Edit tour

Windows Analysis Report
66WXq58R0I.exe

Overview

General Information

Sample name:	66WXq58R0I.exe renamed because original name is a hash value
Original sample name:	e68e0c467ecfbb9f0c6e5c8359f81b09.exe
Analysis ID:	1542676
MD5:	e68e0c467ecfbb9f0c6e5c8359f81b09
SHA1:	f9f00bc6c6fe10f2d95f085be5c4e55d404e7900
SHA256:	ec6c410d323de0552b1cda52bbbbecdb504985994291a387b06525afa26807be
Tags:	64exe
Infos:

Detection

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Found direct / indirect Syscall (likely to bypass EDR)

Hijacks the control flow in another process

Machine Learning detection for sample

Reads the Security eventlog

Reads the System eventlog

Sets debug register (to hijack the execution of another thread)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: PSScriptPolicyTest Creation By Uncommon Process

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

66WXq58R0I.exe (PID: 6580 cmdline: "C:\Users\user\Desktop\66WXq58R0I.exe" MD5: E68E0C467ECFBB9F0C6E5C8359F81B09)

conhost.exe (PID: 6600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

66WXq58R0I.exe (PID: 2056 cmdline: C:\Users\user\Desktop\66wxq58r0i.exe 2580 MD5: E68E0C467ECFBB9F0C6E5C8359F81B09)

cleanup

Sigma Signatures

Sigma detected: PSScriptPolicyTest Creation By Uncommon Process

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\66WXq58R0I.exe, ProcessId: 2056, TargetFilename: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g5elpwno.kpw.ps1

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 66WXq58R0I.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: 66WXq58R0I.exe	Virustotal: Detection: 38%			Perma Link
Source: 66WXq58R0I.exe	ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 66WXq58R0I.exe

Joe Sandbox ML: detected

Source: 66WXq58R0I.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: ntdll.pdb source: 66WXq58R0I.exe, 00000000.00000002.2953785596.0000025EAE862000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000000.00000002.2953608194.0000025EAE66B000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000000.00000002.2954347645.0000025EAEE60000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000000.00000002.2953426997.0000025EAE461000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000000.00000002.2953957081.0000025EAEA6A000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000000.00000002.2954143232.0000025EAEC62000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000002.00000002.2954414520.00000153C3475000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000002.00000002.2954582314.00000153C3676000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000002.00000002.2954890486.00000153C3A7A000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000002.00000002.2955163767.00000153C3E74000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000002.00000002.2955027560.00000153C3C70000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000002.00000002.2954752934.00000153C387F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Git\PwnPowershell\RunSpace\obj\Release\RunSpace.pdb source: 66WXq58R0I.exe, 00000002.00000002.2954223462.00000153C3270000.00000004.08000000.00040000.00000000.sdmp, 66WXq58R0I.exe, 00000002.00000002.2953479298.00000153C1803000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: 66WXq58R0I.exe, 00000000.00000002.2953785596.0000025EAE862000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000000.00000002.2953608194.0000025EAE66B000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000000.00000002.2954347645.0000025EAEE60000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000000.00000002.2953426997.0000025EAE461000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000000.00000002.2953957081.0000025EAEA6A000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000000.00000002.2954143232.0000025EAEC62000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000002.00000002.2954414520.00000153C3475000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000002.00000002.2954582314.00000153C3676000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000002.00000002.2954890486.00000153C3A7A000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000002.00000002.2955163767.00000153C3E74000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000002.00000002.2955027560.00000153C3C70000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000002.00000002.2954752934.00000153C387F000.00000004.00000020.00020000.00000000.sdmp

Source: 66WXq58R0I.exe, 00000002.00000002.2955303730.00000153C4071000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Spam, unwanted Advertisements and Ransom Demands

Reads the Security eventlog

Source: C:\Users\user\Desktop\66WXq58R0I.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Security	Jump to behavior

Reads the System eventlog

Source: C:\Users\user\Desktop\66WXq58R0I.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System\PowerShell	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Key opened: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\System	Jump to behavior

Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 0_2_00007FF78E41C240 RtlGetVersion,memcpy,GetProcessHeap,GetProcessHeap,exit,exit,memcpy,GetTickCount,Sleep,SleepEx,exit,memcpy,memcpy,GetFileAttributesW,GetFileAttributesW,OpenProcess,GetModuleHandleA,GetProcAddress,memcpy,memcpy,GetFileAttributesW,memcpy,memcpy,HeapCreate,VirtualProtect,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,CreateProcessW,LoadLibraryA,GetProcAddress,NtAllocateVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,fwrite,fflush,NtWriteVirtualMemory,NtProtectVirtualMemory,ResumeThread,exit,memcpy,memcpy,fwrite,fflush,fwrite,fflush,	0_2_00007FF78E41C240
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 2_2_00007FF78E41BF80 GetThreadContext,NtTraceEvent,SetThreadContext,BaseThreadInitThunk,BaseThreadInitThunk,	2_2_00007FF78E41BF80
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 2_2_00007FF78E41D570 RtlAddVectoredExceptionHandler,memset,CreateToolhelp32Snapshot,Thread32First,Thread32Next,GetCurrentProcessId,CloseHandle,OpenThread,GetThreadContext,NtTraceEvent,SetThreadContext,CloseHandle,GetModuleHandleA,BaseThreadInitThunk,GetModuleHandleA,GetProcAddress,RtlInitUnicodeString,LdrLoadDll,BaseThreadInitThunk,	2_2_00007FF78E41D570
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 2_2_00007FF78E41BEE0 NtTraceEvent,	2_2_00007FF78E41BEE0
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 2_2_00000153C16D1B10 NtProtectVirtualMemory,NtCreateSection,	2_2_00000153C16D1B10
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 2_2_00000153C16D1BA8 NtCreateSection,	2_2_00000153C16D1BA8

Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 0_2_00007FF78E41C240	0_2_00007FF78E41C240
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 0_2_00007FF78E41F6D0	0_2_00007FF78E41F6D0
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 0_2_00007FF78E416760	0_2_00007FF78E416760
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 0_2_00007FF78E41E7F0	0_2_00007FF78E41E7F0
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 0_2_00007FF78E420460	0_2_00007FF78E420460
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 0_2_00007FF78E41B420	0_2_00007FF78E41B420
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 0_2_00007FF78E422CA0	0_2_00007FF78E422CA0
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 0_2_00007FF78E416970	0_2_00007FF78E416970
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 0_2_00007FF78E414A80	0_2_00007FF78E414A80
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 0_2_00007FF78E42A61A	0_2_00007FF78E42A61A
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 2_2_00007FF78E420460	2_2_00007FF78E420460
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 2_2_00007FF78E41B420	2_2_00007FF78E41B420
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 2_2_00007FF78E422CA0	2_2_00007FF78E422CA0
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 2_2_00007FF78E41C240	2_2_00007FF78E41C240
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 2_2_00007FF78E41F6D0	2_2_00007FF78E41F6D0
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 2_2_00007FF78E416760	2_2_00007FF78E416760
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 2_2_00007FF78E41E7F0	2_2_00007FF78E41E7F0
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 2_2_00007FF78E416970	2_2_00007FF78E416970
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 2_2_00007FF78E414A80	2_2_00007FF78E414A80
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 2_2_00007FF78E42A61A	2_2_00007FF78E42A61A
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 2_2_00000153C16D0B36	2_2_00000153C16D0B36
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 2_2_00000153C16D0730	2_2_00000153C16D0730
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 2_2_00000153C16D0BAD	2_2_00000153C16D0BAD
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 2_2_00000153C16D0AB3	2_2_00000153C16D0AB3
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 2_2_00000153C16D0999	2_2_00000153C16D0999

Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: String function: 00007FF78E4161C0 appears 86 times
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: String function: 00007FF78E4120F0 appears 78 times
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: String function: 00007FF78E41E170 appears 48 times

Source: 66WXq58R0I.exe

Static PE information: Number of sections : 11 > 10

Source: 66WXq58R0I.exe, 00000000.00000002.2954143232.0000025EAEDDA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 66WXq58R0I.exe
Source: 66WXq58R0I.exe, 00000002.00000002.2954414520.00000153C35ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 66WXq58R0I.exe
Source: 66WXq58R0I.exe, 00000002.00000002.2954223462.00000153C3270000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRunSpace.exe2 vs 66WXq58R0I.exe
Source: 66WXq58R0I.exe, 00000002.00000002.2955303730.00000153C40EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs 66WXq58R0I.exe
Source: 66WXq58R0I.exe, 00000002.00000002.2953479298.00000153C1803000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRunSpace.exe2 vs 66WXq58R0I.exe
Source: 66WXq58R0I.exe, 00000002.00000002.2955303730.00000153C4071000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 66WXq58R0I.exe

Source: classification engine

Classification label: mal84.evad.winEXE@4/4@0/0

Source: C:\Users\user\Desktop\66WXq58R0I.exe

Code function: 0_2_00007FF78E41D570 RtlAddVectoredExceptionHandler,memset,CreateToolhelp32Snapshot,Thread32First,GetCurrentProcessId,CloseHandle,OpenThread,GetThreadContext,SetThreadContext,CloseHandle,GetModuleHandleA,BaseThreadInitThunk,GetModuleHandleA,GetProcAddress,RtlInitUnicodeString,LdrLoadDll,BaseThreadInitThunk,

0_2_00007FF78E41D570

Source: C:\Users\user\Desktop\66WXq58R0I.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6600:120:WilError_03

Source: C:\Users\user\Desktop\66WXq58R0I.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g5elpwno.kpw.ps1

Jump to behavior

Source: 66WXq58R0I.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\66WXq58R0I.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 66WXq58R0I.exe	Virustotal: Detection: 38%
Source: 66WXq58R0I.exe	ReversingLabs: Detection: 34%

Source: unknown	Process created: C:\Users\user\Desktop\66WXq58R0I.exe "C:\Users\user\Desktop\66WXq58R0I.exe"
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process created: C:\Users\user\Desktop\66WXq58R0I.exe C:\Users\user\Desktop\66wxq58r0i.exe 2580
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process created: C:\Users\user\Desktop\66WXq58R0I.exe C:\Users\user\Desktop\66wxq58r0i.exe 2580	Jump to behavior

Source: C:\Users\user\Desktop\66WXq58R0I.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Users\user\Desktop\66WXq58R0I.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 66WXq58R0I.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 66WXq58R0I.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: ntdll.pdb source: 66WXq58R0I.exe, 00000000.00000002.2953785596.0000025EAE862000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000000.00000002.2953608194.0000025EAE66B000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000000.00000002.2954347645.0000025EAEE60000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000000.00000002.2953426997.0000025EAE461000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000000.00000002.2953957081.0000025EAEA6A000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000000.00000002.2954143232.0000025EAEC62000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000002.00000002.2954414520.00000153C3475000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000002.00000002.2954582314.00000153C3676000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000002.00000002.2954890486.00000153C3A7A000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000002.00000002.2955163767.00000153C3E74000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000002.00000002.2955027560.00000153C3C70000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000002.00000002.2954752934.00000153C387F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Git\PwnPowershell\RunSpace\obj\Release\RunSpace.pdb source: 66WXq58R0I.exe, 00000002.00000002.2954223462.00000153C3270000.00000004.08000000.00040000.00000000.sdmp, 66WXq58R0I.exe, 00000002.00000002.2953479298.00000153C1803000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: 66WXq58R0I.exe, 00000000.00000002.2953785596.0000025EAE862000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000000.00000002.2953608194.0000025EAE66B000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000000.00000002.2954347645.0000025EAEE60000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000000.00000002.2953426997.0000025EAE461000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000000.00000002.2953957081.0000025EAEA6A000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000000.00000002.2954143232.0000025EAEC62000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000002.00000002.2954414520.00000153C3475000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000002.00000002.2954582314.00000153C3676000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000002.00000002.2954890486.00000153C3A7A000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000002.00000002.2955163767.00000153C3E74000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000002.00000002.2955027560.00000153C3C70000.00000004.00000020.00020000.00000000.sdmp, 66WXq58R0I.exe, 00000002.00000002.2954752934.00000153C387F000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\66WXq58R0I.exe

Code function: 0_2_00007FF78E418C30 _fileno,_fileno,_setmode,_setmode,_fileno,_setmode,_fileno,_setmode,SetConsoleOutputCP,SetConsoleCP,LoadLibraryA,GetProcAddress,CoInitialize,CoInitializeEx,

0_2_00007FF78E418C30

Source: 66WXq58R0I.exe	Static PE information: section name: .eh_fram
Source: 66WXq58R0I.exe	Static PE information: section name: .xdata

Source: C:\Users\user\Desktop\66WXq58R0I.exe

Code function: 2_2_00007FFD9B891508 pushad ; retf 5E51h

2_2_00007FFD9B89169D

Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\66WXq58R0I.exe	Memory allocated: 153C3260000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Memory allocated: 153DC070000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\66WXq58R0I.exe

0_2_00007FF78E41D570

Source: C:\Users\user\Desktop\66WXq58R0I.exe

Window / User API: threadDelayed 1085

Jump to behavior

Source: C:\Users\user\Desktop\66WXq58R0I.exe TID: 1360	Thread sleep count: 1085 > 30			Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe TID: 3624	Thread sleep count: 158 > 30			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\66WXq58R0I.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\66WXq58R0I.exe

0_2_00007FF78E41D570

Source: C:\Users\user\Desktop\66WXq58R0I.exe

0_2_00007FF78E41D570

Source: C:\Users\user\Desktop\66WXq58R0I.exe

Code function: 0_2_00007FF78E418C30 _fileno,_fileno,_setmode,_setmode,_fileno,_setmode,_fileno,_setmode,SetConsoleOutputCP,SetConsoleCP,LoadLibraryA,GetProcAddress,CoInitialize,CoInitializeEx,

0_2_00007FF78E418C30

Source: C:\Users\user\Desktop\66WXq58R0I.exe

Code function: 0_2_00007FF78E41C240 RtlGetVersion,memcpy,GetProcessHeap,GetProcessHeap,exit,exit,memcpy,GetTickCount,Sleep,SleepEx,exit,memcpy,memcpy,GetFileAttributesW,GetFileAttributesW,OpenProcess,GetModuleHandleA,GetProcAddress,memcpy,memcpy,GetFileAttributesW,memcpy,memcpy,HeapCreate,VirtualProtect,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,memcpy,CreateProcessW,LoadLibraryA,GetProcAddress,NtAllocateVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,fwrite,fflush,NtWriteVirtualMemory,NtProtectVirtualMemory,ResumeThread,exit,memcpy,memcpy,fwrite,fflush,fwrite,fflush,

0_2_00007FF78E41C240

Source: C:\Users\user\Desktop\66WXq58R0I.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 0_2_00007FF78E411154 GetStartupInfoA,Sleep,_amsg_exit,_initterm,_initterm,SetUnhandledExceptionFilter,exit,_cexit,	0_2_00007FF78E411154
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 0_2_00007FF78E41D570 RtlAddVectoredExceptionHandler,memset,CreateToolhelp32Snapshot,Thread32First,GetCurrentProcessId,CloseHandle,OpenThread,GetThreadContext,SetThreadContext,CloseHandle,GetModuleHandleA,BaseThreadInitThunk,GetModuleHandleA,GetProcAddress,RtlInitUnicodeString,LdrLoadDll,BaseThreadInitThunk,	0_2_00007FF78E41D570
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 0_2_00007FF78E45CF08 RtlAddVectoredExceptionHandler,	0_2_00007FF78E45CF08
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 2_2_00007FF78E41D570 RtlAddVectoredExceptionHandler,memset,CreateToolhelp32Snapshot,Thread32First,Thread32Next,GetCurrentProcessId,CloseHandle,OpenThread,GetThreadContext,NtTraceEvent,SetThreadContext,CloseHandle,GetModuleHandleA,BaseThreadInitThunk,GetModuleHandleA,GetProcAddress,RtlInitUnicodeString,LdrLoadDll,BaseThreadInitThunk,	2_2_00007FF78E41D570
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 2_2_00007FF78E411154 GetStartupInfoA,Sleep,_amsg_exit,_initterm,_initterm,SetUnhandledExceptionFilter,exit,_cexit,	2_2_00007FF78E411154
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Code function: 2_2_00007FF78E45CF08 RtlAddVectoredExceptionHandler,	2_2_00007FF78E45CF08

Source: C:\Users\user\Desktop\66WXq58R0I.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\66WXq58R0I.exe	NtAllocateVirtualMemory: Indirect: 0x7FF78E424BD1	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	NtWriteVirtualMemory: Indirect: 0x7FF78E424D2B	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	NtProtectVirtualMemory: Indirect: 0x7FF78E425018	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	NtProtectVirtualMemory: Indirect: 0x7FF78E424D80	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	NtProtectVirtualMemory: Indirect: 0x7FF78E424D00	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	NtWriteVirtualMemory: Indirect: 0x7FF78E424FDF	Jump to behavior

Hijacks the control flow in another process

Source: C:\Users\user\Desktop\66WXq58R0I.exe

Memory written: PID: 2056 base: 153C16D0000 value: E9

Jump to behavior

Sets debug register (to hijack the execution of another thread)

Source: C:\Users\user\Desktop\66WXq58R0I.exe

Thread register set: 2056 4

Jump to behavior

Source: C:\Users\user\Desktop\66WXq58R0I.exe

Process created: C:\Users\user\Desktop\66WXq58R0I.exe C:\Users\user\Desktop\66wxq58r0i.exe 2580

Jump to behavior

Source: C:\Users\user\Desktop\66WXq58R0I.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\66WXq58R0I.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\66WXq58R0I.exe

0_2_00007FF78E41C240

Source: C:\Users\user\Desktop\66WXq58R0I.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	211 Process Injection	2 Virtualization/Sandbox Evasion	OS Credential Dumping	2 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	211 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Abuse Elevation Control Mechanism	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
66WXq58R0I.exe	38%	Virustotal		Browse
66WXq58R0I.exe	34%	ReversingLabs	Win64.Trojan.Dacic
66WXq58R0I.exe	100%	Avira	HEUR/AGEN.1329808
66WXq58R0I.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	66WXq58R0I.exe, 00000002.00000002.2955303730.00000153C4071000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542676
Start date and time:	2024-10-26 06:25:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	66WXq58R0I.exe renamed because original name is a hash value
Original Sample Name:	e68e0c467ecfbb9f0c6e5c8359f81b09.exe
Detection:	MAL
Classification:	mal84.evad.winEXE@4/4@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 60 Number of non-executed functions: 67
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g5elpwno.kpw.ps1

Download File

Process:	C:\Users\user\Desktop\66WXq58R0I.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tlxxxkea.ncw.psm1

Download File

Process:	C:\Users\user\Desktop\66WXq58R0I.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\66WXq58R0I.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	49
Entropy (8bit):	4.443606211763083
Encrypted:	false
SSDEEP:	3:jBJ2SL1KSyKAJJovov122ycAIqn:jBJ2SBpsmvBVcs
MD5:	717327D9B75FC7A8ED8EE1F48D3373F7
SHA1:	1DCEDD1A8C4D0BAC49F0BE630FCCF1A1B4491A4B
SHA-256:	C2FD348DE26E7A82953985B05229057CB643D2C7F81F86170B5363A6F9A03DD8
SHA-512:	936F8CEE7B983B33C2A5D28327746FBFB9FE6E5E8D45351D19D54A52D3CAE71160325DC1AC269CED8AA82C8830450DB9E05A64D56290BA4E3DE33C58564CF4A8
Malicious:	false
Reputation:	low
Preview:	Windows PwnPowershell....PS C:\Windows\system32>

Static File Info

General

File type:	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.714839278042225
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	66WXq58R0I.exe
File size:	217'600 bytes
MD5:	e68e0c467ecfbb9f0c6e5c8359f81b09
SHA1:	f9f00bc6c6fe10f2d95f085be5c4e55d404e7900
SHA256:	ec6c410d323de0552b1cda52bbbbecdb504985994291a387b06525afa26807be
SHA512:	6f9b506d505187fd14482c22a4967f439bfb6ddcaef7b4873e1cd7bba30b7ccc2753eb40770d6a402146020a5aed4c1d57934b96b5d14564d9afad2d5eae7b58
SSDEEP:	6144:xHuGnkJ7WtBOxxaNIfm8vlnPJJJ655ZZo:gGnmhxaNIfm8v
TLSH:	24248E3AF29394BCC5ABC27A47C7A8F2A571FC150270B86E16806A317F5BC605B6DF41
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...#}.g...............$.....N...`..%..........@............................. ............`... ............................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x140001125
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x670F7D23 [Wed Oct 16 08:45:23 2024 UTC]
TLS Callbacks:	0x40016430, 0x1, 0x400164ef, 0x1
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e16254f44ddd98c690f5ad4d0a981e4a

Entrypoint Preview

Instruction
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 30h
mov dword ptr [ebp-04h], 000000FFh
dec eax
mov eax, dword ptr [000328A5h]
mov dword ptr [eax], 00000000h
call 00007F6E30CC6003h
mov dword ptr [ebp-04h], eax
nop
nop
mov eax, dword ptr [ebp-04h]
dec eax
add esp, 30h
pop ebp
ret
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 000000E0h
dec eax
mov dword ptr [ebp-08h], 00000000h
mov dword ptr [ebp-0Ch], 00000000h
dec eax
lea eax, dword ptr [ebp-000000C0h]
inc ecx
mov eax, 00000068h
mov edx, 00000000h
dec eax
mov ecx, eax
call 00007F6E30CE1ECDh
dec eax
mov eax, dword ptr [00032851h]
mov eax, dword ptr [eax]
test eax, eax
je 00007F6E30CC6005h
dec eax
lea eax, dword ptr [ebp-000000C0h]
dec eax
mov ecx, eax
dec eax
mov eax, dword ptr [0004D0D6h]
call eax
dec eax
mov dword ptr [ebp-18h], 00000000h
mov dword ptr [ebp-24h], 00000030h
mov eax, dword ptr [ebp-24h]
dec eax
mov eax, dword ptr [eax]
dec eax
mov dword ptr [ebp-30h], eax
dec eax
mov eax, dword ptr [ebp-30h]
dec eax
mov eax, dword ptr [eax+08h]
dec eax
mov dword ptr [ebp-20h], eax
mov dword ptr [ebp-10h], 00000000h
jmp 00007F6E30CC6013h
dec eax
mov eax, dword ptr [ebp-18h]
dec eax
cmp eax, dword ptr [ebp-20h]
jne 00007F6E30CC5FFBh
mov dword ptr [ebp-10h], 00000001h
jmp 00007F6E30CC6037h
mov ecx, 000003E8h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4e000	0x900	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x36000	0xcd8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x51000	0x158	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x32da0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x4e24c	0x210	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x21398	0x21400	8f0885b1d516ce5743c6cdfe6b9f9d6b	False	0.4982084116541353	data	6.304794610527241	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x23000	0x170	0x200	55354dd11b8dee07034c26a5a57569ac	False	0.205078125	data	1.297314840992684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x24000	0x10900	0x10a00	b9bc3e0a12c3e3a735749f1a9285aa07	False	0.7250205592105263	data	7.269544756074582	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.eh_fram	0x35000	0x4	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x36000	0xcd8	0xe00	9ccec1d59548f9e8ee8192df1b5d7fef	False	0.46177455357142855	data	4.883061479874814	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.xdata	0x37000	0xdbc	0xe00	3a4a4f460d87102da95aa72e1647738e	False	0.283203125	shared library	4.539207118672414	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x38000	0x15e20	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x4e000	0x900	0xa00	bd0431b4a2191779186074423221870a	False	0.326953125	data	3.988340192808435	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x4f000	0x68	0x200	1718af1ca73b922f878bc7724bee0003	False	0.0703125	data	0.3646150037346487	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x50000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x51000	0x158	0x200	782504cbe378b23b06df04251da8d02c	False	0.5390625	data	3.819558126695766	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

DeleteCriticalSection, EnterCriticalSection, FreeLibrary, GetLastError, GetModuleHandleA, GetProcAddress, GetStartupInfoA, InitializeCriticalSection, IsDBCSLeadByteEx, LeaveCriticalSection, LoadLibraryA, MultiByteToWideChar, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualAlloc, VirtualFree, VirtualProtect, VirtualQuery, WideCharToMultiByte

msvcrt.dll

__C_specific_handler, ___lc_codepage_func, ___mb_cur_max_func, __getmainargs, __initenv, __iob_func, __lconv_init, __set_app_type, __setusermatherr, _acmdln, _amsg_exit, _cexit, _commode, _errno, _fileno, _fmode, _initterm, _lock, _onexit, _setjmp, _setmode, _unlock, abort, calloc, exit, fflush, fprintf, fputc, free, fwrite, localeconv, longjmp, malloc, memchr, memcpy, memset, signal, strcmp, strerror, strlen, strncmp, strstr, vfprintf, wcslen

Network Behavior

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 26, 2024 06:26:23.738876104 CEST	53	62736	1.1.1.1	192.168.2.4

Target ID:	0
Start time:	00:26:01
Start date:	26/10/2024
Path:	C:\Users\user\Desktop\66WXq58R0I.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\66WXq58R0I.exe"
Imagebase:	0x7ff78e410000
File size:	217'600 bytes
MD5 hash:	E68E0C467ECFBB9F0C6E5C8359F81B09
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	00:26:01
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	00:26:03
Start date:	26/10/2024
Path:	C:\Users\user\Desktop\66WXq58R0I.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\66wxq58r0i.exe 2580
Imagebase:	0x7ff78e410000
File size:	217'600 bytes
MD5 hash:	E68E0C467ECFBB9F0C6E5C8359F81B09
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	14.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.8%
Total number of Nodes:	1358
Total number of Limit Nodes:	33

Executed Functions

Function 00007FF78E41C240 Relevance: 149.6, APIs: 46, Strings: 38, Instructions: 2611memorysleepCOMMON

Download Yara Rule

APIs

RtlGetVersion.NTDLL ref: 00007FF78E41C3DE
memcpy.MSVCRT ref: 00007FF78E41C4C3

Part of subcall function 00007FF78E416670: MultiByteToWideChar.KERNEL32 ref: 00007FF78E4166C7
Part of subcall function 00007FF78E416670: MultiByteToWideChar.KERNEL32 ref: 00007FF78E41672A

Part of subcall function 00007FF78E41BB80: memcpy.MSVCRT ref: 00007FF78E41BC81
Part of subcall function 00007FF78E41BB80: memcpy.MSVCRT ref: 00007FF78E41BCA2

GetProcessHeap.KERNEL32 ref: 00007FF78E41CA71
GetProcessHeap.KERNEL32 ref: 00007FF78E41CA7A
exit.MSVCRT ref: 00007FF78E41CA96
exit.MSVCRT ref: 00007FF78E41CAC2
GetTickCount.KERNEL32 ref: 00007FF78E41CC8D
Sleep.KERNEL32 ref: 00007FF78E41CC9A
SleepEx.KERNELBASE ref: 00007FF78E41CCA0
exit.MSVCRT ref: 00007FF78E41CCB1

Strings

VirtualProtect, xrefs: 00007FF78E41C790
ReadFile, xrefs: 00007FF78E41CA2E
GetModuleHandleA, xrefs: 00007FF78E41C84D
RtlAllocateHeap, xrefs: 00007FF78E41CA08
GetProcessHeap, xrefs: 00007FF78E41C7D5
GetDiskFreeSpaceExA, xrefs: 00007FF78E41CC7E
VariantConversionError, xrefs: 00007FF78E425C27, 00007FF78E425CF7, 00007FF78E425E5F
Sleep, xrefs: 00007FF78E41C968
.v>!, xrefs: 00007FF78E4243E2
p, xrefs: 00007FF78E4246B8
com.nim, xrefs: 00007FF78E425CC8, 00007FF78E425D75, 00007FF78E425EDC
CloseHandle, xrefs: 00007FF78E41C8BF
Jk5, xrefs: 00007FF78E41CA55
LdrLoadDll, xrefs: 00007FF78E41C6BE
OpenProcess, xrefs: 00007FF78E41C7B6
GetThreadContext, xrefs: 00007FF78E41C873
OpenThread, xrefs: 00007FF78E41C8E5
j{t`, xrefs: 00007FF78E41C402
GetCurrentProcessId, xrefs: 00007FF78E41C76A
GetTickCount, xrefs: 00007FF78E41C98E
GetComputerNameExA, xrefs: 00007FF78E41CC40
CreateFileA, xrefs: 00007FF78E41C9B4
ME, xrefs: 00007FF78E424A12
SetThreadContext, xrefs: 00007FF78E41C899
bz, xrefs: 00007FF78E41CBE8
toVariant, xrefs: 00007FF78E425CDB, 00007FF78E425D8B, 00007FF78E425EEF
RtlInitUnicodeString, xrefs: 00007FF78E41C6EC
MultiByteToWideChar, xrefs: 00007FF78E41C949
GlobalMemoryStatusEx, xrefs: 00007FF78E41CC5F
RtlAddVectoredExceptionHandler, xrefs: 00007FF78E41C827
GetFileSize, xrefs: 00007FF78E41C9DA
WaitForSingleObject, xrefs: 00007FF78E41C92A
Ju4J, xrefs: 00007FF78E41CE5A
* -_, xrefs: 00007FF78E41CDD2
GetProcAddress, xrefs: 00007FF78E41C7FB
JDF7, xrefs: 00007FF78E41C6FB
GetCurrentThreadId, xrefs: 00007FF78E41C90B
HYk, xrefs: 00007FF78E41CAA0

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: exitmemcpy$ByteCharHeapMultiProcessSleepWide$CountTickVersion
String ID: * -_$.v>!$CloseHandle$CreateFileA$GetComputerNameExA$GetCurrentProcessId$GetCurrentThreadId$GetDiskFreeSpaceExA$GetFileSize$GetModuleHandleA$GetProcAddress$GetProcessHeap$GetThreadContext$GetTickCount$GlobalMemoryStatusEx$Jk5$JDF7$Ju4J$LdrLoadDll$MultiByteToWideChar$OpenProcess$OpenThread$ReadFile$RtlAddVectoredExceptionHandler$RtlAllocateHeap$RtlInitUnicodeString$SetThreadContext$Sleep$VariantConversionError$VirtualProtect$WaitForSingleObject$com.nim$j{t`$p$toVariant$bz$ME$HYk
API String ID: 4036915570-214144126
Opcode ID: 69e930487f80bd1ae76e9734cf0d26f57097afb2058310c5517ae0ab230f896f
Instruction ID: 1ef5c1930cbc1f022ab22dfd2806282c5d526d83febae3e63234f84c2ff3a320
Opcode Fuzzy Hash: 69e930487f80bd1ae76e9734cf0d26f57097afb2058310c5517ae0ab230f896f
Instruction Fuzzy Hash: 48437762A09B4781EA14FB95E8543BDA3A1FF85B84FE04436EA5D07796EF3CE404C360

Function 00007FF78E418C30 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 190
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fileno.MSVCRT ref: 00007FF78E418C4D
_setmode.MSVCRT ref: 00007FF78E418C5E
_fileno.MSVCRT ref: 00007FF78E418C6A
_setmode.MSVCRT ref: 00007FF78E418C74
_fileno.MSVCRT ref: 00007FF78E418C80
_setmode.MSVCRT ref: 00007FF78E418C8A
SetConsoleOutputCP.KERNEL32 ref: 00007FF78E418C91
SetConsoleCP.KERNEL32 ref: 00007FF78E418C9C
LoadLibraryA.KERNEL32 ref: 00007FF78E418CA9
GetProcAddress.KERNEL32 ref: 00007FF78E418CBE
CoInitialize.OLE32 ref: 00007FF78E418E5B

Strings

Ws2_32.dll, xrefs: 00007FF78E418CA2
inet_ntop, xrefs: 00007FF78E418CB7

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: _fileno_setmode$Console$AddressInitializeLibraryLoadOutputProc
String ID: Ws2_32.dll$inet_ntop
API String ID: 1755878316-2739477577
Opcode ID: 6b7b38b38fdb6f2231155c0515883c19ac27669e06fffbb159bd7b89048bd062
Instruction ID: ae7a87e26f65640ece2079322184d3dad90682ca32970feabf52e60368fa149d
Opcode Fuzzy Hash: 6b7b38b38fdb6f2231155c0515883c19ac27669e06fffbb159bd7b89048bd062
Instruction Fuzzy Hash: 38912472A19B5781EA14AB94E81437CE3A1FB89B44FF44436EA9D433A4DF7CE459C320

Function 00007FF78E411154 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_amsg_exit.MSVCRT ref: 00007FF78E411242
_initterm.MSVCRT ref: 00007FF78E411277
_initterm.MSVCRT ref: 00007FF78E4112AA
exit.MSVCRT ref: 00007FF78E41145D
_cexit.MSVCRT ref: 00007FF78E41146C

Strings

0, xrefs: 00007FF78E4111B0

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: _initterm$_amsg_exit_cexitexit
String ID: 0
API String ID: 602970348-4108050209
Opcode ID: c5bb0eb04c8fb6cd053ca287a568665df2e0e3d12505647d5b9f2f4fedc3075a
Instruction ID: 0d847bdbbb6a79ded6f89817690303faf4172b2a431d36d437bedef7dbc39615
Opcode Fuzzy Hash: c5bb0eb04c8fb6cd053ca287a568665df2e0e3d12505647d5b9f2f4fedc3075a
Instruction Fuzzy Hash: EEA1E866F09B1789FB50AB95E89036CB7A0BB08B88FA04035ED4D577A4DF7DE540C760

Function 00007FF78E41F6D0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 373
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00007FF78E41F7EA
ReadFile.KERNELBASE ref: 00007FF78E41F850

Strings

ME, xrefs: 00007FF78E41F914

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: File$CreateRead
String ID: ME
API String ID: 3388366904-1625691762
Opcode ID: c91cc91aec063e0dbae3efeb34dab07cb7a92331081eabfc2945e3a851a375f5
Instruction ID: e3f7379b64e0c2f845c32822f32fc7419b181ce3e26ed995d03352813738d30b
Opcode Fuzzy Hash: c91cc91aec063e0dbae3efeb34dab07cb7a92331081eabfc2945e3a851a375f5
Instruction Fuzzy Hash: 86F1CF22A0DA8285DB11DFA9E4403ADBBA1FF95B85FA98036EE8D43755DF3CD145C320

Function 00007FF78E42DA70 Relevance: 293.3, APIs: 4, Strings: 162, Instructions: 2775
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF78E4120F0: GetProcAddress.KERNEL32 ref: 00007FF78E41210E

Part of subcall function 00007FF78E4120F0: exit.MSVCRT ref: 00007FF78E41223F

signal.MSVCRT ref: 00007FF78E42F026
signal.MSVCRT ref: 00007FF78E42F033
signal.MSVCRT ref: 00007FF78E42F040
signal.MSVCRT ref: 00007FF78E42F053

Part of subcall function 00007FF78E41BB80: memcpy.MSVCRT ref: 00007FF78E41BC81
Part of subcall function 00007FF78E41BB80: memcpy.MSVCRT ref: 00007FF78E41BCA2

Strings

RtlGetVersion, xrefs: 00007FF78E4321B5
cLocks, xrefs: 00007FF78E42E2D3
SafeArrayCreate, xrefs: 00007FF78E431A71
GetCurrentProcess, xrefs: 00007FF78E42F41C
trace, xrefs: 00007FF78E42EAFC
pvRecord, xrefs: 00007FF78E42DE92
CoInitialize, xrefs: 00007FF78E431A10
SysFreeString, xrefs: 00007FF78E4319D7
HeapCreate, xrefs: 00007FF78E42F34C
GetFieldNoCopy, xrefs: 00007FF78E4312E5
Hi32, xrefs: 00007FF78E42DFF2
wReserved1, xrefs: 00007FF78E42E656
ullVal, xrefs: 00007FF78E42E10D
rgsabound, xrefs: 00007FF78E43047F
cipher, xrefs: 00007FF78E432034
GetThreadContext, xrefs: 00007FF78E42F332
pdblVal, xrefs: 00007FF78E42E211
parray, xrefs: 00007FF78E42E34F
pscode, xrefs: 00007FF78E42E1C9
InitializeProcThreadAttributeList, xrefs: 00007FF78E42F3CE
pulVal, xrefs: 00007FF78E42DF4B
pullVal, xrefs: 00007FF78E42DF32
GetCurrentThread, xrefs: 00007FF78E42F31F
pfltVal, xrefs: 00007FF78E430587
sign, xrefs: 00007FF78E42E040
pllVal, xrefs: 00007FF78E42E221
struct1, xrefs: 00007FF78E42DEAB
VariantClear, xrefs: 00007FF78E431A23
MultiByteToWideChar, xrefs: 00007FF78E42F2CC
GetForegroundWindow, xrefs: 00007FF78E42F489
IsEqualGUID, xrefs: 00007FF78E42F255
ulVal, xrefs: 00007FF78E42E12D
Lo64, xrefs: 00007FF78E42DF88
union2, xrefs: 00007FF78E430CC4
skey, xrefs: 00007FF78E42F4E3
puiVal, xrefs: 00007FF78E42DF68
RecordCopy, xrefs: 00007FF78E4311B0
Mid32, xrefs: 00007FF78E42DF98
SysAllocString, xrefs: 00007FF78E431A57
PutFieldNoCopy, xrefs: 00007FF78E42DDE5
dblVal, xrefs: 00007FF78E42E541
LoadLibraryA, xrefs: 00007FF78E42F39A
cElements, xrefs: 00007FF78E42E299
pdecVal, xrefs: 00007FF78E430D18
scale, xrefs: 00007FF78E42E05D
pbstrVal, xrefs: 00007FF78E4306D2
counter, xrefs: 00007FF78E42DB43
hIntel, xrefs: 00007FF78E42F991
Field2, xrefs: 00007FF78E431B87
punkVal, xrefs: 00007FF78E42E41F
zonedTimeFromAdjTimeImpl, xrefs: 00007FF78E42DCE2
coresCount, xrefs: 00007FF78E42F8EE
HeapAlloc, xrefs: 00007FF78E42F366
GetGuid, xrefs: 00007FF78E4311DA
GetWindowThreadProcessId, xrefs: 00007FF78E42F4A3
OpenProcess, xrefs: 00007FF78E4321FA
fFeatures, xrefs: 00007FF78E42E30D
pcyVal, xrefs: 00007FF78E4306C6
Field0, xrefs: 00007FF78E42DB7C
pRecInfo, xrefs: 00007FF78E4317D0
Field1, xrefs: 00007FF78E42DB5B
dctx6, xrefs: 00007FF78E43205D
key5, xrefs: 00007FF78E431FFE
uiVal, xrefs: 00007FF78E42E14A
GetTypeInfoCount, xrefs: 00007FF78E430015
pdate, xrefs: 00007FF78E42E1B1
ppdispVal, xrefs: 00007FF78E430763
queryIdleProcessorCycleTime, xrefs: 00007FF78E42F8C0
pboolVal, xrefs: 00007FF78E42E1F8
wReserved, xrefs: 00007FF78E42E0B6
RecordInit, xrefs: 00007FF78E42DE4E
name, xrefs: 00007FF78E42DCA3
AddRef, xrefs: 00007FF78E42E3E2
puintVal, xrefs: 00007FF78E42DEEC
SetConsoleCP, xrefs: 00007FF78E42E8E8
RecordCreate, xrefs: 00007FF78E43146D
GetSize, xrefs: 00007FF78E43124F
GetFileAttributesW, xrefs: 00007FF78E4321E7
GetProcAddress, xrefs: 00007FF78E42F3B4
cbElements, xrefs: 00007FF78E42E2F0
SetConsoleOutputCP, xrefs: 00007FF78E42E8D5
Thread32First, xrefs: 00007FF78E431B10
fltVal, xrefs: 00007FF78E42E55E
lVal, xrefs: 00007FF78E42E5B5
GetProcessHeap, xrefs: 00007FF78E42F380
cDims, xrefs: 00007FF78E42E32A
iVal, xrefs: 00007FF78E42E57B
GetTypeInfo, xrefs: 00007FF78E42DE19
bCryptGenRandom, xrefs: 00007FF78E42F7CA
pdispVal, xrefs: 00007FF78E42E398
queryUnbiasedInterruptTime, xrefs: 00007FF78E42F80F
plVal, xrefs: 00007FF78E42E242
bVal, xrefs: 00007FF78E42E598
CreateProcessW, xrefs: 00007FF78E42F402
int64, xrefs: 00007FF78E42E475
intVal, xrefs: 00007FF78E42E0E3
GetField, xrefs: 00007FF78E4312C2
raw, xrefs: 00007FF78E42DB18
queryProcessCycleTime, xrefs: 00007FF78E42F7E2
Thread32Next, xrefs: 00007FF78E431B2A
pvData, xrefs: 00007FF78E42E2B6
RecordClear, xrefs: 00007FF78E42DE35
PutField, xrefs: 00007FF78E42DDFD
cyVal, xrefs: 00007FF78E42E4F7
GetFieldNames, xrefs: 00007FF78E43131A
IsMatchingType, xrefs: 00007FF78E431348
NtFlushInstructionCache4, xrefs: 00007FF78E431EB1
CreateToolhelp32Snapshot, xrefs: 00007FF78E431AF6
GetCommandLineW, xrefs: 00007FF78E42F5C2
scode, xrefs: 00007FF78E42E507
uintVal, xrefs: 00007FF78E42E0C6
ResumeThread, xrefs: 00007FF78E42F436
pintVal, xrefs: 00007FF78E42DF05
GetName, xrefs: 00007FF78E431234
pcVal, xrefs: 00007FF78E430D2B
wReserved2, xrefs: 00007FF78E42E634
line, xrefs: 00007FF78E42E7C4
cVal, xrefs: 00007FF78E42E167
pbVal, xrefs: 00007FF78E43056F
zonedTimeFromTimeImpl, xrefs: 00007FF78E42DD0B
WaitForSingleObject, xrefs: 00007FF78E42F450
tProcess1, xrefs: 00007FF78E42DBFA
procname, xrefs: 00007FF78E42E7D9
lpVtbl, xrefs: 00007FF78E42DE6A
SafeArrayPutElement, xrefs: 00007FF78E431A8B
DispGetIDsOfNames, xrefs: 00007FF78E4319C4
data, xrefs: 00007FF78E431BFA
Release, xrefs: 00007FF78E42E3CD
date, xrefs: 00007FF78E42E458
piVal, xrefs: 00007FF78E42E252
filename, xrefs: 00007FF78E42E7AE
lstrlenW, xrefs: 00007FF78E42F2E6
bstrVal, xrefs: 00007FF78E42E438
msg, xrefs: 00007FF78E42E7F2
remoteProcID2, xrefs: 00007FF78E42DBE5
boolVal, xrefs: 00007FF78E42E524
Invoke, xrefs: 00007FF78E430157
GetIDsOfNames, xrefs: 00007FF78E430028
CLRCreateInstance, xrefs: 00007FF78E431AC4
ppunkVal, xrefs: 00007FF78E430712
treadHandle3, xrefs: 00007FF78E42DBC5
:state, xrefs: 00007FF78E431E9E
RecordDestroy, xrefs: 00007FF78E42DDBD
QueryInterface, xrefs: 00007FF78E42FE84
SysStringLen, xrefs: 00007FF78E42F2B9
WideCharToMultiByte, xrefs: 00007FF78E42F287
GetModuleFileNameW, xrefs: 00007FF78E42F5D5
decVal, xrefs: 00007FF78E42DD8D
llVal, xrefs: 00007FF78E42E5DA
VariantCopy, xrefs: 00007FF78E431A3D
RecordCreateCopy, xrefs: 00007FF78E43148B
parent, xrefs: 00007FF78E42E818
byref, xrefs: 00007FF78E42E184
pvarVal, xrefs: 00007FF78E430875
UpdateProcThreadAttribute, xrefs: 00007FF78E42F3E8
union1, xrefs: 00007FF78E42E08A
pparray, xrefs: 00007FF78E430794
Lo32, xrefs: 00007FF78E42DFC5
signscale, xrefs: 00007FF78E42E01B
wReserved3, xrefs: 00007FF78E42E613
hresult, xrefs: 00007FF78E42DBA4
lLbound, xrefs: 00007FF78E42E27C

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: signal$memcpy$AddressProcexit
String ID: :state$AddRef$CLRCreateInstance$CoInitialize$CreateProcessW$CreateToolhelp32Snapshot$DispGetIDsOfNames$Field0$Field1$Field2$GetCommandLineW$GetCurrentProcess$GetCurrentThread$GetField$GetFieldNames$GetFieldNoCopy$GetFileAttributesW$GetForegroundWindow$GetGuid$GetIDsOfNames$GetModuleFileNameW$GetName$GetProcAddress$GetProcessHeap$GetSize$GetThreadContext$GetTypeInfo$GetTypeInfoCount$GetWindowThreadProcessId$HeapAlloc$HeapCreate$Hi32$InitializeProcThreadAttributeList$Invoke$IsEqualGUID$IsMatchingType$Lo32$Lo64$LoadLibraryA$Mid32$MultiByteToWideChar$NtFlushInstructionCache4$OpenProcess$PutField$PutFieldNoCopy$QueryInterface$RecordClear$RecordCopy$RecordCreate$RecordCreateCopy$RecordDestroy$RecordInit$Release$ResumeThread$RtlGetVersion$SafeArrayCreate$SafeArrayPutElement$SetConsoleCP$SetConsoleOutputCP$SysAllocString$SysFreeString$SysStringLen$Thread32First$Thread32Next$UpdateProcThreadAttribute$VariantClear$VariantCopy$WaitForSingleObject$WideCharToMultiByte$bCryptGenRandom$bVal$boolVal$bstrVal$byref$cDims$cElements$cLocks$cVal$cbElements$cipher$coresCount$counter$cyVal$data$date$dblVal$dctx6$decVal$fFeatures$filename$fltVal$hIntel$hresult$iVal$int64$intVal$key5$lLbound$lVal$line$llVal$lpVtbl$lstrlenW$msg$name$pRecInfo$parent$parray$pbVal$pboolVal$pbstrVal$pcVal$pcyVal$pdate$pdblVal$pdecVal$pdispVal$pfltVal$piVal$pintVal$plVal$pllVal$pparray$ppdispVal$ppunkVal$procname$pscode$puiVal$puintVal$pulVal$pullVal$punkVal$pvData$pvRecord$pvarVal$queryIdleProcessorCycleTime$queryProcessCycleTime$queryUnbiasedInterruptTime$raw$remoteProcID2$rgsabound$scale$scode$sign$signscale$skey$struct1$tProcess1$trace$treadHandle3$uiVal$uintVal$ulVal$ullVal$union1$union2$wReserved$wReserved1$wReserved2$wReserved3$zonedTimeFromAdjTimeImpl$zonedTimeFromTimeImpl
API String ID: 1418167214-113516584
Opcode ID: 289b29ce79b924c64fd36017754f045c1dadd6a6d6f83a0279adc11ace8a1520
Instruction ID: 3404bbce0a9393c76cb188170a957fcb2babb26d0ffaca52a5c36c12668210da
Opcode Fuzzy Hash: 289b29ce79b924c64fd36017754f045c1dadd6a6d6f83a0279adc11ace8a1520
Instruction Fuzzy Hash: 0993FD21C1CA8791F712AB98A8453F5B3A0BF91344FA05335ED9C93661EF7EB249C360

Function 00007FF78E412260 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF78E411DB0: strlen.MSVCRT ref: 00007FF78E411DC1
Part of subcall function 00007FF78E411DB0: fwrite.MSVCRT ref: 00007FF78E411DD4

exit.MSVCRT(?,?,?,?,00007FF78E412365,?,?,?,?,00007FF78E456128,?,3F000000,0000025EAC4E7260,00007FF78E412D1D), ref: 00007FF78E412283
VirtualAlloc.KERNEL32 ref: 00007FF78E412313
VirtualAlloc.KERNEL32 ref: 00007FF78E4123CD

Strings

out of memory, xrefs: 00007FF78E41226F

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: AllocVirtual$exitfwritestrlen
String ID: out of memory
API String ID: 4248889879-49810860
Opcode ID: 0516ab19841267af8d97caf5014a6074e881b3db8c10cd40e0e435bc0d2a0d95
Instruction ID: bbdc45ba930872c8b4d8c6dae6ba02efce478e6a3097a76b41102ad0eaa7d612
Opcode Fuzzy Hash: 0516ab19841267af8d97caf5014a6074e881b3db8c10cd40e0e435bc0d2a0d95
Instruction Fuzzy Hash: D4216D32B05B8682EB145B69E5483ADA3A0F708BE0FA48235DB6D473D2DF3DE454D314

Function 00007FF78E412290 Relevance: 3.9, APIs: 3, Instructions: 153
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 00007FF78E412313
VirtualAlloc.KERNEL32 ref: 00007FF78E4123CD

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 727153abf217048879292d18050c8b28e4688193c53aaa6d340e0ed37de13772
Instruction ID: efa2f8cbad1ef8a1aadcc15285b09cb84732419566e7467ee8e6e0c179a3d496
Opcode Fuzzy Hash: 727153abf217048879292d18050c8b28e4688193c53aaa6d340e0ed37de13772
Instruction Fuzzy Hash: E4517F32705B8681EF149B6AE4583ADA6A1FB48BC4FA48135EE4D4B3C5EF3CE085D314

Function 00007FF78E41BB80 Relevance: 3.9, APIs: 3, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT ref: 00007FF78E41BC81
memcpy.MSVCRT ref: 00007FF78E41BCA2
memcpy.MSVCRT ref: 00007FF78E41BD8F

Part of subcall function 00007FF78E413F10: memset.MSVCRT ref: 00007FF78E413FA2

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: memcpy$memset
String ID:
API String ID: 438689982-0
Opcode ID: 1b5bdb6c99ab6d8c5d26906455fead17df7766ec203ba2dfbcc180d9a118df1e
Instruction ID: b2eaa3a46cf2ffbd5d0a4b7cb65518a272ce3143f2e7e83a72c2d02a6359c7bc
Opcode Fuzzy Hash: 1b5bdb6c99ab6d8c5d26906455fead17df7766ec203ba2dfbcc180d9a118df1e
Instruction Fuzzy Hash: B5517E72609B86D1EE10EF85E4403ADB7A4FB84B84FA58536EA8C47795EF3CD508C350

Function 00007FF78E422AF0 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fputc.MSVCRT ref: 00007FF78E422B3B
fputc.MSVCRT ref: 00007FF78E422BB2

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: fputc
String ID:
API String ID: 1992160199-0
Opcode ID: 57ccfcea121c233f8d07f3c2467c4ac64782e5a1e049ec43631ea0a2ba6a73a8
Instruction ID: 01ad5bcad994541bdeaac04cd110b5f20039edf74cfe1e732b314e82f4da2b83
Opcode Fuzzy Hash: 57ccfcea121c233f8d07f3c2467c4ac64782e5a1e049ec43631ea0a2ba6a73a8
Instruction Fuzzy Hash: 6D21F3A1B0874759FA247E9199A53B9DA487F14BC5FE80434EE1E4B395EF7DE040C228

Function 00007FF78E427B14 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 36
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 00007FF78E427B6E

Strings

(null), xrefs: 00007FF78E427B2B

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: strlen
String ID: (null)
API String ID: 39653677-3941151225
Opcode ID: ff5024eb9933e06b0bbfa2a66c989f9e381f0049ca6fda50563a0ccd99e4c395
Instruction ID: 2055aaae85194ae7df304a2749fea65de6d2019287312634e7858a8b416304e3
Opcode Fuzzy Hash: ff5024eb9933e06b0bbfa2a66c989f9e381f0049ca6fda50563a0ccd99e4c395
Instruction Fuzzy Hash: E0011A22A04B428EE700EF76D8852A867A1F748BD8F600C35FA1C87B99DF34D561C3A0

Function 00007FF78E412370 Relevance: 2.6, APIs: 2, Instructions: 149
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 00007FF78E4123CD

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a86c5dc9920d05f400155eb031ff4e8cb55972a930c6a7583547e339d0d6e71f
Instruction ID: cec50de362983cd66bea837deba0187e2400aa18f861d0fc8251ebbc48e55adb
Opcode Fuzzy Hash: a86c5dc9920d05f400155eb031ff4e8cb55972a930c6a7583547e339d0d6e71f
Instruction Fuzzy Hash: FB515D72706B8681EE15AB56D8583AD63A1FB54FC4FA88536EE0D4B388FF38E041D314

Function 00007FF78E427990 Relevance: 1.5, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fputc.MSVCRT ref: 00007FF78E4279DE

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: fputc
String ID:
API String ID: 1992160199-0
Opcode ID: 504284c848961401c03dab208bcdb2fd3e9e69f166b779f959cc6528fe2ed3ec
Instruction ID: 250c0fac9b843e1a4ff6b5f6ede01798bae149da7a2143a28b58e1deed89508e
Opcode Fuzzy Hash: 504284c848961401c03dab208bcdb2fd3e9e69f166b779f959cc6528fe2ed3ec
Instruction Fuzzy Hash: 0311FAB7A04B458AEB10CF2AC48259C7BB1F798BD87548921EF0C47768DB34D8A1C7A4

Function 00007FF78E422BF0 Relevance: 1.5, APIs: 1, Instructions: 24
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF78E422AF0: fputc.MSVCRT ref: 00007FF78E422B3B

fwrite.MSVCRT ref: 00007FF78E422C2F

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: fputcfwrite
String ID:
API String ID: 1748715138-0
Opcode ID: 439de3348a76cb714ffd0b45168a55d101903fa0adb1ac598fcf396fd099d506
Instruction ID: ac28a5fa46696fc722d664d1ca8ba31a2d62986410c0dc00b8f6cf36fba8135b
Opcode Fuzzy Hash: 439de3348a76cb714ffd0b45168a55d101903fa0adb1ac598fcf396fd099d506
Instruction Fuzzy Hash: 79E04820B1500345E604B392B8517B85251BB4D784FE40438ED1D4B3D3DEBFD481C364

Function 00007FF78E412EA0 Relevance: 1.4, APIs: 1, Instructions: 161
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 00007FF78E412FB1

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f2edbc15cdf84d54289b1ee0bea3483cdf8f1befdda1efe5bcdab0cd9a36917b
Instruction ID: 841d8a4e56efba2a20908af527caa53683d1a7d78ea7bae205ba7dc56b416f6b
Opcode Fuzzy Hash: f2edbc15cdf84d54289b1ee0bea3483cdf8f1befdda1efe5bcdab0cd9a36917b
Instruction Fuzzy Hash: 6761DF62A05B8290EE15AF59D4043ADA3A0FF04B84FB88239EE5D47794EF38E5D0D320

Function 00007FF78E413F10 Relevance: 1.3, APIs: 1, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF78E413FA2

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8b02143593e92ac2916d54e6260cb3ac124fb366926f2417c8424ac6dc95cb66
Instruction ID: 5ce4dc47f646ee33e25e52102a50ab4fc41f0187592ab00e67a9974fab4ef264
Opcode Fuzzy Hash: 8b02143593e92ac2916d54e6260cb3ac124fb366926f2417c8424ac6dc95cb66
Instruction Fuzzy Hash: B5410DA6A08B87A0EA10EF95D4502BCB374F748BA4FE54277EA2D43790DF38D495C360

Non-executed Functions

Function 00007FF78E41D570 Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 334threadlibraryloaderCOMMON

Download Yara Rule

APIs

RtlAddVectoredExceptionHandler.NTDLL ref: 00007FF78E41D5B8
memset.MSVCRT ref: 00007FF78E41D5C9
CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF78E41D62D
Thread32First.KERNEL32 ref: 00007FF78E41D697
GetCurrentProcessId.KERNEL32 ref: 00007FF78E41D6B3

Part of subcall function 00007FF78E41BB80: memcpy.MSVCRT ref: 00007FF78E41BC81
Part of subcall function 00007FF78E41BB80: memcpy.MSVCRT ref: 00007FF78E41BCA2

Part of subcall function 00007FF78E416670: MultiByteToWideChar.KERNEL32 ref: 00007FF78E4166C7
Part of subcall function 00007FF78E416670: MultiByteToWideChar.KERNEL32 ref: 00007FF78E41672A

CloseHandle.KERNEL32 ref: 00007FF78E41D6DE
OpenThread.KERNEL32 ref: 00007FF78E41D70C
GetThreadContext.KERNEL32 ref: 00007FF78E41D724
SetThreadContext.KERNEL32 ref: 00007FF78E41D778
CloseHandle.KERNEL32 ref: 00007FF78E41D7A1
GetModuleHandleA.KERNEL32 ref: 00007FF78E41D7E6
GetModuleHandleA.KERNEL32 ref: 00007FF78E41D9A7
GetProcAddress.KERNEL32 ref: 00007FF78E41D9FF
RtlInitUnicodeString.NTDLL ref: 00007FF78E41DA9E
LdrLoadDll.NTDLL ref: 00007FF78E41DAAE

Strings

jP~, xrefs: 00007FF78E41DA83
bz, xrefs: 00007FF78E41D8B6
Ju4J, xrefs: 00007FF78E41DA0C
NrTP, xrefs: 00007FF78E41D7C1

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: Handle$Thread$ByteCharCloseContextModuleMultiWidememcpy$AddressCreateCurrentExceptionFirstHandlerInitLoadOpenProcProcessSnapshotStringThread32Toolhelp32UnicodeVectoredmemset
String ID: Ju4J$NrTP$jP~$bz
API String ID: 3395284975-2228891234
Opcode ID: b45bdde2e050a73820c03575133c645b573c8b00ded2bee2f5eea24cf29b9914
Instruction ID: 9d35042d8a63671415ee242223e6f18cfdc13832b3cd752cc4660fc0e75ce6cb
Opcode Fuzzy Hash: b45bdde2e050a73820c03575133c645b573c8b00ded2bee2f5eea24cf29b9914
Instruction Fuzzy Hash: 0BE19D62A0864381EE14BB91A8143BEA3A1BF85785FF48035FA4E47799DF7CE445C360

Function 00007FF78E420460 Relevance: 19.5, APIs: 11, Strings: 1, Instructions: 1506COMMON

Download Yara Rule

Strings

@, xrefs: 00007FF78E4218F8

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: d41118d21125260021136046d49c4ddac0172a0b69c53b1cfd141be858fcfbda
Instruction ID: c6e6093a39d9eb408e204241188989728a03c3058d98e97419f0f8588e82a00a
Opcode Fuzzy Hash: d41118d21125260021136046d49c4ddac0172a0b69c53b1cfd141be858fcfbda
Instruction Fuzzy Hash: 53E2E7B2B05A4782EE54AB85C0483BDA3A6FB41BC4FE59536EA1E473D5DF78E490C310

Function 00007FF78E422CA0 Relevance: 14.6, APIs: 5, Strings: 3, Instructions: 605COMMON

Download Yara Rule

APIs

_setjmp.MSVCRT ref: 00007FF78E422D3C
_setjmp.MSVCRT ref: 00007FF78E422E3E
_setjmp.MSVCRT ref: 00007FF78E422F87
_setjmp.MSVCRT ref: 00007FF78E422FEA

Strings

ntime of, xrefs: 00007FF78E423345
unable t, xrefs: 00007FF78E423331
o get ru, xrefs: 00007FF78E42333B

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: _setjmp
String ID: ntime of$o get ru$unable t
API String ID: 3051281561-3332830050
Opcode ID: d0554340613ade2734ec52f66b3ad006e85fbc4489e651fa7a6d65edd9e85561
Instruction ID: caa3bd1adef9f527bded4a4f227225936b387dcb533016769c28ff17f12772fe
Opcode Fuzzy Hash: d0554340613ade2734ec52f66b3ad006e85fbc4489e651fa7a6d65edd9e85561
Instruction Fuzzy Hash: C4623C76B09B4791EB20AF95E4503AAB3B1FB84B84FA08132EA4D477A4DF7DD444C760

Function 00007FF78E42A61A Relevance: 5.9, APIs: 1, Strings: 2, Instructions: 1364COMMON

Download Yara Rule

Strings

Infinity, xrefs: 00007FF78E42A71D
NaN, xrefs: 00007FF78E42A74E

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID:
String ID: Infinity$NaN
API String ID: 0-4285296124
Opcode ID: 43a24777cb2a7448191f746b4a8f09d76225fbc947654351fbeea7187872f442
Instruction ID: 6b6f8f3d4d6b948d1137b29649f13df122cd4da52f0fdf8163316fd07a7137a6
Opcode Fuzzy Hash: 43a24777cb2a7448191f746b4a8f09d76225fbc947654351fbeea7187872f442
Instruction Fuzzy Hash: ADE25732A04B868EE711DFB9C4443AC77A1FB4578CF608226FA0D5BB59DB78E485CB50

Function 00007FF78E416970 Relevance: 4.2, Strings: 2, Instructions: 1713COMMON

Download Yara Rule

Strings

@, xrefs: 00007FF78E417936
, xrefs: 00007FF78E416D1D

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: memset
String ID: $@
API String ID: 2221118986-1077428164
Opcode ID: 03b27ce39678605c4c05157e0135865bc365a15c590f11ba998ac2ac2b446451
Instruction ID: 10d607b3fab77e5c6ca0b1a6dfdc89323716e93afd6c261cddd90111207ffa34
Opcode Fuzzy Hash: 03b27ce39678605c4c05157e0135865bc365a15c590f11ba998ac2ac2b446451
Instruction Fuzzy Hash: B1D225A2718B9542FE10CBA1A9207EBA791FB59BC4F59A531EF9D57B49CB3CE101C300

Function 00007FF78E41E7F0 Relevance: 3.2, Strings: 2, Instructions: 657COMMON

Download Yara Rule

Strings

DDDDDDDD, xrefs: 00007FF78E41F257
"""""""", xrefs: 00007FF78E41F244

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID:
String ID: """"""""$DDDDDDDD
API String ID: 0-1621327129
Opcode ID: 2d363e052113f3d8cd9e6b6330711e63bcd5a0466a8e22fb94e76f087d7d2b95
Instruction ID: 623037476b392d46b4c4d0dcebca10e153f79ca161e02c959b177e3abe6c3414
Opcode Fuzzy Hash: 2d363e052113f3d8cd9e6b6330711e63bcd5a0466a8e22fb94e76f087d7d2b95
Instruction Fuzzy Hash: 2F425E62718BD481E660CFA1B92179BE7A1F7897D4F54A226EE8C67F18DB3CD041CB00

Function 00007FF78E414A80 Relevance: 2.8, Strings: 2, Instructions: 323COMMON

Download Yara Rule

Strings

00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899, xrefs: 00007FF78E414ABC, 00007FF78E414D26
c, xrefs: 00007FF78E414A9E

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID:
String ID: 00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899$c
API String ID: 0-131350621
Opcode ID: fe9ec9832198bf8c78be8ed1d10407d067a980f3333fc5e30a7e9afb6ea7d0de
Instruction ID: a99c037e9642545f44664279a03039d89390a9c78336defb22645b39990b91c5
Opcode Fuzzy Hash: fe9ec9832198bf8c78be8ed1d10407d067a980f3333fc5e30a7e9afb6ea7d0de
Instruction Fuzzy Hash: 0BC1B592B18B4A86EE609B69A8053BDA251FB59BA4FB44331EF3D477D4EB3CD504C310

Function 00007FF78E416760 Relevance: 2.6, Strings: 2, Instructions: 148COMMON

Download Yara Rule

Strings

33333333, xrefs: 00007FF78E416828
UUUUUUUU, xrefs: 00007FF78E416772

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID:
String ID: 33333333$UUUUUUUU
API String ID: 0-3483174168
Opcode ID: 441117c694ab834bf65894c7cf1b76a728a697286da176495cad2e6614abf1fb
Instruction ID: ce635fbe03f273c4060d4f95008f9c0126ce9dda3d0ee2486fa34e039c3354eb
Opcode Fuzzy Hash: 441117c694ab834bf65894c7cf1b76a728a697286da176495cad2e6614abf1fb
Instruction Fuzzy Hash: 7D41C3E3B70BB895EA01CF559905AD56761F314FE8A19E026DF0E3BB0EC638DA47C241

Function 00007FF78E41B420 Relevance: .4, Instructions: 447COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58d152655350713289c819be8dccde4b231c5deb1e4a479145f82acc2a1a33ee
Instruction ID: f5fbe1fb62393563b6391bd17e55d603ea712de299dad0e4c275d42cc4dbddbf
Opcode Fuzzy Hash: 58d152655350713289c819be8dccde4b231c5deb1e4a479145f82acc2a1a33ee
Instruction Fuzzy Hash: 82025953F74FD580F713577C6802EA4AA04ABB33E0B65A301FD5662FE3D76296178A04

Function 00007FF78E45CF08 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ebbe443d4d5eec7067146e404a23c1702ac5f29493cc888530308e17ef8ef7e
Instruction ID: 0e61130fe5f806c7a1f68273e03baab87664133aa8e6132fc5521efbd1a9a86c
Opcode Fuzzy Hash: 6ebbe443d4d5eec7067146e404a23c1702ac5f29493cc888530308e17ef8ef7e
Instruction Fuzzy Hash: 4A21578795E7D22ED3539BB81C651AC7FB09AE291079E81A7DBC8D32C3E44C5819C322

Function 00007FF78E4199F0 Relevance: 31.9, APIs: 10, Strings: 8, Instructions: 373COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32 ref: 00007FF78E419ABC
SysFreeString.OLEAUT32 ref: 00007FF78E419ADC
CoInitialize.OLE32 ref: 00007FF78E419B18
VariantCopy.OLEAUT32 ref: 00007FF78E419B65
_setjmp.MSVCRT ref: 00007FF78E419C04

Strings

d except, xrefs: 00007FF78E419F05
com.nim, xrefs: 00007FF78E419D44
ion insi, xrefs: 00007FF78E419F24
de event, xrefs: 00007FF78E419F32
newVariant, xrefs: 00007FF78E419D4B
hander:, xrefs: 00007FF78E419F16
uncatche, xrefs: 00007FF78E419EFB
VariantConversionError, xrefs: 00007FF78E419CE4, 00007FF78E419D5E

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: String$CopyFreeInitializeVariant_setjmp
String ID: hander:$VariantConversionError$com.nim$d except$de event$ion insi$newVariant$uncatche
API String ID: 1008739868-602244300
Opcode ID: 73eab3e3a8e54823fae27a0f2d74788e3fa71f517200aa9c444ffa85e95ef9c7
Instruction ID: 2ba8fb2addd619392d8cffb5ec1eeca72bfb0cd129fed75f66ac4dfbc90f260f
Opcode Fuzzy Hash: 73eab3e3a8e54823fae27a0f2d74788e3fa71f517200aa9c444ffa85e95ef9c7
Instruction Fuzzy Hash: E8025B72A09B4781EE10AF95E4443BEB7A0FB84B84FA44436EA4D477A5EF3CE544C360

Function 00007FF78E4183F0 Relevance: 31.7, APIs: 3, Strings: 15, Instructions: 224COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 00007FF78E418412

Strings

os.nim, xrefs: 00007FF78E41858E
nds, the, xrefs: 00007FF78E418537
contain, xrefs: 00007FF78E418529
not in , xrefs: 00007FF78E418734
0 .., xrefs: 00007FF78E41868B
pty, xrefs: 00007FF78E418557
not in , xrefs: 00007FF78E418672
0 .., xrefs: 00007FF78E4187B7
paramStr, xrefs: 00007FF78E4185A4
index ou, xrefs: 00007FF78E41850E
IndexDefect, xrefs: 00007FF78E4184C7
inde, xrefs: 00007FF78E4187A7
t of bou, xrefs: 00007FF78E418504
not in , xrefs: 00007FF78E418776
er is em, xrefs: 00007FF78E418545

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: CommandLine
String ID: contain$ not in $ not in $ not in $0 ..$0 ..$IndexDefect$er is em$inde$index ou$nds, the$os.nim$paramStr$pty$t of bou
API String ID: 3253501508-475797482
Opcode ID: ae8af6ebdb65100db110cd49cbf6243cfd4987e597e8c8f6b34ff7532a8fb47d
Instruction ID: a6bcfb1466f2dab1c76cb7ffc9b2556ec278cf85d7f1c6f7d6a478a0d9093e82
Opcode Fuzzy Hash: ae8af6ebdb65100db110cd49cbf6243cfd4987e597e8c8f6b34ff7532a8fb47d
Instruction Fuzzy Hash: 98A19832A09B4381EB10AF95E54436DB7A4FF48B84FA58036EA5D07395EF3CE555C3A0

Function 00007FF78E41A740 Relevance: 28.3, APIs: 8, Strings: 8, Instructions: 297memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78E416670: MultiByteToWideChar.KERNEL32 ref: 00007FF78E4166C7
Part of subcall function 00007FF78E416670: MultiByteToWideChar.KERNEL32 ref: 00007FF78E41672A

SysAllocString.OLEAUT32 ref: 00007FF78E41A77F
_setjmp.MSVCRT ref: 00007FF78E41A7D6
CoInitialize.OLE32 ref: 00007FF78E41A8BB
SysFreeString.OLEAUT32 ref: 00007FF78E41A946
memcpy.MSVCRT ref: 00007FF78E41AA0C
CoInitialize.OLE32 ref: 00007FF78E41AA43
SafeArrayCreate.OLEAUT32 ref: 00007FF78E41AAC9
SafeArrayPutElement.OLEAUT32 ref: 00007FF78E41AAFA

Strings

o invoke, xrefs: 00007FF78E41A97F
com.nim, xrefs: 00007FF78E41ACC7
r: , xrefs: 00007FF78E41A9F6
specifi, xrefs: 00007FF78E41A9C3
toVariant, xrefs: 00007FF78E41ACCE
VariantConversionError, xrefs: 00007FF78E41AC66, 00007FF78E41ACE1
ed membe, xrefs: 00007FF78E41A9D1
unable t, xrefs: 00007FF78E41A9B5

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: ArrayByteCharInitializeMultiSafeStringWide$AllocCreateElementFree_setjmpmemcpy
String ID: specifi$VariantConversionError$com.nim$ed membe$o invoke$r: $toVariant$unable t
API String ID: 4234589578-1707675
Opcode ID: 40dd78bd37efff150318ba0ad35e508670c7ec19cf888205b5695cbcda88311e
Instruction ID: 71df4d97f6a8e9def57ca63b567ec89d3719d4a979e955175a800e59d174e616
Opcode Fuzzy Hash: 40dd78bd37efff150318ba0ad35e508670c7ec19cf888205b5695cbcda88311e
Instruction Fuzzy Hash: 52F12C32A09B8781EA20AF95F4443AEF3A4FB84B84FA44135EA8D47755EF7CE444C760

Function 00007FF78E415110 Relevance: 27.5, APIs: 8, Strings: 10, Instructions: 466stringCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF78E4151DB
strlen.MSVCRT ref: 00007FF78E41521E

Strings

excepti, xrefs: 00007FF78E415170
ed from:, xrefs: 00007FF78E415782
Error: u, xrefs: 00007FF78E415181
]], xrefs: 00007FF78E415758
nhandled, xrefs: 00007FF78E41518B
ReraiseDefect, xrefs: 00007FF78E415114
fatal.nim, xrefs: 00007FF78E415119
sysFatal, xrefs: 00007FF78E41511A
[[rerais, xrefs: 00007FF78E415778
on: , xrefs: 00007FF78E41517A

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: memcpystrlen
String ID: excepti$Error: u$ReraiseDefect$[[rerais$]]$ed from:$fatal.nim$nhandled$on: $sysFatal
API String ID: 3412268980-331123295
Opcode ID: 8f4dde3022c81423b768480ceda97c10880ad535dc9c362d3ef7fb7deb79978a
Instruction ID: 3d92837f47a596a548beb0c9ec962529e091b0e91b485dec1d6c9230f5e06b1f
Opcode Fuzzy Hash: 8f4dde3022c81423b768480ceda97c10880ad535dc9c362d3ef7fb7deb79978a
Instruction Fuzzy Hash: C622BA72A08B8381EE10AB85E4047AEA7A5FB45B94FF48136EE5C07795EF3CE444C760

Function 00007FF78E419280 Relevance: 16.7, APIs: 3, Strings: 8, Instructions: 193COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF78E4194E4
memcpy.MSVCRT ref: 00007FF78E419526

Strings

VT_ARRAY, xrefs: 00007FF78E4194BA
H, xrefs: 00007FF78E4192FD
VED|, xrefs: 00007FF78E419445
VT_ARRAY, xrefs: 00007FF78E4192CD
VT_ARRAY, xrefs: 00007FF78E4195A0
VT_VECTO, xrefs: 00007FF78E4193D0
VT_RESER, xrefs: 00007FF78E419428
VT_BYREF, xrefs: 00007FF78E419398

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: memcpy
String ID: H$VED|$VT_ARRAY$VT_ARRAY$VT_ARRAY$VT_BYREF$VT_RESER$VT_VECTO
API String ID: 3510742995-1705348919
Opcode ID: 337739e223be188f628012b87c5b85072a9b5b8a4ef4e15056e466ec34cbc926
Instruction ID: 0394d53ea68b9e01ecad5f1f473c053b6488cee964b29edc2f0c097a8636dee7
Opcode Fuzzy Hash: 337739e223be188f628012b87c5b85072a9b5b8a4ef4e15056e466ec34cbc926
Instruction Fuzzy Hash: FC816972A08B4685EA10AB55E4443ADA3A4FB54BC4FE98536EF4D073A1EF7CE444C360

Function 00007FF78E422790 Relevance: 16.7, APIs: 2, Strings: 9, Instructions: 167COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF78E4228EB
memcpy.MSVCRT ref: 00007FF78E4229AB

Strings

parseStandardFormatSpecifier, xrefs: 00007FF78E422947
strformat.nim, xrefs: 00007FF78E422931
rse:, xrefs: 00007FF78E4228CC
ValueError, xrefs: 00007FF78E42281B
tring, c, xrefs: 00007FF78E4228A0
CLRError, xrefs: 00007FF78E422796
annot pa, xrefs: 00007FF78E4228AE
invalid , xrefs: 00007FF78E422885
format s, xrefs: 00007FF78E42288F

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: memcpy
String ID: CLRError$ValueError$annot pa$format s$invalid $parseStandardFormatSpecifier$rse:$strformat.nim$tring, c
API String ID: 3510742995-153200016
Opcode ID: 216522f65f7b7ecf525798e0b75d0ca7fecc0448bf14dbf4ae37d6973f2ee7d0
Instruction ID: 6efe1864fa7a6a074c78c5a4dc3df341d8e96e85da45b4b7a1325c97eea4e09a
Opcode Fuzzy Hash: 216522f65f7b7ecf525798e0b75d0ca7fecc0448bf14dbf4ae37d6973f2ee7d0
Instruction Fuzzy Hash: 33716C72B09B4381EB10EF95E9443ADA3A0FB45B94FA48536EA9C0B785EF7CD154C360

Function 00007FF78E41D1F0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 187COMMON

Download Yara Rule

APIs

_setjmp.MSVCRT ref: 00007FF78E41D227
memcpy.MSVCRT ref: 00007FF78E41D422

Strings

integer:, xrefs: 00007FF78E41D3C5
ValueError, xrefs: 00007FF78E41D383, 00007FF78E41D48C
invalid , xrefs: 00007FF78E41D3DF
strutils.nim, xrefs: 00007FF78E41D472
gfffffff, xrefs: 00007FF78E41D298
parseInt, xrefs: 00007FF78E41D479

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: _setjmpmemcpy
String ID: ValueError$gfffffff$integer:$invalid $parseInt$strutils.nim
API String ID: 2721286225-831327929
Opcode ID: d42cb93ac16e04f855ba17adc5a1d2855ebe73bfd532347f31365ef0ddec713f
Instruction ID: 08f521a08165ef2b064f48470d39177bad80b911264dc3b604861a0a7a823591
Opcode Fuzzy Hash: d42cb93ac16e04f855ba17adc5a1d2855ebe73bfd532347f31365ef0ddec713f
Instruction Fuzzy Hash: 2D919072A09B5B81EE20AB85E4443ADB3A0FB44B94FE44232EA5D473D5DF7DE544C350

Function 00007FF78E416150 Relevance: 14.0, APIs: 2, Strings: 6, Instructions: 28stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF78E4161A3
exit.MSVCRT ref: 00007FF78E4161B8

Strings

unknown signal, xrefs: 00007FF78E416189
SIGINT: Interrupted by Ctrl-C., xrefs: 00007FF78E416156
SIGABRT: Abnormal termination., xrefs: 00007FF78E41616E
SIGFPE: Arithmetic error., xrefs: 00007FF78E41617A
SIGSEGV: Illegal storage access. (Attempt to read from nil?), xrefs: 00007FF78E416162
SIGILL: Illegal operation., xrefs: 00007FF78E416190

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: exitstrlen
String ID: SIGABRT: Abnormal termination.$SIGFPE: Arithmetic error.$SIGILL: Illegal operation.$SIGINT: Interrupted by Ctrl-C.$SIGSEGV: Illegal storage access. (Attempt to read from nil?)$unknown signal
API String ID: 4213389737-3987738871
Opcode ID: e106d0bf56c6f6c14220b101e35efae5d1955080e8f0331f6d695c16fe7ff00b
Instruction ID: 4b9aa30f1e36849e5996802262eda8b97dd365016906507905818b389e652d7b
Opcode Fuzzy Hash: e106d0bf56c6f6c14220b101e35efae5d1955080e8f0331f6d695c16fe7ff00b
Instruction Fuzzy Hash: 11F0F920A0844350FE29B7D068559BCA251BF42385FF90539F52D57A63CF7CB445C230

Function 00007FF78E418FD0 Relevance: 13.6, APIs: 2, Strings: 7, Instructions: 142COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF78E41906A
memcpy.MSVCRT ref: 00007FF78E4190AB

Strings

to , xrefs: 00007FF78E41922E
from, xrefs: 00007FF78E41921A
convert , xrefs: 00007FF78E419110
convert , xrefs: 00007FF78E41903F
convert , xrefs: 00007FF78E4191F4
convert , xrefs: 00007FF78E4191B7
convert , xrefs: 00007FF78E419254

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: memcpy
String ID: to $convert $convert $convert $convert $convert $from
API String ID: 3510742995-1950068461
Opcode ID: fd36f46ad0ae37d4b4bddbbc41cb48c1798a24c9597a1145c937eb4c79994910
Instruction ID: 8ab5dbf57a82094de69ebebef4bb8f08efef6b9029e97869554b571a40b32302
Opcode Fuzzy Hash: fd36f46ad0ae37d4b4bddbbc41cb48c1798a24c9597a1145c937eb4c79994910
Instruction Fuzzy Hash: 5C617D72A05B4781EF05EF81D44839DBBA1FB58B84FA9803AEA0D47395EF78D941C391

Function 00007FF78E4116F0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF78E411709
LoadLibraryA.KERNEL32 ref: 00007FF78E41171A
GetProcAddress.KERNEL32 ref: 00007FF78E411738
GetProcAddress.KERNEL32 ref: 00007FF78E411748

Strings

libgcc_s_dw2-1.dll, xrefs: 00007FF78E4116FF
__deregister_frame_info, xrefs: 00007FF78E41173B
__register_frame_info, xrefs: 00007FF78E411727

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: __deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
API String ID: 384173800-1835852900
Opcode ID: b2bd19885756fac5e715177d44c2c246ee0f40da9efa5fc0257f11007989734f
Instruction ID: b573451d84250467d8f14ca29960e22e9338769570c2261941bd53c03e20ccf6
Opcode Fuzzy Hash: b2bd19885756fac5e715177d44c2c246ee0f40da9efa5fc0257f11007989734f
Instruction Fuzzy Hash: 3101F324B0AA0791EE11BB91BC505B9A364BF48788FE80932FC5E03324EF3CA505C320

Function 00007FF78E414F70 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 69COMMON

Download Yara Rule

APIs

longjmp.MSVCRT ref: 00007FF78E415007
exit.MSVCRT ref: 00007FF78E41501A

Strings

ReraiseDefect, xrefs: 00007FF78E415026
fatal.nim, xrefs: 00007FF78E415084
sysFatal, xrefs: 00007FF78E415091
5, xrefs: 00007FF78E41507B

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: exitlongjmp
String ID: 5$ReraiseDefect$fatal.nim$sysFatal
API String ID: 2266059207-1761478562
Opcode ID: 6dba0bab8b8842a3087f969b2d79c435c3b861759359c708d2e6c07f5b605d46
Instruction ID: cb4d428d96a436475439c00ea4b68c60cdd1248caf4e57951c0ad014fc7c906c
Opcode Fuzzy Hash: 6dba0bab8b8842a3087f969b2d79c435c3b861759359c708d2e6c07f5b605d46
Instruction Fuzzy Hash: F9310565A08A0791EE00BB94E4486BEA3A4FB44B84FF40436EA1C47392EF3CE544C3A0

Function 00007FF78E41E170 Relevance: 9.3, APIs: 2, Strings: 4, Instructions: 257stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF78E41E3A4

Strings

MZ, xrefs: 00007FF78E41E1A3
HYk, xrefs: 00007FF78E41E5F3
HYk, xrefs: 00007FF78E41E49D
JDF7, xrefs: 00007FF78E41E330

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: strlen
String ID: JDF7$MZ$HYk$HYk
API String ID: 39653677-2708922670
Opcode ID: fb128b31eecae01c74019f75152d3cf190f191e744a191f74645c25cc66dacfe
Instruction ID: c731aec84acf981aa83f151ac0d20596c72dcd71dbcb269af49889b7d77a5e47
Opcode Fuzzy Hash: fb128b31eecae01c74019f75152d3cf190f191e744a191f74645c25cc66dacfe
Instruction Fuzzy Hash: B9C1CF25B0958792EA20BF95D4502BEA3A1FF84788FF08135FA8D07A99DF3CE545C760

Function 00007FF78E41B080 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 191COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF78E41B14B
VariantCopy.OLEAUT32 ref: 00007FF78E41B1A1

Strings

com.nim, xrefs: 00007FF78E41B350
toVariant, xrefs: 00007FF78E41B366
VariantConversionError, xrefs: 00007FF78E41B2D7

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: CopyInitializeVariant
String ID: VariantConversionError$com.nim$toVariant
API String ID: 633353902-3035603046
Opcode ID: 69b7a0743af9c74be4fe706768bacf6f89d1360f85a604e1a72977d30e1db7da
Instruction ID: 2bf82175c42c7c5240fa460812525899e012ac1bafa74a8f2cd5b3a4358a7d50
Opcode Fuzzy Hash: 69b7a0743af9c74be4fe706768bacf6f89d1360f85a604e1a72977d30e1db7da
Instruction Fuzzy Hash: 50911632A19A4781EA10AB95E8543BEA3A4FF85784FF4443AFA4D47795DF7CE008C360

Function 00007FF78E426F20 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

CCG , xrefs: 00007FF78E426F48

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: 08d7eed76709450e368a73cb412f1c952c93ae8a5c57bb94bda8ef868f485690
Instruction ID: 38c8a0991f51f51b664e4f85ef93a6339d21c67a61a4bd59c2c2e163e9e67f6e
Opcode Fuzzy Hash: 08d7eed76709450e368a73cb412f1c952c93ae8a5c57bb94bda8ef868f485690
Instruction Fuzzy Hash: FF415471A086178AF720ABA4C8483BC6261BF45358FB04A35EE2D877E5CF3CE541D320

Function 00007FF78E411E40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00007FF78E411E69
fflush.MSVCRT ref: 00007FF78E411E71
exit.MSVCRT(?,?,?,?,?,?,?,00007FF78E432350), ref: 00007FF78E411E7B

Strings

[GC] cannot register global variable; too many global variables, xrefs: 00007FF78E411E5C

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: exitfflushfwrite
String ID: [GC] cannot register global variable; too many global variables
API String ID: 3476253079-2146260042
Opcode ID: 437ef05ad9c949bf7c3cade124a65ed7813bdb6dbf6992e3187067ae8dbba8cc
Instruction ID: 774ebc558379c4c0275d012d178ad591ebe06d901a760018fa4f953e256d57bb
Opcode Fuzzy Hash: 437ef05ad9c949bf7c3cade124a65ed7813bdb6dbf6992e3187067ae8dbba8cc
Instruction Fuzzy Hash: 2B4190B2B05A4281EE04EB58D0543BCA761FB94BC4FB18A35DA0E47351EF7EE545C320

Function 00007FF78E4120F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 92libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF78E41210E
exit.MSVCRT ref: 00007FF78E41223F

Strings

@, xrefs: 00007FF78E412163
could not import: , xrefs: 00007FF78E412203

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: AddressProcexit
String ID: @$could not import:
API String ID: 2129014486-260091680
Opcode ID: 69dd1521f8cfb840d2ca3ee137f161da04b393e1b82e55d6114af6ee7714bfbc
Instruction ID: 4b4db1a5a71561f5d3b38fd0cd4376752e53103dfd6fe7ef3cf905c831ef23c3
Opcode Fuzzy Hash: 69dd1521f8cfb840d2ca3ee137f161da04b393e1b82e55d6114af6ee7714bfbc
Instruction Fuzzy Hash: F731F562F0918355EE29E7A9E9047BD9A52BB457C4FA84235EE0E07386EF7CE005C364

Function 00007FF78E415970 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

longjmp.MSVCRT ref: 00007FF78E415A07
exit.MSVCRT(?,?,00000000,00000000,00007FF78E415AB5), ref: 00007FF78E415A17

Strings

fatal.nim, xrefs: 00007FF78E415A22
sysFatal, xrefs: 00007FF78E415A23

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: exitlongjmp
String ID: fatal.nim$sysFatal
API String ID: 2266059207-2644091575
Opcode ID: 46b2c20323a3814dd39974bb7dba7c9da256c0f213f5ca93764d1b22c13c85d6
Instruction ID: e853e1f4bc0960c851606a2f0892c778f1910ac33ea2c81d4357bceb0d897b48
Opcode Fuzzy Hash: 46b2c20323a3814dd39974bb7dba7c9da256c0f213f5ca93764d1b22c13c85d6
Instruction Fuzzy Hash: 98415662B15B0792EE10AB99D8887BDB3A4FB48BC4FB44536EA5C07355EF38D445C360

Function 00007FF78E412050 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78E411DB0: strlen.MSVCRT ref: 00007FF78E411DC1
Part of subcall function 00007FF78E411DB0: fwrite.MSVCRT ref: 00007FF78E411DD4

GetLastError.KERNEL32 ref: 00007FF78E4120A2
exit.MSVCRT(?,?,?,00007FF78E4322CB), ref: 00007FF78E4120CA

Strings

could not load: , xrefs: 00007FF78E412070
(bad format; library may be wrong architecture), xrefs: 00007FF78E4120D6

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: ErrorLastexitfwritestrlen
String ID: (bad format; library may be wrong architecture)$could not load:
API String ID: 671075621-2754783905
Opcode ID: 80ccbc06463d05bc2b5888fd3e508f9d5f8e55bf2f70a7f2de8dd596c3c45509
Instruction ID: d9b5be997cc9a4f7612310fe7d860138b9838117a874f2798b978e77edbd0841
Opcode Fuzzy Hash: 80ccbc06463d05bc2b5888fd3e508f9d5f8e55bf2f70a7f2de8dd596c3c45509
Instruction Fuzzy Hash: 2C011A20A0951351FE44B7E1A819BB89665BF45780FF44139FE0E47396EF3CA801C235

Function 00007FF78E411DF0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00007FF78E411E19
fflush.MSVCRT ref: 00007FF78E411E21
exit.MSVCRT(?,?,?,00007FF78E432350), ref: 00007FF78E411E2B

Strings

[GC] cannot register thread local variable; too many thread local variables, xrefs: 00007FF78E411E0C

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: exitfflushfwrite
String ID: [GC] cannot register thread local variable; too many thread local variables
API String ID: 3476253079-685140759
Opcode ID: c3f1f31466da6b0e5659f2dcc0f8f8b56ac89d22bc30fdeb04acf319fe540aed
Instruction ID: f97038bd30869c6c78a023f01e9689e6d7fc4f40e1ef21219bedba93bcb8e00e
Opcode Fuzzy Hash: c3f1f31466da6b0e5659f2dcc0f8f8b56ac89d22bc30fdeb04acf319fe540aed
Instruction Fuzzy Hash: E2E0EC20E045438AF60477D2A4157F8A660FF87B85FE05438EA1E5B392DF7EA806C365

Function 00007FF78E41A3E0 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 196COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78E413F10: memset.MSVCRT ref: 00007FF78E413FA2

Part of subcall function 00007FF78E422790: memcpy.MSVCRT ref: 00007FF78E4228EB

memcpy.MSVCRT ref: 00007FF78E41A6F3

Strings

clr.nim, xrefs: 00007FF78E41A647
CLRError, xrefs: 00007FF78E41A43D
clrError, xrefs: 00007FF78E41A64E

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: memcpy$memset
String ID: CLRError$clr.nim$clrError
API String ID: 438689982-2830349459
Opcode ID: 77f3dd17192c832a47128c647c90bb103ff66cefc69fe6e175ad23bf75e257b3
Instruction ID: 8a8196bd9ae1b4f10881c6e3fa745fe7a3ffc2f6446044f70495ded53e07f488
Opcode Fuzzy Hash: 77f3dd17192c832a47128c647c90bb103ff66cefc69fe6e175ad23bf75e257b3
Instruction Fuzzy Hash: FA91B262A18B8385EA11AB4598002BDA761FB547A4FA50231FF6D0B3D2DF7CE554D360

Function 00007FF78E41A080 Relevance: 6.1, APIs: 4, Instructions: 128memoryCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF78E41A0A1
MultiByteToWideChar.KERNEL32 ref: 00007FF78E41A139
MultiByteToWideChar.KERNEL32 ref: 00007FF78E41A19C
SysAllocString.OLEAUT32 ref: 00007FF78E41A1AD

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: ByteCharMultiWide$AllocInitializeString
String ID:
API String ID: 1889743751-0
Opcode ID: 65b687b48c692aee826a9be4b8a57595faa841ef06bbf31540a48bb328041d11
Instruction ID: 9027796017c039f925c97fd35c3d25ee1052f0696c8750305c0df39b43d09cbd
Opcode Fuzzy Hash: 65b687b48c692aee826a9be4b8a57595faa841ef06bbf31540a48bb328041d11
Instruction Fuzzy Hash: 3C516962B0AA4781EE15AF95A80437EA3A0BF44B84FF44535EE0D47395EF7CE445D360

Function 00007FF78E413170 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32 ref: 00007FF78E41327E
exit.MSVCRT ref: 00007FF78E413299

Strings

virtualFree failing!, xrefs: 00007FF78E413288

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: FreeVirtualexit
String ID: virtualFree failing!
API String ID: 1212090140-3108117800
Opcode ID: c68e12f655a03d91ba896f2f687b174e3f78ce3526b737a923ed8198372fbc25
Instruction ID: 4dbe25d93a57e4827d5891b3b2c3d607ff8c84b7c6a8a7e2ce7fc36fec180f47
Opcode Fuzzy Hash: c68e12f655a03d91ba896f2f687b174e3f78ce3526b737a923ed8198372fbc25
Instruction Fuzzy Hash: 8951CDB2B05B4680EE04EB55C458BAC73A5FB04B80FB2C235EA5D47398EF7AD984C350

Function 00007FF78E426540 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF78E42663E

Strings

Unknown error, xrefs: 00007FF78E4265DA
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF78E426634

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: a9984ae661c6ac48f04b27f6ff2a17c140177e5de2a6c16ce8aaa602cf112a1e
Instruction ID: 6d45a739406bca77e55b1c0bf29aa8e6ea982bff0b83095a6e9a7a6f54d3c9a6
Opcode Fuzzy Hash: a9984ae661c6ac48f04b27f6ff2a17c140177e5de2a6c16ce8aaa602cf112a1e
Instruction Fuzzy Hash: 5B214926A04F858AD7119FA8E8413EAB371FF59799F944622FE8C17764EF78D245C300

Function 00007FF78E42658C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF78E42663E

Strings

Argument domain error (DOMAIN), xrefs: 00007FF78E42658C
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF78E426634

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: fa2246ec60d3f2d2c8e860e0b899dddbbb1b0a01b347715d37e67942b8b6f4d3
Instruction ID: 19ab70fae6f3ada45faa9f87204a68471ea50a4906df6a92ea4f050132045ab4
Opcode Fuzzy Hash: fa2246ec60d3f2d2c8e860e0b899dddbbb1b0a01b347715d37e67942b8b6f4d3
Instruction Fuzzy Hash: DA015E26A04F858AD7019F69D8402AA7771FF4D799F544722EF8D27724DF38C145C310

Function 00007FF78E4265B3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF78E42663E

Strings

Partial loss of significance (PLOSS), xrefs: 00007FF78E4265B3
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF78E426634

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: 100d4e92daa1d8cb9e2847d07ef5ff8e49b239cca73fcd96e7544013f80db1bf
Instruction ID: 781677d5110813843ace821e37e4b524d64b24556166a680f68f73c4fc8bd08d
Opcode Fuzzy Hash: 100d4e92daa1d8cb9e2847d07ef5ff8e49b239cca73fcd96e7544013f80db1bf
Instruction Fuzzy Hash: 9B015E26A04F858AD7019F69D8402AA7771FF4D799F554722EF8D27725DF38C145C310

Function 00007FF78E426599 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF78E42663E

Strings

Argument singularity (SIGN), xrefs: 00007FF78E426599
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF78E426634

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: ff2584cf3f57ae6350a126f8e35093b32cbe0b374b796bb6d5cdb4394ffb26a0
Instruction ID: 737a6fe8d29f4238c17d2f04d70d6e8272d536b90bde8901f7bd3437ec06e659
Opcode Fuzzy Hash: ff2584cf3f57ae6350a126f8e35093b32cbe0b374b796bb6d5cdb4394ffb26a0
Instruction Fuzzy Hash: F4019E26A04F858AD7019F68D8402AA7371FF4D798F544722EF8D27728DF38C145C310

Function 00007FF78E4265A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF78E42663E

Strings

Overflow range error (OVERFLOW), xrefs: 00007FF78E4265A6
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF78E426634

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: 9e894c05ad2901ed1daa551ccda28ddea90dc3bd28c1571126fd109856676168
Instruction ID: 71816b8532b4be82482f21dbdf39c09ede487547dfe12b292252ab7af301881a
Opcode Fuzzy Hash: 9e894c05ad2901ed1daa551ccda28ddea90dc3bd28c1571126fd109856676168
Instruction Fuzzy Hash: D7015E26A04F898AD7019F69D8402AAB771FF4D799F554722EF8D27764DF38C145C310

Function 00007FF78E4265CD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF78E42663E

Strings

The result is too small to be represented (UNDERFLOW), xrefs: 00007FF78E4265CD
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF78E426634

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: 431faf95ef2588800d0d27bfca1691eee4811e92dd30b5b8fce71afe1fc2f45c
Instruction ID: 789ec758ec0d233eb4b0e85130f9f8a3f8b0b6677d95edb0325516b28e0a0be9
Opcode Fuzzy Hash: 431faf95ef2588800d0d27bfca1691eee4811e92dd30b5b8fce71afe1fc2f45c
Instruction Fuzzy Hash: F8015E26A04F858AD7019F69D8402AA7771FF4D799F554722EF8D27724DF38C145C310

Function 00007FF78E4265C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF78E42663E

Strings

Total loss of significance (TLOSS), xrefs: 00007FF78E4265C0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF78E426634

Memory Dump Source

Source File: 00000000.00000002.2954539764.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000000.00000002.2954517675.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954568050.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954590553.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954613376.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954633631.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2954693841.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: f2129813e4aca10fd5bf26985deab3776ad89d1813962d43f4c18ca8cbf0e0d2
Instruction ID: 4ecd1637e6635a752ff5c6dc24c1bca5849e86b7f094329d74bc10f006a3626d
Opcode Fuzzy Hash: f2129813e4aca10fd5bf26985deab3776ad89d1813962d43f4c18ca8cbf0e0d2
Instruction Fuzzy Hash: 1C014C26A04F858AD7019F69D8402AA7761FB4D799F554622EE8D27724DF38C185C310

Analysis Process: 66WXq58R0I.exePID: 2056, Parent PID: 6580COMMON

Execution Graph

Execution Coverage:	9.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1313
Total number of Limit Nodes:	19

Executed Functions

Function 00007FF78E41C240 Relevance: 147.9, APIs: 45, Strings: 38, Instructions: 2611memorysleepCOMMON

Download Yara Rule

APIs

RtlGetVersion.NTDLL ref: 00007FF78E41C3DE
memcpy.MSVCRT ref: 00007FF78E41C4C3

Part of subcall function 00007FF78E416670: MultiByteToWideChar.KERNEL32 ref: 00007FF78E4166C7
Part of subcall function 00007FF78E416670: MultiByteToWideChar.KERNEL32 ref: 00007FF78E41672A

Part of subcall function 00007FF78E41BB80: memcpy.MSVCRT ref: 00007FF78E41BC81
Part of subcall function 00007FF78E41BB80: memcpy.MSVCRT ref: 00007FF78E41BCA2

GetProcessHeap.KERNEL32 ref: 00007FF78E41CA71
GetProcessHeap.KERNEL32 ref: 00007FF78E41CA7A
exit.MSVCRT ref: 00007FF78E41CA96
exit.MSVCRT ref: 00007FF78E41CAC2
GetTickCount.KERNEL32 ref: 00007FF78E41CC8D
Sleep.KERNEL32 ref: 00007FF78E41CC9A
SleepEx.KERNELBASE ref: 00007FF78E41CCA0
exit.MSVCRT ref: 00007FF78E41CCB1

Strings

VirtualProtect, xrefs: 00007FF78E41C790
SetThreadContext, xrefs: 00007FF78E41C899
CreateFileA, xrefs: 00007FF78E41C9B4
Jk5, xrefs: 00007FF78E41CA55
HYk, xrefs: 00007FF78E41CAA0
ME, xrefs: 00007FF78E424A12
GetDiskFreeSpaceExA, xrefs: 00007FF78E41CC7E
Ju4J, xrefs: 00007FF78E41CE5A
GetProcessHeap, xrefs: 00007FF78E41C7D5
GetTickCount, xrefs: 00007FF78E41C98E
CloseHandle, xrefs: 00007FF78E41C8BF
GlobalMemoryStatusEx, xrefs: 00007FF78E41CC5F
com.nim, xrefs: 00007FF78E425CC8, 00007FF78E425D75, 00007FF78E425EDC
RtlInitUnicodeString, xrefs: 00007FF78E41C6EC
MultiByteToWideChar, xrefs: 00007FF78E41C949
GetFileSize, xrefs: 00007FF78E41C9DA
p, xrefs: 00007FF78E4246B8
j{t`, xrefs: 00007FF78E41C402
OpenThread, xrefs: 00007FF78E41C8E5
VariantConversionError, xrefs: 00007FF78E425C27, 00007FF78E425CF7, 00007FF78E425E5F
RtlAddVectoredExceptionHandler, xrefs: 00007FF78E41C827
LdrLoadDll, xrefs: 00007FF78E41C6BE
GetThreadContext, xrefs: 00007FF78E41C873
OpenProcess, xrefs: 00007FF78E41C7B6
* -_, xrefs: 00007FF78E41CDD2
.v>!, xrefs: 00007FF78E4243E2
WaitForSingleObject, xrefs: 00007FF78E41C92A
GetComputerNameExA, xrefs: 00007FF78E41CC40
bz, xrefs: 00007FF78E41CBE8
Sleep, xrefs: 00007FF78E41C968
JDF7, xrefs: 00007FF78E41C6FB
toVariant, xrefs: 00007FF78E425CDB, 00007FF78E425D8B, 00007FF78E425EEF
GetProcAddress, xrefs: 00007FF78E41C7FB
GetCurrentThreadId, xrefs: 00007FF78E41C90B
GetModuleHandleA, xrefs: 00007FF78E41C84D
ReadFile, xrefs: 00007FF78E41CA2E
GetCurrentProcessId, xrefs: 00007FF78E41C76A
RtlAllocateHeap, xrefs: 00007FF78E41CA08

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: exitmemcpy$ByteCharHeapMultiProcessSleepWide$CountTickVersion
String ID: * -_$.v>!$CloseHandle$CreateFileA$GetComputerNameExA$GetCurrentProcessId$GetCurrentThreadId$GetDiskFreeSpaceExA$GetFileSize$GetModuleHandleA$GetProcAddress$GetProcessHeap$GetThreadContext$GetTickCount$GlobalMemoryStatusEx$Jk5$JDF7$Ju4J$LdrLoadDll$MultiByteToWideChar$OpenProcess$OpenThread$ReadFile$RtlAddVectoredExceptionHandler$RtlAllocateHeap$RtlInitUnicodeString$SetThreadContext$Sleep$VariantConversionError$VirtualProtect$WaitForSingleObject$com.nim$j{t`$p$toVariant$bz$ME$HYk
API String ID: 4036915570-214144126
Opcode ID: 76df0a278d06ba526b916e1918ba5bcf453f18b5cb2c1e949b4a8eb49b42f0ef
Instruction ID: 1ef5c1930cbc1f022ab22dfd2806282c5d526d83febae3e63234f84c2ff3a320
Opcode Fuzzy Hash: 76df0a278d06ba526b916e1918ba5bcf453f18b5cb2c1e949b4a8eb49b42f0ef
Instruction Fuzzy Hash: 48437762A09B4781EA14FB95E8543BDA3A1FF85B84FE04436EA5D07796EF3CE404C360

Function 00007FF78E41D570 Relevance: 35.3, APIs: 16, Strings: 4, Instructions: 334
threadlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAddVectoredExceptionHandler.NTDLL ref: 00007FF78E41D5B8
memset.MSVCRT ref: 00007FF78E41D5C9
CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF78E41D62D
Thread32First.KERNEL32 ref: 00007FF78E41D697
Thread32Next.KERNEL32 ref: 00007FF78E41D6AB
GetCurrentProcessId.KERNEL32 ref: 00007FF78E41D6B3

Part of subcall function 00007FF78E41BB80: memcpy.MSVCRT ref: 00007FF78E41BC81
Part of subcall function 00007FF78E41BB80: memcpy.MSVCRT ref: 00007FF78E41BCA2

Part of subcall function 00007FF78E416670: MultiByteToWideChar.KERNEL32 ref: 00007FF78E4166C7
Part of subcall function 00007FF78E416670: MultiByteToWideChar.KERNEL32 ref: 00007FF78E41672A

CloseHandle.KERNEL32 ref: 00007FF78E41D6DE
OpenThread.KERNEL32 ref: 00007FF78E41D70C
GetThreadContext.KERNEL32 ref: 00007FF78E41D724
SetThreadContext.KERNEL32 ref: 00007FF78E41D778
CloseHandle.KERNEL32 ref: 00007FF78E41D7A1
GetModuleHandleA.KERNEL32 ref: 00007FF78E41D7E6
GetModuleHandleA.KERNEL32 ref: 00007FF78E41D9A7
GetProcAddress.KERNEL32 ref: 00007FF78E41D9FF
RtlInitUnicodeString.NTDLL ref: 00007FF78E41DA9E
LdrLoadDll.NTDLL ref: 00007FF78E41DAAE

Strings

bz, xrefs: 00007FF78E41D8B6
NrTP, xrefs: 00007FF78E41D7C1
Ju4J, xrefs: 00007FF78E41DA0C
jP~, xrefs: 00007FF78E41DA83

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: Handle$Thread$ByteCharCloseContextModuleMultiThread32Widememcpy$AddressCreateCurrentExceptionFirstHandlerInitLoadNextOpenProcProcessSnapshotStringToolhelp32UnicodeVectoredmemset
String ID: Ju4J$NrTP$jP~$bz
API String ID: 902128316-2228891234
Opcode ID: 5caa98e862dff868fa780ae6cdfbd0bf8742712e53fe9a6ecd63f3fdd6b37e3a
Instruction ID: 9d35042d8a63671415ee242223e6f18cfdc13832b3cd752cc4660fc0e75ce6cb
Opcode Fuzzy Hash: 5caa98e862dff868fa780ae6cdfbd0bf8742712e53fe9a6ecd63f3fdd6b37e3a
Instruction Fuzzy Hash: 0BE19D62A0864381EE14BB91A8143BEA3A1BF85785FF48035FA4E47799DF7CE445C360

Function 00007FF78E420460 Relevance: 19.5, APIs: 11, Strings: 1, Instructions: 1506COMMON

Download Yara Rule

Strings

@, xrefs: 00007FF78E4218F8

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: d41118d21125260021136046d49c4ddac0172a0b69c53b1cfd141be858fcfbda
Instruction ID: c6e6093a39d9eb408e204241188989728a03c3058d98e97419f0f8588e82a00a
Opcode Fuzzy Hash: d41118d21125260021136046d49c4ddac0172a0b69c53b1cfd141be858fcfbda
Instruction Fuzzy Hash: 53E2E7B2B05A4782EE54AB85C0483BDA3A6FB41BC4FE59536EA1E473D5DF78E490C310

Function 00007FF78E422CA0 Relevance: 16.4, APIs: 6, Strings: 3, Instructions: 605
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_setjmp.MSVCRT ref: 00007FF78E422D3C
_setjmp.MSVCRT ref: 00007FF78E422E3E
CLRCreateInstance.MSCOREE ref: 00007FF78E422EF5
_setjmp.MSVCRT ref: 00007FF78E422F87
_setjmp.MSVCRT ref: 00007FF78E422FEA

Strings

ntime of, xrefs: 00007FF78E423345
unable t, xrefs: 00007FF78E423331
o get ru, xrefs: 00007FF78E42333B

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: _setjmp$CreateInstance
String ID: ntime of$o get ru$unable t
API String ID: 1775370524-3332830050
Opcode ID: fbe6d5bac598c0a1259f9fdf6e2ac1c3ead579d97badba0988d49303e089c53f
Instruction ID: caa3bd1adef9f527bded4a4f227225936b387dcb533016769c28ff17f12772fe
Opcode Fuzzy Hash: fbe6d5bac598c0a1259f9fdf6e2ac1c3ead579d97badba0988d49303e089c53f
Instruction Fuzzy Hash: C4623C76B09B4791EB20AF95E4503AAB3B1FB84B84FA08132EA4D477A4DF7DD444C760

Function 00007FF78E411154 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_amsg_exit.MSVCRT ref: 00007FF78E411242
_initterm.MSVCRT ref: 00007FF78E411277
_initterm.MSVCRT ref: 00007FF78E4112AA
exit.MSVCRT ref: 00007FF78E41145D
_cexit.MSVCRT ref: 00007FF78E41146C

Strings

0, xrefs: 00007FF78E4111B0

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: _initterm$_amsg_exit_cexitexit
String ID: 0
API String ID: 602970348-4108050209
Opcode ID: c5bb0eb04c8fb6cd053ca287a568665df2e0e3d12505647d5b9f2f4fedc3075a
Instruction ID: 0d847bdbbb6a79ded6f89817690303faf4172b2a431d36d437bedef7dbc39615
Opcode Fuzzy Hash: c5bb0eb04c8fb6cd053ca287a568665df2e0e3d12505647d5b9f2f4fedc3075a
Instruction Fuzzy Hash: EEA1E866F09B1789FB50AB95E89036CB7A0BB08B88FA04035ED4D577A4DF7DE540C760

Function 00007FF78E41F6D0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 373
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00007FF78E41F7EA
ReadFile.KERNELBASE ref: 00007FF78E41F850

Strings

ME, xrefs: 00007FF78E41F914

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: File$CreateRead
String ID: ME
API String ID: 3388366904-1625691762
Opcode ID: f62ba25d732be71ec3c5ae50afd3e3164ab71c9ff0a7c9cb1df3716b1e638057
Instruction ID: e3f7379b64e0c2f845c32822f32fc7419b181ce3e26ed995d03352813738d30b
Opcode Fuzzy Hash: f62ba25d732be71ec3c5ae50afd3e3164ab71c9ff0a7c9cb1df3716b1e638057
Instruction Fuzzy Hash: 86F1CF22A0DA8285DB11DFA9E4403ADBBA1FF95B85FA98036EE8D43755DF3CD145C320

Function 00007FF78E41BF80 Relevance: 4.6, APIs: 3, Instructions: 58
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF78E41BB80: memcpy.MSVCRT ref: 00007FF78E41BC81
Part of subcall function 00007FF78E41BB80: memcpy.MSVCRT ref: 00007FF78E41BCA2

GetThreadContext.KERNEL32 ref: 00007FF78E41BFD9
SetThreadContext.KERNEL32 ref: 00007FF78E41C03A
BaseThreadInitThunk.KERNEL32 ref: 00007FF78E41C063

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: Thread$Contextmemcpy$BaseInitThunk
String ID:
API String ID: 2238238550-0
Opcode ID: c43e258c4f01fee23de003e19650e6d8b38c1bae0ff2e7acfe210e28294bdbcd
Instruction ID: 3d80403821aed1e14548ed5db10ffd234668a8a75ef1578b5206c76674e94b70
Opcode Fuzzy Hash: c43e258c4f01fee23de003e19650e6d8b38c1bae0ff2e7acfe210e28294bdbcd
Instruction Fuzzy Hash: 1721906260864795EA10AFA2F81037AA355BB89BE4FA44235ED6D877D9CF3CD044C710

Function 00000153C16D1B10 Relevance: 3.1, APIs: 2, Instructions: 132
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL ref: 00000153C16D1BA2
NtCreateSection.NTDLL ref: 00000153C16D1C02

Memory Dump Source

Source File: 00000002.00000002.2953425980.00000153C16D0000.00000020.00000400.00020000.00000000.sdmp, Offset: 00000153C16D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_153c16d0000_66WXq58R0I.jbxd

Similarity

API ID: CreateMemoryProtectSectionVirtual
String ID:
API String ID: 1366966015-0
Opcode ID: f6b47d1aec46e1e957693d9d0c8cb924439d4d7cbf412633b4b44180241d7493
Instruction ID: cc05d559bff73cd9d09bc43024f9a238ace9d79263d9d3caba7b33eef5d579ae
Opcode Fuzzy Hash: f6b47d1aec46e1e957693d9d0c8cb924439d4d7cbf412633b4b44180241d7493
Instruction Fuzzy Hash: 1031207061CF0C8FE714B67CDC456B972D4EBD9312F10072FE89AE3291EAA4D9154686

Function 00000153C16D1BA8 Relevance: 1.6, APIs: 1, Instructions: 73nativeCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL ref: 00000153C16D1C02

Memory Dump Source

Source File: 00000002.00000002.2953425980.00000153C16D0000.00000020.00000400.00020000.00000000.sdmp, Offset: 00000153C16D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_153c16d0000_66WXq58R0I.jbxd

Similarity

API ID: CreateSection
String ID:
API String ID: 2449625523-0
Opcode ID: 9e7362a58a991fd67ed60abdc4631b05ef3ffe28a9eadedd5685242ff6fa6018
Instruction ID: 1bc6c13553d500370b2751e065fc6e4cee9ae7d1ac91eae01852f01ca6d3079a
Opcode Fuzzy Hash: 9e7362a58a991fd67ed60abdc4631b05ef3ffe28a9eadedd5685242ff6fa6018
Instruction Fuzzy Hash: 3201D67170CF084FE7689A6CEC4A77973C0D7C5322F40072FE899E76D2E9A5A8124686

Function 00007FF78E42DA70 Relevance: 293.3, APIs: 4, Strings: 162, Instructions: 2775
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF78E4120F0: GetProcAddress.KERNEL32 ref: 00007FF78E41210E

Part of subcall function 00007FF78E4120F0: exit.MSVCRT ref: 00007FF78E41223F

signal.MSVCRT ref: 00007FF78E42F026
signal.MSVCRT ref: 00007FF78E42F033
signal.MSVCRT ref: 00007FF78E42F040
signal.MSVCRT ref: 00007FF78E42F053

Part of subcall function 00007FF78E41BB80: memcpy.MSVCRT ref: 00007FF78E41BC81
Part of subcall function 00007FF78E41BB80: memcpy.MSVCRT ref: 00007FF78E41BCA2

Strings

fltVal, xrefs: 00007FF78E42E55E
SysFreeString, xrefs: 00007FF78E4319D7
DispGetIDsOfNames, xrefs: 00007FF78E4319C4
zonedTimeFromAdjTimeImpl, xrefs: 00007FF78E42DCE2
GetCurrentProcess, xrefs: 00007FF78E42F41C
puintVal, xrefs: 00007FF78E42DEEC
data, xrefs: 00007FF78E431BFA
GetProcessHeap, xrefs: 00007FF78E42F380
GetTypeInfoCount, xrefs: 00007FF78E430015
coresCount, xrefs: 00007FF78E42F8EE
llVal, xrefs: 00007FF78E42E5DA
skey, xrefs: 00007FF78E42F4E3
cyVal, xrefs: 00007FF78E42E4F7
byref, xrefs: 00007FF78E42E184
wReserved1, xrefs: 00007FF78E42E656
hIntel, xrefs: 00007FF78E42F991
RecordCreate, xrefs: 00007FF78E43146D
queryUnbiasedInterruptTime, xrefs: 00007FF78E42F80F
GetModuleFileNameW, xrefs: 00007FF78E42F5D5
queryIdleProcessorCycleTime, xrefs: 00007FF78E42F8C0
UpdateProcThreadAttribute, xrefs: 00007FF78E42F3E8
pvData, xrefs: 00007FF78E42E2B6
bCryptGenRandom, xrefs: 00007FF78E42F7CA
wReserved, xrefs: 00007FF78E42E0B6
Hi32, xrefs: 00007FF78E42DFF2
pfltVal, xrefs: 00007FF78E430587
key5, xrefs: 00007FF78E431FFE
Thread32First, xrefs: 00007FF78E431B10
ppunkVal, xrefs: 00007FF78E430712
ullVal, xrefs: 00007FF78E42E10D
Field2, xrefs: 00007FF78E431B87
queryProcessCycleTime, xrefs: 00007FF78E42F7E2
:state, xrefs: 00007FF78E431E9E
pRecInfo, xrefs: 00007FF78E4317D0
pcVal, xrefs: 00007FF78E430D2B
fFeatures, xrefs: 00007FF78E42E30D
counter, xrefs: 00007FF78E42DB43
PutField, xrefs: 00007FF78E42DDFD
pbVal, xrefs: 00007FF78E43056F
tProcess1, xrefs: 00007FF78E42DBFA
GetForegroundWindow, xrefs: 00007FF78E42F489
bstrVal, xrefs: 00007FF78E42E438
Field1, xrefs: 00007FF78E42DB5B
InitializeProcThreadAttributeList, xrefs: 00007FF78E42F3CE
cDims, xrefs: 00007FF78E42E32A
SetConsoleOutputCP, xrefs: 00007FF78E42E8D5
scode, xrefs: 00007FF78E42E507
Field0, xrefs: 00007FF78E42DB7C
decVal, xrefs: 00007FF78E42DD8D
trace, xrefs: 00007FF78E42EAFC
parray, xrefs: 00007FF78E42E34F
ulVal, xrefs: 00007FF78E42E12D
filename, xrefs: 00007FF78E42E7AE
GetCurrentThread, xrefs: 00007FF78E42F31F
pscode, xrefs: 00007FF78E42E1C9
RtlGetVersion, xrefs: 00007FF78E4321B5
dblVal, xrefs: 00007FF78E42E541
parent, xrefs: 00007FF78E42E818
Invoke, xrefs: 00007FF78E430157
rgsabound, xrefs: 00007FF78E43047F
GetCommandLineW, xrefs: 00007FF78E42F5C2
wReserved2, xrefs: 00007FF78E42E634
msg, xrefs: 00007FF78E42E7F2
RecordInit, xrefs: 00007FF78E42DE4E
CreateProcessW, xrefs: 00007FF78E42F402
pparray, xrefs: 00007FF78E430794
procname, xrefs: 00007FF78E42E7D9
uiVal, xrefs: 00007FF78E42E14A
ResumeThread, xrefs: 00007FF78E42F436
SafeArrayPutElement, xrefs: 00007FF78E431A8B
pllVal, xrefs: 00007FF78E42E221
SysStringLen, xrefs: 00007FF78E42F2B9
GetIDsOfNames, xrefs: 00007FF78E430028
wReserved3, xrefs: 00007FF78E42E613
scale, xrefs: 00007FF78E42E05D
ppdispVal, xrefs: 00007FF78E430763
SysAllocString, xrefs: 00007FF78E431A57
Release, xrefs: 00007FF78E42E3CD
PutFieldNoCopy, xrefs: 00007FF78E42DDE5
Lo64, xrefs: 00007FF78E42DF88
hresult, xrefs: 00007FF78E42DBA4
Lo32, xrefs: 00007FF78E42DFC5
NtFlushInstructionCache4, xrefs: 00007FF78E431EB1
pvarVal, xrefs: 00007FF78E430875
SetConsoleCP, xrefs: 00007FF78E42E8E8
piVal, xrefs: 00007FF78E42E252
union2, xrefs: 00007FF78E430CC4
CoInitialize, xrefs: 00007FF78E431A10
SafeArrayCreate, xrefs: 00007FF78E431A71
GetFileAttributesW, xrefs: 00007FF78E4321E7
treadHandle3, xrefs: 00007FF78E42DBC5
pdblVal, xrefs: 00007FF78E42E211
GetFieldNames, xrefs: 00007FF78E43131A
line, xrefs: 00007FF78E42E7C4
HeapCreate, xrefs: 00007FF78E42F34C
sign, xrefs: 00007FF78E42E040
pbstrVal, xrefs: 00007FF78E4306D2
pulVal, xrefs: 00007FF78E42DF4B
iVal, xrefs: 00007FF78E42E57B
signscale, xrefs: 00007FF78E42E01B
HeapAlloc, xrefs: 00007FF78E42F366
pdate, xrefs: 00007FF78E42E1B1
OpenProcess, xrefs: 00007FF78E4321FA
GetFieldNoCopy, xrefs: 00007FF78E4312E5
IsMatchingType, xrefs: 00007FF78E431348
pullVal, xrefs: 00007FF78E42DF32
GetField, xrefs: 00007FF78E4312C2
IsEqualGUID, xrefs: 00007FF78E42F255
Thread32Next, xrefs: 00007FF78E431B2A
lstrlenW, xrefs: 00007FF78E42F2E6
punkVal, xrefs: 00007FF78E42E41F
VariantClear, xrefs: 00007FF78E431A23
WaitForSingleObject, xrefs: 00007FF78E42F450
bVal, xrefs: 00007FF78E42E598
name, xrefs: 00007FF78E42DCA3
dctx6, xrefs: 00007FF78E43205D
pcyVal, xrefs: 00007FF78E4306C6
GetGuid, xrefs: 00007FF78E4311DA
GetWindowThreadProcessId, xrefs: 00007FF78E42F4A3
CreateToolhelp32Snapshot, xrefs: 00007FF78E431AF6
boolVal, xrefs: 00007FF78E42E524
LoadLibraryA, xrefs: 00007FF78E42F39A
puiVal, xrefs: 00007FF78E42DF68
RecordCopy, xrefs: 00007FF78E4311B0
plVal, xrefs: 00007FF78E42E242
CLRCreateInstance, xrefs: 00007FF78E431AC4
uintVal, xrefs: 00007FF78E42E0C6
AddRef, xrefs: 00007FF78E42E3E2
lVal, xrefs: 00007FF78E42E5B5
GetTypeInfo, xrefs: 00007FF78E42DE19
QueryInterface, xrefs: 00007FF78E42FE84
raw, xrefs: 00007FF78E42DB18
remoteProcID2, xrefs: 00007FF78E42DBE5
cElements, xrefs: 00007FF78E42E299
WideCharToMultiByte, xrefs: 00007FF78E42F287
pintVal, xrefs: 00007FF78E42DF05
pvRecord, xrefs: 00007FF78E42DE92
VariantCopy, xrefs: 00007FF78E431A3D
GetSize, xrefs: 00007FF78E43124F
MultiByteToWideChar, xrefs: 00007FF78E42F2CC
cbElements, xrefs: 00007FF78E42E2F0
cVal, xrefs: 00007FF78E42E167
RecordDestroy, xrefs: 00007FF78E42DDBD
Mid32, xrefs: 00007FF78E42DF98
RecordCreateCopy, xrefs: 00007FF78E43148B
GetThreadContext, xrefs: 00007FF78E42F332
union1, xrefs: 00007FF78E42E08A
RecordClear, xrefs: 00007FF78E42DE35
cipher, xrefs: 00007FF78E432034
struct1, xrefs: 00007FF78E42DEAB
zonedTimeFromTimeImpl, xrefs: 00007FF78E42DD0B
lLbound, xrefs: 00007FF78E42E27C
pdispVal, xrefs: 00007FF78E42E398
date, xrefs: 00007FF78E42E458
pboolVal, xrefs: 00007FF78E42E1F8
GetProcAddress, xrefs: 00007FF78E42F3B4
cLocks, xrefs: 00007FF78E42E2D3
intVal, xrefs: 00007FF78E42E0E3
int64, xrefs: 00007FF78E42E475
GetName, xrefs: 00007FF78E431234
pdecVal, xrefs: 00007FF78E430D18
lpVtbl, xrefs: 00007FF78E42DE6A

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: signal$memcpy$AddressProcexit
String ID: :state$AddRef$CLRCreateInstance$CoInitialize$CreateProcessW$CreateToolhelp32Snapshot$DispGetIDsOfNames$Field0$Field1$Field2$GetCommandLineW$GetCurrentProcess$GetCurrentThread$GetField$GetFieldNames$GetFieldNoCopy$GetFileAttributesW$GetForegroundWindow$GetGuid$GetIDsOfNames$GetModuleFileNameW$GetName$GetProcAddress$GetProcessHeap$GetSize$GetThreadContext$GetTypeInfo$GetTypeInfoCount$GetWindowThreadProcessId$HeapAlloc$HeapCreate$Hi32$InitializeProcThreadAttributeList$Invoke$IsEqualGUID$IsMatchingType$Lo32$Lo64$LoadLibraryA$Mid32$MultiByteToWideChar$NtFlushInstructionCache4$OpenProcess$PutField$PutFieldNoCopy$QueryInterface$RecordClear$RecordCopy$RecordCreate$RecordCreateCopy$RecordDestroy$RecordInit$Release$ResumeThread$RtlGetVersion$SafeArrayCreate$SafeArrayPutElement$SetConsoleCP$SetConsoleOutputCP$SysAllocString$SysFreeString$SysStringLen$Thread32First$Thread32Next$UpdateProcThreadAttribute$VariantClear$VariantCopy$WaitForSingleObject$WideCharToMultiByte$bCryptGenRandom$bVal$boolVal$bstrVal$byref$cDims$cElements$cLocks$cVal$cbElements$cipher$coresCount$counter$cyVal$data$date$dblVal$dctx6$decVal$fFeatures$filename$fltVal$hIntel$hresult$iVal$int64$intVal$key5$lLbound$lVal$line$llVal$lpVtbl$lstrlenW$msg$name$pRecInfo$parent$parray$pbVal$pboolVal$pbstrVal$pcVal$pcyVal$pdate$pdblVal$pdecVal$pdispVal$pfltVal$piVal$pintVal$plVal$pllVal$pparray$ppdispVal$ppunkVal$procname$pscode$puiVal$puintVal$pulVal$pullVal$punkVal$pvData$pvRecord$pvarVal$queryIdleProcessorCycleTime$queryProcessCycleTime$queryUnbiasedInterruptTime$raw$remoteProcID2$rgsabound$scale$scode$sign$signscale$skey$struct1$tProcess1$trace$treadHandle3$uiVal$uintVal$ulVal$ullVal$union1$union2$wReserved$wReserved1$wReserved2$wReserved3$zonedTimeFromAdjTimeImpl$zonedTimeFromTimeImpl
API String ID: 1418167214-113516584
Opcode ID: 8e9a48657c1b5c700ace5fe9dc3f56d2322ee6397c0adfebe6d25ab97b2bcfb0
Instruction ID: 3404bbce0a9393c76cb188170a957fcb2babb26d0ffaca52a5c36c12668210da
Opcode Fuzzy Hash: 8e9a48657c1b5c700ace5fe9dc3f56d2322ee6397c0adfebe6d25ab97b2bcfb0
Instruction Fuzzy Hash: 0993FD21C1CA8791F712AB98A8453F5B3A0BF91344FA05335ED9C93661EF7EB249C360

Function 00007FF78E41A740 Relevance: 28.3, APIs: 8, Strings: 8, Instructions: 297
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF78E416670: MultiByteToWideChar.KERNEL32 ref: 00007FF78E4166C7
Part of subcall function 00007FF78E416670: MultiByteToWideChar.KERNEL32 ref: 00007FF78E41672A

SysAllocString.OLEAUT32 ref: 00007FF78E41A77F
_setjmp.MSVCRT ref: 00007FF78E41A7D6
CoInitialize.OLE32 ref: 00007FF78E41A8BB
SysFreeString.OLEAUT32 ref: 00007FF78E41A946
memcpy.MSVCRT ref: 00007FF78E41AA0C
CoInitialize.OLE32 ref: 00007FF78E41AA43
SafeArrayCreate.OLEAUT32 ref: 00007FF78E41AAC9
SafeArrayPutElement.OLEAUT32 ref: 00007FF78E41AAFA

Strings

r: , xrefs: 00007FF78E41A9F6
unable t, xrefs: 00007FF78E41A9B5
VariantConversionError, xrefs: 00007FF78E41AC66, 00007FF78E41ACE1
o invoke, xrefs: 00007FF78E41A97F
ed membe, xrefs: 00007FF78E41A9D1
com.nim, xrefs: 00007FF78E41ACC7
toVariant, xrefs: 00007FF78E41ACCE
specifi, xrefs: 00007FF78E41A9C3

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: ArrayByteCharInitializeMultiSafeStringWide$AllocCreateElementFree_setjmpmemcpy
String ID: specifi$VariantConversionError$com.nim$ed membe$o invoke$r: $toVariant$unable t
API String ID: 4234589578-1707675
Opcode ID: 40dd78bd37efff150318ba0ad35e508670c7ec19cf888205b5695cbcda88311e
Instruction ID: 71df4d97f6a8e9def57ca63b567ec89d3719d4a979e955175a800e59d174e616
Opcode Fuzzy Hash: 40dd78bd37efff150318ba0ad35e508670c7ec19cf888205b5695cbcda88311e
Instruction Fuzzy Hash: 52F12C32A09B8781EA20AF95F4443AEF3A4FB84B84FA44135EA8D47755EF7CE444C760

Function 00007FF78E418C30 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 190
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fileno.MSVCRT ref: 00007FF78E418C4D
_setmode.MSVCRT ref: 00007FF78E418C5E
_fileno.MSVCRT ref: 00007FF78E418C6A
_setmode.MSVCRT ref: 00007FF78E418C74
_fileno.MSVCRT ref: 00007FF78E418C80
_setmode.MSVCRT ref: 00007FF78E418C8A
SetConsoleOutputCP.KERNEL32 ref: 00007FF78E418C91
SetConsoleCP.KERNEL32 ref: 00007FF78E418C9C
LoadLibraryA.KERNEL32 ref: 00007FF78E418CA9
GetProcAddress.KERNEL32 ref: 00007FF78E418CBE
CoInitialize.OLE32 ref: 00007FF78E418E5B

Strings

inet_ntop, xrefs: 00007FF78E418CB7
Ws2_32.dll, xrefs: 00007FF78E418CA2

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: _fileno_setmode$Console$AddressInitializeLibraryLoadOutputProc
String ID: Ws2_32.dll$inet_ntop
API String ID: 1755878316-2739477577
Opcode ID: 6b7b38b38fdb6f2231155c0515883c19ac27669e06fffbb159bd7b89048bd062
Instruction ID: ae7a87e26f65640ece2079322184d3dad90682ca32970feabf52e60368fa149d
Opcode Fuzzy Hash: 6b7b38b38fdb6f2231155c0515883c19ac27669e06fffbb159bd7b89048bd062
Instruction Fuzzy Hash: 38912472A19B5781EA14AB94E81437CE3A1FB89B44FF44436EA9D433A4DF7CE459C320

Function 00007FF78E412260 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF78E411DB0: strlen.MSVCRT ref: 00007FF78E411DC1
Part of subcall function 00007FF78E411DB0: fwrite.MSVCRT ref: 00007FF78E411DD4

exit.MSVCRT(?,?,?,?,00007FF78E412365,?,?,?,?,00007FF78E456128,?,3F000000,00000153C1849060,00007FF78E412D1D), ref: 00007FF78E412283
VirtualAlloc.KERNEL32 ref: 00007FF78E412313
VirtualAlloc.KERNEL32 ref: 00007FF78E4123CD

Strings

out of memory, xrefs: 00007FF78E41226F

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: AllocVirtual$exitfwritestrlen
String ID: out of memory
API String ID: 4248889879-49810860
Opcode ID: 0516ab19841267af8d97caf5014a6074e881b3db8c10cd40e0e435bc0d2a0d95
Instruction ID: bbdc45ba930872c8b4d8c6dae6ba02efce478e6a3097a76b41102ad0eaa7d612
Opcode Fuzzy Hash: 0516ab19841267af8d97caf5014a6074e881b3db8c10cd40e0e435bc0d2a0d95
Instruction Fuzzy Hash: D4216D32B05B8682EB145B69E5483ADA3A0F708BE0FA48235DB6D473D2DF3DE454D314

Function 00007FFD9B8905E4 Relevance: 5.3, Strings: 4, Instructions: 308
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

K^], xrefs: 00007FFD9B890694
N_^, xrefs: 00007FFD9B8906C9
N_^, xrefs: 00007FFD9B89077A
N_^, xrefs: 00007FFD9B890772

Memory Dump Source

Source File: 00000002.00000002.2956849577.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b890000_66WXq58R0I.jbxd

Similarity

API ID:
String ID: K^]$N_^$N_^$N_^
API String ID: 0-1679923151
Opcode ID: 981b3109eff993e2ea14ff384ffcae5723bddec8376c34123f6c81e1d1eefc5e
Instruction ID: 9eae7f2ba71069c09890e5672e5cb693e5f3d4c326b36657eb601148aac16418
Opcode Fuzzy Hash: 981b3109eff993e2ea14ff384ffcae5723bddec8376c34123f6c81e1d1eefc5e
Instruction Fuzzy Hash: 64A10553A1F6D55FEB2667A86C790E83FA0EF5175471900FBC0D88B0E7E91865068382

Function 00007FFD9B8905D7 Relevance: 5.3, Strings: 4, Instructions: 297
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

K^], xrefs: 00007FFD9B890694
N_^, xrefs: 00007FFD9B8906C9
N_^, xrefs: 00007FFD9B89077A
N_^, xrefs: 00007FFD9B890772

Memory Dump Source

Source File: 00000002.00000002.2956849577.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b890000_66WXq58R0I.jbxd

Similarity

API ID:
String ID: K^]$N_^$N_^$N_^
API String ID: 0-1679923151
Opcode ID: 0d71c3bba0a7ce75b40000f5fbd3640c19668965e86863348e09a27d10381d85
Instruction ID: 3b558e81b22d6d223ab8d593bebc32a28ead80bd3009202853d9967996847c5b
Opcode Fuzzy Hash: 0d71c3bba0a7ce75b40000f5fbd3640c19668965e86863348e09a27d10381d85
Instruction Fuzzy Hash: 77914763B1F6D55FE72667A86C790E83F90EF5175470900FBD1E88B0E3ED18650A8382

Function 00007FFD9B89064D Relevance: 5.3, Strings: 4, Instructions: 271
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

K^], xrefs: 00007FFD9B890694
N_^, xrefs: 00007FFD9B8906C9
N_^, xrefs: 00007FFD9B89077A
N_^, xrefs: 00007FFD9B890772

Memory Dump Source

Source File: 00000002.00000002.2956849577.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b890000_66WXq58R0I.jbxd

Similarity

API ID:
String ID: K^]$N_^$N_^$N_^
API String ID: 0-1679923151
Opcode ID: 7b07f58f80d32fab2ae5140cc2eaaabbb37baa8960157d4cc9f55ae53732ba30
Instruction ID: 804ba4e728aa4b96e47c1c21fb0f0f491c3f864c6e800daeea1ea9c7eca4aa57
Opcode Fuzzy Hash: 7b07f58f80d32fab2ae5140cc2eaaabbb37baa8960157d4cc9f55ae53732ba30
Instruction Fuzzy Hash: BB813663B1F6D55FE72767A86C790E97FA0EF4175470900FBD0E88B0A3ED18650A8382

Function 00007FF78E412290 Relevance: 3.9, APIs: 3, Instructions: 153
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 00007FF78E412313
VirtualAlloc.KERNEL32 ref: 00007FF78E4123CD

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 727153abf217048879292d18050c8b28e4688193c53aaa6d340e0ed37de13772
Instruction ID: efa2f8cbad1ef8a1aadcc15285b09cb84732419566e7467ee8e6e0c179a3d496
Opcode Fuzzy Hash: 727153abf217048879292d18050c8b28e4688193c53aaa6d340e0ed37de13772
Instruction Fuzzy Hash: E4517F32705B8681EF149B6AE4583ADA6A1FB48BC4FA48135EE4D4B3C5EF3CE085D314

Function 00007FF78E41BB80 Relevance: 3.9, APIs: 3, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT ref: 00007FF78E41BC81
memcpy.MSVCRT ref: 00007FF78E41BCA2
memcpy.MSVCRT ref: 00007FF78E41BD8F

Part of subcall function 00007FF78E413F10: memset.MSVCRT ref: 00007FF78E413FA2

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: memcpy$memset
String ID:
API String ID: 438689982-0
Opcode ID: 47af80f8d585bb8eaf351b5b245895dcb42a4c0a20f3c9c2433354ba6dfa0c1d
Instruction ID: b2eaa3a46cf2ffbd5d0a4b7cb65518a272ce3143f2e7e83a72c2d02a6359c7bc
Opcode Fuzzy Hash: 47af80f8d585bb8eaf351b5b245895dcb42a4c0a20f3c9c2433354ba6dfa0c1d
Instruction Fuzzy Hash: B5517E72609B86D1EE10EF85E4403ADB7A4FB84B84FA58536EA8C47795EF3CD508C350

Function 00007FF78E412370 Relevance: 2.6, APIs: 2, Instructions: 149memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FF78E4123CD

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a86c5dc9920d05f400155eb031ff4e8cb55972a930c6a7583547e339d0d6e71f
Instruction ID: cec50de362983cd66bea837deba0187e2400aa18f861d0fc8251ebbc48e55adb
Opcode Fuzzy Hash: a86c5dc9920d05f400155eb031ff4e8cb55972a930c6a7583547e339d0d6e71f
Instruction Fuzzy Hash: FB515D72706B8681EE15AB56D8583AD63A1FB54FC4FA88536EE0D4B388FF38E041D314

Function 00007FFD9B891AC8 Relevance: 2.6, Strings: 2, Instructions: 92COMMON

Download Yara Rule

Strings

N_H, xrefs: 00007FFD9B891B70
,N_, xrefs: 00007FFD9B891B04

Memory Dump Source

Source File: 00000002.00000002.2956849577.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b890000_66WXq58R0I.jbxd

Similarity

API ID:
String ID: N_H$,N_
API String ID: 0-1881918159
Opcode ID: 55f521dc49053408206c1555f62a9709207f1b72bd3aa2ac80349650e189e6d0
Instruction ID: 08a734bc073b4db8baabf071b8e2483fde53c925097546787def53e3d1e1b99f
Opcode Fuzzy Hash: 55f521dc49053408206c1555f62a9709207f1b72bd3aa2ac80349650e189e6d0
Instruction Fuzzy Hash: 4A21D762F2EF494BDB6CA7785465575B6D1EFA834074441BAE05BC31EBFC28E9024341

Function 00007FF78E41ADB0 Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

APIs

_setjmp.MSVCRT ref: 00007FF78E41AE48

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: _setjmp
String ID:
API String ID: 3051281561-0
Opcode ID: 11c62ada9a8221c4bbbbc44d46ea302a526bbffaa33909e8a56b8878bd430247
Instruction ID: c44a39f091776f29f5396179b411dab1fbf5f76f6b04100c0d2c7fd1c34942cf
Opcode Fuzzy Hash: 11c62ada9a8221c4bbbbc44d46ea302a526bbffaa33909e8a56b8878bd430247
Instruction Fuzzy Hash: 81711C36609B86C5EB61EB55E4403AEB7A0FB88B84FA04136EA8D43768DF7DD444CB50

Function 00007FF78E41DDD0 Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00007FF78E41DE5A

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 6591676397270a4e3217357eda89af4b9744021b9baa0fe6884c5ea28a42c5a8
Instruction ID: a1ce1fc66c5e92602c1a67a97e589ce9d15867b426e29f1eeef5797d8fb3f65e
Opcode Fuzzy Hash: 6591676397270a4e3217357eda89af4b9744021b9baa0fe6884c5ea28a42c5a8
Instruction Fuzzy Hash: E4318CA3B04B5681EF18AF5AC48866D6765FB54B99FA64132EE2C033D0DF39D881C350

Function 00007FF78E41E630 Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

_setjmp.MSVCRT ref: 00007FF78E41E69E

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: _setjmp
String ID:
API String ID: 3051281561-0
Opcode ID: 0985e1f2feb46b6cf15dadd3a91707ceedb4e0726fb7f37f1a927fe6a31959d7
Instruction ID: 770d48b6ca13092f6c6b30002ff2e5e7bf6071e25327d33bc332ee60c6106759
Opcode Fuzzy Hash: 0985e1f2feb46b6cf15dadd3a91707ceedb4e0726fb7f37f1a927fe6a31959d7
Instruction Fuzzy Hash: 3F41E07A609F8780EB65AB55E0543AEB3A1FB84B84FA08036EE9D47754DF3CD045C750

Function 00007FFD9B8905A5 Relevance: 1.5, Strings: 1, Instructions: 284COMMON

Download Yara Rule

Strings

Z, xrefs: 00007FFD9B89442E

Memory Dump Source

Source File: 00000002.00000002.2956849577.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b890000_66WXq58R0I.jbxd

Similarity

API ID:
String ID: Z
API String ID: 0-1505515367
Opcode ID: d7fb815c03b26ab561ef70f1b47ff6446063583d243e95421a91a2cb188588d1
Instruction ID: 3d1d50c73bf31908616d2a3df448022f816ea274751ea23e93d379c28f2131dc
Opcode Fuzzy Hash: d7fb815c03b26ab561ef70f1b47ff6446063583d243e95421a91a2cb188588d1
Instruction Fuzzy Hash: A0711A61B1E9491FE76867BC286A6B97BC1DF89720B1942FEE44DC32DBDC1C6C024281

Function 00007FFD9B8908D9 Relevance: 1.4, Strings: 1, Instructions: 199COMMON

Download Yara Rule

Strings

5N_H, xrefs: 00007FFD9B890972

Memory Dump Source

Source File: 00000002.00000002.2956849577.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b890000_66WXq58R0I.jbxd

Similarity

API ID:
String ID: 5N_H
API String ID: 0-3650223996
Opcode ID: 24fc7132ebc8583fabe3854f3f904bcd1fc99e5d30954e5d455ef76c8482345f
Instruction ID: 552ec588c404c3f9729f6dcc53ed706ae86664d06d1d3970f46f88c097205a74
Opcode Fuzzy Hash: 24fc7132ebc8583fabe3854f3f904bcd1fc99e5d30954e5d455ef76c8482345f
Instruction Fuzzy Hash: 2751C571B19E4D4FDF98EF6888A4AA977E1FF6830070505BAD41DC7296DE34EC028740

Function 00007FF78E412EA0 Relevance: 1.4, APIs: 1, Instructions: 161memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FF78E412FB1

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f2edbc15cdf84d54289b1ee0bea3483cdf8f1befdda1efe5bcdab0cd9a36917b
Instruction ID: 841d8a4e56efba2a20908af527caa53683d1a7d78ea7bae205ba7dc56b416f6b
Opcode Fuzzy Hash: f2edbc15cdf84d54289b1ee0bea3483cdf8f1befdda1efe5bcdab0cd9a36917b
Instruction Fuzzy Hash: 6761DF62A05B8290EE15AF59D4043ADA3A0FF04B84FB88239EE5D47794EF38E5D0D320

Function 00007FF78E416370 Relevance: 1.4, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF78E416435

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 233dc74edd6d16f76b361879b0056e042be489a83ed074eb344440320959ce30
Instruction ID: 25ca94b73cc140557d0e13f2d3156785a2c6574e5c5fb57972430ae4b21a12c7
Opcode Fuzzy Hash: 233dc74edd6d16f76b361879b0056e042be489a83ed074eb344440320959ce30
Instruction Fuzzy Hash: 75414EB6604F4690EE00EF96D5402BCB365FB48B94FE04672EA2D83791DF38E495C360

Function 00007FF78E413F10 Relevance: 1.3, APIs: 1, Instructions: 91COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF78E413FA2

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8b02143593e92ac2916d54e6260cb3ac124fb366926f2417c8424ac6dc95cb66
Instruction ID: 5ce4dc47f646ee33e25e52102a50ab4fc41f0187592ab00e67a9974fab4ef264
Opcode Fuzzy Hash: 8b02143593e92ac2916d54e6260cb3ac124fb366926f2417c8424ac6dc95cb66
Instruction Fuzzy Hash: B5410DA6A08B87A0EA10EF95D4502BCB374F748BA4FE54277EA2D43790DF38D495C360

Function 00007FFD9B890508 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

N_H, xrefs: 00007FFD9B891B70

Memory Dump Source

Source File: 00000002.00000002.2956849577.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b890000_66WXq58R0I.jbxd

Similarity

API ID:
String ID: N_H
API String ID: 0-1668069477
Opcode ID: 83217b59779640013bd42a6f5a5d3f3a8dc5a5467019e38d199077c3d10989f5
Instruction ID: 79fe78468e4a6309136e1ad97b5877300e89996629cd428c38e74ceb497afc1d
Opcode Fuzzy Hash: 83217b59779640013bd42a6f5a5d3f3a8dc5a5467019e38d199077c3d10989f5
Instruction Fuzzy Hash: D6119831F29E094BDB6CB77454659B6B2D1EF68344B4044B9D01FC31DAFC39E4424341

Function 00007FFD9B89454D Relevance: 1.3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

Strings

#@, xrefs: 00007FFD9B89458F

Memory Dump Source

Source File: 00000002.00000002.2956849577.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b890000_66WXq58R0I.jbxd

Similarity

API ID:
String ID: #@
API String ID: 0-742695533
Opcode ID: 25a251a0bb0606a923219f2a18edb3393cd47a0ebdc5ba3b9e9a2ccdb8e79f44
Instruction ID: 10c56cb25f84646c407bde072f5bc52f0acfae2cef191ec8be733126115ea2ad
Opcode Fuzzy Hash: 25a251a0bb0606a923219f2a18edb3393cd47a0ebdc5ba3b9e9a2ccdb8e79f44
Instruction Fuzzy Hash: 58F0597180E28C6FDF21DBB848164E97FB0FF05310B0442DBE418D7062D528A6458742

Function 00007FFD9B8905D0 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

#@, xrefs: 00007FFD9B89458F

Memory Dump Source

Source File: 00000002.00000002.2956849577.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b890000_66WXq58R0I.jbxd

Similarity

API ID:
String ID: #@
API String ID: 0-742695533
Opcode ID: a72add07acd7c17cbb4b15244cca5a697043826b81d75447ae7c9d11cec6a295
Instruction ID: ff2f79abf4fd4e28af4ae2a751007fc0e4a12497175ea8fa29af8ae3955db757
Opcode Fuzzy Hash: a72add07acd7c17cbb4b15244cca5a697043826b81d75447ae7c9d11cec6a295
Instruction Fuzzy Hash: D8E0DF3081AA4C6FDF51EBB488054EEBFA4FF04204F0045AAE42DE3011D638A6448B42

Function 00007FFD9B891378 Relevance: .9, Instructions: 870COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2956849577.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b890000_66WXq58R0I.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c3c3cb499cfe8f098a9155befefa5856a92ae4b4e0f3e3b69fc6433ec0d348f
Instruction ID: 8f8a74470568e2413350fe160440462710bec8f3695f9d9d3e18ea527cf5528b
Opcode Fuzzy Hash: 4c3c3cb499cfe8f098a9155befefa5856a92ae4b4e0f3e3b69fc6433ec0d348f
Instruction Fuzzy Hash: 1E42D331B1DA4E4FEB6CDF9894656B97BE1FF98300B11017AD44EC32A6DE24F9428781

Function 00007FFD9B894172 Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2956849577.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b890000_66WXq58R0I.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69a48e89cbad6328bad03512f330dceb84ad35845881e8191c7862e36bbc1e2e
Instruction ID: d6e56265fce78d5924087e706eb4a085635ea256bf5ae40bc5a0b7b1562df00b
Opcode Fuzzy Hash: 69a48e89cbad6328bad03512f330dceb84ad35845881e8191c7862e36bbc1e2e
Instruction Fuzzy Hash: A8813961B1EA891FF769A7BC1C665B97BC1DF89620B1941FEE449C31DBDC1C6C028382

Function 00007FFD9B894E90 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2956849577.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b890000_66WXq58R0I.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6956c2f9412f0c4701d465acc6e5b75caa7ee3d90233fd619f548f6ee04a03af
Instruction ID: 6c70c06da27c7faf48d395edfc219e8f6fe7c22e72288f1ef3c3bee9a5e6f0b8
Opcode Fuzzy Hash: 6956c2f9412f0c4701d465acc6e5b75caa7ee3d90233fd619f548f6ee04a03af
Instruction Fuzzy Hash: B6A10630A09A8D4FEB95EF78C425AE97BE0FF59314B0404FDD45ACB2E2DA28AC05C740

Function 00007FFD9B891E9D Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2956849577.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b890000_66WXq58R0I.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b63bdd4684716adda0d4666eca53dfe767f879abf669c217249c8de8377f3227
Instruction ID: cc21229fde784b59ae6f4bab0fc06f09c73f1c751f0a1e93651f4a2ceee9ddaa
Opcode Fuzzy Hash: b63bdd4684716adda0d4666eca53dfe767f879abf669c217249c8de8377f3227
Instruction Fuzzy Hash: FE61E863F0F7DA1FE762AB695C754943FA0EF5722470A02FBC488CB0A3ED1959068355

Function 00007FFD9B894AF2 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2956849577.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b890000_66WXq58R0I.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6af3d45b565703bd174622b68af37553fa045373f62d555b2e358f1b136e87ae
Instruction ID: 35b97e2db146a73c9db30def31150b85938efc2ffebb5c26720ec66e590d0805
Opcode Fuzzy Hash: 6af3d45b565703bd174622b68af37553fa045373f62d555b2e358f1b136e87ae
Instruction Fuzzy Hash: 1F213717B1B52E0BE635B3ADB8B15E8BF80DFC6133B1503BBC204D7092DC4A144B82A4

Function 00007FFD9B894626 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2956849577.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b890000_66WXq58R0I.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e00ade8d36df4b2f3375ae0536e5c02078f3a7e30a93f190510ef5220aa3133a
Instruction ID: c866bf7fc77c8ce3fcd94812cb2fce61a1522460d0cc16cd81e3fbe2f604ff77
Opcode Fuzzy Hash: e00ade8d36df4b2f3375ae0536e5c02078f3a7e30a93f190510ef5220aa3133a
Instruction Fuzzy Hash: FD31C561B0994D4FEFA5FBB884296FD7BE1EF49355B0504FAE44DC71A3DE2899008381

Function 00007FFD9B892265 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2956849577.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b890000_66WXq58R0I.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f18a85f92760fdafb6359c4a5b481245b96f57fbbe29f56064e337e75096cc1d
Instruction ID: 47d6d9ef4c0411e5ef9e923cc64b7c13731e372f797217790a9ba026a631261c
Opcode Fuzzy Hash: f18a85f92760fdafb6359c4a5b481245b96f57fbbe29f56064e337e75096cc1d
Instruction Fuzzy Hash: EE313A21B0EB890FEB599BB844655797FD1EF99290B4900BEE08EC72E7DD1C99438341

Function 00007FFD9B894BD5 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2956849577.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b890000_66WXq58R0I.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 309246325ea9c84349279e8c7939cbcb8e509be269fe13b77132d1e05832d358
Instruction ID: e7ea728f68f845b79b440765cda1864de5c772ca479cb20b937444bdabcd4489
Opcode Fuzzy Hash: 309246325ea9c84349279e8c7939cbcb8e509be269fe13b77132d1e05832d358
Instruction Fuzzy Hash: 57010851B1F64A4BEB7567A408766B93F809F4A221F4A41FDC409CB2E3DC0D29478256

Function 00007FFD9B891101 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2956849577.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b890000_66WXq58R0I.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c34249108ab9ea9fbfb1650259b00dd903c824235d8568c777178d04a71700a1
Instruction ID: e555721dc022a1f17f48529a3a9bf6b6faf7cd9276b8ced5487498b6bc7e56d2
Opcode Fuzzy Hash: c34249108ab9ea9fbfb1650259b00dd903c824235d8568c777178d04a71700a1
Instruction Fuzzy Hash: AF112B2194E6CD1FDB4297A08C689E9BFE0DF8B200F0901F7E088C71A3DC6C59468351

Function 00007FFD9B890A90 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2956849577.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b890000_66WXq58R0I.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 897a7ed43c93749b57a7e4e4b6771efb9712d40ca6baa9f350a1a15adce850fe
Instruction ID: a0d1c4d650b3dc6206452c231b46926c73d3fe87d79bbb92d0e81d5e9496ae3e
Opcode Fuzzy Hash: 897a7ed43c93749b57a7e4e4b6771efb9712d40ca6baa9f350a1a15adce850fe
Instruction Fuzzy Hash: 25F09035B15A0E8FDBA8DF68C491AB673D2FF98308B620478D01DC3195CE35E8428780

Function 00007FFD9B8910BB Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2956849577.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b890000_66WXq58R0I.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d1faff235b80f88e12d398f7a0030b229419da520a85662d5e118f6ec50f4c0
Instruction ID: 3a7b295cc054285c9cac71ccdade7b0de4ecebcf50f24ca6365f7238301f60a1
Opcode Fuzzy Hash: 6d1faff235b80f88e12d398f7a0030b229419da520a85662d5e118f6ec50f4c0
Instruction Fuzzy Hash: D8F0ED3061160C8FD748EF68C844A9537A0FF09308F5000AAE80CC7392DA3AE9E1CB81

Function 00007FFD9B894710 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2956849577.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b890000_66WXq58R0I.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b65be6e4c9ad10a2b7cc1c74d958da3caa69f7c0a7cafbf2e4337f4d75a14743
Instruction ID: 87f4dbd7f201d646158bf5edf37d6d4006da01e568c93a52dc8ff6ee93b21881
Opcode Fuzzy Hash: b65be6e4c9ad10a2b7cc1c74d958da3caa69f7c0a7cafbf2e4337f4d75a14743
Instruction Fuzzy Hash: 44E0263195EA5D9BCF64AB98BC102E57BA5FF4D308F05056EE05CC31A1E7365A90C741

Function 00007FFD9B895160 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2956849577.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b890000_66WXq58R0I.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95c6bbff73cb9be06479fc33827f9d00d78ccf679ef85903d7d62c5a9129f58e
Instruction ID: e039d595f7baaba64c953c70fc194d8b398e427f181d78e1058c186771f07b17
Opcode Fuzzy Hash: 95c6bbff73cb9be06479fc33827f9d00d78ccf679ef85903d7d62c5a9129f58e
Instruction Fuzzy Hash: DDB01204E5680A01C90C31B60C9206830919B89004FC404209818C01CDE84D18944342

Function 00007FFD9B894C50 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2956849577.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b890000_66WXq58R0I.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2dfd365486cc3850c98de051ec8f31c9fc1fb72c22ff7c69fd3432053135f94
Instruction ID: 84dddcbb82b4e708f684993eef82a79956ccc3942a655eafa85bb13305133723
Opcode Fuzzy Hash: d2dfd365486cc3850c98de051ec8f31c9fc1fb72c22ff7c69fd3432053135f94
Instruction Fuzzy Hash: 62B01211C2903912EB047BC8BD534F833508B843D1B420469EC098D193D81D53E251A5

Non-executed Functions

Function 00007FF78E4199F0 Relevance: 31.9, APIs: 10, Strings: 8, Instructions: 373COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32 ref: 00007FF78E419ABC
SysFreeString.OLEAUT32 ref: 00007FF78E419ADC
CoInitialize.OLE32 ref: 00007FF78E419B18
VariantCopy.OLEAUT32 ref: 00007FF78E419B65
_setjmp.MSVCRT ref: 00007FF78E419C04

Strings

ion insi, xrefs: 00007FF78E419F24
d except, xrefs: 00007FF78E419F05
newVariant, xrefs: 00007FF78E419D4B
hander:, xrefs: 00007FF78E419F16
VariantConversionError, xrefs: 00007FF78E419CE4, 00007FF78E419D5E
uncatche, xrefs: 00007FF78E419EFB
com.nim, xrefs: 00007FF78E419D44
de event, xrefs: 00007FF78E419F32

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: String$CopyFreeInitializeVariant_setjmp
String ID: hander:$VariantConversionError$com.nim$d except$de event$ion insi$newVariant$uncatche
API String ID: 1008739868-602244300
Opcode ID: 11ce26baa4aa0d701453141a9494270b61a522db57f4edc48ce201d80866295f
Instruction ID: 2ba8fb2addd619392d8cffb5ec1eeca72bfb0cd129fed75f66ac4dfbc90f260f
Opcode Fuzzy Hash: 11ce26baa4aa0d701453141a9494270b61a522db57f4edc48ce201d80866295f
Instruction Fuzzy Hash: E8025B72A09B4781EE10AF95E4443BEB7A0FB84B84FA44436EA4D477A5EF3CE544C360

Function 00007FF78E4183F0 Relevance: 31.7, APIs: 3, Strings: 15, Instructions: 224COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 00007FF78E418412

Strings

pty, xrefs: 00007FF78E418557
er is em, xrefs: 00007FF78E418545
index ou, xrefs: 00007FF78E41850E
IndexDefect, xrefs: 00007FF78E4184C7
t of bou, xrefs: 00007FF78E418504
contain, xrefs: 00007FF78E418529
nds, the, xrefs: 00007FF78E418537
not in , xrefs: 00007FF78E418734
0 .., xrefs: 00007FF78E41868B
not in , xrefs: 00007FF78E418672
inde, xrefs: 00007FF78E4187A7
not in , xrefs: 00007FF78E418776
paramStr, xrefs: 00007FF78E4185A4
os.nim, xrefs: 00007FF78E41858E
0 .., xrefs: 00007FF78E4187B7

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: CommandLine
String ID: contain$ not in $ not in $ not in $0 ..$0 ..$IndexDefect$er is em$inde$index ou$nds, the$os.nim$paramStr$pty$t of bou
API String ID: 3253501508-475797482
Opcode ID: ae8af6ebdb65100db110cd49cbf6243cfd4987e597e8c8f6b34ff7532a8fb47d
Instruction ID: a6bcfb1466f2dab1c76cb7ffc9b2556ec278cf85d7f1c6f7d6a478a0d9093e82
Opcode Fuzzy Hash: ae8af6ebdb65100db110cd49cbf6243cfd4987e597e8c8f6b34ff7532a8fb47d
Instruction Fuzzy Hash: 98A19832A09B4381EB10AF95E54436DB7A4FF48B84FA58036EA5D07395EF3CE555C3A0

Function 00007FF78E415110 Relevance: 27.5, APIs: 8, Strings: 10, Instructions: 466stringCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF78E4151DB
strlen.MSVCRT ref: 00007FF78E41521E

Strings

ReraiseDefect, xrefs: 00007FF78E415114
nhandled, xrefs: 00007FF78E41518B
fatal.nim, xrefs: 00007FF78E415119
[[rerais, xrefs: 00007FF78E415778
excepti, xrefs: 00007FF78E415170
on: , xrefs: 00007FF78E41517A
ed from:, xrefs: 00007FF78E415782
sysFatal, xrefs: 00007FF78E41511A
]], xrefs: 00007FF78E415758
Error: u, xrefs: 00007FF78E415181

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: memcpystrlen
String ID: excepti$Error: u$ReraiseDefect$[[rerais$]]$ed from:$fatal.nim$nhandled$on: $sysFatal
API String ID: 3412268980-331123295
Opcode ID: 8f4dde3022c81423b768480ceda97c10880ad535dc9c362d3ef7fb7deb79978a
Instruction ID: 3d92837f47a596a548beb0c9ec962529e091b0e91b485dec1d6c9230f5e06b1f
Opcode Fuzzy Hash: 8f4dde3022c81423b768480ceda97c10880ad535dc9c362d3ef7fb7deb79978a
Instruction Fuzzy Hash: C622BA72A08B8381EE10AB85E4047AEA7A5FB45B94FF48136EE5C07795EF3CE444C760

Function 00007FF78E419280 Relevance: 16.7, APIs: 3, Strings: 8, Instructions: 193COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF78E4194E4
memcpy.MSVCRT ref: 00007FF78E419526

Strings

VT_BYREF, xrefs: 00007FF78E419398
H, xrefs: 00007FF78E4192FD
VT_ARRAY, xrefs: 00007FF78E4195A0
VT_RESER, xrefs: 00007FF78E419428
VT_ARRAY, xrefs: 00007FF78E4194BA
VED|, xrefs: 00007FF78E419445
VT_VECTO, xrefs: 00007FF78E4193D0
VT_ARRAY, xrefs: 00007FF78E4192CD

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: memcpy
String ID: H$VED|$VT_ARRAY$VT_ARRAY$VT_ARRAY$VT_BYREF$VT_RESER$VT_VECTO
API String ID: 3510742995-1705348919
Opcode ID: 337739e223be188f628012b87c5b85072a9b5b8a4ef4e15056e466ec34cbc926
Instruction ID: 0394d53ea68b9e01ecad5f1f473c053b6488cee964b29edc2f0c097a8636dee7
Opcode Fuzzy Hash: 337739e223be188f628012b87c5b85072a9b5b8a4ef4e15056e466ec34cbc926
Instruction Fuzzy Hash: FC816972A08B4685EA10AB55E4443ADA3A4FB54BC4FE98536EF4D073A1EF7CE444C360

Function 00007FF78E422790 Relevance: 16.7, APIs: 2, Strings: 9, Instructions: 167COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF78E4228EB
memcpy.MSVCRT ref: 00007FF78E4229AB

Strings

format s, xrefs: 00007FF78E42288F
invalid , xrefs: 00007FF78E422885
ValueError, xrefs: 00007FF78E42281B
strformat.nim, xrefs: 00007FF78E422931
annot pa, xrefs: 00007FF78E4228AE
CLRError, xrefs: 00007FF78E422796
parseStandardFormatSpecifier, xrefs: 00007FF78E422947
rse:, xrefs: 00007FF78E4228CC
tring, c, xrefs: 00007FF78E4228A0

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: memcpy
String ID: CLRError$ValueError$annot pa$format s$invalid $parseStandardFormatSpecifier$rse:$strformat.nim$tring, c
API String ID: 3510742995-153200016
Opcode ID: 216522f65f7b7ecf525798e0b75d0ca7fecc0448bf14dbf4ae37d6973f2ee7d0
Instruction ID: 6efe1864fa7a6a074c78c5a4dc3df341d8e96e85da45b4b7a1325c97eea4e09a
Opcode Fuzzy Hash: 216522f65f7b7ecf525798e0b75d0ca7fecc0448bf14dbf4ae37d6973f2ee7d0
Instruction Fuzzy Hash: 33716C72B09B4381EB10EF95E9443ADA3A0FB45B94FA48536EA9C0B785EF7CD154C360

Function 00007FF78E41D1F0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 187COMMON

Download Yara Rule

APIs

_setjmp.MSVCRT ref: 00007FF78E41D227
memcpy.MSVCRT ref: 00007FF78E41D422

Strings

invalid , xrefs: 00007FF78E41D3DF
parseInt, xrefs: 00007FF78E41D479
strutils.nim, xrefs: 00007FF78E41D472
ValueError, xrefs: 00007FF78E41D383, 00007FF78E41D48C
gfffffff, xrefs: 00007FF78E41D298
integer:, xrefs: 00007FF78E41D3C5

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: _setjmpmemcpy
String ID: ValueError$gfffffff$integer:$invalid $parseInt$strutils.nim
API String ID: 2721286225-831327929
Opcode ID: d42cb93ac16e04f855ba17adc5a1d2855ebe73bfd532347f31365ef0ddec713f
Instruction ID: 08f521a08165ef2b064f48470d39177bad80b911264dc3b604861a0a7a823591
Opcode Fuzzy Hash: d42cb93ac16e04f855ba17adc5a1d2855ebe73bfd532347f31365ef0ddec713f
Instruction Fuzzy Hash: 2D919072A09B5B81EE20AB85E4443ADB3A0FB44B94FE44232EA5D473D5DF7DE544C350

Function 00007FF78E416150 Relevance: 14.0, APIs: 2, Strings: 6, Instructions: 28stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF78E4161A3
exit.MSVCRT ref: 00007FF78E4161B8

Strings

SIGINT: Interrupted by Ctrl-C., xrefs: 00007FF78E416156
unknown signal, xrefs: 00007FF78E416189
SIGABRT: Abnormal termination., xrefs: 00007FF78E41616E
SIGSEGV: Illegal storage access. (Attempt to read from nil?), xrefs: 00007FF78E416162
SIGILL: Illegal operation., xrefs: 00007FF78E416190
SIGFPE: Arithmetic error., xrefs: 00007FF78E41617A

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: exitstrlen
String ID: SIGABRT: Abnormal termination.$SIGFPE: Arithmetic error.$SIGILL: Illegal operation.$SIGINT: Interrupted by Ctrl-C.$SIGSEGV: Illegal storage access. (Attempt to read from nil?)$unknown signal
API String ID: 4213389737-3987738871
Opcode ID: e106d0bf56c6f6c14220b101e35efae5d1955080e8f0331f6d695c16fe7ff00b
Instruction ID: 4b9aa30f1e36849e5996802262eda8b97dd365016906507905818b389e652d7b
Opcode Fuzzy Hash: e106d0bf56c6f6c14220b101e35efae5d1955080e8f0331f6d695c16fe7ff00b
Instruction Fuzzy Hash: 11F0F920A0844350FE29B7D068559BCA251BF42385FF90539F52D57A63CF7CB445C230

Function 00007FF78E418FD0 Relevance: 13.6, APIs: 2, Strings: 7, Instructions: 142COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF78E41906A
memcpy.MSVCRT ref: 00007FF78E4190AB

Strings

to , xrefs: 00007FF78E41922E
convert , xrefs: 00007FF78E419110
convert , xrefs: 00007FF78E4191B7
convert , xrefs: 00007FF78E419254
convert , xrefs: 00007FF78E41903F
convert , xrefs: 00007FF78E4191F4
from, xrefs: 00007FF78E41921A

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: memcpy
String ID: to $convert $convert $convert $convert $convert $from
API String ID: 3510742995-1950068461
Opcode ID: fd36f46ad0ae37d4b4bddbbc41cb48c1798a24c9597a1145c937eb4c79994910
Instruction ID: 8ab5dbf57a82094de69ebebef4bb8f08efef6b9029e97869554b571a40b32302
Opcode Fuzzy Hash: fd36f46ad0ae37d4b4bddbbc41cb48c1798a24c9597a1145c937eb4c79994910
Instruction Fuzzy Hash: 5C617D72A05B4781EF05EF81D44839DBBA1FB58B84FA9803AEA0D47395EF78D941C391

Function 00007FF78E4116F0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00007FF78E411709
LoadLibraryA.KERNEL32 ref: 00007FF78E41171A
GetProcAddress.KERNEL32 ref: 00007FF78E411738
GetProcAddress.KERNEL32 ref: 00007FF78E411748

Strings

__deregister_frame_info, xrefs: 00007FF78E41173B
libgcc_s_dw2-1.dll, xrefs: 00007FF78E4116FF
__register_frame_info, xrefs: 00007FF78E411727

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: __deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
API String ID: 384173800-1835852900
Opcode ID: b2bd19885756fac5e715177d44c2c246ee0f40da9efa5fc0257f11007989734f
Instruction ID: b573451d84250467d8f14ca29960e22e9338769570c2261941bd53c03e20ccf6
Opcode Fuzzy Hash: b2bd19885756fac5e715177d44c2c246ee0f40da9efa5fc0257f11007989734f
Instruction Fuzzy Hash: 3101F324B0AA0791EE11BB91BC505B9A364BF48788FE80932FC5E03324EF3CA505C320

Function 00007FF78E414F70 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 69COMMON

Download Yara Rule

APIs

longjmp.MSVCRT ref: 00007FF78E415007
exit.MSVCRT ref: 00007FF78E41501A

Strings

ReraiseDefect, xrefs: 00007FF78E415026
fatal.nim, xrefs: 00007FF78E415084
5, xrefs: 00007FF78E41507B
sysFatal, xrefs: 00007FF78E415091

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: exitlongjmp
String ID: 5$ReraiseDefect$fatal.nim$sysFatal
API String ID: 2266059207-1761478562
Opcode ID: 6dba0bab8b8842a3087f969b2d79c435c3b861759359c708d2e6c07f5b605d46
Instruction ID: cb4d428d96a436475439c00ea4b68c60cdd1248caf4e57951c0ad014fc7c906c
Opcode Fuzzy Hash: 6dba0bab8b8842a3087f969b2d79c435c3b861759359c708d2e6c07f5b605d46
Instruction Fuzzy Hash: F9310565A08A0791EE00BB94E4486BEA3A4FB44B84FF40436EA1C47392EF3CE544C3A0

Function 00007FF78E41E170 Relevance: 9.3, APIs: 2, Strings: 4, Instructions: 257stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF78E41E3A4

Strings

HYk, xrefs: 00007FF78E41E5F3
MZ, xrefs: 00007FF78E41E1A3
JDF7, xrefs: 00007FF78E41E330
HYk, xrefs: 00007FF78E41E49D

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: strlen
String ID: JDF7$MZ$HYk$HYk
API String ID: 39653677-2708922670
Opcode ID: 94c6417f10c9750efabe6c0aa8dad0cc91598c17a4138bae4fbfefadc9b2a79d
Instruction ID: c731aec84acf981aa83f151ac0d20596c72dcd71dbcb269af49889b7d77a5e47
Opcode Fuzzy Hash: 94c6417f10c9750efabe6c0aa8dad0cc91598c17a4138bae4fbfefadc9b2a79d
Instruction Fuzzy Hash: B9C1CF25B0958792EA20BF95D4502BEA3A1FF84788FF08135FA8D07A99DF3CE545C760

Function 00007FF78E41B080 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 191COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF78E41B14B
VariantCopy.OLEAUT32 ref: 00007FF78E41B1A1

Strings

VariantConversionError, xrefs: 00007FF78E41B2D7
com.nim, xrefs: 00007FF78E41B350
toVariant, xrefs: 00007FF78E41B366

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: CopyInitializeVariant
String ID: VariantConversionError$com.nim$toVariant
API String ID: 633353902-3035603046
Opcode ID: 6476d55cf4dd1f5fe45e3bf9ef567c15420c12c968b5b0298e89105b166aa263
Instruction ID: 2bf82175c42c7c5240fa460812525899e012ac1bafa74a8f2cd5b3a4358a7d50
Opcode Fuzzy Hash: 6476d55cf4dd1f5fe45e3bf9ef567c15420c12c968b5b0298e89105b166aa263
Instruction Fuzzy Hash: 50911632A19A4781EA10AB95E8543BEA3A4FF85784FF4443AFA4D47795DF7CE008C360

Function 00007FF78E426F20 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

CCG , xrefs: 00007FF78E426F48

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: 08d7eed76709450e368a73cb412f1c952c93ae8a5c57bb94bda8ef868f485690
Instruction ID: 38c8a0991f51f51b664e4f85ef93a6339d21c67a61a4bd59c2c2e163e9e67f6e
Opcode Fuzzy Hash: 08d7eed76709450e368a73cb412f1c952c93ae8a5c57bb94bda8ef868f485690
Instruction Fuzzy Hash: FF415471A086178AF720ABA4C8483BC6261BF45358FB04A35EE2D877E5CF3CE541D320

Function 00007FF78E411E40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00007FF78E411E69
fflush.MSVCRT ref: 00007FF78E411E71
exit.MSVCRT(?,?,?,?,?,?,?,00007FF78E432350), ref: 00007FF78E411E7B

Strings

[GC] cannot register global variable; too many global variables, xrefs: 00007FF78E411E5C

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: exitfflushfwrite
String ID: [GC] cannot register global variable; too many global variables
API String ID: 3476253079-2146260042
Opcode ID: b7571dad61ca20dee86a2af1c9d979772e7033c268770b4022c9546089bfcbf8
Instruction ID: 774ebc558379c4c0275d012d178ad591ebe06d901a760018fa4f953e256d57bb
Opcode Fuzzy Hash: b7571dad61ca20dee86a2af1c9d979772e7033c268770b4022c9546089bfcbf8
Instruction Fuzzy Hash: 2B4190B2B05A4281EE04EB58D0543BCA761FB94BC4FB18A35DA0E47351EF7EE545C320

Function 00007FF78E4120F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 92libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF78E41210E
exit.MSVCRT ref: 00007FF78E41223F

Strings

could not import: , xrefs: 00007FF78E412203
@, xrefs: 00007FF78E412163

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: AddressProcexit
String ID: @$could not import:
API String ID: 2129014486-260091680
Opcode ID: 69dd1521f8cfb840d2ca3ee137f161da04b393e1b82e55d6114af6ee7714bfbc
Instruction ID: 4b4db1a5a71561f5d3b38fd0cd4376752e53103dfd6fe7ef3cf905c831ef23c3
Opcode Fuzzy Hash: 69dd1521f8cfb840d2ca3ee137f161da04b393e1b82e55d6114af6ee7714bfbc
Instruction Fuzzy Hash: F731F562F0918355EE29E7A9E9047BD9A52BB457C4FA84235EE0E07386EF7CE005C364

Function 00007FF78E415970 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

longjmp.MSVCRT ref: 00007FF78E415A07
exit.MSVCRT(?,?,00000000,00000000,00007FF78E415AB5), ref: 00007FF78E415A17

Strings

fatal.nim, xrefs: 00007FF78E415A22
sysFatal, xrefs: 00007FF78E415A23

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: exitlongjmp
String ID: fatal.nim$sysFatal
API String ID: 2266059207-2644091575
Opcode ID: 46b2c20323a3814dd39974bb7dba7c9da256c0f213f5ca93764d1b22c13c85d6
Instruction ID: e853e1f4bc0960c851606a2f0892c778f1910ac33ea2c81d4357bceb0d897b48
Opcode Fuzzy Hash: 46b2c20323a3814dd39974bb7dba7c9da256c0f213f5ca93764d1b22c13c85d6
Instruction Fuzzy Hash: 98415662B15B0792EE10AB99D8887BDB3A4FB48BC4FB44536EA5C07355EF38D445C360

Function 00007FF78E412050 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78E411DB0: strlen.MSVCRT ref: 00007FF78E411DC1
Part of subcall function 00007FF78E411DB0: fwrite.MSVCRT ref: 00007FF78E411DD4

GetLastError.KERNEL32 ref: 00007FF78E4120A2
exit.MSVCRT(?,?,?,00007FF78E4322CB), ref: 00007FF78E4120CA

Strings

(bad format; library may be wrong architecture), xrefs: 00007FF78E4120D6
could not load: , xrefs: 00007FF78E412070

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: ErrorLastexitfwritestrlen
String ID: (bad format; library may be wrong architecture)$could not load:
API String ID: 671075621-2754783905
Opcode ID: 80ccbc06463d05bc2b5888fd3e508f9d5f8e55bf2f70a7f2de8dd596c3c45509
Instruction ID: d9b5be997cc9a4f7612310fe7d860138b9838117a874f2798b978e77edbd0841
Opcode Fuzzy Hash: 80ccbc06463d05bc2b5888fd3e508f9d5f8e55bf2f70a7f2de8dd596c3c45509
Instruction Fuzzy Hash: 2C011A20A0951351FE44B7E1A819BB89665BF45780FF44139FE0E47396EF3CA801C235

Function 00007FF78E411DF0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00007FF78E411E19
fflush.MSVCRT ref: 00007FF78E411E21
exit.MSVCRT(?,?,?,00007FF78E432350), ref: 00007FF78E411E2B

Strings

[GC] cannot register thread local variable; too many thread local variables, xrefs: 00007FF78E411E0C

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: exitfflushfwrite
String ID: [GC] cannot register thread local variable; too many thread local variables
API String ID: 3476253079-685140759
Opcode ID: d644f526e3d56218455da416d993ee9c210ffd2179d7a09f73680639e114c0dc
Instruction ID: f97038bd30869c6c78a023f01e9689e6d7fc4f40e1ef21219bedba93bcb8e00e
Opcode Fuzzy Hash: d644f526e3d56218455da416d993ee9c210ffd2179d7a09f73680639e114c0dc
Instruction Fuzzy Hash: E2E0EC20E045438AF60477D2A4157F8A660FF87B85FE05438EA1E5B392DF7EA806C365

Function 00007FF78E41A3E0 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 196COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78E413F10: memset.MSVCRT ref: 00007FF78E413FA2

Part of subcall function 00007FF78E422790: memcpy.MSVCRT ref: 00007FF78E4228EB

memcpy.MSVCRT ref: 00007FF78E41A6F3

Strings

clr.nim, xrefs: 00007FF78E41A647
clrError, xrefs: 00007FF78E41A64E
CLRError, xrefs: 00007FF78E41A43D

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: memcpy$memset
String ID: CLRError$clr.nim$clrError
API String ID: 438689982-2830349459
Opcode ID: 77f3dd17192c832a47128c647c90bb103ff66cefc69fe6e175ad23bf75e257b3
Instruction ID: 8a8196bd9ae1b4f10881c6e3fa745fe7a3ffc2f6446044f70495ded53e07f488
Opcode Fuzzy Hash: 77f3dd17192c832a47128c647c90bb103ff66cefc69fe6e175ad23bf75e257b3
Instruction Fuzzy Hash: FA91B262A18B8385EA11AB4598002BDA761FB547A4FA50231FF6D0B3D2DF7CE554D360

Function 00007FF78E41A080 Relevance: 6.1, APIs: 4, Instructions: 128memoryCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF78E41A0A1
MultiByteToWideChar.KERNEL32 ref: 00007FF78E41A139
MultiByteToWideChar.KERNEL32 ref: 00007FF78E41A19C
SysAllocString.OLEAUT32 ref: 00007FF78E41A1AD

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: ByteCharMultiWide$AllocInitializeString
String ID:
API String ID: 1889743751-0
Opcode ID: 65b687b48c692aee826a9be4b8a57595faa841ef06bbf31540a48bb328041d11
Instruction ID: 9027796017c039f925c97fd35c3d25ee1052f0696c8750305c0df39b43d09cbd
Opcode Fuzzy Hash: 65b687b48c692aee826a9be4b8a57595faa841ef06bbf31540a48bb328041d11
Instruction Fuzzy Hash: 3C516962B0AA4781EE15AF95A80437EA3A0BF44B84FF44535EE0D47395EF7CE445D360

Function 00007FF78E413170 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32 ref: 00007FF78E41327E
exit.MSVCRT ref: 00007FF78E413299

Strings

virtualFree failing!, xrefs: 00007FF78E413288

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: FreeVirtualexit
String ID: virtualFree failing!
API String ID: 1212090140-3108117800
Opcode ID: c68e12f655a03d91ba896f2f687b174e3f78ce3526b737a923ed8198372fbc25
Instruction ID: 4dbe25d93a57e4827d5891b3b2c3d607ff8c84b7c6a8a7e2ce7fc36fec180f47
Opcode Fuzzy Hash: c68e12f655a03d91ba896f2f687b174e3f78ce3526b737a923ed8198372fbc25
Instruction Fuzzy Hash: 8951CDB2B05B4680EE04EB55C458BAC73A5FB04B80FB2C235EA5D47398EF7AD984C350

Function 00007FF78E426540 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF78E42663E

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF78E426634
Unknown error, xrefs: 00007FF78E4265DA

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: a9984ae661c6ac48f04b27f6ff2a17c140177e5de2a6c16ce8aaa602cf112a1e
Instruction ID: 6d45a739406bca77e55b1c0bf29aa8e6ea982bff0b83095a6e9a7a6f54d3c9a6
Opcode Fuzzy Hash: a9984ae661c6ac48f04b27f6ff2a17c140177e5de2a6c16ce8aaa602cf112a1e
Instruction Fuzzy Hash: 5B214926A04F858AD7119FA8E8413EAB371FF59799F944622FE8C17764EF78D245C300

Function 00007FF78E42658C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF78E42663E

Strings

Argument domain error (DOMAIN), xrefs: 00007FF78E42658C
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF78E426634

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: fa2246ec60d3f2d2c8e860e0b899dddbbb1b0a01b347715d37e67942b8b6f4d3
Instruction ID: 19ab70fae6f3ada45faa9f87204a68471ea50a4906df6a92ea4f050132045ab4
Opcode Fuzzy Hash: fa2246ec60d3f2d2c8e860e0b899dddbbb1b0a01b347715d37e67942b8b6f4d3
Instruction Fuzzy Hash: DA015E26A04F858AD7019F69D8402AA7771FF4D799F544722EF8D27724DF38C145C310

Function 00007FF78E4265B3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF78E42663E

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF78E426634
Partial loss of significance (PLOSS), xrefs: 00007FF78E4265B3

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: 100d4e92daa1d8cb9e2847d07ef5ff8e49b239cca73fcd96e7544013f80db1bf
Instruction ID: 781677d5110813843ace821e37e4b524d64b24556166a680f68f73c4fc8bd08d
Opcode Fuzzy Hash: 100d4e92daa1d8cb9e2847d07ef5ff8e49b239cca73fcd96e7544013f80db1bf
Instruction Fuzzy Hash: 9B015E26A04F858AD7019F69D8402AA7771FF4D799F554722EF8D27725DF38C145C310

Function 00007FF78E426599 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF78E42663E

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF78E426634
Argument singularity (SIGN), xrefs: 00007FF78E426599

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: ff2584cf3f57ae6350a126f8e35093b32cbe0b374b796bb6d5cdb4394ffb26a0
Instruction ID: 737a6fe8d29f4238c17d2f04d70d6e8272d536b90bde8901f7bd3437ec06e659
Opcode Fuzzy Hash: ff2584cf3f57ae6350a126f8e35093b32cbe0b374b796bb6d5cdb4394ffb26a0
Instruction Fuzzy Hash: F4019E26A04F858AD7019F68D8402AA7371FF4D798F544722EF8D27728DF38C145C310

Function 00007FF78E4265A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF78E42663E

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF78E426634
Overflow range error (OVERFLOW), xrefs: 00007FF78E4265A6

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: 9e894c05ad2901ed1daa551ccda28ddea90dc3bd28c1571126fd109856676168
Instruction ID: 71816b8532b4be82482f21dbdf39c09ede487547dfe12b292252ab7af301881a
Opcode Fuzzy Hash: 9e894c05ad2901ed1daa551ccda28ddea90dc3bd28c1571126fd109856676168
Instruction Fuzzy Hash: D7015E26A04F898AD7019F69D8402AAB771FF4D799F554722EF8D27764DF38C145C310

Function 00007FF78E4265CD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF78E42663E

Strings

The result is too small to be represented (UNDERFLOW), xrefs: 00007FF78E4265CD
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF78E426634

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: 431faf95ef2588800d0d27bfca1691eee4811e92dd30b5b8fce71afe1fc2f45c
Instruction ID: 789ec758ec0d233eb4b0e85130f9f8a3f8b0b6677d95edb0325516b28e0a0be9
Opcode Fuzzy Hash: 431faf95ef2588800d0d27bfca1691eee4811e92dd30b5b8fce71afe1fc2f45c
Instruction Fuzzy Hash: F8015E26A04F858AD7019F69D8402AA7771FF4D799F554722EF8D27724DF38C145C310

Function 00007FF78E4265C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF78E42663E

Strings

Total loss of significance (TLOSS), xrefs: 00007FF78E4265C0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF78E426634

Memory Dump Source

Source File: 00000002.00000002.2956305689.00007FF78E411000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78E410000, based on PE: true

Associated: 00000002.00000002.2956292410.00007FF78E410000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956326512.00007FF78E433000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956340099.00007FF78E434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956356665.00007FF78E446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E448000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E455000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956410392.00007FF78E458000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2956459077.00007FF78E461000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff78e410000_66WXq58R0I.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: f2129813e4aca10fd5bf26985deab3776ad89d1813962d43f4c18ca8cbf0e0d2
Instruction ID: 4ecd1637e6635a752ff5c6dc24c1bca5849e86b7f094329d74bc10f006a3626d
Opcode Fuzzy Hash: f2129813e4aca10fd5bf26985deab3776ad89d1813962d43f4c18ca8cbf0e0d2
Instruction Fuzzy Hash: 1C014C26A04F858AD7019F69D8402AA7761FB4D799F554622EE8D27724DF38C185C310

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 66WXq58R0I.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g5elpwno.kpw.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tlxxxkea.ncw.psm1

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

UDP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: 66WXq58R0I.exePID: 6580, Parent PID: 2580

General

Chronological Activities

Windows Analysis Report
66WXq58R0I.exe

Function 00007FF78E418C30 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 190
libraryloaderCOMMON

Function 00007FF78E411154 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 193
COMMON

Function 00007FF78E41F6D0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 373
fileCOMMON

Function 00007FF78E42DA70 Relevance: 293.3, APIs: 4, Strings: 162, Instructions: 2775
COMMON

Function 00007FF78E412260 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62
memoryCOMMON

Function 00007FF78E412290 Relevance: 3.9, APIs: 3, Instructions: 153
memoryCOMMON

Function 00007FF78E41BB80 Relevance: 3.9, APIs: 3, Instructions: 143
COMMON

Function 00007FF78E422AF0 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Function 00007FF78E427B14 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 36
stringCOMMON

Function 00007FF78E412370 Relevance: 2.6, APIs: 2, Instructions: 149
memoryCOMMON

Function 00007FF78E427990 Relevance: 1.5, APIs: 1, Instructions: 44
COMMON

Function 00007FF78E422BF0 Relevance: 1.5, APIs: 1, Instructions: 24
fileCOMMON

Function 00007FF78E412EA0 Relevance: 1.4, APIs: 1, Instructions: 161
memoryCOMMON

Function 00007FF78E413F10 Relevance: 1.3, APIs: 1, Instructions: 91
COMMON