc692a5a0032e8b2bd6cd91ad83c8
Opcode Fuzzy Hash: a48d8addc7e316d515ad7bb4e0af664b66e390c9a172f2212fe5bf00532013a0
Instruction Fuzzy Hash: 0E111826B14B058AEB00CF61E8562AC73A4FB19799F440E32DA6D967A4DF78D168C740

Function 00007FF6D34E59F0 Relevance: 4.7, APIs: 3, Instructions: 217filenativesynchronizationCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL ref: 00007FF6D34E5B52
WaitForSingleObject.KERNEL32 ref: 00007FF6D34E5B68

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: FileObjectReadSingleWait
String ID:
API String ID: 631497895-0
Opcode ID: 48df2269a7b53f8d124459123b759143cf34784917d3122b594ae08f15cc44eb
Instruction ID: feb44e28b61568f736b0a488e000a7b1599edd382bdfe121cc83231efe0fa710
Opcode Fuzzy Hash: 48df2269a7b53f8d124459123b759143cf34784917d3122b594ae08f15cc44eb
Instruction Fuzzy Hash: B3818522B05B9589EB10CF25D5552AD6360FB087A8F544A72EE2DF77C4DF3CE4A58300

Function 00007FF6D34E5E40 Relevance: 4.6, APIs: 3, Instructions: 82filenativesynchronizationCOMMON

Download Yara Rule

APIs

NtWriteFile.NTDLL ref: 00007FF6D34E5EB1
WaitForSingleObject.KERNEL32 ref: 00007FF6D34E5EC6
RtlNtStatusToDosError.NTDLL ref: 00007FF6D34E5EE4

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: ErrorFileObjectSingleStatusWaitWrite
String ID:
API String ID: 3447438843-0
Opcode ID: 38994e9378a27918e7d61546cfcb851761bb9edc0d43296c3d0e46e79b72fbaf
Instruction ID: 11411d10e577fdd9bf4a4100cbf139aed538454b9f44dfddce5575a3a37a392a
Opcode Fuzzy Hash: 38994e9378a27918e7d61546cfcb851761bb9edc0d43296c3d0e46e79b72fbaf
Instruction Fuzzy Hash: 50317C32A14B818AE710CF35E8413AD77A4FB48358F548232EA8DD2B98EF3CD1A5C700

Function 00007FF6D34F8600 Relevance: 4.6, Strings: 3, Instructions: 832COMMON

Download Yara Rule

Strings

`fmt::Error`s should be impossible without a `fmt::Formatter`, xrefs: 00007FF6D34F91DD
.llvm./rust/deps\rustc-demangle-0.1.24\src\lib.rs, xrefs: 00007FF6D34F862E
__ZN, xrefs: 00007FF6D34F8A20

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: memcmp
String ID: .llvm./rust/deps\rustc-demangle-0.1.24\src\lib.rs$__ZN$`fmt::Error`s should be impossible without a `fmt::Formatter`
API String ID: 1475443563-898947652
Opcode ID: 27c76308de8fedce15fa74c3de40ad259249838babb7568c5eaacadce3183ecc
Instruction ID: b5e1ceb32b6ca1fce1a5900f89a02b115c0170b11cbcbc7296604dbcec3ce9c0
Opcode Fuzzy Hash: 27c76308de8fedce15fa74c3de40ad259249838babb7568c5eaacadce3183ecc
Instruction Fuzzy Hash: 62625762E0C5A245F7A58B2198063BDAB61BB15798F484233DE6EFB6C4DF3CD964C300

Function 00007FF6D34E5D20 Relevance: 4.6, APIs: 3, Instructions: 74filenativesynchronizationCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL ref: 00007FF6D34E5D91
WaitForSingleObject.KERNEL32 ref: 00007FF6D34E5DA6
RtlNtStatusToDosError.NTDLL ref: 00007FF6D34E5DD1

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: ErrorFileObjectReadSingleStatusWait
String ID:
API String ID: 3583596364-0
Opcode ID: 8cb1b2950b0192ba39fac8278ab127f5d4e47bfa13269cca44aac9028c51aecc
Instruction ID: cfa686a670216c428b2d8fcfb5aadd45b819dfd883bf949ad6f3d19362928c87
Opcode Fuzzy Hash: 8cb1b2950b0192ba39fac8278ab127f5d4e47bfa13269cca44aac9028c51aecc
Instruction Fuzzy Hash: 7B31A332A14B818AE750CF74E8457ED73A5EB48358F548231EA4ED2B98EF3CD1A5C300

Function 00007FF6D34DE250 Relevance: 3.0, APIs: 2, Instructions: 27networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF6D34DE270
WSAGetLastError.WS2_32 ref: 00007FF6D34DE282

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: ErrorLastrecv
String ID:
API String ID: 2514157807-0
Opcode ID: f30d5b90075e076290a39d6d358aa374eafe5a83ad31bc2260e3979ec8f12219
Instruction ID: 747a131c5c2628134ee0c2948a899d3f264635680d10cb3985ab7cc84fff735d
Opcode Fuzzy Hash: f30d5b90075e076290a39d6d358aa374eafe5a83ad31bc2260e3979ec8f12219
Instruction Fuzzy Hash: 7DF0E521B0854686FB3402B6A45A33E9282AB89779FA84331C87EDA7D0DF1C95E14300

Function 00007FF6D34FE1C0 Relevance: 1.6, APIs: 1, Instructions: 365COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140 ref: 00007FF6D34FE23F

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: befc191b3607c03911a2eeedab1f5b74f69f50d8bf05d76a9f7b34d0e9db0df4
Instruction ID: b7257f13941d4265c0b5c4454c4f0a27cbced69a7e672cf6105767da31cef6e1
Opcode Fuzzy Hash: befc191b3607c03911a2eeedab1f5b74f69f50d8bf05d76a9f7b34d0e9db0df4
Instruction Fuzzy Hash: 25C14B22B1C6A542FA54CB228815BBFA751B700B95F8C9532DE4EE3BC0DF3DE5A59300

Function 00007FF6D34DD400 Relevance: 1.5, APIs: 1, Instructions: 268COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6D34DD545

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 09ead8ae22a9f678e0afcd436b8ed1b13d25ecab2a4b6423cc19afc710c4effe
Instruction ID: e303dd34f01857f66ef93f118d7a1252f5faf5ece143dad577afdee8849348e6
Opcode Fuzzy Hash: 09ead8ae22a9f678e0afcd436b8ed1b13d25ecab2a4b6423cc19afc710c4effe
Instruction Fuzzy Hash: EAA1ED22F19A5585FB50CB22E8067BDA7A0BF85788F448636DE1DA7B84DF3CE595C300

Function 00007FF6D34F9D90 Relevance: 1.5, APIs: 1, Instructions: 205COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6D34F9F8F

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: bfdd58eceb348985c70949a203d559a279bccd114a88580ee092d6670aabbd74
Instruction ID: 7f7f7eb26d81df497ce0b2ef970191465708aac589c424c8108c9dfb2b9cf972
Opcode Fuzzy Hash: bfdd58eceb348985c70949a203d559a279bccd114a88580ee092d6670aabbd74
Instruction Fuzzy Hash: 1A712222B0664699FF148A66D8023FDB760BB44798F484937DE5DA77C6DE3CD2A1C320

Function 00007FF6D34FA4C0 Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

0123456789abcdefBorrowMutErroralready borrowed: , xrefs: 00007FF6D34FA548, 00007FF6D34FA659

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID:
String ID: 0123456789abcdefBorrowMutErroralready borrowed:
API String ID: 0-1320686809
Opcode ID: cff3b81a152a68af3c11e422c6747823cd71d391286798a0cd8d004250de175f
Instruction ID: 481e9091fe14f01684b9b266e2ae76a04f9a828297ac693fad995a2f7a582a84
Opcode Fuzzy Hash: cff3b81a152a68af3c11e422c6747823cd71d391286798a0cd8d004250de175f
Instruction Fuzzy Hash: 39515F63B196F09EF33187785401EAC7FA19B11B48F098095CFD86BF96CA1AC129E761

Function 00007FF6D34F2F20 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

0123456789abcdef, xrefs: 00007FF6D34F2F9F, 00007FF6D34F3097

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID:
String ID: 0123456789abcdef
API String ID: 0-1757737011
Opcode ID: ae0b264afda1bb4ee36adef3a6f2a6fdcd0280b107d50b2d65126c5647b23264
Instruction ID: d30fe8ad86d2bebd77ff881f568e11d170df5e1e6764bca23a24b08e22b3b22a
Opcode Fuzzy Hash: ae0b264afda1bb4ee36adef3a6f2a6fdcd0280b107d50b2d65126c5647b23264
Instruction Fuzzy Hash: C4510893B396F19EE3219B38840166C7F719B16744F0840A5CFD85BF96C61BC134EB91

Function 00007FF6D34F04A0 Relevance: 1.3, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?,?,00007FF6D34E2EF5), ref: 00007FF6D34F04B1

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: ba3843fa14d71a9afaf3bf546d96b0d0233b5bb930036e6c6f2859228b8a349f
Instruction ID: 8bd434678a26af5af85f89a5b218391ce1beaec41e64a1655691a6c4931393bd
Opcode Fuzzy Hash: ba3843fa14d71a9afaf3bf546d96b0d0233b5bb930036e6c6f2859228b8a349f
Instruction Fuzzy Hash: 9AE0C213F4995986F62617A7A8811B88290AFDCBEAF1C8031CF1C92780ED3CD9E38710

Function 00007FF6D34FDAC0 Relevance: .4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1af7a84c1973de48db45c686f6e70b5ad21abf27e87473aaf2867ac57fe4dc81
Instruction ID: 19a4d0a190abc4e15f176b7aa4de3cbb17a79964670005237483788d9fd37539
Opcode Fuzzy Hash: 1af7a84c1973de48db45c686f6e70b5ad21abf27e87473aaf2867ac57fe4dc81
Instruction Fuzzy Hash: A8E18B96E2AB9601F723433954036B897006FB37E4A05D337FDA9F1BD5DF29A2929304

Function 00007FF6D34F0D10 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28ebcbae177fa21c4c9d2db39c4594c1ad24c6c265d0818e4561ac82ca5d039d
Instruction ID: be6df7a178fdb766759743bdf171a013b66329033240ede37d3ab14ae48e3b02
Opcode Fuzzy Hash: 28ebcbae177fa21c4c9d2db39c4594c1ad24c6c265d0818e4561ac82ca5d039d
Instruction Fuzzy Hash: 60C14892E0C2D245F7218B65940277EEB919742764F9C9332CA6DF76D0CE7D99B2D300

Function 00007FF6D34E4C00 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1c2ba2e7f2323371a74e774ed58dbce8568105049910fb679fa3795461acfd3
Instruction ID: 0a0069b162a67fc75f3e3dff8e3159e9188ceacfe00e71f34680265cc090d9b3
Opcode Fuzzy Hash: f1c2ba2e7f2323371a74e774ed58dbce8568105049910fb679fa3795461acfd3
Instruction Fuzzy Hash: D2D1F062A18B5282EA65CB55940237EABA1FF50798F015633DE9EF77E0DF7CE5608300

Function 00007FF6D34FAAC0 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 131cc5725294e9c444d8c95861a4833b241e892aa6dacbb4adcd38c5698c79db
Instruction ID: 8d3ebef6bb0fc599e51d33baac170ab8490e5bc48a99a31bd21b8a4340373d6a
Opcode Fuzzy Hash: 131cc5725294e9c444d8c95861a4833b241e892aa6dacbb4adcd38c5698c79db
Instruction Fuzzy Hash: 26C18D32F1A4A146F2A18A28851567DBB51AF517B9F0D4332CE3AE23E4EE7DD961C700

Function 00007FF6D34DE6C0 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8005d9a2cbc8911cdd68848e74bc1f2e69e9ebe8131348bd924abfe94df93a6
Instruction ID: 846d275753f989624b3086a816a8d9321d27a650b204ec6d0744e95a75190d79
Opcode Fuzzy Hash: b8005d9a2cbc8911cdd68848e74bc1f2e69e9ebe8131348bd924abfe94df93a6
Instruction Fuzzy Hash: 00A16A27E0969645FB608B71E5027FEA7A1AB41788F484433DE4DE3A94CE7CA5F6C340

Function 00007FF6D34FB0C0 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc4f5debda7e273ba8b9ac16d27b21b97a1b3bca713a962f16aaa22fd6a81127
Instruction ID: acbb2c21f49073f8f1d0b70652dd72cf6a212e326f526772d6e478f816b20d3e
Opcode Fuzzy Hash: bc4f5debda7e273ba8b9ac16d27b21b97a1b3bca713a962f16aaa22fd6a81127
Instruction Fuzzy Hash: BCA11422A08A9695E7118F21D9013BDB7A0FB46798F488132CF9DE7784DFBDD5A6C340

Function 00007FF6D34E2880 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00255f296dc66b294dd65752686819104dd031d2d238505cb628f4971243d254
Instruction ID: 2ac30749938f06a0fae38d5f7df1be20483ba87cdf418a1716821ec04003b021
Opcode Fuzzy Hash: 00255f296dc66b294dd65752686819104dd031d2d238505cb628f4971243d254
Instruction Fuzzy Hash: 6D614752F196D248F321DF2448022BDAF61BB56388F189172DAAAF76E5CE7DD022D310

Function 00007FF6D35002C8 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a95c09293253489ebf8132741973aeb1f16b2ea04a0a30f3396dac04e4785d60
Instruction ID: 8eed5bdb93d8adfcdbad84ea2c57d7cb79ad4b259e40a3952de33cecf64cb60b
Opcode Fuzzy Hash: a95c09293253489ebf8132741973aeb1f16b2ea04a0a30f3396dac04e4785d60
Instruction Fuzzy Hash: 4FA0022590CD0BD0F6448B02E9A2038A330FB50349F404233C00DF2470EF3EA8A5C301

Function 00007FF6D34D8660 Relevance: 21.5, APIs: 12, Strings: 2, Instructions: 453COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6D34D86F8
memmove.VCRUNTIME140 ref: 00007FF6D34D8711
memmove.VCRUNTIME140 ref: 00007FF6D34D8758
memmove.VCRUNTIME140 ref: 00007FF6D34D8770
memmove.VCRUNTIME140 ref: 00007FF6D34D88D4
memmove.VCRUNTIME140 ref: 00007FF6D34D88EF
memmove.VCRUNTIME140 ref: 00007FF6D34D8C1B
memmove.VCRUNTIME140 ref: 00007FF6D34D8C32
memmove.VCRUNTIME140 ref: 00007FF6D34D8C48
memmove.VCRUNTIME140 ref: 00007FF6D34D8C61
memmove.VCRUNTIME140 ref: 00007FF6D34D8C9F
memmove.VCRUNTIME140 ref: 00007FF6D34D8CBA

Strings

assertion failed: old_right_len + count <= CAPACITY, xrefs: 00007FF6D34D89F2
assertion failed: old_left_len >= count, xrefs: 00007FF6D34D8A0A

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: memmove
String ID: assertion failed: old_left_len >= count$assertion failed: old_right_len + count <= CAPACITY
API String ID: 2162964266-1889375005
Opcode ID: 98eeb9f1055991272f6c4855f6be01142e1b736703fe412fc1bd7e05ecf3261c
Instruction ID: 4c9c9bf8e3968cc166fbedbb806ba1522d7c9a96c972c6a7c8f3cec08d4880ae
Opcode Fuzzy Hash: 98eeb9f1055991272f6c4855f6be01142e1b736703fe412fc1bd7e05ecf3261c
Instruction Fuzzy Hash: 2632C462914BC882E7568F28E8023FDA374FF58798F549322DF8D63655DF39A2A5C300

Function 00007FF6D34F2350 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 221libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,00000001,00000000,?,00007FF6D34F21D9), ref: 00007FF6D34F2388
GetProcAddress.KERNEL32(?,?,?,?,00000001,00000000,?,00007FF6D34F21D9), ref: 00007FF6D34F23C0
GetProcAddress.KERNEL32(?,?,?,?,00000001,00000000,?,00007FF6D34F21D9), ref: 00007FF6D34F23FA
GetProcAddress.KERNEL32(?,?,?,?,00000001,00000000,?,00007FF6D34F21D9), ref: 00007FF6D34F2460
GetProcAddress.KERNEL32(?,?,?,?,00000001,00000000,?,00007FF6D34F21D9), ref: 00007FF6D34F2493
memset.VCRUNTIME140(?,?,?,?,00000001,00000000,?,00007FF6D34F21D9), ref: 00007FF6D34F25B0

Strings

SymQueryInlineTrace, xrefs: 00007FF6D34F248C
SymGetLineFromInlineContextW, xrefs: 00007FF6D34F23F3
SymAddrIncludeInlineTrace, xrefs: 00007FF6D34F2459
SymFromInlineContextW, xrefs: 00007FF6D34F23B9

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: AddressProc$CurrentProcessmemset
String ID: SymAddrIncludeInlineTrace$SymFromInlineContextW$SymGetLineFromInlineContextW$SymQueryInlineTrace
API String ID: 3017635649-3384281969
Opcode ID: a8fd4004f6d30cedab294656d58e363b4eb94c0d0a4f86d8887aab600e2d2934
Instruction ID: edb4aee54a8a15aa45fb80896c0652dc3c14477dca9a9e00dd730012cbece066
Opcode Fuzzy Hash: a8fd4004f6d30cedab294656d58e363b4eb94c0d0a4f86d8887aab600e2d2934
Instruction Fuzzy Hash: 1AB16D35A09AC689E7718F15E8423EDB3A0FB447D8F044136EA5DA7B58DF7D92A5C300

Function 00007FF6D34D9300 Relevance: 13.9, APIs: 8, Strings: 1, Instructions: 434COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6D34D939C
memmove.VCRUNTIME140 ref: 00007FF6D34D93D3
memmove.VCRUNTIME140 ref: 00007FF6D34D987A
memmove.VCRUNTIME140 ref: 00007FF6D34D98E7
memmove.VCRUNTIME140 ref: 00007FF6D34D991F

Strings

assertion failed: new_left_len <= CAPACITY, xrefs: 00007FF6D34D9BF6

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: memmove
String ID: assertion failed: new_left_len <= CAPACITY
API String ID: 2162964266-3316943531
Opcode ID: 0ab012618e32522a899e17589b9b5da8098de30be2dd1013d6859d5e2057c80e
Instruction ID: eb9d6e8997e4dc99f85fe9f840849ee27fe0cec0e7db313b7c7ffd35976932e9
Opcode Fuzzy Hash: 0ab012618e32522a899e17589b9b5da8098de30be2dd1013d6859d5e2057c80e
Instruction Fuzzy Hash: 1A22CF32614BC585DB61CF28E8453ED73A8FB98788F548232DE8DA7795DF3992A5C300

Function 00007FF6D34EDDDC Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 318COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6D34EDDF6
DuplicateHandle.KERNEL32 ref: 00007FF6D34EDE24
GetLastError.KERNEL32 ref: 00007FF6D34EDFD1

Part of subcall function 00007FF6D34EEFB0: CreateThread.KERNEL32 ref: 00007FF6D34EF01B
Part of subcall function 00007FF6D34EEFB0: GetLastError.KERNEL32 ref: 00007FF6D34EF078

CloseHandle.KERNEL32 ref: 00007FF6D34EE022
CloseHandle.KERNEL32 ref: 00007FF6D34EE400

Strings

failed to spawn thread, xrefs: 00007FF6D34EE50C
RUST_MIN_STACKfatal runtime error: something here is badly broken!, xrefs: 00007FF6D34EE0D1

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: Handle$CloseErrorLast$CreateCurrentDuplicateProcessThread
String ID: RUST_MIN_STACKfatal runtime error: something here is badly broken!$failed to spawn thread
API String ID: 4152547513-2688294036
Opcode ID: 2ac6805eee62272696b31a7e1f23047961a96289fbd890656303bc65f767d612
Instruction ID: 18cdc57394e43d2ad145db8e60ace630c22ccfa7aa980a5cdc9bbee4d31a0a0e
Opcode Fuzzy Hash: 2ac6805eee62272696b31a7e1f23047961a96289fbd890656303bc65f767d612
Instruction Fuzzy Hash: 48F17F22908BC589E761CF65D8413EDA7A0FB44788F088136DE4DE7B99DF3D96A5C340

Function 00007FF6D34E1630 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D34DBAC0: SetLastError.KERNEL32 ref: 00007FF6D34DBBBC
Part of subcall function 00007FF6D34DBAC0: GetCurrentDirectoryW.KERNEL32 ref: 00007FF6D34DBBC5
Part of subcall function 00007FF6D34DBAC0: GetLastError.KERNEL32 ref: 00007FF6D34DBBD4
Part of subcall function 00007FF6D34DBAC0: GetLastError.KERNEL32 ref: 00007FF6D34DBBFF

memset.VCRUNTIME140 ref: 00007FF6D34E17D3
RtlCaptureContext.KERNEL32 ref: 00007FF6D34E17DB
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6D34E1800

Strings

stack backtrace:, xrefs: 00007FF6D34E174B
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.__rust_end_short_backtrace__rust_begin_short_backtraces [... omitted frame ...], xrefs: 00007FF6D34E1A80

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: ErrorLast$CaptureContextCurrentDirectoryEntryFunctionLookupmemset
String ID: note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.__rust_end_short_backtrace__rust_begin_short_backtraces [... omitted frame ...]$stack backtrace:
API String ID: 3347127084-3486849450
Opcode ID: daa63e6adda8ece9e6210a25b12def9b3dc05e647b5230fff2beaea3dbfbd3cf
Instruction ID: 25c093ee77f57ad5349f10442144ee3fb07df2bde46f35801aa9d31870ca7bbb
Opcode Fuzzy Hash: daa63e6adda8ece9e6210a25b12def9b3dc05e647b5230fff2beaea3dbfbd3cf
Instruction Fuzzy Hash: 3AC11826605FC188EB708F25EC513EE77A4FB45799F44112ACA4DABB99DF389294CB00

Function 00007FF6D34D8A40 Relevance: 12.2, APIs: 6, Strings: 2, Instructions: 216COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF6D34D8C1B
memmove.VCRUNTIME140 ref: 00007FF6D34D8C32
memmove.VCRUNTIME140 ref: 00007FF6D34D8C48
memmove.VCRUNTIME140 ref: 00007FF6D34D8C61
memmove.VCRUNTIME140 ref: 00007FF6D34D8C9F
memmove.VCRUNTIME140 ref: 00007FF6D34D8CBA

Strings

assertion failed: old_left_len + count <= CAPACITY, xrefs: 00007FF6D34D8EA2
assertion failed: match track_edge_idx { LeftOrRight::Left(idx) => idx <= old_left_len, LeftOrRight::Right(idx) => idx <= right_len,}, xrefs: 00007FF6D34D9CBC, 00007FF6D34D9CD6

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: memmove
String ID: assertion failed: match track_edge_idx { LeftOrRight::Left(idx) => idx <= old_left_len, LeftOrRight::Right(idx) => idx <= right_len,}$assertion failed: old_left_len + count <= CAPACITY
API String ID: 2162964266-77976654
Opcode ID: 91be5c1c38b5776940463a3e12816a08ad78f4c4bf70c20d187f08985be168f2
Instruction ID: 1c7850303c29cb726fbd1cd72a3a4dec029e6092a3232c9043477e54cb7e8d73
Opcode Fuzzy Hash: 91be5c1c38b5776940463a3e12816a08ad78f4c4bf70c20d187f08985be168f2
Instruction Fuzzy Hash: 81B1C562914AC981E7458F29E8423FDA374FFA4798F499332DE4D63365DF38A295C300

Function 00007FF6D34EFCB0 Relevance: 10.8, APIs: 7, Instructions: 257COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF6D34EFD9E
GetFullPathNameW.KERNEL32 ref: 00007FF6D34EFDB3
GetLastError.KERNEL32 ref: 00007FF6D34EFDBF
GetLastError.KERNEL32 ref: 00007FF6D34EFDD9
memcmp.VCRUNTIME140 ref: 00007FF6D34EFE9E
GetLastError.KERNEL32 ref: 00007FF6D34EFEDB
memmove.VCRUNTIME140 ref: 00007FF6D34EFFAD

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: ErrorLast$FullNamePathmemcmpmemmove
String ID:
API String ID: 2319842497-0
Opcode ID: 52328ebc5aa32788b9c6690510f7f09ff0fe035a7d4db79920dcd67c30abfa3d
Instruction ID: f6c9b4cc3c440c81560a11a4e8756702fd79796c74c4ee3bea81271572b1a354
Opcode Fuzzy Hash: 52328ebc5aa32788b9c6690510f7f09ff0fe035a7d4db79920dcd67c30abfa3d
Instruction Fuzzy Hash: D9B17D62A04BC685EB758F21E8467EDA355FB44BD8F048036DE5DEBB89CE3DD2658300

Function 00007FF6D34DDD20 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

freeaddrinfo.WS2_32(?,?,?,?,?,?,?,?,00000002,?,?,00000001,?,?,00007FF6D34DE19A), ref: 00007FF6D34DDDA4

Strings

assertion failed: len >= mem::size_of::<c::sockaddr_in6>(), xrefs: 00007FF6D34DDFBB, 00007FF6D34DE011
assertion failed: len >= mem::size_of::<c::sockaddr_in>()library\std\src\sys\net\connection\socket.rs, xrefs: 00007FF6D34DDFD5, 00007FF6D34DDFF3
, xrefs: 00007FF6D34DDF59

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: freeaddrinfo
String ID: $assertion failed: len >= mem::size_of::<c::sockaddr_in6>()$assertion failed: len >= mem::size_of::<c::sockaddr_in>()library\std\src\sys\net\connection\socket.rs
API String ID: 2731292433-1984122431
Opcode ID: 91b0d018951ebabc00718dca490462d990410a8c08fa3d0328ac04f35b270379
Instruction ID: 535f6cab37d597b75652ee1e2a49bde517075a4bdae5c3d8010a37517d44fa96
Opcode Fuzzy Hash: 91b0d018951ebabc00718dca490462d990410a8c08fa3d0328ac04f35b270379
Instruction Fuzzy Hash: B3A1CF72B04A55CAE714CF52E4422AD7BB0FB88B98F51813ADE49A3784CF3DD5A5C340

Function 00007FF6D34EE9F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 207COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF6D34EEA1B
GetLastError.KERNEL32 ref: 00007FF6D34EEA34
GetConsoleMode.KERNEL32 ref: 00007FF6D34EEA6B
GetConsoleOutputCP.KERNEL32 ref: 00007FF6D34EEA75
CloseHandle.KERNEL32 ref: 00007FF6D34EED0A

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF6D34EECC9

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: ConsoleHandle$CloseErrorLastModeOutput
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 841666474-2333694755
Opcode ID: 0bff7d7f5b2a8327b4ff97474a302545f5bf111b20a2dc17edbe1c34f87a03b2
Instruction ID: be3bb600b7cb5647dc3445dba24cf7e090dcfd1808c65b5860c9c01eb415b387
Opcode Fuzzy Hash: 0bff7d7f5b2a8327b4ff97474a302545f5bf111b20a2dc17edbe1c34f87a03b2
Instruction Fuzzy Hash: F191C062A0979688FB10CB6194423FEAB60BB05798F484537DE5EF3A89DF3DD1A5C310

Function 00007FF6D34F0880 Relevance: 10.6, APIs: 7, Instructions: 68networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32 ref: 00007FF6D34F08BE
WSAGetLastError.WS2_32 ref: 00007FF6D34F08D1
WSASocketW.WS2_32 ref: 00007FF6D34F0902
SetHandleInformation.KERNEL32 ref: 00007FF6D34F091E
GetLastError.KERNEL32 ref: 00007FF6D34F0928
closesocket.WS2_32 ref: 00007FF6D34F093B
WSAGetLastError.WS2_32 ref: 00007FF6D34F094B

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: ErrorLast$Socket$HandleInformationclosesocket
String ID:
API String ID: 3114377017-0
Opcode ID: 01a9f0181150d39e0e0eb74cea150dec15ffc1c5b46924c35c5b68e9aeb0b3b0
Instruction ID: e3abeb50858d94c059f288701a799525eb87cdd32ef357833437c97ec6311365
Opcode Fuzzy Hash: 01a9f0181150d39e0e0eb74cea150dec15ffc1c5b46924c35c5b68e9aeb0b3b0
Instruction Fuzzy Hash: 2121C631F0815987F7200B76A845B2EA650BB887F9F184331DD6EE3BD4DE7D98968B00

Function 00007FF6D34EF760 Relevance: 9.3, APIs: 6, Instructions: 266COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF6D34EF84E
GetFullPathNameW.KERNEL32 ref: 00007FF6D34EF863
GetLastError.KERNEL32 ref: 00007FF6D34EF870
GetLastError.KERNEL32 ref: 00007FF6D34EF88A
GetLastError.KERNEL32 ref: 00007FF6D34EF9B3
memmove.VCRUNTIME140 ref: 00007FF6D34EFA7C

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: ErrorLast$FullNamePathmemmove
String ID:
API String ID: 2429493883-0
Opcode ID: 8d28676f2eef97ff957e3374e9136987e3c36d63638e227bc63bc2388a2b3af5
Instruction ID: c8be0b4e04d6f56e8fc59ea0427c5dc544960d152b13b689901b277a152d9b1a
Opcode Fuzzy Hash: 8d28676f2eef97ff957e3374e9136987e3c36d63638e227bc63bc2388a2b3af5
Instruction Fuzzy Hash: 8FB17D62A04B8285EB658B22D8163EDA255FF44BD8F048136DE5DEBB89DF3DD2618300

Function 00007FF6D34E1F30 Relevance: 9.2, APIs: 6, Instructions: 185fileCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF6D34E1F87

Part of subcall function 00007FF6D34E7460: ReadFileEx.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6D34D48E0), ref: 00007FF6D34E74B7
Part of subcall function 00007FF6D34E7460: SleepEx.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6D34D48E0), ref: 00007FF6D34E74DA

WriteFileEx.KERNEL32 ref: 00007FF6D34E203F
SleepEx.KERNEL32 ref: 00007FF6D34E205A
GetLastError.KERNEL32 ref: 00007FF6D34E2089
CloseHandle.KERNEL32 ref: 00007FF6D34E2127
CloseHandle.KERNEL32 ref: 00007FF6D34E212C

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: CloseFileHandleSleep$ErrorLastReadWritememset
String ID:
API String ID: 78123985-0
Opcode ID: 0168f3d553456825f67070c16f83d12341ae1867f4dec35a2907005a98c09a7c
Instruction ID: dbc693263a5aac111d240aa5b3eb0dbb97945493ac96a71f71ee38b517788880
Opcode Fuzzy Hash: 0168f3d553456825f67070c16f83d12341ae1867f4dec35a2907005a98c09a7c
Instruction Fuzzy Hash: 1B714A26604AC684EB71DF25E8427FDA360FB487D9F444132EE5DABB98DF39D2919300

Function 00007FF6D34DBDA0 Relevance: 7.7, APIs: 5, Instructions: 243COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF6D34DBF2A
GetEnvironmentVariableW.KERNEL32 ref: 00007FF6D34DBF3D
GetLastError.KERNEL32 ref: 00007FF6D34DBF49
GetLastError.KERNEL32 ref: 00007FF6D34DBF63

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: ErrorLast$EnvironmentVariable
String ID:
API String ID: 2691138088-0
Opcode ID: 0b8f5f7d19e902fd4ad3e3cf4bd93ef8e6a8eaa2b6355bd38295b5dfad08274f
Instruction ID: ff4caeaf5ece00eeb1425dc6cd1b4e143081f7ec4146826c8ae1ecbd3f06ae7b
Opcode Fuzzy Hash: 0b8f5f7d19e902fd4ad3e3cf4bd93ef8e6a8eaa2b6355bd38295b5dfad08274f
Instruction Fuzzy Hash: C3A1A062B04BC584EB758F62E9553EDA364FB84B98F048136CE5CEB789DE3CD6918340

Function 00007FF6D34E6790 Relevance: 7.7, APIs: 5, Instructions: 172COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF6D34E688C
GetModuleFileNameW.KERNEL32 ref: 00007FF6D34E6897
GetLastError.KERNEL32 ref: 00007FF6D34E68A6
GetLastError.KERNEL32 ref: 00007FF6D34E68D1
GetLastError.KERNEL32 ref: 00007FF6D34E69AF

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: ErrorLast$FileModuleName
String ID:
API String ID: 1026760046-0
Opcode ID: be93ae174fec49e0e1835816cfb0d83c9017082af5287e129b0dec15580dce2e
Instruction ID: 93efd8ad427d156c19e47756ae7d73590469abcd4526bb703f5e97fdb7dae53a
Opcode Fuzzy Hash: be93ae174fec49e0e1835816cfb0d83c9017082af5287e129b0dec15580dce2e
Instruction Fuzzy Hash: 0461A022A05BC585EB618F26E8563EDA354FB05BE8F448136DD5DFB785CE3C92958300

Function 00007FF6D34DBAC0 Relevance: 7.7, APIs: 5, Instructions: 171COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF6D34DBBBC
GetCurrentDirectoryW.KERNEL32 ref: 00007FF6D34DBBC5
GetLastError.KERNEL32 ref: 00007FF6D34DBBD4
GetLastError.KERNEL32 ref: 00007FF6D34DBBFF
GetLastError.KERNEL32 ref: 00007FF6D34DBCDF

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: ErrorLast$CurrentDirectory
String ID:
API String ID: 3993060814-0
Opcode ID: 9a35608ebf0667a0be1e2a41299b647733ef9f518b20724664c280a903615085
Instruction ID: d024a48b9f4aeee595811a374929e961d9617c95cd0c42766d8ee796b84181bf
Opcode Fuzzy Hash: 9a35608ebf0667a0be1e2a41299b647733ef9f518b20724664c280a903615085
Instruction Fuzzy Hash: FE61D322A04BC585E7318F22F8553EDA354BB44BE8F448136DE5DEBB89DF7CA2958300

Function 00007FF6D34E92FA Relevance: 7.7, APIs: 5, Instructions: 170COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF6D34E90D4
SetLastError.KERNEL32 ref: 00007FF6D34E96BD
GetSystemDirectoryW.KERNEL32 ref: 00007FF6D34E96C9
GetLastError.KERNEL32 ref: 00007FF6D34E96D6
GetLastError.KERNEL32 ref: 00007FF6D34E96F0

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: ErrorLast$CloseDirectoryHandleSystem
String ID:
API String ID: 1105796624-0
Opcode ID: 379ce094e4b3d41bf789cee7a1156aa1ac7ec0f8a2113625f357eecd4ddc35bb
Instruction ID: 0ac148eaf9b6f6bd1e8a8d373b33d49cd5635a8ec448265d3cb2b71b548f452d
Opcode Fuzzy Hash: 379ce094e4b3d41bf789cee7a1156aa1ac7ec0f8a2113625f357eecd4ddc35bb
Instruction Fuzzy Hash: 9C817922A14B9585EB708F25EC553EEA3A0FB44B99F445036CA0EEBBD8DF3D9651C300

Function 00007FF6D34EED20 Relevance: 7.6, APIs: 5, Instructions: 147COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000000600000002), ref: 00007FF6D34EEDA5
WriteConsoleW.KERNEL32 ref: 00007FF6D34EEDE5
WriteConsoleW.KERNEL32 ref: 00007FF6D34EEE4D
GetLastError.KERNEL32 ref: 00007FF6D34EEE57
GetLastError.KERNEL32 ref: 00007FF6D34EEECE

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: ConsoleErrorLastWrite$ByteCharMultiWide
String ID:
API String ID: 1956605914-0
Opcode ID: 8cc9ad3dd247b0712cdc626823cb013f669e4188b96b897174f53f20c94ee3c9
Instruction ID: a566274d672e148795d671163f38e6041feb62bdb6a70a34bed835fae27359f4
Opcode Fuzzy Hash: 8cc9ad3dd247b0712cdc626823cb013f669e4188b96b897174f53f20c94ee3c9
Instruction Fuzzy Hash: E051AC22A0869685E7208B65D8463FEA251BB047D8F484632ED4EF7AD8DF3D96A58340

Function 00007FF6D34F0790 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68networkCOMMON

Download Yara Rule

APIs

connect.WS2_32 ref: 00007FF6D34F083A
WSAGetLastError.WS2_32(?,?,?,?,?,+h+s,00000000,?,00007FF6D34D36EC), ref: 00007FF6D34F084C
closesocket.WS2_32 ref: 00007FF6D34F085F

Strings

+h+s, xrefs: 00007FF6D34F0792

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: ErrorLastclosesocketconnect
String ID: +h+s
API String ID: 1542918720-2949623892
Opcode ID: ab9fde687e3e598cc117a40da9ddbc42c744ea24dc851e7e8a6286f687b7e008
Instruction ID: dabec3e3065deb3c6b451927616d4ddda324cb3cd9797c5d5c0006313dc4457c
Opcode Fuzzy Hash: ab9fde687e3e598cc117a40da9ddbc42c744ea24dc851e7e8a6286f687b7e008
Instruction Fuzzy Hash: 7521D761F0864686F7518B6286062BDA361AF847D4F188136CE4DE7B94EF6CA9B1C740

Function 00007FF6D34F01D0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF6D34F01E9
GetProcAddress.KERNEL32 ref: 00007FF6D34F01FE

Strings

SetThreadDescription, xrefs: 00007FF6D34F01F4
kernel32, xrefs: 00007FF6D34F01E2

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: SetThreadDescription$kernel32
API String ID: 1646373207-1950310818
Opcode ID: f35343e957d81f29b0cfe5f80b3b9b94f5bef8ac7c641135711ed7b0e7c6ecbd
Instruction ID: b58ff11666eeab9259dd1ae26419a629ed96248d24a8e4578c6c4fc58d56d724
Opcode Fuzzy Hash: f35343e957d81f29b0cfe5f80b3b9b94f5bef8ac7c641135711ed7b0e7c6ecbd
Instruction Fuzzy Hash: B6F08914F09B49D5FA158B82EC461F8A360AF48BD5F494037CD0EA3750EE3CE568C310

Function 00007FF6D34E48D0 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 167stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 00007FF6D34E48F4
memcmp.VCRUNTIME140 ref: 00007FF6D34E49F1
memmove.VCRUNTIME140 ref: 00007FF6D34E4A64

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00007FF6D34E4AB9

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: lstrlenmemcmpmemmove
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 3068774867-2333694755
Opcode ID: 097221d359f9ae9315f7db0d346ba9872c946f03235e5fa8b5dfcddd1df57c6f
Instruction ID: 1c48351cd97b4a8f33b5d68ad41da0fa47310c4dfc35b68a0da95aafec931242
Opcode Fuzzy Hash: 097221d359f9ae9315f7db0d346ba9872c946f03235e5fa8b5dfcddd1df57c6f
Instruction Fuzzy Hash: 0851B752A0874581EA10DB62A8022BEA760FB45BB8F544733DE6DF37D4DF7CE5618340

Function 00007FF6D34E7CF0 Relevance: 6.1, APIs: 4, Instructions: 85COMMON

Download Yara Rule

APIs

CancelIo.KERNEL32(?,?,?,?,?,?,00000000,?,00007FF6D34D5BBD,?,?,?,00000000,?,00007FF6D34E78F6), ref: 00007FF6D34E7D18
GetOverlappedResult.KERNEL32(?,?,?,?,?,?,00000000,?,00007FF6D34D5BBD,?,?,?,00000000,?,00007FF6D34E78F6), ref: 00007FF6D34E7D3A
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,?,00007FF6D34D5BBD,?,?,?,00000000,?,00007FF6D34E78F6), ref: 00007FF6D34E7D58
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,?,00007FF6D34D5BBD,?,?,?,00000000,?,00007FF6D34E78F6), ref: 00007FF6D34E7DB4

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: ErrorLast$CancelOverlappedResult
String ID:
API String ID: 3836860830-0
Opcode ID: 0d6a3f8a805c6b89bebaa39ccf015ecf48fa0361ce349d1ec8789ad1fc8d0611
Instruction ID: 04869e269cfca16e3cf9b186f901c65951bab4cddd4f759e86bbc193d7acbc33
Opcode Fuzzy Hash: 0d6a3f8a805c6b89bebaa39ccf015ecf48fa0361ce349d1ec8789ad1fc8d0611
Instruction Fuzzy Hash: 50318132A04B4186E7108F62E8017BDA7A0FB847A4F188536CE5CE3794CF3DE991C340

Function 00007FF6D34E79D0 Relevance: 6.1, APIs: 4, Instructions: 84COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(?,?,?,?,00000000,00000001,?,00007FF6D34E76BD), ref: 00007FF6D34E7A00
GetLastError.KERNEL32(?,?,?,?,00000000,00000001,?,00007FF6D34E76BD), ref: 00007FF6D34E7A5D
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000001,?,00007FF6D34E76BD), ref: 00007FF6D34E7ACE
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000001,?,00007FF6D34E76BD), ref: 00007FF6D34E7AD4

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: CloseHandle$CreateErrorEventLast
String ID:
API String ID: 3743700123-0
Opcode ID: 41b0fc3f326c798697f9e71773b707d7e1c60f22c00989ee746eebeaed7e9687
Instruction ID: f9714d2146a0428806f93800ce4d051b7a06f96b8ceb839644a34fec7041853b
Opcode Fuzzy Hash: 41b0fc3f326c798697f9e71773b707d7e1c60f22c00989ee746eebeaed7e9687
Instruction Fuzzy Hash: 4E218C33A04B4086E7218F22B85136DAA64EB887A4F188236DF9D537D0EF3D95E6C340

Function 00007FF6D34E9597 Relevance: 6.1, APIs: 4, Instructions: 84COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF6D34E96BD
GetSystemDirectoryW.KERNEL32 ref: 00007FF6D34E96C9
GetLastError.KERNEL32 ref: 00007FF6D34E96D6
GetLastError.KERNEL32 ref: 00007FF6D34E96F0

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: ErrorLast$DirectorySystem
String ID:
API String ID: 860285823-0
Opcode ID: 6d0cdf0a28aadf5b0df58b8e6606ab2ae181b47ca8618a7ffee0bb89751b144a
Instruction ID: cb86a1b10b74f15319c84334034130be59468ad74eb713237e6036f16fd8a8a1
Opcode Fuzzy Hash: 6d0cdf0a28aadf5b0df58b8e6606ab2ae181b47ca8618a7ffee0bb89751b144a
Instruction Fuzzy Hash: A331C422A08B6245F7748F3699563BDA291BF04BA9F140137D91EF66D8EF2DA550C300

Function 00007FF6D34D4BD0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 236networkCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF6D34D4C03
WSAStartup.WS2_32 ref: 00007FF6D34D4C0F

Strings

__rust_end_short_backtrace__rust_begin_short_backtraces [... omitted frame ...], xrefs: 00007FF6D34E1E62

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: Startupmemset
String ID: __rust_end_short_backtrace__rust_begin_short_backtraces [... omitted frame ...]
API String ID: 1873301828-1231577002
Opcode ID: b0eddce7fe33bb42552e16108e32812b5c359ef9b265ea7aa9d1c09704aac092
Instruction ID: 155af55626eb65bb101b05e2b1b53cc22e96459ac83cbe91603521468a890db5
Opcode Fuzzy Hash: b0eddce7fe33bb42552e16108e32812b5c359ef9b265ea7aa9d1c09704aac092
Instruction Fuzzy Hash: 46B12822A08B8599E721CF65D8413EC77A0FB45798F448126DF8DA7B99DF3DE2A5C300

Function 00007FF6D34E2F60 Relevance: 5.1, APIs: 4, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6D34E2F7D
memmove.VCRUNTIME140 ref: 00007FF6D34E2FDD
GetProcessHeap.KERNEL32 ref: 00007FF6D34E2FE6
HeapFree.KERNEL32 ref: 00007FF6D34E2FF4

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: Heap$Process$Freememmove
String ID:
API String ID: 1907206786-0
Opcode ID: 3e12bfa78147047b6efd51ccb68fe556bd34640b66029a57a27eb93a1c74438f
Instruction ID: 4e09c1021014992031cbbe9bd70ec3bc378eae976b64f39e08add3330d5f840d
Opcode Fuzzy Hash: 3e12bfa78147047b6efd51ccb68fe556bd34640b66029a57a27eb93a1c74438f
Instruction Fuzzy Hash: 2801F923B49AA941F906DB93AD060AD87466B88FF8F4D8432CE4DA3741DD3CD1E78300

Function 00007FF6D34D19B0 Relevance: 5.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF6D34D19E9
CloseHandle.KERNEL32 ref: 00007FF6D34D19EF
CloseHandle.KERNEL32 ref: 00007FF6D34D19FB
CloseHandle.KERNEL32 ref: 00007FF6D34D1A0C

Memory Dump Source

Source File: 00000000.00000002.901662895.00007FF6D34D1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF6D34D0000, based on PE: true

Associated: 00000000.00000002.901640051.00007FF6D34D0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901735216.00007FF6D3502000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901780143.00007FF6D3511000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.901826256.00007FF6D3512000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d34d0000_lmtyweWwbU.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 53028f9988b41fbe304bb245313824de683c7cf9cf1e9230ab237fb7c421fb4f
Instruction ID: 5b682125860a4d0b2c16b00763ef3433ad12fa980fbcf089b8215bed6ef4257c
Opcode Fuzzy Hash: 53028f9988b41fbe304bb245313824de683c7cf9cf1e9230ab237fb7c421fb4f
Instruction Fuzzy Hash: 50011E23B0954582E6758B17F95136DA224EB947E6F445132DF4E96A90DF3CE8D6C300

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report lmtyweWwbU.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

TCP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: lmtyweWwbU.exePID: 6644, Parent PID: 4056

General

File Activities

File Opened

Windows Analysis Report
lmtyweWwbU.exe