Edit tour

Windows Analysis Report
ujsvTrVlol.exe

Overview

General Information

Sample name:	ujsvTrVlol.exe renamed because original name is a hash value
Original sample name:	15af4a7899b540337cebe28776f4e24874aa6ac219636ca76b5b106f98919a04.exe
Analysis ID:	1502382
MD5:	35868ed1b450f9fcf74d7076b64383f2
SHA1:	a5be319b81e0551e27436f0a5010808723d48704
SHA256:	15af4a7899b540337cebe28776f4e24874aa6ac219636ca76b5b106f98919a04
Tags:	exe
Infos:

Detection

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

AI detected suspicious sample

Contains functionality to inject code into remote processes

Found direct / indirect Syscall (likely to bypass EDR)

Hides threads from debuggers

Machine Learning detection for sample

PE file has nameless sections

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Detected potential crypto function

Found large amount of non-executed APIs

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains more sections than normal

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Classification

Process Tree

System is w10x64

ujsvTrVlol.exe (PID: 5180 cmdline: "C:\Users\user\Desktop\ujsvTrVlol.exe" MD5: 35868ED1B450F9FCF74D7076B64383F2)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: ujsvTrVlol.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Code function: 0_2_00007FF7F59E2205 FindFirstFileW,FindClose,	0_2_00007FF7F59E2205
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Code function: 0_2_00007FF7F59E21E4 FindFirstFileW,FindClose,	0_2_00007FF7F59E21E4
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Code function: 0_2_00007FF7F59E21DC FindFirstFileW,FindClose,	0_2_00007FF7F59E21DC
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Code function: 0_2_00007FF7F59E21F1 FindFirstFileW,FindClose,	0_2_00007FF7F59E21F1

Source: C:\Users\user\Desktop\ujsvTrVlol.exe

Code function: 0_2_00007FF7F59E55D2 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,GetLastError,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00007FF7F59E55D2

Source: ujsvTrVlol.exe	String found in binary or memory: https://enigmaprotector.com/taggant/spv.crl0
Source: ujsvTrVlol.exe	String found in binary or memory: https://enigmaprotector.com/taggant/user.crl0
Source: ujsvTrVlol.exe, 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://gcc.gnu.org/bugs/):

System Summary

PE file has nameless sections

Source: ujsvTrVlol.exe	Static PE information: section name:
Source: ujsvTrVlol.exe	Static PE information: section name:
Source: ujsvTrVlol.exe	Static PE information: section name:
Source: ujsvTrVlol.exe	Static PE information: section name:
Source: ujsvTrVlol.exe	Static PE information: section name:
Source: ujsvTrVlol.exe	Static PE information: section name:
Source: ujsvTrVlol.exe	Static PE information: section name:
Source: ujsvTrVlol.exe	Static PE information: section name:
Source: ujsvTrVlol.exe	Static PE information: section name:
Source: ujsvTrVlol.exe	Static PE information: section name:
Source: ujsvTrVlol.exe	Static PE information: section name:
Source: ujsvTrVlol.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Code function: 0_2_00007FF7F59E493C	0_2_00007FF7F59E493C
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Code function: 0_2_00007FF7F59E58C0	0_2_00007FF7F59E58C0
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Code function: 0_2_00007FF7F59E1E5B	0_2_00007FF7F59E1E5B
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Code function: 0_2_00007FF7F59E159A	0_2_00007FF7F59E159A
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Code function: 0_2_00007FF7F59EA9FA	0_2_00007FF7F59EA9FA
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Code function: 0_2_00007FF7F59E8982	0_2_00007FF7F59E8982
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Code function: 0_2_00007FF7F59E4963	0_2_00007FF7F59E4963
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Code function: 0_2_00007FF7F59E8F62	0_2_00007FF7F59E8F62

Source: ujsvTrVlol.exe

Static PE information: invalid certificate

Source: ujsvTrVlol.exe

Static PE information: Number of sections : 12 > 10

Source: ujsvTrVlol.exe

Static PE information: Section: ZLIB complexity 0.9949612657563025

Source: classification engine

Classification label: mal80.evad.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\ujsvTrVlol.exe

Code function: 0_2_00007FF7F59E493C GetEnvironmentVariableW,GetFileAttributesW,GetEnvironmentVariableW,GetFileAttributesW,CreateToolhelp32Snapshot,Process32FirstW,_wcsicmp,Process32NextW,_wcsicmp,

0_2_00007FF7F59E493C

Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mutex object: Unique: -1472423074-1413185751. Number: 8
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mutex object: Unique: -1472423074-1413185751. Number: 9
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mutex object: Unique: -1472423074-1413185751. Number: 4
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mutex object: Unique: -1472423074-1413185751. Number: 5
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mutex object: Unique: -1472423074-1413185751. Number: 6
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mutex object: Unique: -1472423074-1413185751. Number: 7
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mutex object: Unique: -1472423074-1413185751. Number: 0
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mutex object: Unique: -1472423074-1413185751. Number: 1
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mutex object: Unique: -1472423074-1413185751. Number: 2
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mutex object: Unique: -1472423074-1413185751. Number: 3
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mutex object: Unique: -1472423074-1413185751. Number: 10

Source: C:\Users\user\Desktop\ujsvTrVlol.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\ujsvTrVlol.exe

File read: C:\Users\user\Desktop\ujsvTrVlol.exe

Jump to behavior

Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Section loaded: userenv.dll	Jump to behavior

Source: C:\Users\user\Desktop\ujsvTrVlol.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\InProcServer32

Jump to behavior

Source: ujsvTrVlol.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: ujsvTrVlol.exe

Static file information: File size 16260936 > 1048576

Source: ujsvTrVlol.exe

Static PE information: Raw size of is bigger than: 0x100000 < 0x323600

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\ujsvTrVlol.exe

Unpacked PE file: 0.2.ujsvTrVlol.exe.7ff7f59e0000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;Unknown_Section5:W;Unknown_Section6:EW;Unknown_Section7:EW;Unknown_Section8:EW;Unknown_Section9:EW;Unknown_Section10:EW;Unknown_Section11:EW; vs Unknown_Section0:ER;Unknown_Section1:W;Unknown_Section2:R;Unknown_Section3:R;Unknown_Section4:R;Unknown_Section5:W;Unknown_Section6:W;Unknown_Section7:W;Unknown_Section8:W;Unknown_Section9:R;Unknown_Section10:EW;Unknown_Section11:EW;

Source: ujsvTrVlol.exe	Static PE information: section name:
Source: ujsvTrVlol.exe	Static PE information: section name:
Source: ujsvTrVlol.exe	Static PE information: section name:
Source: ujsvTrVlol.exe	Static PE information: section name:
Source: ujsvTrVlol.exe	Static PE information: section name:
Source: ujsvTrVlol.exe	Static PE information: section name:
Source: ujsvTrVlol.exe	Static PE information: section name:
Source: ujsvTrVlol.exe	Static PE information: section name:
Source: ujsvTrVlol.exe	Static PE information: section name:
Source: ujsvTrVlol.exe	Static PE information: section name:
Source: ujsvTrVlol.exe	Static PE information: section name:
Source: ujsvTrVlol.exe	Static PE information: section name:

Source: ujsvTrVlol.exe	Static PE information: section name: entropy: 7.992284035028791
Source: ujsvTrVlol.exe	Static PE information: section name: entropy: 7.857678669786828
Source: ujsvTrVlol.exe	Static PE information: section name: entropy: 7.813860737497707

Source: C:\Users\user\Desktop\ujsvTrVlol.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\ujsvTrVlol.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: ujsvTrVlol.exe, 00000000.00000002.1733792396.000001E802AC9000.00000004.00000020.00020000.00000000.sdmp, ujsvTrVlol.exe, 00000000.00000003.1729303397.000001E802AC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $SANDBOXIERPCSS.EXETA
Source: ujsvTrVlol.exe, 00000000.00000002.1733413761.000001E800C45000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TCPDUMP.EXEZ1Y)H
Source: ujsvTrVlol.exe, 00000000.00000002.1733792396.000001E802AC9000.00000004.00000020.00020000.00000000.sdmp, ujsvTrVlol.exe, 00000000.00000003.1729303397.000001E802AC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NETSNIFFER.EXE#
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: QEMU-GA.EXE
Source: ujsvTrVlol.exe, 00000000.00000002.1734103431.000001E803486000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: XENSERVICE.EXE3
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXEQ
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SBIESVC.EXE&
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: X64DBG.EXE
Source: ujsvTrVlol.exe, 00000000.00000002.1733792396.000001E802AC9000.00000004.00000020.00020000.00000000.sdmp, ujsvTrVlol.exe, 00000000.00000003.1729303397.000001E802AC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SBIECTRL.EXEC
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $APIMONITOR-X86.EXEURES\Q
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WINDBG.EXE=
Source: ujsvTrVlol.exe, 00000000.00000002.1733792396.000001E802AC9000.00000004.00000020.00020000.00000000.sdmp, ujsvTrVlol.exe, 00000000.00000003.1729303397.000001E802AC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IMPORTREC.EXE
Source: ujsvTrVlol.exe, 00000000.00000002.1733792396.000001E802AC9000.00000004.00000020.00020000.00000000.sdmp, ujsvTrVlol.exe, 00000000.00000003.1729303397.000001E802AC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $FAKEHTTPSERVER.EXEU+
Source: ujsvTrVlol.exe, 00000000.00000002.1734103431.000001E803486000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE[
Source: ujsvTrVlol.exe, 00000000.00000002.1733792396.000001E802AC9000.00000004.00000020.00020000.00000000.sdmp, ujsvTrVlol.exe, 00000000.00000003.1729303397.000001E802AC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $BEHAVIORDUMPER.EXE
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WINDUMP.EXE
Source: ujsvTrVlol.exe, 00000000.00000002.1733413761.000001E800C45000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DUMPCAP.EXE?1QD-
Source: ujsvTrVlol.exe, 00000000.00000002.1733413761.000001E800C45000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DUMPCAP.EXE>
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: REGMON.EXEG
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SYSANALYZER.EXE
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMUSRVC.EXE0
Source: ujsvTrVlol.exe, 00000000.00000002.1734103431.000001E803486000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: XENSERVICE.EXEV
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: ujsvTrVlol.exe, 00000000.00000002.1733792396.000001E802AC9000.00000004.00000020.00020000.00000000.sdmp, ujsvTrVlol.exe, 00000000.00000003.1729303397.000001E802AC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CFF EXPLORER.EXE
Source: ujsvTrVlol.exe, 00000000.00000002.1734103431.000001E803486000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AUTORUNSC.EXE9
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AUTORUNS.EXES\PICTURES\\{
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .SANDBOXIEDCOMLAUNCH.EXE
Source: ujsvTrVlol.exe, 00000000.00000002.1733792396.000001E802AC9000.00000004.00000020.00020000.00000000.sdmp, ujsvTrVlol.exe, 00000000.00000003.1729303397.000001E802AC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: :FRIDA-WINJECTOR-HELPER-64.EXELOL.EXE\WINDOWS\INETCACHE\\
Source: ujsvTrVlol.exe, 00000000.00000002.1733792396.000001E802AC9000.00000004.00000020.00020000.00000000.sdmp, ujsvTrVlol.exe, 00000000.00000003.1729303397.000001E802AC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "PROC_ANALYZER.EXEG
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PETOOLS.EXE
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FIDDLER.EXE
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp, ujsvTrVlol.exe, 00000000.00000002.1733413761.000001E800C45000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TCPDUMP.EXE
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SNIFF_HIT.EXE
Source: ujsvTrVlol.exe, 00000000.00000002.1734103431.000001E803486000.00000004.00000020.00020000.00000000.sdmp, ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: XENSERVICE.EXE
Source: ujsvTrVlol.exe, 00000000.00000002.1733792396.000001E802AC9000.00000004.00000020.00020000.00000000.sdmp, ujsvTrVlol.exe, 00000000.00000003.1729303397.000001E802AC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HOOKEXPLORER.EXEK
Source: ujsvTrVlol.exe, 00000000.00000002.1733413761.000001E800C45000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AUTORUNSC.EXE91PC-
Source: ujsvTrVlol.exe, 00000000.00000002.1733736527.000001E802A60000.00000004.00000020.00020000.00000000.sdmp, ujsvTrVlol.exe, 00000000.00000002.1733413761.000001E800C45000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DUMPCAP.EXE
Source: ujsvTrVlol.exe, 00000000.00000002.1733792396.000001E802AC9000.00000004.00000020.00020000.00000000.sdmp, ujsvTrVlol.exe, 00000000.00000003.1729303397.000001E802AC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "PROCESSHACKER.EXE
Source: ujsvTrVlol.exe, 00000000.00000002.1734103431.000001E803486000.00000004.00000020.00020000.00000000.sdmp, ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE
Source: ujsvTrVlol.exe, 00000000.00000002.1733792396.000001E802AC9000.00000004.00000020.00020000.00000000.sdmp, ujsvTrVlol.exe, 00000000.00000003.1729303397.000001E802AC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AUTORUNSC.EXEC

Source: C:\Users\user\Desktop\ujsvTrVlol.exe

API coverage: 8.4 %

Source: C:\Users\user\Desktop\ujsvTrVlol.exe TID: 1804

Thread sleep count: 231 > 30

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\ujsvTrVlol.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Code function: 0_2_00007FF7F59E2205 FindFirstFileW,FindClose,	0_2_00007FF7F59E2205
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Code function: 0_2_00007FF7F59E21E4 FindFirstFileW,FindClose,	0_2_00007FF7F59E21E4
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Code function: 0_2_00007FF7F59E21DC FindFirstFileW,FindClose,	0_2_00007FF7F59E21DC
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Code function: 0_2_00007FF7F59E21F1 FindFirstFileW,FindClose,	0_2_00007FF7F59E21F1

Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 3Windows 2012 Server Standard without Hyper-V (core)
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 11 Essential Server Solutions without Hyper-V
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: #Windows 10 Microsoft Hyper-V Server
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8.1 Microsoft Hyper-V Server
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 Server Standard without Hyper-V
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8 Microsoft Hyper-V Server
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (full)
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (core)
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 3Windows 2016 Server Standard without Hyper-V (core)
Source: ujsvTrVlol.exe, 00000000.00000002.1733962235.000001E803070000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmicheartbeatfaceY
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8.1 Server Standard without Hyper-V (core)
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (core)
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: (Windows 2012 R2 Microsoft Hyper-V Server
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 11 Microsoft Hyper-V Server
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 6Windows 2012 R2 Server Standard without Hyper-V (core)
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8 Server Datacenter without Hyper-V (core)
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 10 Server Datacenter without Hyper-V (core)
Source: ujsvTrVlol.exe, 00000000.00000002.1734103431.000001E803486000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareuser.exe
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 0Windows 8 Server Standard without Hyper-V (core)
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 6Windows 8.1 Essential Server Solutions without Hyper-V
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: vmwareVBoxService.exe
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: vmware
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8 Server Standard without Hyper-V
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 4Windows 8 Essential Server Solutions without Hyper-V
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (full)
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2016 Essential Server Solutions without Hyper-V
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (full)
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmtools
Source: ujsvTrVlol.exe, 00000000.00000002.1734103431.000001E803486000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: qemu-ga!
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (core)
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: "Windows 8 Microsoft Hyper-V Server
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (full)
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (full)
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 10 Server Standard without Hyper-V
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 R2 Microsoft Hyper-V Server
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (core)
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwaretray.exeO
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 11 Server Standard without Hyper-V (core)
Source: ujsvTrVlol.exe, 00000000.00000002.1733962235.000001E803070000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OLEAUT32.dllager.dllHhyper-v m
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8.1 Essential Server Solutions without Hyper-V
Source: ujsvTrVlol.exe, 00000000.00000002.1734103431.000001E803486000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwaretray.exeW
Source: ujsvTrVlol.exe, 00000000.00000002.1734103431.000001E803486000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareuser.exe>1qe-
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V (core)
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Hyper-V (guest)
Source: ujsvTrVlol.exe, 00000000.00000002.1734103431.000001E803486000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwaretray.exe>1qe-
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 Essential Server Solutions without Hyper-V
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 10 Microsoft Hyper-V Server
Source: ujsvTrVlol.exe, 00000000.00000002.1734103431.000001E803486000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareuser.exe<
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2016 Microsoft Hyper-V Server
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: /Windows 2012 R2 Server Standard without Hyper-V
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 11 Server Standard without Hyper-V
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: )Windows 8 Server Standard without Hyper-V
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 11 Server Enterprise without Hyper-V (full)
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (core)
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmsrvc.exeM
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 11 Server Datacenter without Hyper-V (full)
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (core)
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmusrvc.exe0
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Hyper-V
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: %Windows 2012 Microsoft Hyper-V Server
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: $Windows 8.1 Microsoft Hyper-V Server
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ,Windows 2012 Server Standard without Hyper-V
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxservice
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (full)
Source: ujsvTrVlol.exe, 00000000.00000002.1734103431.000001E803486000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxtray.exe>1qe-
Source: ujsvTrVlol.exe, 00000000.00000003.1728764942.000001E803176000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Exchange ServicevmickvpexchangeHyper-V Heartbeat ServicevmicheartbeatHyper-V Gue
Source: ujsvTrVlol.exe, 00000000.00000002.1734103431.000001E803486000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxservice.exe(
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 Microsoft Hyper-V Server
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (core)
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: qemu-ga.exe
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 10 Essential Server Solutions without Hyper-V
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8 Essential Server Solutions without Hyper-V
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (core)
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 10 Server Standard without Hyper-V (core)
Source: ujsvTrVlol.exe, 00000000.00000002.1734103431.000001E803486000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxtray.exe5
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 7Windows 2012 Essential Server Solutions without Hyper-V
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8 Server Enterprise without Hyper-V (full)
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (core)
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (full)
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (full)
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: %Windows 2016 Microsoft Hyper-V Server
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (full)
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (core)
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (core)
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 7Windows 2016 Essential Server Solutions without Hyper-V
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: +Windows 8.1 Server Standard without Hyper-V
Source: ujsvTrVlol.exe, 00000000.00000003.1728764942.000001E803176000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l Direct ServicevmicvmsessionHyper-V Time Synchronization ServicevmictimesyncHyp
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmmemctl.exec
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2016 Server Standard without Hyper-V
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (core)
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 11 Server Enterprise without Hyper-V (core)
Source: ujsvTrVlol.exe, 00000000.00000002.1734103431.000001E803486000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxservice.exe]
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 11 Server Datacenter without Hyper-V (core)
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (full)
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (full)
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Fvmware physical disk helper servicee\windows\inetcache\
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxservice.exe
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (core)
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 10 Server Enterprise without Hyper-V (core)
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 10 Server Datacenter without Hyper-V (full)
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: :Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 5Windows 11 Essential Server Solutions without Hyper-V
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2016 Server Standard without Hyper-V (core)
Source: ujsvTrVlol.exe, 00000000.00000002.1734103431.000001E803486000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxservice.exe>1qe-
Source: ujsvTrVlol.exe, 00000000.00000002.1734103431.000001E803486000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwaretray.exe
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8 Server Standard without Hyper-V (core)
Source: ujsvTrVlol.exe, 00000000.00000003.1728764942.000001E803176000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hutdown ServicevmicshutdownHyper-V Remote Desktop Virtualization ServicevmicrdvH
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 5Windows 10 Essential Server Solutions without Hyper-V
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmscsi.exe
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmtoolsd.exeC
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (core)
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (full)
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (full)
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8 Server Enterprise without Hyper-V (core)
Source: ujsvTrVlol.exe, 00000000.00000002.1734103431.000001E803486000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: qemu-ga@
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: *Windows 11 Server Standard without Hyper-V
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ,Windows 2016 Server Standard without Hyper-V
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 Server Standard without Hyper-V (core)
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (core)
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8 Server Datacenter without Hyper-V (full)
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (core)
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (full)
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxtray.exe{
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VBoxService.exe
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 8.1 Server Standard without Hyper-V
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: *Windows 10 Server Standard without Hyper-V
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 1Windows 11 Server Standard without Hyper-V (core)
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 1Windows 10 Server Standard without Hyper-V (core)
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (full)
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (full)
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: VMWare
Source: ujsvTrVlol.exe, 00000000.00000003.1728764942.000001E803176000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: meW32TimeVolume Shadow CopyVSSHyper-V Volume Shadow Copy RequestorvmicvssHyper
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (core)
Source: ujsvTrVlol.exe, ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Windows 10 Server Enterprise without Hyper-V (full)
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 2Windows 8.1 Server Standard without Hyper-V (core)
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (full)
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (core)
Source: ujsvTrVlol.exe, 00000000.00000002.1734103431.000001E803486000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vboxtray.exe^
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (full)
Source: ujsvTrVlol.exe, 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: #Windows 11 Microsoft Hyper-V Server

Source: C:\Users\user\Desktop\ujsvTrVlol.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\ujsvTrVlol.exe

Thread information set: HideFromDebugger

Jump to behavior

Source: C:\Users\user\Desktop\ujsvTrVlol.exe

Process queried: DebugPort

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Code function: 0_2_00007FF7F59E1131 Sleep,Sleep,_amsg_exit,_initterm,_initterm,SetUnhandledExceptionFilter,_malloc_dbg,strlen,_malloc_dbg,_cexit,		0_2_00007FF7F59E1131
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	Code function: 0_2_00007FF7F5A11690 SetUnhandledExceptionFilter,		0_2_00007FF7F5A11690

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\ujsvTrVlol.exe

Code function: 0_2_00007FF7F59E58C0 ExitProcess,CreateMutexA,GetLastError,CreateProcessA,CreateProcessA,VirtualAllocEx,WriteProcessMemory,VirtualProtect,QueueUserAPC,ResumeThread,

0_2_00007FF7F59E58C0

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\ujsvTrVlol.exe	NtProtectVirtualMemory: Indirect: 0x7FF7F65F92E1	Jump to behavior
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	NtProtectVirtualMemory: Indirect: 0x7FF7F5AABD37	Jump to behavior
Source: C:\Users\user\Desktop\ujsvTrVlol.exe	NtSetInformationThread: Indirect: 0x7FF7F5A5ACC1	Jump to behavior

Source: ujsvTrVlol.exe, 00000000.00000002.1733792396.000001E802B65000.00000004.00000020.00020000.00000000.sdmp, ujsvTrVlol.exe, 00000000.00000003.1729303397.000001E802B65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: shell_traywndexeeh
Source: ujsvTrVlol.exe, 00000000.00000002.1733962235.000001E803070000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: program manager chrome
Source: ujsvTrVlol.exe, 00000000.00000002.1733917093.000001E802BFB000.00000004.00000020.00020000.00000000.sdmp, ujsvTrVlol.exe, 00000000.00000003.1729442062.000001E802BF8000.00000004.00000020.00020000.00000000.sdmp, ujsvTrVlol.exe, 00000000.00000003.1729303397.000001E802B65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: progmane

Source: C:\Users\user\Desktop\ujsvTrVlol.exe

Code function: 0_2_00007FF7F59F2040 GetSystemTimeAsFileTime,

0_2_00007FF7F59F2040

Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: procmon.exe
Source: ujsvTrVlol.exe, 00000000.00000002.1734103431.000001E803486000.00000004.00000020.00020000.00000000.sdmp, ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: wireshark.exe
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fch32.exe
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: spideragent.exe
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: procexp.exe
Source: ujsvTrVlol.exe, 00000000.00000002.1733602494.000001E8026A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fsaua.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	23 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	11 Process Injection	LSASS Memory	331 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	23 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	3 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ujsvTrVlol.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
https://gcc.gnu.org/bugs/):	0%	Avira URL Cloud	safe
https://enigmaprotector.com/taggant/spv.crl0	0%	Avira URL Cloud	safe
https://enigmaprotector.com/taggant/user.crl0	0%	Avira URL Cloud	safe
https://enigmaprotector.com/taggant/user.crl0	0%	Virustotal		Browse
https://enigmaprotector.com/taggant/spv.crl0	0%	Virustotal		Browse
https://gcc.gnu.org/bugs/):	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
https://gcc.gnu.org/bugs/):	ujsvTrVlol.exe, 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://enigmaprotector.com/taggant/spv.crl0	ujsvTrVlol.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://enigmaprotector.com/taggant/user.crl0	ujsvTrVlol.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502382
Start date and time:	2024-09-01 03:42:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ujsvTrVlol.exe renamed because original name is a hash value
Original Sample Name:	15af4a7899b540337cebe28776f4e24874aa6ac219636ca76b5b106f98919a04.exe
Detection:	MAL
Classification:	mal80.evad.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Report size getting too big, too many NtQueryValueKey calls found.

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	2.535956405188153
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	ujsvTrVlol.exe
File size:	16'260'936 bytes
MD5:	35868ed1b450f9fcf74d7076b64383f2
SHA1:	a5be319b81e0551e27436f0a5010808723d48704
SHA256:	15af4a7899b540337cebe28776f4e24874aa6ac219636ca76b5b106f98919a04
SHA512:	75e5dca2f3718b48df8bec3e2d9222f73c6c7d0d0315bf4291fbb5eb40400b0d87bf0ac7f992c1949880e4e157cfec67fa21c033132d8ae238f0086dc35c5c96
SSDEEP:	49152:3GkxqJL9ShMZwshiNMNVkWeedBdI3voGkQwJ5dxKMVgM6QW/ddz/xMC3h/:3NFgwixLZ8flkQaz/Vg5h37Jd
TLSH:	55F63387F96F2ACAE60525BA6A145542CFAB12447BFF0805730ED78C71C37A11BDA3C9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(.......................@.............................p.......'....`...@...... ........ ...... .....

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x141031d90
Entrypoint Section:
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	c1fbf380722f62e9d13f77bc10915a89

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Microsoft Windows Third Party Component CA 2012, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	14/09/2023 20:14:17 04/09/2024 20:14:17
Subject Chain	CN=Microsoft Windows 3rd party Component, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	D327E7E8E247DDC0E7314737F61385E9
Thumbprint SHA-1:	D8E11B329D0A4327717DE0F59AFA3B50652A589C
Thumbprint SHA-256:	33760015F745C23025DD88BAC62534A4373F18D396806AB2C38ABEA7FFCB6C7B
Serial:	3300000105637D69ABB7413418000000000105

Entrypoint Preview

Instruction
jmp 00007F4C5C803A9Ah
add dl, al
add eax, 00000000h
add byte ptr [eax+51h], dl
push edx
push ebx
push ebp
push esi
push edi
inc ecx
push eax
inc ecx
push ecx
inc ecx
push edx
inc ecx
push ebx
inc ecx
push esp
inc ecx
push ebp
inc ecx
push esi
inc ecx
push edi
dec eax
pushfd
dec eax
sub esp, 00000008h
stmxcsr dword ptr [esp]
call 00007F4C5C803A95h
pop ebp
dec eax
sub ebp, 00000033h
dec eax
sub ebp, 01031D90h
dec eax
sub esp, 00000020h
jmp 00007F4C5C803A99h
ret
push ebx
das
sahf
dec eax
mov eax, 01031D90h
dec eax
add eax, ebp
dec eax
add eax, 00000084h
dec eax
mov ecx, 0000060Bh
dec eax
mov edx, 3C125229h
xor byte ptr [eax], dl
dec eax
inc eax
dec eax
dec ecx
jne 00007F4C5C803A88h
jmp 00007F4C5C803A99h
std
wait
adc al, 15h
popad
mov al, byte ptr [15A0A2C0h]
sub dword ptr [ecx], ebp
sub dword ptr [ecx-58h], esp
call 00007F4C85A962B6h
popad
sub al, al
popad
out dx, al
jmp 00007F4C85A963B8h
popad
out dx, al
jmp 00007F4C5C803A93h
sub dword ptr [ecx], ebp
sub dword ptr [ecx-22h], esp
retf
popad
sub al, ch
mov byte ptr [292925A8h], al
sub dword ptr [ecx+28h], esp
sar dword ptr [ecx+79h], 61h
xchg eax, ecx
xchg eax, ecx
xor al, 06h
sub dword ptr [ecx], ebp
sub dword ptr [ecx], ebp
sub dword ptr [ecx-70h], esp
int1

Data Directories

Name	Virtual Address	Virtual Size
IMAGE_DIRECTORY_ENTRY_EXPORT	0xd16060	0xe10
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd16e70	0x2e8
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xd17a58	0x28260
IMAGE_DIRECTORY_ENTRY_SECURITY	0xf7f800	0x2748
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd16040	0x10
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xd16000	0x28
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
0x1000	0x21000	0xee00	a2978e26ac17b895a8892198932c7586	False	0.9949612657563025	data	7.992284035028791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0x22000	0x2000	0x200	2ef7b7c14f375ed79bc660e3d832d7d5	False	0.54296875	data	4.549237444581537	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0x24000	0x5000	0x1800	cff392e02346bede5550c56f00474076	False	0.9654947916666666	data	7.857678669786828	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0x29000	0x4000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0x2d000	0x3000	0xa00	ceb4031eca21f49fbd6372c9fbeb45da	False	0.980859375	data	7.813860737497707	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0x30000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0x31000	0x2000	0x200	b651ac7f2eb6e0a28d8da1e67d8f9a27	False	0.1796875	data	1.4913317566268227	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0x33000	0x1000	0x200	09801ea94b4138c6eea441e1236259fe	False	0.087890625	data	0.6015377733147627	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0x34000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0x35000	0x1000	0x400	6cc157b8ee4be76ec9623a2911c34ff8	False	0.8056640625	data	6.6013212901111435	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0x36000	0xcdd000	0x4a400	8b084ac645ee6665e6bce9495fb597c6	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0xd13000	0x324000	0x323600	f19b582d0e1a165ed888bb908274f1fe	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	GetModuleHandleA, GetProcAddress, ExitProcess, LoadLibraryA
user32.dll	MessageBoxA
advapi32.dll	RegCloseKey
oleaut32.dll	SysFreeString
gdi32.dll	CreateFontA
shell32.dll	ShellExecuteA
version.dll	GetFileVersionInfoA
ole32.dll	OleInitialize
msvcrt.dll	__C_specific_handler
WININET.dll	InternetCloseHandle

Target ID:	0
Start time:	21:43:04
Start date:	31/08/2024
Path:	C:\Users\user\Desktop\ujsvTrVlol.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\ujsvTrVlol.exe"
Imagebase:	0x7ff7f59e0000
File size:	16'260'936 bytes
MD5 hash:	35868ED1B450F9FCF74D7076B64383F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	23.6%
Total number of Nodes:	1411
Total number of Limit Nodes:	6

Executed Functions

Function 00007FF7F59E58C0 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 341
memoryinjectionprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32 ref: 00007FF7F59E58E3
CreateMutexA.KERNEL32 ref: 00007FF7F59E59B4
GetLastError.KERNEL32 ref: 00007FF7F59E59BD
CreateProcessA.KERNEL32 ref: 00007FF7F59E5CC3
VirtualAllocEx.KERNEL32 ref: 00007FF7F59E5CF3
WriteProcessMemory.KERNEL32 ref: 00007FF7F59E5D0F
VirtualProtect.KERNEL32 ref: 00007FF7F59E5D24
QueueUserAPC.KERNEL32 ref: 00007FF7F59E5D33
ResumeThread.KERNEL32 ref: 00007FF7F59E5D3C

Strings

@, xrefs: 00007FF7F59E5CD2

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: Process$CreateVirtual$AllocErrorExitLastMemoryMutexProtectQueueResumeThreadUserWrite
String ID: @
API String ID: 2997260034-2766056989
Opcode ID: 9f7852a02a220a5e5b33c3eb3e8b6b9e50d7e72d7da08080b9e47964c4a5a969
Instruction ID: cf6ec4206e2cc9b31051db56076bd0551cf557771414b74e0bfe573d4e6066f2
Opcode Fuzzy Hash: 9f7852a02a220a5e5b33c3eb3e8b6b9e50d7e72d7da08080b9e47964c4a5a969
Instruction Fuzzy Hash: 22E1D122A1C58696E728EB20D420A6EFB91EB51F84FD48031DA1D077D1DF7CA855CBB2

Function 00007FF7F59E1131 Relevance: 13.6, APIs: 9, Instructions: 120
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00007FF7F59E116E
_amsg_exit.MSVCRT ref: 00007FF7F59E118D
_initterm.MSVCRT ref: 00007FF7F59E11AE
_initterm.MSVCRT ref: 00007FF7F59E11D3
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7F59E1212
_malloc_dbg.MSVCRT ref: 00007FF7F59E1244
strlen.MSVCRT ref: 00007FF7F59E125C
_malloc_dbg.MSVCRT ref: 00007FF7F59E1268
_cexit.MSVCRT ref: 00007FF7F59E12E3

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: _initterm_malloc_dbg$ExceptionFilterSleepUnhandled_amsg_exit_cexitstrlen
String ID:
API String ID: 4167734774-0
Opcode ID: 753628ac01c2c5ff09041190b82e25c71f875488427bbd96ee8c278c392f9780
Instruction ID: d76bd97127d36f017eef35c185b6a99fd034c60e6b1fde5f8de7be86a0b0571c
Opcode Fuzzy Hash: 753628ac01c2c5ff09041190b82e25c71f875488427bbd96ee8c278c392f9780
Instruction Fuzzy Hash: 0E513921A1C64686EB55FB25E840A79ABA4BF48F94F844031DD2D473D1EF3CE46187F2

Function 00007FF7F59E493C Relevance: 12.8, APIs: 8, Instructions: 752COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46388b73c7daebd9874acaa60cf26d5e30e69ca13bc0712a9788c5b13997f90f
Instruction ID: 3f483e11e35d39c74b344efc6bbf5b265384e4651afcf0628b75291faa0c34c9
Opcode Fuzzy Hash: 46388b73c7daebd9874acaa60cf26d5e30e69ca13bc0712a9788c5b13997f90f
Instruction Fuzzy Hash: BE72D232A1D69386E728EB14D40066DFB90EB50F88F98D134C62D077D0DF7AE956C7A2

Function 00007FF7F59E4963 Relevance: 6.6, APIs: 4, Instructions: 597COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: _malloc_dbg$_calloc_dbg_realloc_dbgabort
String ID:
API String ID: 1593204669-0
Opcode ID: 37c4acbd5d2b75a74fc6b2c30c1b30852b287732ed97225bbd25e9d2e457384d
Instruction ID: 88cb606971ccb263c98f765f307fbc550a481c18b951a01583395684a96d9844
Opcode Fuzzy Hash: 37c4acbd5d2b75a74fc6b2c30c1b30852b287732ed97225bbd25e9d2e457384d
Instruction Fuzzy Hash: A252D032A1D6C68AEB28EB14D4006ADFB90FB51F48F988134C62D077D0DF79E956C7A1

Function 00007FF7F59F068F Relevance: 12.1, APIs: 8, Instructions: 71
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32 ref: 00007FF7F59F06A1

Part of subcall function 00007FF7F59F04A5: _calloc_dbg.MSVCRT ref: 00007FF7F59F04D1

GetCurrentThreadId.KERNEL32 ref: 00007FF7F59F06D9
CreateEventA.KERNEL32 ref: 00007FF7F59F06EF

Part of subcall function 00007FF7F59F0551: GetCurrentThreadId.KERNEL32 ref: 00007FF7F59F0591
Part of subcall function 00007FF7F59F0551: _ultoa.MSVCRT ref: 00007FF7F59F05A4
Part of subcall function 00007FF7F59F0551: OutputDebugStringA.KERNEL32 ref: 00007FF7F59F05DB
Part of subcall function 00007FF7F59F0551: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00007FF7F59F05E1

GetCurrentThread.KERNEL32 ref: 00007FF7F59F0726
DuplicateHandle.KERNEL32 ref: 00007FF7F59F0755
abort.MSVCRT ref: 00007FF7F59F075F
GetThreadPriority.KERNEL32 ref: 00007FF7F59F0768
TlsSetValue.KERNEL32 ref: 00007FF7F59F0791

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: Thread$Current$Valueabort$CreateDebugDuplicateEventHandleOutputPriorityString_calloc_dbg_ultoa
String ID:
API String ID: 3003713025-0
Opcode ID: bf720afae6cc2831d5dec5afd31eb2b47a9e5cd5ef4996494e334fc07c4d2c6c
Instruction ID: 3509e98e71915817551886f10fee8d411dcc449ac09b31f6c2afbfe69e048882
Opcode Fuzzy Hash: bf720afae6cc2831d5dec5afd31eb2b47a9e5cd5ef4996494e334fc07c4d2c6c
Instruction Fuzzy Hash: 33319031A1874286EB54EF35E844669BAA5EF44FA4F880235C93E437D4EF3CD451CBA0

Function 00007FF7F59EC17F Relevance: 7.6, APIs: 5, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_calloc_dbg.MSVCRT ref: 00007FF7F59EC202
abort.MSVCRT(?,?,00000000,?,00007FF7F59E15BC), ref: 00007FF7F59EC20F
_malloc_dbg.MSVCRT ref: 00007FF7F59EC28F

Part of subcall function 00007FF7F59EFEE8: GetCurrentThreadId.KERNEL32 ref: 00007FF7F59EFE20

_realloc_dbg.MSVCRT ref: 00007FF7F59EC23A
_malloc_dbg.MSVCRT ref: 00007FF7F59EC2AB

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: _malloc_dbg$CurrentThread_calloc_dbg_realloc_dbgabort
String ID:
API String ID: 4037631172-0
Opcode ID: 98955a1ccf2fb4bb41422b61f5aec0c2e9efb4f9caaed5460e39e2e248c0b7d9
Instruction ID: 4cdbaae3f4a989c4dfbba0444a0ddf5fc31434fb573d7e5034fe9f38ca9bfda2
Opcode Fuzzy Hash: 98955a1ccf2fb4bb41422b61f5aec0c2e9efb4f9caaed5460e39e2e248c0b7d9
Instruction Fuzzy Hash: FC419D21B0DA0696EB09FB15D8046A9A795AF44F94FC88032DE6D177C5EF2CE905C3B1

Function 00007FF7F59F1233 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 00007FF7F59F12E8

Strings

once %p is %d, xrefs: 00007FF7F59F12DE

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: fprintf
String ID: once %p is %d
API String ID: 383729395-95064319
Opcode ID: 55b584f43668437dd560fc9eee8895c1e0dace20f83414431f4fc698468315d6
Instruction ID: f08e7cc56382368d2f03626a1fbcf4ab1f74691d3e7bc290a62a71148563cb5b
Opcode Fuzzy Hash: 55b584f43668437dd560fc9eee8895c1e0dace20f83414431f4fc698468315d6
Instruction Fuzzy Hash: A8118035A08A4285EB18FB61E4005BDA6E49F85FC4FD48031EA3D037D6DF2CE41297A0

Non-executed Functions

Function 00007FF7F59E55D2 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 208
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7F59EC17F: _calloc_dbg.MSVCRT ref: 00007FF7F59EC202
Part of subcall function 00007FF7F59EC17F: abort.MSVCRT(?,?,00000000,?,00007FF7F59E15BC), ref: 00007FF7F59EC20F
Part of subcall function 00007FF7F59EC17F: _malloc_dbg.MSVCRT ref: 00007FF7F59EC28F

Part of subcall function 00007FF7F59EC17F: _realloc_dbg.MSVCRT ref: 00007FF7F59EC23A
Part of subcall function 00007FF7F59EC17F: _malloc_dbg.MSVCRT ref: 00007FF7F59EC2AB

InternetOpenW.WININET ref: 00007FF7F59E56D6
InternetOpenUrlW.WININET ref: 00007FF7F59E5701
InternetCloseHandle.WININET ref: 00007FF7F59E5727
InternetReadFile.WININET ref: 00007FF7F59E57A7
InternetCloseHandle.WININET ref: 00007FF7F59E587A
InternetCloseHandle.WININET ref: 00007FF7F59E5881
GetLastError.KERNEL32 ref: 00007FF7F59E588A
InternetCloseHandle.WININET ref: 00007FF7F59E589E
InternetCloseHandle.WININET ref: 00007FF7F59E58A5

Strings

vector::_M_range_insert, xrefs: 00007FF7F59E57CB

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: Internet$CloseHandle$Open_malloc_dbg$ErrorFileLastRead_calloc_dbg_realloc_dbgabort
String ID: vector::_M_range_insert
API String ID: 264723552-1989829942
Opcode ID: 0f8aa1aad9e42c1a2b09d3c5134087cb67ee98e9b140eb476b48317dedf48c8b
Instruction ID: 019e81b3aaf1599ac06661953deaa7f2a5373b1e4a72ae8718803c0e78c15c9f
Opcode Fuzzy Hash: 0f8aa1aad9e42c1a2b09d3c5134087cb67ee98e9b140eb476b48317dedf48c8b
Instruction Fuzzy Hash: F7811422A1D68286EB14EB26E41066DE790FF45FE4F888131DE6D07BD5DF3CD45287A0

Function 00007FF7F59EA9FA Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 292
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strncoll.MSVCRT ref: 00007FF7F59EAA44
strlen.MSVCRT ref: 00007FF7F59EAAB3
strlen.MSVCRT ref: 00007FF7F59EAC78
strlen.MSVCRT ref: 00007FF7F59EACBD

Strings

_GLOBAL_, xrefs: 00007FF7F59EAA38

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: strlen$_strncoll
String ID: _GLOBAL_
API String ID: 3979851410-770460502
Opcode ID: 78255e53fb856305445e6588d778a689cd4c3cc0a28087946a99be3806b47767
Instruction ID: 073f40396dc7ccd7177ba1dca19df75034b5f11d20ec3d155a1bb9dc4d2ed221
Opcode Fuzzy Hash: 78255e53fb856305445e6588d778a689cd4c3cc0a28087946a99be3806b47767
Instruction Fuzzy Hash: 6BC1D332A0C7828BF728EB70D8483ED77A5BB04B88F844135DA6D17BD5DF38955287A1

Function 00007FF7F59E159A Relevance: 5.0, APIs: 3, Instructions: 548memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F59EC17F: _calloc_dbg.MSVCRT ref: 00007FF7F59EC202
Part of subcall function 00007FF7F59EC17F: abort.MSVCRT(?,?,00000000,?,00007FF7F59E15BC), ref: 00007FF7F59EC20F
Part of subcall function 00007FF7F59EC17F: _malloc_dbg.MSVCRT ref: 00007FF7F59EC28F

Part of subcall function 00007FF7F59EC17F: _realloc_dbg.MSVCRT ref: 00007FF7F59EC23A
Part of subcall function 00007FF7F59EC17F: _malloc_dbg.MSVCRT ref: 00007FF7F59EC2AB

VirtualProtect.KERNEL32 ref: 00007FF7F59E1CBC
VirtualProtect.KERNEL32 ref: 00007FF7F59E1CDD
FlushInstructionCache.KERNEL32 ref: 00007FF7F59E1CF2

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: ProtectVirtual_malloc_dbg$CacheFlushInstruction_calloc_dbg_realloc_dbgabort
String ID:
API String ID: 4203908447-0
Opcode ID: dcc3aade698dbe6acce71ded1e8ff223fe62e30bc48d3c26e3a64b7732f0337a
Instruction ID: 6a2fa4ef6963894961365e88ed8ea0b5d00aaa65766dd3b8abf5d5d00e78ec52
Opcode Fuzzy Hash: dcc3aade698dbe6acce71ded1e8ff223fe62e30bc48d3c26e3a64b7732f0337a
Instruction Fuzzy Hash: 2D32C432A1C29686E729EB10D400A79FB91EB91F40FD9C131D66A037C5DF7DA842D7B2

Function 00007FF7F59E21DC Relevance: 3.0, APIs: 2, Instructions: 22fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F59EBEB8: RtlCaptureContext.KERNEL32 ref: 00007FF7F59EBF47
Part of subcall function 00007FF7F59EBEB8: RtlUnwindEx.KERNEL32 ref: 00007FF7F59EBF6C
Part of subcall function 00007FF7F59EBEB8: abort.MSVCRT ref: 00007FF7F59EBF72

FindFirstFileW.KERNEL32 ref: 00007FF7F59E2214
FindClose.KERNEL32 ref: 00007FF7F59E2225

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: Find$CaptureCloseContextFileFirstUnwindabort
String ID:
API String ID: 1173583122-0
Opcode ID: 07bed845c777f2094d9f1d8608d56d60ff18c68610ad4310ed9743b875ecc369
Instruction ID: 44aabe82db28b7a124b9ed6b2fecec858ca636f02418920b2476d2ab7f9d00d6
Opcode Fuzzy Hash: 07bed845c777f2094d9f1d8608d56d60ff18c68610ad4310ed9743b875ecc369
Instruction Fuzzy Hash: 98E03212E4D40282EF69F725E82837882506F85FB0FD40330DA3F463D2EE2CA20546B1

Function 00007FF7F59E21E4 Relevance: 3.0, APIs: 2, Instructions: 21fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F59EBEB8: RtlCaptureContext.KERNEL32 ref: 00007FF7F59EBF47
Part of subcall function 00007FF7F59EBEB8: RtlUnwindEx.KERNEL32 ref: 00007FF7F59EBF6C
Part of subcall function 00007FF7F59EBEB8: abort.MSVCRT ref: 00007FF7F59EBF72

FindFirstFileW.KERNEL32 ref: 00007FF7F59E2214
FindClose.KERNEL32 ref: 00007FF7F59E2225

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: Find$CaptureCloseContextFileFirstUnwindabort
String ID:
API String ID: 1173583122-0
Opcode ID: 49752a5b69ba3cca85898a7ce776668438236c9ac12fb5bc9c0f809d60343a9d
Instruction ID: 227e85f80d01f3b4e180207eb7eb8e781e2cc3aa7eb5278f506ff241f4dcb4bd
Opcode Fuzzy Hash: 49752a5b69ba3cca85898a7ce776668438236c9ac12fb5bc9c0f809d60343a9d
Instruction Fuzzy Hash: 3BE0E512E5D44286EF69F735E81937892506F86FB0FD44330DA3F463D2EE2CA11646A1

Function 00007FF7F59E21F1 Relevance: 3.0, APIs: 2, Instructions: 18fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F59EBEB8: RtlCaptureContext.KERNEL32 ref: 00007FF7F59EBF47
Part of subcall function 00007FF7F59EBEB8: RtlUnwindEx.KERNEL32 ref: 00007FF7F59EBF6C
Part of subcall function 00007FF7F59EBEB8: abort.MSVCRT ref: 00007FF7F59EBF72

FindFirstFileW.KERNEL32 ref: 00007FF7F59E2214
FindClose.KERNEL32 ref: 00007FF7F59E2225

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: Find$CaptureCloseContextFileFirstUnwindabort
String ID:
API String ID: 1173583122-0
Opcode ID: f6be1d11bafd7138262e0ed3e4cc706dcfcce335c57d2ecc58c705f9c05d47dc
Instruction ID: 55ab5cd0a1e17542ab831dc5f2c662e168328a25e19f464ddc89eaa735a1de27
Opcode Fuzzy Hash: f6be1d11bafd7138262e0ed3e4cc706dcfcce335c57d2ecc58c705f9c05d47dc
Instruction Fuzzy Hash: 4AE08C12F5C40286EF69F735E8183789250AF89FB0FC80330D93F863E2EE2C911546A0

Function 00007FF7F59E2205 Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF7F59E2214
FindClose.KERNEL32 ref: 00007FF7F59E2225

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: ddc723069839fbc64ed822299912c8629a0478eca376f5b88e1be3bad91a2ba0
Instruction ID: 75f81698e6a71e857fb2b6e47b044c2af8c219191f7af2d90e1aa090a0b2e28b
Opcode Fuzzy Hash: ddc723069839fbc64ed822299912c8629a0478eca376f5b88e1be3bad91a2ba0
Instruction Fuzzy Hash: CED05E62E1840282EF25A724D4083385260AB44B74FD00330D53F823E0EE6C811A4A60

Function 00007FF7F59E8F62 Relevance: 2.7, Strings: 2, Instructions: 208COMMON

Download Yara Rule

Strings

std, xrefs: 00007FF7F59E913E
string literal, xrefs: 00007FF7F59E9064

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID:
String ID: std$string literal
API String ID: 0-2980153874
Opcode ID: 6a946cb0a3405175331ad94ad00e71cc511e386829943c81622d4c0cc77cc3f8
Instruction ID: 771e39c3245ddaed6458d60333bd06e8147408f2ec44285aef3f9ce388ff5fe0
Opcode Fuzzy Hash: 6a946cb0a3405175331ad94ad00e71cc511e386829943c81622d4c0cc77cc3f8
Instruction Fuzzy Hash: EA718B61E0C64246FB6DEA66D905279A7819F46FC4FC88430DA2D473C6EF2DE94183F2

Function 00007FF7F59E1E5B Relevance: 1.8, APIs: 1, Instructions: 267COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F59E1E21: GetModuleFileNameA.KERNEL32 ref: 00007FF7F59E1E3D

Part of subcall function 00007FF7F59EC17F: _calloc_dbg.MSVCRT ref: 00007FF7F59EC202
Part of subcall function 00007FF7F59EC17F: abort.MSVCRT(?,?,00000000,?,00007FF7F59E15BC), ref: 00007FF7F59EC20F
Part of subcall function 00007FF7F59EC17F: _malloc_dbg.MSVCRT ref: 00007FF7F59EC28F

Part of subcall function 00007FF7F59EC17F: _realloc_dbg.MSVCRT ref: 00007FF7F59EC23A
Part of subcall function 00007FF7F59EC17F: _malloc_dbg.MSVCRT ref: 00007FF7F59EC2AB

ShellExecuteA.SHELL32 ref: 00007FF7F59E21AA

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: _malloc_dbg$ExecuteFileModuleNameShell_calloc_dbg_realloc_dbgabort
String ID:
API String ID: 1988290971-0
Opcode ID: 8469d6f7687541d2284c82d1fd9a916e2834edf6ec8860e712d162e7119f5010
Instruction ID: 645d1f051c96ac67d529d880bb8a0c1c2e1e9c1afc474bbc9befb15b06b97e18
Opcode Fuzzy Hash: 8469d6f7687541d2284c82d1fd9a916e2834edf6ec8860e712d162e7119f5010
Instruction Fuzzy Hash: 89B1B472A1C28256EB29EB10D50067DEB91EFA1F80FD5C031D66A072D2DF6CA945D3F2

Function 00007FF7F59F2040 Relevance: 1.5, APIs: 1, Instructions: 14timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7F59F2049

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: 21ab27f4fa84f6b9d8a90f3ad8d344712bba9146ed1255f8eadf81c2d5fbb99a
Instruction ID: d0029a02751e842e4df5960c0a2a925df68eb6cda8262f5207bafd19656e3f07
Opcode Fuzzy Hash: 21ab27f4fa84f6b9d8a90f3ad8d344712bba9146ed1255f8eadf81c2d5fbb99a
Instruction Fuzzy Hash: 5ED05EAAF0854487DB20DB10F445016B722EBD87E9B848120EE5D02768DF3CD667CF00

Function 00007FF7F59E8982 Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47397c67e756e3ce22256b19d5bc484a3134d5edddd8c0af1c067dce716a842e
Instruction ID: 82a39d82a620dd1546640497b2515c1ad279f249a947b477b2feb5d40806ca85
Opcode Fuzzy Hash: 47397c67e756e3ce22256b19d5bc484a3134d5edddd8c0af1c067dce716a842e
Instruction Fuzzy Hash: 43D18521E0D64247FB6CFA95D44137A97929F95F84FDA8431CA2D136C6DF2CE88182F2

Function 00007FF7F5A11690 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 881578eabfbfffa7946b0a06e234dd643742ef944514ef788b83b882e2c7e22b
Instruction ID: a247a302809207fb1806045fd937e66d3abc40e6a1b16bc9ee9f2d6f1bd27950
Opcode Fuzzy Hash: 881578eabfbfffa7946b0a06e234dd643742ef944514ef788b83b882e2c7e22b
Instruction Fuzzy Hash: B0E01287E5EEC54AF35361548C6D8286ED29F72D3074D40B6CA78062D3AC0F2C1646A2

Function 00007FF7F59EBC95 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

abort.MSVCRT(?,?,?,?,00000060,basic_string::_M_create,?,?,?,?,?,00007FF7F5A00DE5), ref: 00007FF7F59EBE15
RtlUnwindEx.KERNEL32 ref: 00007FF7F59EBE5C

Strings

CCG!, xrefs: 00007FF7F59EBDBA
CCG , xrefs: 00007FF7F59EBD64
CCG!, xrefs: 00007FF7F59EBCD9
basic_string::_M_create, xrefs: 00007FF7F59EBC9D
CCG", xrefs: 00007FF7F59EBD30

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: Unwindabort
String ID: CCG $CCG!$CCG!$CCG"$basic_string::_M_create
API String ID: 2187188232-955483099
Opcode ID: 07666c5911fae5383afa0ff1d0b08fb36272c3b48217d42c5d5c40ffc9c6ef3b
Instruction ID: 301136728799400ae8cc2fdf6d71fa2a4f7bf95d91c56b1c5309044a56e5bf85
Opcode Fuzzy Hash: 07666c5911fae5383afa0ff1d0b08fb36272c3b48217d42c5d5c40ffc9c6ef3b
Instruction Fuzzy Hash: BE516D76608B4082D764DB45E4802AAB3B5F788F94F60413AEF9D43BA9CF3DD891C791

Function 00007FF7F59EB1C4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 91
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 00007FF7F59EB26D
VirtualProtect.KERNEL32 ref: 00007FF7F59EB2D5
GetLastError.KERNEL32 ref: 00007FF7F59EB2DF

Strings

Unknown pseudo relocation protocol version %d., xrefs: 00007FF7F59EB1C9
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF7F59EB282
VirtualProtect failed with code 0x%x, xrefs: 00007FF7F59EB2E5
Mingw-w64 runtime failure:, xrefs: 00007FF7F59EB18B
Address %p has no image-section, xrefs: 00007FF7F59EB225

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuery
String ID: Unknown pseudo relocation protocol version %d.$ VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 637304234-2693646698
Opcode ID: d0d996821a2ca10f39028e77ba8c4b9571d2c6f9c7c75cd471fc788101b850ad
Instruction ID: bdc969b37ea7ef5452e2dd4eddd076b97eb7658f22f8ba3357a0a7fead850e5e
Opcode Fuzzy Hash: d0d996821a2ca10f39028e77ba8c4b9571d2c6f9c7c75cd471fc788101b850ad
Instruction Fuzzy Hash: 2E317F61B09A0287EB04EB11E841569BB62FF94FA4F848135DE2C473E5DE3CE556C7B0

Function 00007FF7F59F2DFF Relevance: 10.6, APIs: 7, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_calloc_dbg.MSVCRT ref: 00007FF7F59F2E34
CreateSemaphoreA.KERNEL32 ref: 00007FF7F59F2E73
CreateSemaphoreA.KERNEL32 ref: 00007FF7F59F2E89
??3@YAXPEAX@Z.MSVCRT ref: 00007FF7F59F2EBE
RtlInitializeCriticalSection.NTDLL ref: 00007FF7F59F2EDA
RtlInitializeCriticalSection.NTDLL ref: 00007FF7F59F2EE0
RtlInitializeCriticalSection.NTDLL ref: 00007FF7F59F2EE6

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: CriticalInitializeSection$CreateSemaphore$??3@_calloc_dbg
String ID:
API String ID: 278339251-0
Opcode ID: a0c677a658eab8f689cd59e2a2e6a0ec8e4901bff5b3ddd49d5ece65d1f956a7
Instruction ID: c778602acb823dd877a0f62a583ffe4818fef3fb9e19d9734fb57c62947ea7e1
Opcode Fuzzy Hash: a0c677a658eab8f689cd59e2a2e6a0ec8e4901bff5b3ddd49d5ece65d1f956a7
Instruction Fuzzy Hash: F221EC32B0564282FF69EF75E8107A966D1AF50F94F988135CE2D873C4DF3C984183A0

Function 00007FF7F59EA409 Relevance: 10.2, APIs: 8, Instructions: 250
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.MSVCRT ref: 00007FF7F59EA428
strcmp.MSVCRT ref: 00007FF7F59EA54E
strcmp.MSVCRT ref: 00007FF7F59EA57B
strcmp.MSVCRT ref: 00007FF7F59EA5A0
strcmp.MSVCRT ref: 00007FF7F59EA5B3
strcmp.MSVCRT ref: 00007FF7F59EA656
strcmp.MSVCRT ref: 00007FF7F59EA669
strcmp.MSVCRT ref: 00007FF7F59EA784

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 47e7821870c9d44db7b1c61fb07224ef18ee184e55d4f8feeb2e9a8fbeef8cbd
Instruction ID: 7990730e8267c076d7a426cdd651326a7b3dae4851d17813076cb2efd324e3f5
Opcode Fuzzy Hash: 47e7821870c9d44db7b1c61fb07224ef18ee184e55d4f8feeb2e9a8fbeef8cbd
Instruction Fuzzy Hash: 12916B11E4C24247FB6CFB62D8192BD96825F52F84FD84031DD2E067E6DF2DE94282B2

Function 00007FF7F59EFEE8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7F59EFDD9: _malloc_dbg.MSVCRT ref: 00007FF7F59EFD81
Part of subcall function 00007FF7F59EFDD9: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF7F59EFDC7

GetCurrentThreadId.KERNEL32 ref: 00007FF7F59EFE20
GetCurrentThreadId.KERNEL32 ref: 00007FF7F59EFE38

Strings

basic_string::_M_create, xrefs: 00007FF7F59EFDF0

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: CurrentThread$??3@_malloc_dbg
String ID: basic_string::_M_create
API String ID: 581562805-3122258987
Opcode ID: 5c38d48b0b1f57da120027f2617a23af55e420cf5cba999f5cc3a76c39dbfb9b
Instruction ID: 0fbbe739818d2bd871cdddc79ead500c1fa6312a12d41849f4a34c24eeff2df4
Opcode Fuzzy Hash: 5c38d48b0b1f57da120027f2617a23af55e420cf5cba999f5cc3a76c39dbfb9b
Instruction Fuzzy Hash: 2D317821A0D60387FB69AA35D400739A591AF44F15F94943ACA3E46AC5EF3DF881C7F2

Function 00007FF7F59F0551 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7F59F0591
_ultoa.MSVCRT ref: 00007FF7F59F05A4
OutputDebugStringA.KERNEL32 ref: 00007FF7F59F05DB
abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00007FF7F59F05E1

Strings

Error cleaning up spin_keys for thread , xrefs: 00007FF7F59F057C

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: CurrentDebugOutputStringThread_ultoaabort
String ID: Error cleaning up spin_keys for thread
API String ID: 4191895893-2906507043
Opcode ID: 28625374de596ec957c2db102addecdbc3fdee8b1b9ec0c5134ffc8d867eb8dd
Instruction ID: 5133c41012fe8e785e02d5d52066648f7f33d62515cfb1f54318573a62c3f7f4
Opcode Fuzzy Hash: 28625374de596ec957c2db102addecdbc3fdee8b1b9ec0c5134ffc8d867eb8dd
Instruction Fuzzy Hash: 3811ED52B0CA02C0FB25A724E41477A9EE19F45B64FD40330DA7E067C4DFACE9468BA1

Function 00007FF7F59F2F53 Relevance: 7.7, APIs: 5, Instructions: 181synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF7F59F2FA5
ResetEvent.KERNEL32 ref: 00007FF7F59F3016
WaitForSingleObject.KERNEL32 ref: 00007FF7F59F304F
WaitForSingleObject.KERNEL32 ref: 00007FF7F59F30FF
WaitForSingleObject.KERNEL32 ref: 00007FF7F59F3177

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: ObjectSingleWait$EventReset
String ID:
API String ID: 466820088-0
Opcode ID: c9eace45c1e20b2ee973a4e5154353f1058ee3e2b26b7ba299b9a0ac35f2f4ec
Instruction ID: 001bfef29a45186b206e969e1fafd6f5f6e36137486fff0cd21c7263447a7002
Opcode Fuzzy Hash: c9eace45c1e20b2ee973a4e5154353f1058ee3e2b26b7ba299b9a0ac35f2f4ec
Instruction Fuzzy Hash: C7513211F0D20342FBBCF5A5CA8837AD1C09F85B94F98413ADD7E8A1D2CF5CA84592A2

Function 00007FF7F59F2BC0 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

RtlAcquirePebLock.NTDLL ref: 00007FF7F59F2BD8
RtlLeaveCriticalSection.NTDLL ref: 00007FF7F59F2BFC
RtlLeaveCriticalSection.NTDLL ref: 00007FF7F59F2C0F

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: CriticalLeaveSection$AcquireLock
String ID:
API String ID: 602743569-0
Opcode ID: 0962ff4d408e6cb1288624cfeb866287765c4f685f0bdbf6130013d173507566
Instruction ID: 5a3a7af07829f5df0a095e18c124b246f04f016042a6a6df5081e47b874f54be
Opcode Fuzzy Hash: 0962ff4d408e6cb1288624cfeb866287765c4f685f0bdbf6130013d173507566
Instruction Fuzzy Hash: 4001A721F0960646EB14EF56ED91B39D2916F99FF5F988530CD7E837C0DE2CA8828254

Function 00007FF7F59EB30B Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 165memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00007FF7F5A10078,00000000,?,?,?,00007FF7F5A10070,00007FF7F59E1208), ref: 00007FF7F59EB562

Strings

Unknown pseudo relocation protocol version %d., xrefs: 00007FF7F59EB402
Unknown pseudo relocation bit size %d., xrefs: 00007FF7F59EB48B
%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FF7F59EB4FD

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
API String ID: 544645111-1286557213
Opcode ID: b87c440d0ce09a325146255e2c62a7d7f9ea911dbc58ee9562a63bfc68d4317a
Instruction ID: 5b598ef86871e152252ffd0824ee1968755670cd2c0eb0c997377e792af1e845
Opcode Fuzzy Hash: b87c440d0ce09a325146255e2c62a7d7f9ea911dbc58ee9562a63bfc68d4317a
Instruction Fuzzy Hash: 71619F31F0C61287EB18EB21D9406B8A7A2AF04FA4F845131D92C477D6EF3CE55187B2

Function 00007FF7F59EAE31 Relevance: 6.1, APIs: 4, Instructions: 81stringCOMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 00007FF7F59EAE93
strlen.MSVCRT ref: 00007FF7F59EAEE1
??3@YAXPEAX@Z.MSVCRT ref: 00007FF7F59EAEFC
??3@YAXPEAX@Z.MSVCRT ref: 00007FF7F59EAF06

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: ??3@$strlen
String ID:
API String ID: 4288758904-0
Opcode ID: a6dfbd3bbd6d30f0285126fd7785c26c9d49edd82aa33e0c3b24215e10c8bb32
Instruction ID: 60d0f45c08d8c718567ce14ef852d0d27c9ae38ef5bc46db699d07b6f7245df0
Opcode Fuzzy Hash: a6dfbd3bbd6d30f0285126fd7785c26c9d49edd82aa33e0c3b24215e10c8bb32
Instruction Fuzzy Hash: DA21D462A1D64287FBADFB11D448278D2906F50FA0F948535EE7E06BE8DF2C944186F2

Function 00007FF7F59EF960 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7F59EF9DB
IsDBCSLeadByteEx.KERNEL32 ref: 00007FF7F59EF9F6
MultiByteToWideChar.KERNEL32 ref: 00007FF7F59EFA4A
_errno.MSVCRT ref: 00007FF7F59EFA54

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: Byte$CharMultiWide$Lead_errno
String ID:
API String ID: 2766522060-0
Opcode ID: 9826d567b648bf2a4da359b114d33b2d7787b083df2dbd1d3b3ec95ef89887e6
Instruction ID: f0ddc9fd5683209a9c5ea7034f13251eddd3d3555d272f44cdb17866b4e61b61
Opcode Fuzzy Hash: 9826d567b648bf2a4da359b114d33b2d7787b083df2dbd1d3b3ec95ef89887e6
Instruction Fuzzy Hash: BE310771A0C68247F3349B21E401769BA90AF85F88F848136DAA84B7C5EB3CD541CBB2

Function 00007FF7F59F0D0D Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7F59F0D22

Part of subcall function 00007FF7F59F068F: TlsGetValue.KERNEL32 ref: 00007FF7F59F06A1
Part of subcall function 00007FF7F59F068F: GetCurrentThreadId.KERNEL32 ref: 00007FF7F59F06D9
Part of subcall function 00007FF7F59F068F: CreateEventA.KERNEL32 ref: 00007FF7F59F06EF
Part of subcall function 00007FF7F59F068F: GetCurrentThread.KERNEL32 ref: 00007FF7F59F0726
Part of subcall function 00007FF7F59F068F: DuplicateHandle.KERNEL32 ref: 00007FF7F59F0755
Part of subcall function 00007FF7F59F068F: abort.MSVCRT ref: 00007FF7F59F075F
Part of subcall function 00007FF7F59F068F: GetThreadPriority.KERNEL32 ref: 00007FF7F59F0768
Part of subcall function 00007FF7F59F068F: TlsSetValue.KERNEL32 ref: 00007FF7F59F0791

_realloc_dbg.MSVCRT ref: 00007FF7F59F0D57
_realloc_dbg.MSVCRT ref: 00007FF7F59F0D6B
SetLastError.KERNEL32 ref: 00007FF7F59F0DD5

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: Thread$CurrentErrorLastValue_realloc_dbg$CreateDuplicateEventHandlePriorityabort
String ID:
API String ID: 276713024-0
Opcode ID: 509f6bb76a6c33398b4ef3129c2671d0f9d188c6ac23010b116aace9a4fa66ff
Instruction ID: b4985e35c05202d64d2fe86c345c66f0646b156da156a3d8ea5bbed78e98c59c
Opcode Fuzzy Hash: 509f6bb76a6c33398b4ef3129c2671d0f9d188c6ac23010b116aace9a4fa66ff
Instruction Fuzzy Hash: E621B07260478146DB08EF29D88466CABD6BB45FE4F840030CE2A07385EF38E481C390

Function 00007FF7F59F131F Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F59F068F: TlsGetValue.KERNEL32 ref: 00007FF7F59F06A1
Part of subcall function 00007FF7F59F068F: GetCurrentThreadId.KERNEL32 ref: 00007FF7F59F06D9
Part of subcall function 00007FF7F59F068F: CreateEventA.KERNEL32 ref: 00007FF7F59F06EF
Part of subcall function 00007FF7F59F068F: GetCurrentThread.KERNEL32 ref: 00007FF7F59F0726
Part of subcall function 00007FF7F59F068F: DuplicateHandle.KERNEL32 ref: 00007FF7F59F0755
Part of subcall function 00007FF7F59F068F: abort.MSVCRT ref: 00007FF7F59F075F
Part of subcall function 00007FF7F59F068F: GetThreadPriority.KERNEL32 ref: 00007FF7F59F0768
Part of subcall function 00007FF7F59F068F: TlsSetValue.KERNEL32 ref: 00007FF7F59F0791

longjmp.MSVCRT ref: 00007FF7F59F1352
TlsGetValue.KERNEL32 ref: 00007FF7F59F135E
TlsSetValue.KERNEL32 ref: 00007FF7F59F13DD
_endthreadex.MSVCRT ref: 00007FF7F59F13E5

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: Value$Thread$Current$CreateDuplicateEventHandlePriority_endthreadexabortlongjmp
String ID:
API String ID: 843818611-0
Opcode ID: 5f9ad97aa4ef47e8a630175607ed95d2c45f71f0beb6403a4ce64425aad03d7f
Instruction ID: cae2348172431c3c8d323380e69243201979584541353ddcb198326ff60a767b
Opcode Fuzzy Hash: 5f9ad97aa4ef47e8a630175607ed95d2c45f71f0beb6403a4ce64425aad03d7f
Instruction Fuzzy Hash: 93215C35E0960286EB19EF21D444338AAE5EF88F68F894035CA2D073D0DF7CA856C7E0

Function 00007FF7F59F31AB Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

RtlAcquirePebLock.NTDLL ref: 00007FF7F59F31DA
RtlLeaveCriticalSection.NTDLL ref: 00007FF7F59F31EF
RtlAcquirePebLock.NTDLL ref: 00007FF7F59F320D
RtlLeaveCriticalSection.NTDLL ref: 00007FF7F59F321A

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: AcquireCriticalLeaveLockSection
String ID:
API String ID: 1584331419-0
Opcode ID: ed7aad597c06a4bb3ce86a0ffdcfefde02845fcb6de0f9fbb5a24b8bcb1a1b13
Instruction ID: 10d4ad8de53c58d91a69da0e9b3a67c45f602b8c2382ba2c3bdb8e57885776fa
Opcode Fuzzy Hash: ed7aad597c06a4bb3ce86a0ffdcfefde02845fcb6de0f9fbb5a24b8bcb1a1b13
Instruction Fuzzy Hash: 6D01A233F4525186DB16EB5BBD0096AA750BB88FE0F444131EE2A47391CE3CD8A28BC0

Function 00007FF7F59EB5C7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 00007FF7F59EB686
signal.MSVCRT ref: 00007FF7F59EB69B

Strings

CCG , xrefs: 00007FF7F59EB5E6

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: a4dc9a7c7b0d6930c548d7929bbeb70a8dfba4514cb76b27c5fc15729a25129a
Instruction ID: 8f20e7e8a022bf2fa1b8ffa2794586cc7ce8226f8424411708f0f6c685c14ca9
Opcode Fuzzy Hash: a4dc9a7c7b0d6930c548d7929bbeb70a8dfba4514cb76b27c5fc15729a25129a
Instruction Fuzzy Hash: 3E217A21E0D50643FB6CF615C440378D593AF46F74FA88936CABD862D2CF5DA89142B3

Function 00007FF7F59F03E2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 00007FF7F59F044C
fprintf.MSVCRT ref: 00007FF7F59F046B

Strings

%p not found?!?!, xrefs: 00007FF7F59F0461

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: ??3@fprintf
String ID: %p not found?!?!
API String ID: 4236183796-11085004
Opcode ID: d4ccac3f16f495541239e0516adcd3c245d2562482bc6974cdf4db170845370b
Instruction ID: fe9e3603f226baccd7461283756d8633b4e646db557e13f3d6e5e3ebe091c300
Opcode Fuzzy Hash: d4ccac3f16f495541239e0516adcd3c245d2562482bc6974cdf4db170845370b
Instruction Fuzzy Hash: 6511F521A1E60281FF69FB56E950178AA98AF58F94F941431CD3E067D5EF2CA89183E0

Function 00007FF7F59EFF3F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7F59EFDD9: _malloc_dbg.MSVCRT ref: 00007FF7F59EFD81
Part of subcall function 00007FF7F59EFDD9: ??3@YAXPEAX@Z.MSVCRT ref: 00007FF7F59EFDC7

GetCurrentThreadId.KERNEL32 ref: 00007FF7F59EFF6A
SetEvent.KERNEL32 ref: 00007FF7F59EFF9F

Strings

basic_string::_M_create, xrefs: 00007FF7F59EFF3F

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: ??3@CurrentEventThread_malloc_dbg
String ID: basic_string::_M_create
API String ID: 3602570239-3122258987
Opcode ID: 3e086e1e1efb732a2bacf63e727d34f988616a79da3d3229d1a8298470904e7d
Instruction ID: e406856d24b303f69f121e88f79bc4eb50081de5ec0c50d4f652b1dedf4e08fb
Opcode Fuzzy Hash: 3e086e1e1efb732a2bacf63e727d34f988616a79da3d3229d1a8298470904e7d
Instruction Fuzzy Hash: D9014F32A195818BEB59AF35D800769A6E0DB49F14F884A32D929C61D4DB2CD881C7F2

Function 00007FF7F59EB070 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7F59EB12A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7F59EB11D
Unknown error, xrefs: 00007FF7F59EB087

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: f79641b6554905c2071e0436e5a8cc675a953b9ca8f1b14d9ef0de9fb5485f2e
Instruction ID: 0965e58d2001065f9e9796d7e3b56d59758922d5c3de1939d3cec5fbf5753db5
Opcode Fuzzy Hash: f79641b6554905c2071e0436e5a8cc675a953b9ca8f1b14d9ef0de9fb5485f2e
Instruction Fuzzy Hash: B3115166808E84C2D7119F1CE0413EAB370FF9A759FA05726EBC827664DF3AD1528750

Function 00007FF7F59EB0C2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7F59EB12A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7F59EB11D
Total loss of significance (TLOSS), xrefs: 00007FF7F59EB0C2

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 3c30c74fbd3a8ddfe79d8203db9c88e2db8818a124d273b3e40c8f0e39c7f29f
Instruction ID: 645982a7d1520734e3cf890da6f174c6d74251aaead9c36499d4fc4898309844
Opcode Fuzzy Hash: 3c30c74fbd3a8ddfe79d8203db9c88e2db8818a124d273b3e40c8f0e39c7f29f
Instruction Fuzzy Hash: 73F06266808F8482D311DF18E0002ABB370FF9E789F605326EBC926564DF3DD5128790

Function 00007FF7F59EB0B9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7F59EB12A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7F59EB11D
Partial loss of significance (PLOSS), xrefs: 00007FF7F59EB0B9

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: 04a889be2543c6147e35710510380d74e02a8c9c553f051a13b4bcad3d1ebc2c
Instruction ID: 185bcdcbd46ccbba4eca9c640ad8efa5514b9870d7a686d50fa9b05ca6737ccf
Opcode Fuzzy Hash: 04a889be2543c6147e35710510380d74e02a8c9c553f051a13b4bcad3d1ebc2c
Instruction Fuzzy Hash: F9F06D66808F8482D311DF28E0002ABB370FF9EB89F605326EBC92A564DF3DD5128790

Function 00007FF7F59EB0CB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7F59EB12A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7F59EB11D
The result is too small to be represented (UNDERFLOW), xrefs: 00007FF7F59EB0CB

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: f52472305d3ab5d63fc849f1574e45686c4f16452a5b7e6288fcec5478011775
Instruction ID: 32499fd7fe462522c20d8a5100189dfc77dd6d452a94597105b0430e023ee9ed
Opcode Fuzzy Hash: f52472305d3ab5d63fc849f1574e45686c4f16452a5b7e6288fcec5478011775
Instruction Fuzzy Hash: 1CF06D66808F8482D311DF28E0002ABB370FF9EB89F605326EBC92A564DF3DD5128790

Function 00007FF7F59EB0B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7F59EB12A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7F59EB11D
Overflow range error (OVERFLOW), xrefs: 00007FF7F59EB0B0

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: 16fc224b4bca745fd197d012a30d66de97d0318c747842bdd232329dfa74399c
Instruction ID: 0a0a00e19c78733036ac03b0720e3a8b7242cf8e76f8b90cc0abcdaf7157fc10
Opcode Fuzzy Hash: 16fc224b4bca745fd197d012a30d66de97d0318c747842bdd232329dfa74399c
Instruction Fuzzy Hash: 5FF06266808F8483D311DF18E0002ABB370FF9E789F605326EBC926564DF3DD5128750

Function 00007FF7F59EB0A7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7F59EB12A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7F59EB11D
Argument domain error (DOMAIN), xrefs: 00007FF7F59EB0A7

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: 4b833ccd667910693c88d745a006db30c292b226b9ddee592da0c286fcd70c56
Instruction ID: d347cbe6de8f14f556c7df2c43f5cb80ff2544964d7c08721da1ef9fbfa72f2d
Opcode Fuzzy Hash: 4b833ccd667910693c88d745a006db30c292b226b9ddee592da0c286fcd70c56
Instruction Fuzzy Hash: 17F06266808F8482D311DF18E0002ABB370FF9E789F605326EBC926564DF3DD5128750

Function 00007FF7F59EB0D4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7F59EB12A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7F59EB11D
Argument singularity (SIGN), xrefs: 00007FF7F59EB0D4

Memory Dump Source

Source File: 00000000.00000002.1734232887.00007FF7F59E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7F59E0000, based on PE: true

Associated: 00000000.00000002.1734220406.00007FF7F59E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734251471.00007FF7F5A02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734267913.00007FF7F5A0D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734292780.00007FF7F5A10000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734305762.00007FF7F5A15000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5A16000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D8A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DC8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5DF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F5EF3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F63A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1734318346.00007FF7F66F6000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7f59e0000_ujsvTrVlol.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: b60da36e04e493ffe0a46cb8861305eccc9b30ba0eead1ba32104459ad7300b7
Instruction ID: 22f6d91d1b5b5b79f7c017fcc0462b82da6db2551d8990cc8a59c17399ff6c4a
Opcode Fuzzy Hash: b60da36e04e493ffe0a46cb8861305eccc9b30ba0eead1ba32104459ad7300b7
Instruction Fuzzy Hash: A3F01D66818F8482D311DF28E4402ABB370FF9E789F605326EFC92A664DF3DD5528750

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ujsvTrVlol.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: ujsvTrVlol.exePID: 5180, Parent PID: 2580

General

Chronological Activities

Disassembly

Analysis Process: ujsvTrVlol.exePID: 5180, Parent PID: 2580COMMON

Execution Graph

Graph

Executed Functions

Windows Analysis Report
ujsvTrVlol.exe

Function 00007FF7F59E58C0 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 341
memoryinjectionprocessCOMMON

Function 00007FF7F59E1131 Relevance: 13.6, APIs: 9, Instructions: 120
sleepstringCOMMON

Function 00007FF7F59F068F Relevance: 12.1, APIs: 8, Instructions: 71
threadCOMMON

Function 00007FF7F59EC17F Relevance: 7.6, APIs: 5, Instructions: 108
COMMON

Function 00007FF7F59F1233 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 61
COMMON

Function 00007FF7F59E55D2 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 208
networkfileCOMMON

Function 00007FF7F59EA9FA Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 292
stringCOMMON

Function 00007FF7F59EBC95 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 127
COMMON

Function 00007FF7F59EB1C4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 91
memoryCOMMON

Function 00007FF7F59F2DFF Relevance: 10.6, APIs: 7, Instructions: 73
COMMON

Function 00007FF7F59EA409 Relevance: 10.2, APIs: 8, Instructions: 250
stringCOMMON

Function 00007FF7F59EFEE8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81
threadCOMMON

Function 00007FF7F59F0551 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46
threadCOMMON