Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1544033
MD5:	f01ed03b7a786c24ebd92eab9b441b9d
SHA1:	891c8ef7b9ef32e9d4de3ee473186cd4ba66059f
SHA256:	6dc5fcbd3d05cb11dc4731aea996c7cbc213253c4d4b119799c5ddedebe537fb
Tags:	exeuser-Bitsight
Infos:

Detection

DarkVision Rat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected DarkVision Rat

AI detected suspicious sample

Contains functionality to registers a callback to get notified when the system is suspended or resumed (often done by Miners)

Creates autostart registry keys with suspicious names

Found direct / indirect Syscall (likely to bypass EDR)

Machine Learning detection for dropped file

Machine Learning detection for sample

Potentially malicious time measurement code found

Switches to a custom stack to bypass stack traces

Uses dynamic DNS services

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Found evasive API chain (may stop execution after accessing registry keys)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Stores large binary data to the registry

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 3776 cmdline: "C:\Users\user\Desktop\file.exe" MD5: F01ED03B7A786C24EBD92EAB9B441B9D)

Edge.exe (PID: 7020 cmdline: "C:\Users\user\AppData\Roaming\Edge\Edge.exe" {6B387F7B-F5A9-4597-ABB2-EB1AC679F320} MD5: F01ED03B7A786C24EBD92EAB9B441B9D)

Edge.exe (PID: 3192 cmdline: "C:\Users\user\AppData\Roaming\Edge\Edge.exe" {5E0DB032-E9D6-4C1D-A145-C083BA9C5AAA} MD5: F01ED03B7A786C24EBD92EAB9B441B9D)

Edge.exe (PID: 6052 cmdline: "C:\Users\user\AppData\Roaming\Edge\Edge.exe" {5E0DB032-E9D6-4C1D-A145-C083BA9C5AAA} MD5: F01ED03B7A786C24EBD92EAB9B441B9D)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.2434983215.000000C000180000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x6e518:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x71a4e:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000002.00000002.3409842091.000000C000180000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x6e518:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x71a4e:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000005.00000002.2435764747.0000018F78460000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x6ed68:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x7229e:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000004.00000002.2350558821.00000261E5450000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x6ed68:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x7229e:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000002.00000002.3410605768.0000026679980000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x6ed68:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x7229e:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000004.00000002.2349782661.000000C000180000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x6e518:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x71a4e:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000000.00000002.2177332111.000000C000180000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x6e518:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x71a4e:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000000.00000002.2178027279.000001B278C10000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x6ed68:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0x7229e:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
Process Memory Space: file.exe PID: 3776	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
Process Memory Space: Edge.exe PID: 7020	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
Process Memory Space: Edge.exe PID: 3192	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
Process Memory Space: Edge.exe PID: 6052	JoeSecurity_DarkVisionRat	Yara detected DarkVision Rat	Joe Security
Click to see the 7 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\Edge\Edge.exe {5E0DB032-E9D6-4C1D-A145-C083BA9C5AAA}, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Roaming\Edge\Edge.exe, ProcessId: 7020, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{AB1F3E47-AEF1-400E-A108-233A046C3A34}

Suricata Signatures

ET MALWARE Win32/DarkVision RAT CnC Checkin M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T18:27:14.832287+0100	2045618	1	A Network Trojan was detected	192.168.2.6	49705	178.215.224.241	5589	TCP
2024-10-28T18:27:15.267682+0100	2045618	1	A Network Trojan was detected	192.168.2.6	49705	178.215.224.241	5589	TCP
2024-10-28T18:27:21.568738+0100	2045618	1	A Network Trojan was detected	192.168.2.6	49708	178.215.224.241	5589	TCP
2024-10-28T18:27:24.579334+0100	2045618	1	A Network Trojan was detected	192.168.2.6	49708	178.215.224.241	5589	TCP
2024-10-28T18:27:25.814191+0100	2045618	1	A Network Trojan was detected	192.168.2.6	49710	178.215.224.241	5589	TCP
2024-10-28T18:27:26.904465+0100	2045618	1	A Network Trojan was detected	192.168.2.6	49717	178.215.224.241	5589	TCP
2024-10-28T18:27:27.990523+0100	2045618	1	A Network Trojan was detected	192.168.2.6	49726	178.215.224.241	5589	TCP
2024-10-28T18:27:29.065178+0100	2045618	1	A Network Trojan was detected	192.168.2.6	49735	178.215.224.241	5589	TCP
2024-10-28T18:27:30.241808+0100	2045618	1	A Network Trojan was detected	192.168.2.6	49742	178.215.224.241	5589	TCP
2024-10-28T18:28:25.021247+0100	2045618	1	A Network Trojan was detected	192.168.2.6	49908	178.215.224.241	5589	TCP
2024-10-28T18:28:26.665782+0100	2045618	1	A Network Trojan was detected	192.168.2.6	49918	178.215.224.241	5589	TCP
2024-10-28T18:28:27.934942+0100	2045618	1	A Network Trojan was detected	192.168.2.6	49924	178.215.224.241	5589	TCP
2024-10-28T18:28:29.007585+0100	2045618	1	A Network Trojan was detected	192.168.2.6	49932	178.215.224.241	5589	TCP
2024-10-28T18:28:30.079258+0100	2045618	1	A Network Trojan was detected	192.168.2.6	49940	178.215.224.241	5589	TCP
2024-10-28T18:28:31.161043+0100	2045618	1	A Network Trojan was detected	192.168.2.6	49948	178.215.224.241	5589	TCP

ET MALWARE Win32/DarkVision RAT CnC Checkin M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T18:27:18.876125+0100	2045619	1	A Network Trojan was detected	192.168.2.6	49705	178.215.224.241	5589	TCP
2024-10-28T18:28:26.309555+0100	2045619	1	A Network Trojan was detected	192.168.2.6	49908	178.215.224.241	5589	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe

ReversingLabs: Detection: 15%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 15%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.6% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Bitcoin Miner

Contains functionality to registers a callback to get notified when the system is suspended or resumed (often done by Miners)

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A23100 LoadLibraryExW,	0_2_00A23100
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00AD3100 LoadLibraryExW,	2_2_00AD3100
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00AD3100 LoadLibraryExW,	5_2_00AD3100

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp rdx, 40h	0_2_00A103B1
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp rdx, 40h	0_2_00A103C0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then shr r10, 0Dh	0_2_00A1B5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then shr r10, 0Dh	0_2_00A1CA60
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then lock or byte ptr [rdx], dil	0_2_00A10B00
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp rdx, rbx	0_2_009FBEA0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4x nop then cmp rdx, 40h	2_2_00AC03B1
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4x nop then cmp rdx, 40h	2_2_00AC03C0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4x nop then shr r10, 0Dh	2_2_00ACB5E0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4x nop then shr r10, 0Dh	2_2_00ACCA60
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4x nop then lock or byte ptr [rdx], dil	2_2_00AC0B00
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4x nop then cmp rdx, rbx	2_2_00AABEA0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4x nop then cmp rdx, 40h	5_2_00AC03B1
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4x nop then cmp rdx, 40h	5_2_00AC03C0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4x nop then shr r10, 0Dh	5_2_00ACB5E0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4x nop then shr r10, 0Dh	5_2_00ACCA60
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4x nop then lock or byte ptr [rdx], dil	5_2_00AC0B00
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4x nop then cmp rdx, rbx	5_2_00AABEA0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.6:49708 -> 178.215.224.241:5589
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.6:49705 -> 178.215.224.241:5589
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.6:49710 -> 178.215.224.241:5589
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.6:49717 -> 178.215.224.241:5589
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.6:49726 -> 178.215.224.241:5589
Source: Network traffic	Suricata IDS: 2045619 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M3 : 192.168.2.6:49705 -> 178.215.224.241:5589
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.6:49735 -> 178.215.224.241:5589
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.6:49940 -> 178.215.224.241:5589
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.6:49932 -> 178.215.224.241:5589
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.6:49918 -> 178.215.224.241:5589
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.6:49924 -> 178.215.224.241:5589
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.6:49908 -> 178.215.224.241:5589
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.6:49948 -> 178.215.224.241:5589
Source: Network traffic	Suricata IDS: 2045618 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M1 : 192.168.2.6:49742 -> 178.215.224.241:5589
Source: Network traffic	Suricata IDS: 2045619 - Severity 1 - ET MALWARE Win32/DarkVision RAT CnC Checkin M3 : 192.168.2.6:49908 -> 178.215.224.241:5589

Uses dynamic DNS services

Source: unknown

DNS query: name: fishcrabs99.ddns.net

Source: global traffic

TCP traffic: 192.168.2.6:49705 -> 178.215.224.241:5589

Source: Joe Sandbox View

ASN Name: LVLT-10753US LVLT-10753US

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe

Code function: 2_2_000002667B1C1B70 recv,

2_2_000002667B1C1B70

Source: global traffic

DNS traffic detected: DNS query: fishcrabs99.ddns.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000005.00000002.2434983215.000000C000180000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000002.00000002.3409842091.000000C000180000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000005.00000002.2435764747.0000018F78460000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000004.00000002.2350558821.00000261E5450000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000002.00000002.3410605768.0000026679980000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000004.00000002.2349782661.000000C000180000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000000.00000002.2177332111.000000C000180000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000000.00000002.2178027279.000001B278C10000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000001B278C80808 NtCreateSection,NtMapViewOfSection,VirtualAlloc,NtUnmapViewOfSection,NtMapViewOfSection,VirtualProtect,VirtualProtect,VirtualProtect,	0_2_000001B278C80808
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00000266799F0808 NtCreateSection,NtMapViewOfSection,VirtualAlloc,NtUnmapViewOfSection,NtMapViewOfSection,VirtualProtect,VirtualProtect,VirtualProtect,	2_2_00000266799F0808
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4_2_00000261E54C0808 NtCreateSection,NtMapViewOfSection,VirtualAlloc,NtUnmapViewOfSection,NtMapViewOfSection,VirtualProtect,VirtualProtect,VirtualProtect,	4_2_00000261E54C0808
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_0000018F784D0808 NtCreateSection,NtMapViewOfSection,VirtualAlloc,NtUnmapViewOfSection,NtMapViewOfSection,VirtualProtect,VirtualProtect,VirtualProtect,	5_2_0000018F784D0808

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F2020	0_2_009F2020
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A25320	0_2_00A25320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009FD960	0_2_009FD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A18AC0	0_2_00A18AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A2EA00	0_2_00A2EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A17CC0	0_2_00A17CC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A35D80	0_2_00A35D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009FCDC0	0_2_009FCDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A05E80	0_2_00A05E80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A281A0	0_2_00A281A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3F160	0_2_00A3F160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0E140	0_2_00A0E140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A40380	0_2_00A40380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A64320	0_2_00A64320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A2F480	0_2_00A2F480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0A420	0_2_00A0A420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A1B5E0	0_2_00A1B5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A155C0	0_2_00A155C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009FE520	0_2_009FE520
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A2C6E0	0_2_00A2C6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A536E9	0_2_00A536E9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A12660	0_2_00A12660
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A30640	0_2_00A30640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F3980	0_2_009F3980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A1F9E0	0_2_00A1F9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A289E0	0_2_00A289E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A0A940	0_2_00A0A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A1BAA0	0_2_00A1BAA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A04A80	0_2_00A04A80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A16A00	0_2_00A16A00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A1CA60	0_2_00A1CA60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A64B40	0_2_00A64B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A1EC60	0_2_00A1EC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A10D80	0_2_00A10D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A2BD80	0_2_00A2BD80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4AD20	0_2_00A4AD20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A09D60	0_2_00A09D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A1DE40	0_2_00A1DE40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3BE40	0_2_00A3BE40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009F9F80	0_2_009F9F80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A08FC0	0_2_00A08FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000001B278C80808	0_2_000001B278C80808
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000001B278C7FFFC	0_2_000001B278C7FFFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000001B278C803D8	0_2_000001B278C803D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000001B278C83AB4	0_2_000001B278C83AB4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000001B278C7F120	0_2_000001B278C7F120
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000001B278C812BC	0_2_000001B278C812BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000001B27A4CF1A0	0_2_000001B27A4CF1A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000001B27A4C1000	0_2_000001B27A4C1000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000001B27A4D2EF0	0_2_000001B27A4D2EF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000001B27A4CE700	0_2_000001B27A4CE700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000001B27A4D03A0	0_2_000001B27A4D03A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000001B27A4DACD0	0_2_000001B27A4DACD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000001B27A4DAD51	0_2_000001B27A4DAD51
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000001B27A4C7D70	0_2_000001B27A4C7D70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000001B27A4E4520	0_2_000001B27A4E4520
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000001B27A4E0A10	0_2_000001B27A4E0A10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000001B27A4D4AC0	0_2_000001B27A4D4AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000001B27A4D92E0	0_2_000001B27A4D92E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000001B27A4E0A86	0_2_000001B27A4E0A86
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000001B27A4D8AA0	0_2_000001B27A4D8AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000001B27A4D82B0	0_2_000001B27A4D82B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000001B27A4CB340	0_2_000001B27A4CB340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000001B27A4E8370	0_2_000001B27A4E8370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000001B27A4EDFC4	0_2_000001B27A4EDFC4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000001B27A4ED01C	0_2_000001B27A4ED01C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000001B27A4EB030	0_2_000001B27A4EB030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_000001B27A4DB880	0_2_000001B27A4DB880
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00AA2020	2_2_00AA2020
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00AD5320	2_2_00AD5320
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00AAD960	2_2_00AAD960
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00AC8AC0	2_2_00AC8AC0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00ADEA00	2_2_00ADEA00
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00AC7CC0	2_2_00AC7CC0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00AE5D80	2_2_00AE5D80
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00AACDC0	2_2_00AACDC0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00AB5E80	2_2_00AB5E80
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00AD81A0	2_2_00AD81A0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00AEF160	2_2_00AEF160
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00ABE140	2_2_00ABE140
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00AF0380	2_2_00AF0380
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00B14320	2_2_00B14320
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00ADF480	2_2_00ADF480
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00ABA420	2_2_00ABA420
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00ACB5E0	2_2_00ACB5E0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00AC55C0	2_2_00AC55C0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00AAE520	2_2_00AAE520
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00ADC6E0	2_2_00ADC6E0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00B036E9	2_2_00B036E9
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00AC2660	2_2_00AC2660
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00AE0640	2_2_00AE0640
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00AA3980	2_2_00AA3980
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00ACF9E0	2_2_00ACF9E0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00AD89E0	2_2_00AD89E0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00ABA940	2_2_00ABA940
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00ACBAA0	2_2_00ACBAA0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00AB4A80	2_2_00AB4A80
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00AC6A00	2_2_00AC6A00
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00ACCA60	2_2_00ACCA60
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00B14B40	2_2_00B14B40
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00ACEC60	2_2_00ACEC60
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00AC0D80	2_2_00AC0D80
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00ADBD80	2_2_00ADBD80
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00AFAD20	2_2_00AFAD20
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00AB9D60	2_2_00AB9D60
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00ACDE40	2_2_00ACDE40
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00AEBE40	2_2_00AEBE40
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00AA9F80	2_2_00AA9F80
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00AB8FC0	2_2_00AB8FC0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00000266799EFFFC	2_2_00000266799EFFFC
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00000266799F0808	2_2_00000266799F0808
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00000266799EF120	2_2_00000266799EF120
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00000266799F12BC	2_2_00000266799F12BC
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00000266799F03D8	2_2_00000266799F03D8
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00000266799F3AB4	2_2_00000266799F3AB4
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_000002667B1AF1A0	2_2_000002667B1AF1A0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_000002667B1A1000	2_2_000002667B1A1000
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_000002667B1C4520	2_2_000002667B1C4520
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_000002667B1C0A10	2_2_000002667B1C0A10
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_000002667B1CDFC4	2_2_000002667B1CDFC4
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_000002667B1CD01C	2_2_000002667B1CD01C
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_000002667B1CB030	2_2_000002667B1CB030
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_000002667B1BB880	2_2_000002667B1BB880
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_000002667B1AE700	2_2_000002667B1AE700
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_000002667B1B2EF0	2_2_000002667B1B2EF0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_000002667B1C0E60	2_2_000002667B1C0E60
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_000002667B1BACD0	2_2_000002667B1BACD0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_000002667B1BAD51	2_2_000002667B1BAD51
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_000002667B1A7D70	2_2_000002667B1A7D70
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_000002667B1B4AC0	2_2_000002667B1B4AC0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_000002667B1B82B0	2_2_000002667B1B82B0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_000002667B1B92E0	2_2_000002667B1B92E0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_000002667B1AB340	2_2_000002667B1AB340
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_000002667B1C8370	2_2_000002667B1C8370
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_000002667B1B03A0	2_2_000002667B1B03A0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_000002667B1B8AA0	2_2_000002667B1B8AA0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_000002667B1C0A86	2_2_000002667B1C0A86
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4_2_00000261E54C0808	4_2_00000261E54C0808
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4_2_00000261E54BFFFC	4_2_00000261E54BFFFC
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4_2_00000261E54C12BC	4_2_00000261E54C12BC
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4_2_00000261E54C3AB4	4_2_00000261E54C3AB4
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4_2_00000261E54BF120	4_2_00000261E54BF120
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4_2_00000261E54C03D8	4_2_00000261E54C03D8
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4_2_00000261E6CEF1A0	4_2_00000261E6CEF1A0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4_2_00000261E6CE1000	4_2_00000261E6CE1000
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4_2_00000261E6D04520	4_2_00000261E6D04520
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4_2_00000261E6CFACD0	4_2_00000261E6CFACD0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4_2_00000261E6CFB880	4_2_00000261E6CFB880
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4_2_00000261E6D00A10	4_2_00000261E6D00A10
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4_2_00000261E6CFAD51	4_2_00000261E6CFAD51
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4_2_00000261E6CE7D70	4_2_00000261E6CE7D70
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4_2_00000261E6CEB340	4_2_00000261E6CEB340
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4_2_00000261E6CF92E0	4_2_00000261E6CF92E0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4_2_00000261E6CF2EF0	4_2_00000261E6CF2EF0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4_2_00000261E6CEE700	4_2_00000261E6CEE700
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4_2_00000261E6CF8AA0	4_2_00000261E6CF8AA0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4_2_00000261E6D00A86	4_2_00000261E6D00A86
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4_2_00000261E6CF82B0	4_2_00000261E6CF82B0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4_2_00000261E6CF4AC0	4_2_00000261E6CF4AC0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4_2_00000261E6D0D01C	4_2_00000261E6D0D01C
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4_2_00000261E6D0B030	4_2_00000261E6D0B030
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4_2_00000261E6D0DFC4	4_2_00000261E6D0DFC4
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4_2_00000261E6CF03A0	4_2_00000261E6CF03A0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 4_2_00000261E6D08370	4_2_00000261E6D08370
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00AA2020	5_2_00AA2020
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00AD5320	5_2_00AD5320
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00AAD960	5_2_00AAD960
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00AC8AC0	5_2_00AC8AC0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00ADEA00	5_2_00ADEA00
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00AC7CC0	5_2_00AC7CC0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00AE5D80	5_2_00AE5D80
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00AACDC0	5_2_00AACDC0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00AB5E80	5_2_00AB5E80
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00AD81A0	5_2_00AD81A0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00AEF160	5_2_00AEF160
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00ABE140	5_2_00ABE140
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00AF0380	5_2_00AF0380
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00B14320	5_2_00B14320
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00ADF480	5_2_00ADF480
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00ABA420	5_2_00ABA420
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00ACB5E0	5_2_00ACB5E0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00AC55C0	5_2_00AC55C0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00AAE520	5_2_00AAE520
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00ADC6E0	5_2_00ADC6E0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00B036E9	5_2_00B036E9
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00AC2660	5_2_00AC2660
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00AE0640	5_2_00AE0640
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00AA3980	5_2_00AA3980
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00ACF9E0	5_2_00ACF9E0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00AD89E0	5_2_00AD89E0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00ABA940	5_2_00ABA940
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00ACBAA0	5_2_00ACBAA0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00AB4A80	5_2_00AB4A80
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00AC6A00	5_2_00AC6A00
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00ACCA60	5_2_00ACCA60
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00B14B40	5_2_00B14B40
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00ACEC60	5_2_00ACEC60
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00AC0D80	5_2_00AC0D80
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00ADBD80	5_2_00ADBD80
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00AFAD20	5_2_00AFAD20
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00AB9D60	5_2_00AB9D60
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00ACDE40	5_2_00ACDE40
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00AEBE40	5_2_00AEBE40
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00AA9F80	5_2_00AA9F80
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00AB8FC0	5_2_00AB8FC0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_0000018F784D0808	5_2_0000018F784D0808
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_0000018F784CFFFC	5_2_0000018F784CFFFC
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_0000018F784D3AB4	5_2_0000018F784D3AB4
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_0000018F784CF120	5_2_0000018F784CF120
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_0000018F784D12BC	5_2_0000018F784D12BC
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_0000018F784D03D8	5_2_0000018F784D03D8
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_0000018F79CFF1A0	5_2_0000018F79CFF1A0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_0000018F79CF1000	5_2_0000018F79CF1000
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_0000018F79D0B880	5_2_0000018F79D0B880
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_0000018F79D1B030	5_2_0000018F79D1B030
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_0000018F79D1D01C	5_2_0000018F79D1D01C
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_0000018F79D1DFC4	5_2_0000018F79D1DFC4
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_0000018F79D18370	5_2_0000018F79D18370
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_0000018F79D003A0	5_2_0000018F79D003A0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_0000018F79CFB340	5_2_0000018F79CFB340
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_0000018F79D04AC0	5_2_0000018F79D04AC0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_0000018F79D082B0	5_2_0000018F79D082B0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_0000018F79D092E0	5_2_0000018F79D092E0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_0000018F79D10A86	5_2_0000018F79D10A86
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_0000018F79D08AA0	5_2_0000018F79D08AA0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_0000018F79D10A10	5_2_0000018F79D10A10
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_0000018F79CF7D70	5_2_0000018F79CF7D70
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_0000018F79D0AD51	5_2_0000018F79D0AD51
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_0000018F79D14520	5_2_0000018F79D14520
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_0000018F79D0ACD0	5_2_0000018F79D0ACD0
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_0000018F79CFE700	5_2_0000018F79CFE700
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_0000018F79D02EF0	5_2_0000018F79D02EF0

Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: String function: 00AD8F00 appears 176 times
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: String function: 00AD9720 appears 1386 times
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: String function: 00AEFC60 appears 38 times
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: String function: 00AD7400 appears 1016 times
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: String function: 00AEFBA0 appears 32 times
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: String function: 00AEFB00 appears 32 times
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: String function: 00AD74E0 appears 52 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00A27400 appears 508 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00A28F00 appears 88 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00A29720 appears 693 times

Source: 00000005.00000002.2434983215.000000C000180000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000002.00000002.3409842091.000000C000180000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000005.00000002.2435764747.0000018F78460000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000004.00000002.2350558821.00000261E5450000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000002.00000002.3410605768.0000026679980000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000004.00000002.2349782661.000000C000180000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000000.00000002.2177332111.000000C000180000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000000.00000002.2178027279.000001B278C10000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13

Source: classification engine

Classification label: mal100.troj.evad.mine.winEXE@5/1@2/1

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\Edge\

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Mutant created: \Sessions\1\BaseNamedObjects\{F8DE3DC4-75BA-41B5-AAA0-72BEB2254E92}
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Mutant created: \Sessions\1\BaseNamedObjects\{201D2E18-90F7-4B7A-B82B-6FF56BC5C891}
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Mutant created: \Sessions\1\BaseNamedObjects\{D2F471D6-04FC-452D-BFE5-E6CA5D7676C4}
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Mutant created: \Sessions\1\BaseNamedObjects\{9559844D-7F94-49DE-971B-013ECDA3550E}
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Mutant created: \Sessions\1\BaseNamedObjects\{2BCF8665-0CFD-491A-9C88-1B848948EC08}

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Windows\system32\1540f5beb3236a6a3ae461a727ff5cab6cda68073f5022edeecd799d7b90531dAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	File opened: C:\Windows\system32\cd7370b541f81c6e63571b7c4178dc3fd003c0098fefb3d855eb17b20e3164bcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	File opened: C:\Windows\system32\0ddda059f12607f1fa5eb7d94f3736249f72f462429f6c2bfd59b67060fe32f1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	File opened: C:\Windows\system32\e4b43d036c60d98b37efca81f08fd9a3fa61ae198d475cb67cccfb92dddf7fc8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA	Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 15%

Source: file.exe	String found in binary or memory: ) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime:
Source: file.exe	String found in binary or memory: ) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime:
Source: file.exe	String found in binary or memory: lfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime:
Source: file.exe	String found in binary or memory: lfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime:
Source: file.exe	String found in binary or memory: /sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime:
Source: file.exe	String found in binary or memory: /sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime:
Source: file.exe	String found in binary or memory: uncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime:
Source: file.exe	String found in binary or memory: uncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime:
Source: file.exe	String found in binary or memory: runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable t
Source: file.exe	String found in binary or memory: runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable t
Source: file.exe	String found in binary or memory: /memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime:
Source: file.exe	String found in binary or memory: /memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime:
Source: file.exe	String found in binary or memory: runtime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:sec
Source: file.exe	String found in binary or memory: runtime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:sec
Source: file.exe	String found in binary or memory: concurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:sec
Source: file.exe	String found in binary or memory: concurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:sec
Source: file.exe	String found in binary or memory: /cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.ins
Source: file.exe	String found in binary or memory: /cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.ins
Source: file.exe	String found in binary or memory: /cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power
Source: file.exe	String found in binary or memory: /cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power
Source: file.exe	String found in binary or memory: /memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent loc
Source: file.exe	String found in binary or memory: /memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent loc
Source: file.exe	String found in binary or memory: /gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus old
Source: file.exe	String found in binary or memory: /gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus old
Source: file.exe	String found in binary or memory: /sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack
Source: file.exe	String found in binary or memory: /sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack
Source: file.exe	String found in binary or memory: /memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspin
Source: file.exe	String found in binary or memory: /memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspin
Source: Edge.exe	String found in binary or memory: ) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime:
Source: Edge.exe	String found in binary or memory: ) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime:
Source: Edge.exe	String found in binary or memory: lfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime:
Source: Edge.exe	String found in binary or memory: lfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime:
Source: Edge.exe	String found in binary or memory: /sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime:
Source: Edge.exe	String found in binary or memory: /sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime:
Source: Edge.exe	String found in binary or memory: uncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime:
Source: Edge.exe	String found in binary or memory: uncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime:
Source: Edge.exe	String found in binary or memory: runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable t
Source: Edge.exe	String found in binary or memory: runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable t
Source: Edge.exe	String found in binary or memory: /memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime:
Source: Edge.exe	String found in binary or memory: /memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime:
Source: Edge.exe	String found in binary or memory: runtime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:sec
Source: Edge.exe	String found in binary or memory: runtime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:sec
Source: Edge.exe	String found in binary or memory: concurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:sec
Source: Edge.exe	String found in binary or memory: concurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:sec
Source: Edge.exe	String found in binary or memory: /cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.ins
Source: Edge.exe	String found in binary or memory: /cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.ins
Source: Edge.exe	String found in binary or memory: /cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power
Source: Edge.exe	String found in binary or memory: /cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power
Source: Edge.exe	String found in binary or memory: /memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent loc
Source: Edge.exe	String found in binary or memory: /memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent loc
Source: Edge.exe	String found in binary or memory: /gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus old
Source: Edge.exe	String found in binary or memory: /gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus old
Source: Edge.exe	String found in binary or memory: /sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack
Source: Edge.exe	String found in binary or memory: /sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack
Source: Edge.exe	String found in binary or memory: /memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspin
Source: Edge.exe	String found in binary or memory: /memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspin
Source: Edge.exe	String found in binary or memory: ) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime:
Source: Edge.exe	String found in binary or memory: ) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime:
Source: Edge.exe	String found in binary or memory: lfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime:
Source: Edge.exe	String found in binary or memory: lfstack node allocated from the heap) is larger than maximum page size (runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime:
Source: Edge.exe	String found in binary or memory: /sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime:
Source: Edge.exe	String found in binary or memory: /sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime: sudog with non-nil waitlinkruntime:
Source: Edge.exe	String found in binary or memory: uncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime:
Source: Edge.exe	String found in binary or memory: uncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime:
Source: Edge.exe	String found in binary or memory: runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable t
Source: Edge.exe	String found in binary or memory: runtime: invalid typeBitsBulkBarrieruncaching span but s.allocCount == 0/memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable t
Source: Edge.exe	String found in binary or memory: /memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime:
Source: Edge.exe	String found in binary or memory: /memory/classes/metadata/other:bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescUnable to determine system directoryruntime: VirtualQuery failed; errno=runtime:
Source: Edge.exe	String found in binary or memory: runtime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:sec
Source: Edge.exe	String found in binary or memory: runtime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:sec
Source: Edge.exe	String found in binary or memory: concurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:sec
Source: Edge.exe	String found in binary or memory: concurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:sec
Source: Edge.exe	String found in binary or memory: /cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.ins
Source: Edge.exe	String found in binary or memory: /cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.ins
Source: Edge.exe	String found in binary or memory: /cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power
Source: Edge.exe	String found in binary or memory: /cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power
Source: Edge.exe	String found in binary or memory: /memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent loc
Source: Edge.exe	String found in binary or memory: /memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent loc
Source: Edge.exe	String found in binary or memory: /gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus old
Source: Edge.exe	String found in binary or memory: /gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus old
Source: Edge.exe	String found in binary or memory: /sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack
Source: Edge.exe	String found in binary or memory: /sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack
Source: Edge.exe	String found in binary or memory: /memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspin
Source: Edge.exe	String found in binary or memory: /memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspin
Source: file.exe	String found in binary or memory: unsafe.String: len out of rangeCertDuplicateCertificateContextSetupDiGetDeviceInfoListDetailW11368683772161602973937988281255684341886080801486968994140625resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyMapIter.Value called before Nextslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceGCProg for type that isn't largeruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = WSAGetOverlappedResult not found_cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevruntime: mcall function returnedruntime: newstack called from g=runtime: stack split at bad timepanic while printing panic valueruntime: setevent failed; errno=runtime.semasleep wait_abandoneduse of closed network connectionGetVolumePathNamesForVolumeNameWfail to seek to string table: %vfail to seek to symbol table: %v28421709430404007434844970703125crypto/aes: input not full block" not supported for cpu option "too many levels of symbolic linksInitializeProcThreadAttributeListreflect: slice index out of range of method on nil interface valuereflect: Field index out of rangereflect: array index out of rangebytes.Reader.Seek: invalid whenceskip everything and stop the walkGetVolumeNameForVolumeMountPointWslice bounds out of range [%x:%y]base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativeruntime: name offset out of rangeruntime: type offset out of rangewaiting for unsupported file typeCryptAcquireCertificatePrivateKeySetupDiGetDeviceRegistryPropertyWSetupDiSetDeviceRegistryPropertyWfail to read relocation block: %v142108547152020037174224853515625710542735760100185871124267578125crypto/aes: output not full blockGODEBUG: no value specified for "leafCounts[maxBits][maxBits] != ntoo many references: cannot spliceSetFileCompletionNotificationModesreflect: Field of non-struct type reflect: Field index out of boundsreflect: string index out of rangeillegal
Source: file.exe	String found in binary or memory: unsafe.String: len out of rangeCertDuplicateCertificateContextSetupDiGetDeviceInfoListDetailW11368683772161602973937988281255684341886080801486968994140625resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyMapIter.Value called before Nextslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceGCProg for type that isn't largeruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = WSAGetOverlappedResult not found_cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevruntime: mcall function returnedruntime: newstack called from g=runtime: stack split at bad timepanic while printing panic valueruntime: setevent failed; errno=runtime.semasleep wait_abandoneduse of closed network connectionGetVolumePathNamesForVolumeNameWfail to seek to string table: %vfail to seek to symbol table: %v28421709430404007434844970703125crypto/aes: input not full block" not supported for cpu option "too many levels of symbolic linksInitializeProcThreadAttributeListreflect: slice index out of range of method on nil interface valuereflect: Field index out of rangereflect: array index out of rangebytes.Reader.Seek: invalid whenceskip everything and stop the walkGetVolumeNameForVolumeMountPointWslice bounds out of range [%x:%y]base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanList.insert runtime: castogscanstatus oldval=stoplockedm: inconsistent lockingfindrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativeruntime: name offset out of rangeruntime: type offset out of rangewaiting for unsupported file typeCryptAcquireCertificatePrivateKeySetupDiGetDeviceRegistryPropertyWSetupDiSetDeviceRegistryPropertyWfail to read relocation block: %v142108547152020037174224853515625710542735760100185871124267578125crypto/aes: output not full blockGODEBUG: no value specified for "leafCounts[maxBits][maxBits] != ntoo many references: cannot spliceSetFileCompletionNotificationModesreflect: Field of non-struct type reflect: Field index out of boundsreflect: string index out of rangeillegal
Source: file.exe	String found in binary or memory: net/addrselect.go

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Roaming\Edge\Edge.exe "C:\Users\user\AppData\Roaming\Edge\Edge.exe" {6B387F7B-F5A9-4597-ABB2-EB1AC679F320}
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Edge\Edge.exe "C:\Users\user\AppData\Roaming\Edge\Edge.exe" {5E0DB032-E9D6-4C1D-A145-C083BA9C5AAA}
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Edge\Edge.exe "C:\Users\user\AppData\Roaming\Edge\Edge.exe" {5E0DB032-E9D6-4C1D-A145-C083BA9C5AAA}
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Roaming\Edge\Edge.exe "C:\Users\user\AppData\Roaming\Edge\Edge.exe" {6B387F7B-F5A9-4597-ABB2-EB1AC679F320}	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Section loaded: sspicli.dll	Jump to behavior

Source: file.exe

Static file information: File size 2482176 > 1048576

Source: file.exe

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x175000

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: file.exe	Static PE information: section name: .xdata
Source: file.exe	Static PE information: section name: .symtab
Source: Edge.exe.0.dr	Static PE information: section name: .xdata
Source: Edge.exe.0.dr	Static PE information: section name: .symtab

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\Edge\Edge.exe

Jump to dropped file

Boot Survival

Creates autostart registry keys with suspicious names

Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run {AB1F3E47-AEF1-400E-A108-233A046C3A34}

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run {AB1F3E47-AEF1-400E-A108-233A046C3A34}			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run {AB1F3E47-AEF1-400E-A108-233A046C3A34}			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\{68A1BBBA-1552-44A8-955F-BE6CBFD1BFA8} {5CD9FA9E-C629-40A5-B53C-5627575F9471}

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\file.exe	API/Special instruction interceptor: Address: AAE94B
Source: C:\Users\user\Desktop\file.exe	API/Special instruction interceptor: Address: AAEA0D
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	API/Special instruction interceptor: Address: B5E94B
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	API/Special instruction interceptor: Address: B5EA0D

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A56440 rdtscp

0_2_00A56440

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess

graph_0-57295

Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe TID: 776	Thread sleep count: 55 > 30			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe TID: 776	Thread sleep time: -55000s >= -30000s			Jump to behavior

Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A23240 GetProcessAffinityMask,GetSystemInfo,

0_2_00A23240

Source: file.exe, 00000000.00000002.2177552989.000001B233845000.00000004.00000020.00020000.00000000.sdmp, Edge.exe, 00000002.00000002.3409909564.0000026654384000.00000004.00000020.00020000.00000000.sdmp, Edge.exe, 00000004.00000002.2349979823.00000261DFE8E000.00000004.00000020.00020000.00000000.sdmp, Edge.exe, 00000005.00000002.2435167248.0000018F72FAE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Anti Debugging

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A56440 Start: 00A56449 End: 00A5645F	0_2_00A56440
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 2_2_00B06440 Start: 00B06449 End: 00B0645F	2_2_00B06440
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	Code function: 5_2_00B06440 Start: 00B06449 End: 00B0645F	5_2_00B06440

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A56440 rdtscp

0_2_00A56440

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\file.exe	NtMapViewOfSection: Indirect: 0x1B278C80F03	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	NtMapViewOfSection: Indirect: 0x1B278C809C6	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	NtUnmapViewOfSection: Indirect: 0x266799F0E97	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	NtMapViewOfSection: Indirect: 0x261E54C0F03	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	NtDelayExecution: Direct from: 0xB5EA0D	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	NtMapViewOfSection: Indirect: 0x261E54C09C6	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	NtMapViewOfSection: Indirect: 0x266799F0F03	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	NtMapViewOfSection: Indirect: 0x266799F09C6	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	NtMapViewOfSection: Indirect: 0x18F784D0F03	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	NtMapViewOfSection: Indirect: 0x18F784D09C6	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	NtUnmapViewOfSection: Indirect: 0x1B278C80E97	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	NtDelayExecution: Direct from: 0xAAE94B	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	NtDelayExecution: Direct from: 0xB5E94B	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	NtUnmapViewOfSection: Indirect: 0x261E54C0E97	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe	NtUnmapViewOfSection: Indirect: 0x18F784D0E97	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Edge\Edge.exe

Code function: 2_2_000002667B1C41A0 GetUserGeoID,gethostname,gethostbyname,GetUserNameW,

2_2_000002667B1C41A0

Stealing of Sensitive Information

Yara detected DarkVision Rat

Source: Yara match	File source: Process Memory Space: file.exe PID: 3776, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Edge.exe PID: 7020, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Edge.exe PID: 3192, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Edge.exe PID: 6052, type: MEMORYSTR

Remote Access Functionality

Yara detected DarkVision Rat

Source: Yara match	File source: Process Memory Space: file.exe PID: 3776, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Edge.exe PID: 7020, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Edge.exe PID: 3192, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Edge.exe PID: 6052, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	211 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Modify Registry	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Registry Run Keys / Startup Folder	1 Virtualization/Sandbox Evasion	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Process Injection	NTDS	1 System Owner/User Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	12 System Information Discovery	SSH	Keylogging	11 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Abuse Elevation Control Mechanism	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	16%	ReversingLabs
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Edge\Edge.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Edge\Edge.exe	16%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fishcrabs99.ddns.net	178.215.224.241	true	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
178.215.224.241	fishcrabs99.ddns.net	Germany		10753	LVLT-10753US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544033
Start date and time:	2024-10-28 18:26:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.mine.winEXE@5/1@2/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 108 Number of non-executed functions: 116
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, login.live.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
13:27:52	API Interceptor	96x Sleep call for process: Edge.exe modified
18:27:13	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run {AB1F3E47-AEF1-400E-A108-233A046C3A34} C:\Users\user\AppData\Roaming\Edge\Edge.exe {5E0DB032-E9D6-4C1D-A145-C083BA9C5AAA}
18:27:21	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run {AB1F3E47-AEF1-400E-A108-233A046C3A34} C:\Users\user\AppData\Roaming\Edge\Edge.exe {5E0DB032-E9D6-4C1D-A145-C083BA9C5AAA}

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LVLT-10753US	nabspc.elf	Get hash	malicious	Unknown	Browse	217.22.7.30
	splsh4.elf	Get hash	malicious	Unknown	Browse	168.215.79.153
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	148.57.98.32
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	212.87.197.98
	w18Ys8qKuX.elf	Get hash	malicious	Unknown	Browse	168.215.50.172
	keldRUiaay.elf	Get hash	malicious	Mirai	Browse	147.207.101.215
	ai3eCONS9Q.elf	Get hash	malicious	Mirai	Browse	94.154.174.114
	i686.elf	Get hash	malicious	Unknown	Browse	178.215.238.10
	oodforme.doc	Get hash	malicious	Remcos	Browse	178.215.224.176
	172966320624e13c69130942cdd5d6acfaaa0a3c37caf1b0782206d6657ac60035e08c695d630.dat-decoded.exe	Get hash	malicious	Remcos	Browse	178.215.224.176

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Roaming\Edge\Edge.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2482176
Entropy (8bit):	6.547362799877085
Encrypted:	false
SSDEEP:	24576:VmbfFJN3P6yM97l2cMPdjjy/ZIbRCTtM+UcI6TRq3jUN6DMhQKjyJ9IFz1uXy:k7N3P6ykZ2cmjjalM+E3SMQJW
MD5:	F01ED03B7A786C24EBD92EAB9B441B9D
SHA1:	891C8EF7B9EF32E9D4DE3EE473186CD4BA66059F
SHA-256:	6DC5FCBD3D05CB11DC4731AEA996C7CBC213253C4D4B119799C5DDEDEBE537FB
SHA-512:	A8041C03E9FD9AB1C2BF4BB6FDE3948C803B1592E24FDD112387249B83DFF0309D14BE6D7BDD19A4D1C5FEE3B931E45B13C361E38AC15358AFA7B82652CF55E4
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 16%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.........%......."......P...........{........@...........................................`... ..............................................P..T.............-..O...........`..PE....................................................#..............................text...VO.......P.................. ..`.rdata..HN...`...P...V..............@..@.data....9....#.......#.............@....pdata...O....-..P...@%.............@..@.xdata.......@........%.............@..@.idata..T....P........%.............@....reloc..PE...`...F....%.............@..B.symtab...............%................B................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.547362799877085
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'482'176 bytes
MD5:	f01ed03b7a786c24ebd92eab9b441b9d
SHA1:	891c8ef7b9ef32e9d4de3ee473186cd4ba66059f
SHA256:	6dc5fcbd3d05cb11dc4731aea996c7cbc213253c4d4b119799c5ddedebe537fb
SHA512:	a8041c03e9fd9ab1c2bf4bb6fde3948c803b1592e24fdd112387249b83dff0309d14be6d7bdd19a4d1c5fee3b931e45b13c361e38ac15358afa7b82652cf55e4
SSDEEP:	24576:VmbfFJN3P6yM97l2cMPdjjy/ZIbRCTtM+UcI6TRq3jUN6DMhQKjyJ9IFz1uXy:k7N3P6ykZ2cmjjalM+E3SMQJW
TLSH:	1FB58D0BBDE448B5D0AA9332896691567A31BC544F3263D73B90B3BC3FB2BD06A75704
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.........%......."......P...........{........@...........................................`... ............................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x467b80
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	c2d457ad8ac36fc9f18d45bffcd450c2

Entrypoint Preview

Instruction
jmp 00007EFC84B21F00h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
dec eax
mov ebp, esp
pushfd
cld
dec eax
sub esp, 000000E0h
dec eax
mov dword ptr [esp], edi
dec eax
mov dword ptr [esp+08h], esi
dec eax
mov dword ptr [esp+10h], ebp
dec eax
mov dword ptr [esp+18h], ebx
dec esp
mov dword ptr [esp+20h], esp
dec esp
mov dword ptr [esp+28h], ebp
dec esp
mov dword ptr [esp+30h], esi
dec esp
mov dword ptr [esp+38h], edi
movups dqword ptr [esp+40h], xmm6
movups dqword ptr [esp+50h], xmm7
inc esp
movups dqword ptr [esp+60h], xmm0
inc esp
movups dqword ptr [esp+70h], xmm1
inc esp
movups dqword ptr [esp+00000080h], xmm2
inc esp
movups dqword ptr [esp+00000090h], xmm3
inc esp
movups dqword ptr [esp+000000A0h], xmm4
inc esp
movups dqword ptr [esp+000000B0h], xmm5
inc esp
movups dqword ptr [esp+000000C0h], xmm6
inc esp
movups dqword ptr [esp+000000D0h], xmm7
inc ebp
xorps xmm7, xmm7
dec ebp
xor esi, esi
dec eax
mov eax, dword ptr [00273292h]
dec eax
mov eax, dword ptr [eax]
dec eax
cmp eax, 00000000h
je 00007EFC84B257A5h
dec esp
mov esi, dword ptr [eax]
dec eax
sub esp, 10h
dec eax
mov eax, ecx
dec eax
mov ebx, edx
call 00007EFC84B2897Bh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e5000	0x554	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x2df000	0x4f80	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e6000	0x4550	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23b2c0	0x180	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xc4f56	0xc5000	f85ed6485f5f341b3bfbfb5ae146eb33	False	0.45797311230964466	data	6.328756615813412	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xc6000	0x174e48	0x175000	80890c89e7b14da192af4f0d2176e2bb	False	0.5579961618213807	data	6.275020134818021	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x23b000	0xa39a0	0x19a00	509af2b069c52edeca952f993de59ff7	False	0.3520865091463415	data	3.8801574277109085	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x2df000	0x4f80	0x5000	a25d14af5f938a1b681ef469fec4e055	False	0.404931640625	data	5.202052188261448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0x2e4000	0xb4	0x200	2a441ced7959d453af803daaa7e3d98a	False	0.2265625	shared library	1.787112262798912	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata	0x2e5000	0x554	0x600	caf70aed9e8209f6f72fbe542260dad3	False	0.380859375	data	4.006464998139286	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x2e6000	0x4550	0x4600	aa41c0b0e4d4eed7b16333031ee89fed	False	0.32042410714285713	data	5.426941412781997	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.symtab	0x2eb000	0x4	0x200	07b5472d347d42780469fb2654b7fc54	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

kernel32.dll

WriteFile, WriteConsoleW, WerSetFlags, WerGetFlags, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, TlsAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, RtlVirtualUnwind, RtlLookupFunctionEntry, ResumeThread, RaiseFailFastException, PostQueuedCompletionStatus, LoadLibraryW, LoadLibraryExW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetErrorMode, GetEnvironmentStringsW, GetCurrentThreadId, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateFileA, CreateEventA, CloseHandle, AddVectoredExceptionHandler, AddVectoredContinueHandler

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-28T18:27:14.832287+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.6	49705	178.215.224.241	5589	TCP
2024-10-28T18:27:15.267682+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.6	49705	178.215.224.241	5589	TCP
2024-10-28T18:27:18.876125+0100	2045619	ET MALWARE Win32/DarkVision RAT CnC Checkin M3	1	192.168.2.6	49705	178.215.224.241	5589	TCP
2024-10-28T18:27:21.568738+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.6	49708	178.215.224.241	5589	TCP
2024-10-28T18:27:24.579334+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.6	49708	178.215.224.241	5589	TCP
2024-10-28T18:27:25.814191+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.6	49710	178.215.224.241	5589	TCP
2024-10-28T18:27:26.904465+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.6	49717	178.215.224.241	5589	TCP
2024-10-28T18:27:27.990523+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.6	49726	178.215.224.241	5589	TCP
2024-10-28T18:27:29.065178+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.6	49735	178.215.224.241	5589	TCP
2024-10-28T18:27:30.241808+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.6	49742	178.215.224.241	5589	TCP
2024-10-28T18:28:25.021247+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.6	49908	178.215.224.241	5589	TCP
2024-10-28T18:28:26.309555+0100	2045619	ET MALWARE Win32/DarkVision RAT CnC Checkin M3	1	192.168.2.6	49908	178.215.224.241	5589	TCP
2024-10-28T18:28:26.665782+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.6	49918	178.215.224.241	5589	TCP
2024-10-28T18:28:27.934942+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.6	49924	178.215.224.241	5589	TCP
2024-10-28T18:28:29.007585+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.6	49932	178.215.224.241	5589	TCP
2024-10-28T18:28:30.079258+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.6	49940	178.215.224.241	5589	TCP
2024-10-28T18:28:31.161043+0100	2045618	ET MALWARE Win32/DarkVision RAT CnC Checkin M1	1	192.168.2.6	49948	178.215.224.241	5589	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 18:27:14.689480066 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:14.831177950 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:14.831446886 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:14.832287073 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:15.267682076 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:15.428659916 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:16.239568949 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:16.239722967 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:16.381685019 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:16.841222048 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:16.841412067 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:17.236537933 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:17.642654896 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:17.909189939 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:17.909488916 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:18.439502001 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:18.598802090 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:18.827305079 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:18.876125097 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:19.009028912 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:19.009128094 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:19.361388922 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:19.705156088 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:19.849839926 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:20.079778910 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:20.126991034 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:20.192632914 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:20.194881916 CET	49708	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:20.236464977 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:20.303309917 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:20.345844984 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:21.205194950 CET	49708	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:21.273988962 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:21.327788115 CET	5589	49708	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:21.328063965 CET	49708	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:21.330877066 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:21.568737984 CET	49708	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:22.289984941 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:22.330245972 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:22.933101892 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:22.933262110 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:23.306171894 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:23.351057053 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:24.357512951 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:24.402779102 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:24.579334021 CET	49708	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:24.792223930 CET	49708	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:24.796257973 CET	49710	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:24.959230900 CET	5589	49708	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:25.199403048 CET	5589	49708	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:25.199512959 CET	49708	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:25.346029043 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:25.402019978 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:25.653131008 CET	5589	49708	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:25.653301001 CET	49708	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:25.808329105 CET	49710	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:25.813808918 CET	5589	49710	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:25.813992023 CET	49710	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:25.814191103 CET	49710	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:25.819999933 CET	5589	49710	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:26.346551895 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:26.402163029 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:26.663857937 CET	5589	49710	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:26.664001942 CET	49710	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:26.669687986 CET	5589	49710	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:26.896924019 CET	5589	49710	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:26.897639990 CET	49717	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:26.903309107 CET	5589	49717	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:26.903402090 CET	49717	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:26.904464960 CET	49717	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:26.910185099 CET	5589	49717	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:26.964536905 CET	49710	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:27.355581045 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:27.417587042 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:27.741226912 CET	5589	49717	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:27.741411924 CET	49717	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:27.747673988 CET	5589	49717	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:27.983715057 CET	5589	49717	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:27.984764099 CET	49726	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:27.990276098 CET	5589	49726	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:27.990369081 CET	49726	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:27.990523100 CET	49726	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:27.996923923 CET	5589	49726	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:28.026999950 CET	49717	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:28.358155012 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:28.402066946 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:28.820591927 CET	5589	49726	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:28.820775032 CET	49726	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:28.826173067 CET	5589	49726	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:29.056844950 CET	5589	49726	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:29.058490992 CET	49735	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:29.063834906 CET	5589	49735	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:29.065063953 CET	49735	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:29.065177917 CET	49735	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:29.070974112 CET	5589	49735	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:29.105067015 CET	49726	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:29.368536949 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:29.417638063 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:29.903242111 CET	5589	49735	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:29.905298948 CET	49735	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:29.910677910 CET	5589	49735	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:30.146635056 CET	5589	49735	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:30.198837042 CET	49735	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:30.228883028 CET	49742	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:30.234239101 CET	5589	49742	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:30.236885071 CET	49742	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:30.241807938 CET	49742	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:30.247247934 CET	5589	49742	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:30.383208990 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:30.437218904 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:31.105932951 CET	5589	49742	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:31.110033035 CET	49742	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:31.115721941 CET	5589	49742	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:31.351700068 CET	5589	49742	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:31.383163929 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:31.393049955 CET	49742	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:31.433485031 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:32.399024010 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:32.449424982 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:33.415095091 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:33.455825090 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:34.429920912 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:34.471522093 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:35.430073023 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:35.471498966 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:36.445051908 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:36.487066031 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:37.445830107 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:37.487027884 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:38.462260008 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:38.518325090 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:39.461194992 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:39.502769947 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:40.525562048 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:40.565392971 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:41.481220007 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:41.533922911 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:42.493305922 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:42.533951998 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:43.492679119 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:43.533979893 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:44.510588884 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:44.565287113 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:46.368372917 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:46.369472027 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:46.369529963 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:46.524373055 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:46.566747904 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:47.524209023 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:47.565196991 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:48.524020910 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:48.565176964 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:49.540486097 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:49.580957890 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:50.539943933 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:50.580846071 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:51.556627989 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:51.598866940 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:52.570476055 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:52.612065077 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:53.571187019 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:53.612107038 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:54.587594986 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:54.627814054 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:55.604367018 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:55.658926964 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:56.601628065 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:56.643335104 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:57.602473974 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:57.643296003 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:58.617187023 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:58.658921003 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:27:59.633025885 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:27:59.674635887 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:00.635874987 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:00.690227985 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:01.633419037 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:01.674621105 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:02.649240017 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:02.703191042 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:03.664702892 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:03.707063913 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:04.681329012 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:04.721416950 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:05.680108070 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:05.721498966 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:06.680365086 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:06.721429110 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:07.760174036 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:07.815207005 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:08.785900116 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:08.830818892 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:09.774708986 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:09.815190077 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:10.790467024 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:10.831407070 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:11.804884911 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:11.847191095 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:12.806659937 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:12.850898981 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:13.821386099 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:13.862648010 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:14.836899042 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:14.878449917 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:15.837251902 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:15.878309011 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:16.851234913 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:16.893914938 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:17.978156090 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:18.034544945 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:18.992527962 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:19.034548044 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:19.992419958 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:20.034684896 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:20.972212076 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:20.972345114 CET	49710	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:20.972431898 CET	49717	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:20.972471952 CET	49726	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:20.972510099 CET	49735	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:20.972537041 CET	49742	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:20.978884935 CET	5589	49705	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:20.978950977 CET	49705	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:20.978981972 CET	5589	49710	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:20.978993893 CET	5589	49717	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:20.979007959 CET	5589	49726	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:20.979029894 CET	49710	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:20.979062080 CET	49717	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:20.979063988 CET	5589	49735	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:20.979074955 CET	5589	49742	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:20.979074955 CET	49726	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:20.979129076 CET	49735	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:20.979141951 CET	49742	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:25.015336037 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:25.020996094 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:25.021104097 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:25.021246910 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:25.026690006 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:25.836482048 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:25.836922884 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:25.842734098 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:26.070249081 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:26.070422888 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:26.075965881 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:26.076060057 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:26.082035065 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:26.309365988 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:26.309555054 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:26.315123081 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:26.315196037 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:26.320626020 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:26.549150944 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:26.597068071 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:26.657862902 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:26.659817934 CET	49918	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:26.665505886 CET	5589	49918	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:26.665595055 CET	49918	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:26.665781975 CET	49918	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:26.671451092 CET	5589	49918	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:26.706427097 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:27.069051981 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:27.112688065 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:27.495012045 CET	5589	49918	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:27.530141115 CET	49918	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:27.535898924 CET	5589	49918	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:27.928512096 CET	5589	49918	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:27.929379940 CET	49924	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:27.934745073 CET	5589	49924	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:27.934808969 CET	49924	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:27.934942007 CET	49924	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:27.940359116 CET	5589	49924	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:27.972059011 CET	49918	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:28.069526911 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:28.112662077 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:28.761718988 CET	5589	49924	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:28.761914968 CET	49924	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:28.767379999 CET	5589	49924	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:29.001065969 CET	5589	49924	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:29.001853943 CET	49932	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:29.007389069 CET	5589	49932	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:29.007466078 CET	49932	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:29.007585049 CET	49932	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:29.012962103 CET	5589	49932	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:29.050167084 CET	49924	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:29.084770918 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:29.128292084 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:29.833540916 CET	5589	49932	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:29.833678007 CET	49932	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:29.839143991 CET	5589	49932	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:30.072923899 CET	5589	49932	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:30.073683977 CET	49940	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:30.079081059 CET	5589	49940	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:30.079171896 CET	49940	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:30.079257965 CET	49940	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:30.084958076 CET	5589	49940	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:30.085247993 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:30.128319025 CET	49932	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:30.128463984 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:30.913430929 CET	5589	49940	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:30.913738012 CET	49940	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:30.919199944 CET	5589	49940	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:31.100595951 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:31.143923044 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:31.154639006 CET	5589	49940	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:31.155428886 CET	49948	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:31.160873890 CET	5589	49948	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:31.160950899 CET	49948	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:31.161042929 CET	49948	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:31.166605949 CET	5589	49948	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:31.206440926 CET	49940	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:31.973566055 CET	5589	49948	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:31.989115000 CET	49948	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:31.994673967 CET	5589	49948	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:32.103739023 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:32.143929958 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:32.320755959 CET	5589	49948	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:32.362730026 CET	49948	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:33.222168922 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:33.268925905 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:34.210621119 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:34.253325939 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:35.228840113 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:35.268949032 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:36.240828037 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:36.284532070 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:37.242064953 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:37.284569025 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:38.257520914 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:38.300208092 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:39.273041964 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:39.315830946 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:40.288667917 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:40.331418991 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:41.289789915 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:41.331434965 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:42.303534985 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:42.347078085 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:43.319921970 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:43.362684011 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:44.428685904 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:44.472099066 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:45.414299965 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:45.456439972 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:46.592811108 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:46.643938065 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:47.444144964 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:47.487674952 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:49.049392939 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:49.050095081 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:49.050177097 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:49.050518990 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:49.050573111 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:49.444339991 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:49.487710953 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:50.447957039 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:50.503348112 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:52.415832996 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:52.416486025 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:52.416548967 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:52.417016983 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:52.417064905 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:52.600887060 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:52.643937111 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:53.607338905 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:53.659578085 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:54.617733002 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:54.659584045 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:55.632427931 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:55.675184965 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:56.647730112 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:56.690874100 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:57.665004969 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:57.706537962 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:58.665138006 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:58.706461906 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:28:59.679851055 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:28:59.722109079 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:29:00.694411039 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:29:00.737793922 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:29:01.711178064 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:29:01.753343105 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:29:02.714598894 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:29:02.769015074 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:29:03.727596998 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:29:03.769025087 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:29:04.888395071 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:29:04.940840960 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:29:05.192584991 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:29:05.192682981 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:29:05.897360086 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:29:05.940908909 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:29:06.897284031 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:29:06.941035032 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:29:07.897619009 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:29:07.940831900 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:29:08.912900925 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:29:08.956511021 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:29:09.916237116 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:29:09.972115993 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:29:10.928601980 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:29:10.972738981 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:29:11.934185982 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:29:11.988421917 CET	49908	5589	192.168.2.6	178.215.224.241
Oct 28, 2024 18:29:12.944536924 CET	5589	49908	178.215.224.241	192.168.2.6
Oct 28, 2024 18:29:12.988365889 CET	49908	5589	192.168.2.6	178.215.224.241

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 18:27:14.498375893 CET	49879	53	192.168.2.6	1.1.1.1
Oct 28, 2024 18:27:14.651345015 CET	53	49879	1.1.1.1	192.168.2.6
Oct 28, 2024 18:28:25.004865885 CET	55971	53	192.168.2.6	1.1.1.1
Oct 28, 2024 18:28:25.014700890 CET	53	55971	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 28, 2024 18:27:14.498375893 CET	192.168.2.6	1.1.1.1	0x6475	Standard query (0)	fishcrabs99.ddns.net	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:28:25.004865885 CET	192.168.2.6	1.1.1.1	0x9507	Standard query (0)	fishcrabs99.ddns.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 28, 2024 18:27:14.651345015 CET	1.1.1.1	192.168.2.6	0x6475	No error (0)	fishcrabs99.ddns.net		178.215.224.241	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:28:25.014700890 CET	1.1.1.1	192.168.2.6	0x9507	No error (0)	fishcrabs99.ddns.net		178.215.224.241	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	13:27:04
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x9f0000
File size:	2'482'176 bytes
MD5 hash:	F01ED03B7A786C24EBD92EAB9B441B9D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.2177332111.000000C000180000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000000.00000002.2178027279.000001B278C10000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:27:06
Start date:	28/10/2024
Path:	C:\Users\user\AppData\Roaming\Edge\Edge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Edge\Edge.exe" {6B387F7B-F5A9-4597-ABB2-EB1AC679F320}
Imagebase:	0xaa0000
File size:	2'482'176 bytes
MD5 hash:	F01ED03B7A786C24EBD92EAB9B441B9D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000002.00000002.3409842091.000000C000180000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000002.00000002.3410605768.0000026679980000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 16%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	13:27:21
Start date:	28/10/2024
Path:	C:\Users\user\AppData\Roaming\Edge\Edge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Edge\Edge.exe" {5E0DB032-E9D6-4C1D-A145-C083BA9C5AAA}
Imagebase:	0xaa0000
File size:	2'482'176 bytes
MD5 hash:	F01ED03B7A786C24EBD92EAB9B441B9D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Go lang
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000004.00000002.2350558821.00000261E5450000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000004.00000002.2349782661.000000C000180000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:27:29
Start date:	28/10/2024
Path:	C:\Users\user\AppData\Roaming\Edge\Edge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Edge\Edge.exe" {5E0DB032-E9D6-4C1D-A145-C083BA9C5AAA}
Imagebase:	0xaa0000
File size:	2'482'176 bytes
MD5 hash:	F01ED03B7A786C24EBD92EAB9B441B9D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Go lang
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000005.00000002.2434983215.000000C000180000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000005.00000002.2435764747.0000018F78460000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	21.7%
Signature Coverage:	20.5%
Total number of Nodes:	1128
Total number of Limit Nodes:	101

Executed Functions

Function 000001B278C80808 Relevance: 16.8, APIs: 8, Strings: 1, Instructions: 1070memorynativeCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL ref: 000001B278C808D5
NtMapViewOfSection.NTDLL ref: 000001B278C809C0
VirtualAlloc.KERNELBASE ref: 000001B278C80DEB
NtUnmapViewOfSection.NTDLL ref: 000001B278C80E91
NtMapViewOfSection.NTDLL ref: 000001B278C80EFD
VirtualProtect.KERNELBASE ref: 000001B278C80F24
VirtualProtect.KERNELBASE ref: 000001B278C80FF8
VirtualProtect.KERNELBASE ref: 000001B278C8103B

Strings

@, xrefs: 000001B278C808C3

Memory Dump Source

Source File: 00000000.00000002.2178027279.000001B278C10000.00000040.00000020.00020000.00000000.sdmp, Offset: 000001B278C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b278c10000_file.jbxd

Yara matches

Similarity

API ID: SectionVirtual$ProtectView$AllocCreateUnmap
String ID: @
API String ID: 1653215272-2766056989
Opcode ID: c637d99d209d1ca9699a6f6406458f9f86e5ddc939b9afbe853fcc5f8e29eda5
Instruction ID: 976ae001585e16b1e5c21a47c28f2f022087f06777f6181779b7885937eb4734
Opcode Fuzzy Hash: c637d99d209d1ca9699a6f6406458f9f86e5ddc939b9afbe853fcc5f8e29eda5
Instruction Fuzzy Hash: F672A830658B488FEB6DDF29C88A7E973D1FB68314F14462DD88ACB281DF70E9458B45

Function 009FCDC0 Relevance: 14.1, Strings: 11, Instructions: 384
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listcasgstatus: , xrefs: 009FD505
out of memory allocating heap arena metadata/cpu/classes/scavenge/background:cpu-secondsruntime: unexpected metric registration for gcmarknewobject called while doing checkmarkactive sweepers found at start of mark phaseno P available, write barriers are forbi, xrefs: 009FD176
out of memory allocating allArenas/memory/classes/heap/objects:bytesruntime.SetFinalizer: cannot pass too many pages allocated in chunk?mspan.ensureSwept: m is not lockedVirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning wit, xrefs: 009FD165
, )(M [("")) ) @s -> Pn=][}]> +25LlLtLuMn"\\?nilintmapptr... m=EOFfinobjgc %: gp *(in n= ) - NaN P MPC= < end > ]:???pc= G125625adxaesshaavxfmanetcgodnstcpudpfilereadseekopenpipebindtrueboolint8uintchanfunccallkind on allgallprootitabsbrkidled, xrefs: 009FD4E5
, xrefs: 009FD44F
arena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p , xrefs: 009FD187
base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-c, xrefs: 009FD431
out of memory allocating heap arena map/cpu/classes/gc/mark/assist:cpu-seconds/cpu/classes/scavenge/total:cpu-seconds/memory/classes/profiling/buckets:bytesmspan.sweep: bad span state after sweepruntime: blocked write on free polldescPowerRegisterSuspendResume, xrefs: 009FD198
memory reservation exceeds address space limittried to park scavenger from another goroutinereleased less than one physical page of memory (bad use of unsafe.Pointer? try -d=checkptr)sysGrow bounds not aligned to pallocChunkBytesruntime: failed to create new , xrefs: 009FD532
region exceeds uintptr range/gc/heap/frees-by-size:bytes/gc/heap/tiny/allocs:objects/sched/goroutines:goroutinesgcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: m, xrefs: 009FD407
end outside usable address spaceGCProg for type that isn't largeruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremo, xrefs: 009FD45F

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID: $) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listcasgstatus: $, )(M [("")) ) @s -> Pn=][}]> +25LlLtLuMn"\\?nilintmapptr... m=EOFfinobjgc %: gp *(in n= ) - NaN P MPC= < end > ]:???pc= G125625adxaesshaavxfmanetcgodnstcpudpfilereadseekopenpipebindtrueboolint8uintchanfunccallkind on allgallprootitabsbrkidled$arena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p $base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocconcurrent map read and map writeruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-c$end outside usable address spaceGCProg for type that isn't largeruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremo$memory reservation exceeds address space limittried to park scavenger from another goroutinereleased less than one physical page of memory (bad use of unsafe.Pointer? try -d=checkptr)sysGrow bounds not aligned to pallocChunkBytesruntime: failed to create new $out of memory allocating allArenas/memory/classes/heap/objects:bytesruntime.SetFinalizer: cannot pass too many pages allocated in chunk?mspan.ensureSwept: m is not lockedVirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning wit$out of memory allocating heap arena map/cpu/classes/gc/mark/assist:cpu-seconds/cpu/classes/scavenge/total:cpu-seconds/memory/classes/profiling/buckets:bytesmspan.sweep: bad span state after sweepruntime: blocked write on free polldescPowerRegisterSuspendResume$out of memory allocating heap arena metadata/cpu/classes/scavenge/background:cpu-secondsruntime: unexpected metric registration for gcmarknewobject called while doing checkmarkactive sweepers found at start of mark phaseno P available, write barriers are forbi$region exceeds uintptr range/gc/heap/frees-by-size:bytes/gc/heap/tiny/allocs:objects/sched/goroutines:goroutinesgcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: m
API String ID: 0-1345119885
Opcode ID: 700bc75013b752d390000daae56adac780d21d9f7be87efe6d8e797ecaec1c91
Instruction ID: 3785d66e78ce50daaec74d0d590b33e3119330a4c835be626bc8b21b2fdab6f4
Opcode Fuzzy Hash: 700bc75013b752d390000daae56adac780d21d9f7be87efe6d8e797ecaec1c91
Instruction Fuzzy Hash: 2E029A62309BC882EB64CB55F4407AAB765F78AB94F848226EF9D57799CF3CC444C740

Function 000001B27A4C1000 Relevance: 12.8, APIs: 8, Instructions: 790synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexExW.KERNELBASE ref: 000001B27A4C10CC
CreateMutexExW.KERNELBASE ref: 000001B27A4C1200
CreateMutexExW.KERNELBASE ref: 000001B27A4C12C3
CreateMutexExW.KERNELBASE ref: 000001B27A4C130D
_LDint.LIBCPMTD ref: 000001B27A4C13C5
_LDint.LIBCPMTD ref: 000001B27A4C1406
_LDint.LIBCPMTD ref: 000001B27A4C145E
ExitProcess.KERNEL32 ref: 000001B27A4C164B

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: CreateMutex$Dint$ExitProcess
String ID:
API String ID: 1692871624-0
Opcode ID: f98d3638bcb4881571893d0b64532fb7071e35af9423874bbb812e626070e764
Instruction ID: 2254e8a4bda405b6246ea12a0a364adaf23816b67e4c1fa3edcc2afe050a7c29
Opcode Fuzzy Hash: f98d3638bcb4881571893d0b64532fb7071e35af9423874bbb812e626070e764
Instruction Fuzzy Hash: 3F7274701096448FF7B4EB68D8687EA73E2FBA5315F60052DE18FC21A0DFB98584CB19

Function 009FD960 Relevance: 9.3, Strings: 7, Instructions: 547COMMON

Download Yara Rule

Strings

!"#$%%&&''((()))*++,,,,,------....//////0001123333333333444444444455666677777888888888889999999999::::::;;;;;;;;;;;;;;;;<<<<<<<<<<<<<<<<=====>>>>>>>>>>>??????????@@@@@@@@@@@@@@@@@@@@@@AAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC, xrefs: 009FDCF3
mallocgc called without a P or outside bootstrappingruntime.SetFinalizer: pointer not in allocated blockruntime: use of FixAlloc_Alloc before FixAlloc_Initspan set block with unpopped elements found in resetruntime: GetQueuedCompletionStatusEx failed (errno= , xrefs: 009FE1E5
malloc during signalclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=, xrefs: 009FE1F6
delayed zeroing on data that may contain pointerssweeper left outstanding across sweep generationsfully empty unfreed span set block found in resetcasgstatus: waiting for Gwaiting but is Grunnablepe32 optional header has unexpected Magic of 0x%xnot enough sign, xrefs: 009FE19D
unexpected malloc header in delayed zeroing of large objectreflect: call of reflect.Value.Len on ptr to non-array Valuemanual span allocation called with non-manually-managed typeaddr range base and limit are not in the same memory segmentruntime: netpoll: Pos, xrefs: 009FE18C
malloc deadlockruntime error: with GC progscan missed a gmisaligned maskruntime: min = runtime: inUse=runtime: max = bad panic stackrecovery failedstopm holding pstartm: m has ppreempt SPWRITEmissing mcache?ms: gomaxprocs=randinit missed]morebuf={pc:: no , xrefs: 009FE207
mallocgc called with gcphase == _GCmarkterminationrecursive call during initialization - linker skewattempt to execute system stack code on user stackcompileCallback: function argument frame too largepe32+ optional header has unexpected Magic of 0x%xlimiterEve, xrefs: 009FE218

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID: !"#$%%&&''((()))*++,,,,,------....//////0001123333333333444444444455666677777888888888889999999999::::::;;;;;;;;;;;;;;;;<<<<<<<<<<<<<<<<=====>>>>>>>>>>>??????????@@@@@@@@@@@@@@@@@@@@@@AAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC$delayed zeroing on data that may contain pointerssweeper left outstanding across sweep generationsfully empty unfreed span set block found in resetcasgstatus: waiting for Gwaiting but is Grunnablepe32 optional header has unexpected Magic of 0x%xnot enough sign$malloc deadlockruntime error: with GC progscan missed a gmisaligned maskruntime: min = runtime: inUse=runtime: max = bad panic stackrecovery failedstopm holding pstartm: m has ppreempt SPWRITEmissing mcache?ms: gomaxprocs=randinit missed]morebuf={pc:: no $malloc during signalclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=$mallocgc called with gcphase == _GCmarkterminationrecursive call during initialization - linker skewattempt to execute system stack code on user stackcompileCallback: function argument frame too largepe32+ optional header has unexpected Magic of 0x%xlimiterEve$mallocgc called without a P or outside bootstrappingruntime.SetFinalizer: pointer not in allocated blockruntime: use of FixAlloc_Alloc before FixAlloc_Initspan set block with unpopped elements found in resetruntime: GetQueuedCompletionStatusEx failed (errno= $unexpected malloc header in delayed zeroing of large objectreflect: call of reflect.Value.Len on ptr to non-array Valuemanual span allocation called with non-manually-managed typeaddr range base and limit are not in the same memory segmentruntime: netpoll: Pos
API String ID: 0-4152454558
Opcode ID: 1c07a9087ef7c3bb9bd022a14b2628ef4e69f7e3abee94bcd684101d588a91df
Instruction ID: 4147b6dc3a26ee61eda3be64818b4a334084d49eaba23320d6d47c27e8052617
Opcode Fuzzy Hash: 1c07a9087ef7c3bb9bd022a14b2628ef4e69f7e3abee94bcd684101d588a91df
Instruction Fuzzy Hash: 4632F272319798C2DB248F11E4407BABB6AF785B94F489615EF9D07BA5CF78C885CB00

Function 009F2020 Relevance: 8.0, Strings: 6, Instructions: 474
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

rdtscppopcntcmd/gonetdnsheaderAnswer%s: %xconsoleCopySidWSARecvWSASendconnectfloat32float64invaliduintptrChanDir Value>forcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingUNKNOWN:events, goid= s=nil (scan MB in pacer: % CPU ( zombie, j0 = , xrefs: 009F20C0
adxaesshaavxfmanetcgodnstcpudpfilereadseekopenpipebindtrueboolint8uintchanfunccallkind on allgallprootitabsbrkidledead is LEAFbase of ) = <==GOGC] = pc=+Inf-Inf: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp= gp= mp=) m=3125Atoiermssse3avx2bmi1bmi2icmpig, xrefs: 009F2046
avx512fos/execruntime#internno anodeCancelIoReadFileAcceptExWSAIoctlshutdownGoStringscavengepollDesctraceBufdeadlockraceFinipanicnilcgocheckrunnable procid rax rbx rcx rdx rdi rsi rbp rsp r8 r9 r10 r11 r12 , xrefs: 009F2624
sse41sse42ssse3filesKeyKey SysidreadatlistensocketStringFormat[]bytestringuint16uint32uint64structchan<-<-chan ValueGetACPsysmontimersefenceselect, not object next= jobs= goid sweep B -> % util alloc free span= prev= list=, i = code= addr= m->p= p->m=SCHED , xrefs: 009F22A8
avx512bwavx512vlgo/typesnet/httpgo/buildnetedns0x509sha1ClassANYQuestionntdll.dllFindCloseLocalFreeMoveFileWWriteFileWSASendTocomplex64interfaceinvalid nfuncargs(bad indirreflect: Interfaced.nx != 0psapi.dllprofBlockstackpoolhchanLeafwbufSpansmSpanDeadscavtrac, xrefs: 009F2671
pclmulqdqmath/randtlsrsakexfiles,dnsdns,filesipv6-icmpClassINETAuthority/dev/stdinowner diedDnsQuery_WGetIfEntryCancelIoExCreatePipeGetVersionWSACleanupWSAStartupgetsockoptsetsockoptdnsapi.dllws2_32.dllcomplex128t.Kind == execerrdotLockFileExWSASocketWnotifyLi, xrefs: 009F209F

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID: adxaesshaavxfmanetcgodnstcpudpfilereadseekopenpipebindtrueboolint8uintchanfunccallkind on allgallprootitabsbrkidledead is LEAFbase of ) = <==GOGC] = pc=+Inf-Inf: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp= gp= mp=) m=3125Atoiermssse3avx2bmi1bmi2icmpig$avx512bwavx512vlgo/typesnet/httpgo/buildnetedns0x509sha1ClassANYQuestionntdll.dllFindCloseLocalFreeMoveFileWWriteFileWSASendTocomplex64interfaceinvalid nfuncargs(bad indirreflect: Interfaced.nx != 0psapi.dllprofBlockstackpoolhchanLeafwbufSpansmSpanDeadscavtrac$avx512fos/execruntime#internno anodeCancelIoReadFileAcceptExWSAIoctlshutdownGoStringscavengepollDesctraceBufdeadlockraceFinipanicnilcgocheckrunnable procid rax rbx rcx rdx rdi rsi rbp rsp r8 r9 r10 r11 r12 $pclmulqdqmath/randtlsrsakexfiles,dnsdns,filesipv6-icmpClassINETAuthority/dev/stdinowner diedDnsQuery_WGetIfEntryCancelIoExCreatePipeGetVersionWSACleanupWSAStartupgetsockoptsetsockoptdnsapi.dllws2_32.dllcomplex128t.Kind == execerrdotLockFileExWSASocketWnotifyLi$rdtscppopcntcmd/gonetdnsheaderAnswer%s: %xconsoleCopySidWSARecvWSASendconnectfloat32float64invaliduintptrChanDir Value>forcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingUNKNOWN:events, goid= s=nil (scan MB in pacer: % CPU ( zombie, j0 = $sse41sse42ssse3filesKeyKey SysidreadatlistensocketStringFormat[]bytestringuint16uint32uint64structchan<-<-chan ValueGetACPsysmontimersefenceselect, not object next= jobs= goid sweep B -> % util alloc free span= prev= list=, i = code= addr= m->p= p->m=SCHED
API String ID: 0-1417408132
Opcode ID: 9c643a768f8ec8aa84f59b625758038bdd5eec99a0d6f59ef95dd1064b35c5bf
Instruction ID: f4ca3c46f812e5f08f112f08674aaf4e36797ee4cd0c6ceffbe0f2b877857066
Opcode Fuzzy Hash: 9c643a768f8ec8aa84f59b625758038bdd5eec99a0d6f59ef95dd1064b35c5bf
Instruction Fuzzy Hash: EF42AF7A108B48CAF700DF65F845F993BA4F355B84F448226DA9D8B362DF79C4A9C341

Function 00A25320 Relevance: 4.0, Strings: 3, Instructions: 273COMMON

Download Yara Rule

Strings

runtime.preemptM: duplicatehandle failed; errno=runtime: waitforsingleobject wait_failed; errno=strconv: illegal AppendFloat/FormatFloat bitSizenot enough significant bits after mult64bitPow10invalid or incomplete multibyte or wide characterslice bounds out of, xrefs: 00A25787
runtime.preemptM: duplicatehandle failedglobal runq empty with non-zero runqsizemust be able to track idle limiter eventruntime: SyscallN has too many argumentsHad a bad time getting restore point: %v138777878078144567552953958511352539062569388939039072283776, xrefs: 00A257AF
self-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchnot pollableCfgMgr32.dllsetupapi.dllwintrust.dllwtsapi32.dllReportEventWCreateMu, xrefs: 00A257C5

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID: runtime.preemptM: duplicatehandle failed; errno=runtime: waitforsingleobject wait_failed; errno=strconv: illegal AppendFloat/FormatFloat bitSizenot enough significant bits after mult64bitPow10invalid or incomplete multibyte or wide characterslice bounds out of$runtime.preemptM: duplicatehandle failedglobal runq empty with non-zero runqsizemust be able to track idle limiter eventruntime: SyscallN has too many argumentsHad a bad time getting restore point: %v138777878078144567552953958511352539062569388939039072283776$self-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchnot pollableCfgMgr32.dllsetupapi.dllwintrust.dllwtsapi32.dllReportEventWCreateMu
API String ID: 0-1863512095
Opcode ID: 1126cb3ff532d9fc41985dd48f636640860cf349cfb3c991e9276940f26be467
Instruction ID: bd8716699ad4c02ead356ad9e25d117cdec99d2e0b50df18d5862f6dad494663
Opcode Fuzzy Hash: 1126cb3ff532d9fc41985dd48f636640860cf349cfb3c991e9276940f26be467
Instruction Fuzzy Hash: B3C19F36605F9481DB20DF29F84136E7761F78AB94F089236DAAC43BA5DF39C492CB40

Function 00A23100 Relevance: 2.6, Strings: 2, Instructions: 65COMMON

Download Yara Rule

Strings

PowerRegisterSuspendResumeNotification, xrefs: 00A23169
powrprof.dll, xrefs: 00A23119

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID: PowerRegisterSuspendResumeNotification$powrprof.dll
API String ID: 0-3247360486
Opcode ID: 748306455cc0cdd962a134eaef724f13414d11fa4ce0e781f7d601c1ebda70af
Instruction ID: 4c39461a2edead7809f2ffc7988f236ece4eba5f68622e41fcfe63f85bee1410
Opcode Fuzzy Hash: 748306455cc0cdd962a134eaef724f13414d11fa4ce0e781f7d601c1ebda70af
Instruction Fuzzy Hash: B3214632208B84C6EB01CF15F44535ABBA5F78AB84F588626EA8C47B69DF7DC195CB40

Function 000001B278C7FFFC Relevance: 1.6, APIs: 1, Instructions: 382memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 000001B278C8006F

Memory Dump Source

Source File: 00000000.00000002.2178027279.000001B278C10000.00000040.00000020.00020000.00000000.sdmp, Offset: 000001B278C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b278c10000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 08c3b473a1f7362871bcf2729fe2c144e163769adb635b581bed10db9dac86c4
Instruction ID: 9f5a2e0b6b41dacf03606e80b07f45200eb8bda2083d41f11c75a1eab3d3ba44
Opcode Fuzzy Hash: 08c3b473a1f7362871bcf2729fe2c144e163769adb635b581bed10db9dac86c4
Instruction Fuzzy Hash: 37C1A7306549058BFB5DEA2AD48A7FAB3D1FBA8310F14432DD44ACB1D6DF70E849C685

Function 00A18AC0 Relevance: 1.6, Strings: 1, Instructions: 332COMMON

Download Yara Rule

Strings

grew heap, but no adequate free space foundroot level max pages doesn't fit in summaryruntime: releaseSudog with non-nil gp.paramunknown runnable goroutine during bootstrapruntime: casfrom_Gscanstatus bad oldval gp=runtime:stoplockedm: lockedg (atomicstatus=me, xrefs: 00A19022

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID: grew heap, but no adequate free space foundroot level max pages doesn't fit in summaryruntime: releaseSudog with non-nil gp.paramunknown runnable goroutine during bootstrapruntime: casfrom_Gscanstatus bad oldval gp=runtime:stoplockedm: lockedg (atomicstatus=me
API String ID: 0-3724787384
Opcode ID: 4a7bf5be069226780375828105615d46f7dda4ef383fd86da7f64172008db5df
Instruction ID: ee1d91837c63e6a5e1ae541648a2d8a95994cd305f6aa57b4aad7cc885cb395e
Opcode Fuzzy Hash: 4a7bf5be069226780375828105615d46f7dda4ef383fd86da7f64172008db5df
Instruction Fuzzy Hash: 3AE16D72209B8485EB60CB55F49079EBB61F78ABD0F589116EE8D43B69CF3CC494CB40

Function 00A05E80 Relevance: 1.5, Strings: 1, Instructions: 283COMMON

Download Yara Rule

Strings

span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incor, xrefs: 00A06030

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID: span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incor
API String ID: 0-1712010102
Opcode ID: d203450acb01d06bbebda50fa3a71de4bedf89a95e5b95e9feddb898e8f9b2ea
Instruction ID: 6e901e734c3d6ecf6965c6bca09c631f748a0c6008cb7b7dd366725d0f06d626
Opcode Fuzzy Hash: d203450acb01d06bbebda50fa3a71de4bedf89a95e5b95e9feddb898e8f9b2ea
Instruction Fuzzy Hash: E8C1CE32609B458ADF14CF24F4907AEB764F785B94F484225EB8E47BA9DF38C894CB50

Function 000001B27A4CF1A0 Relevance: 1.5, APIs: 1, Instructions: 272stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNELBASE ref: 000001B27A4CF1D7

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 742e74ce351c1f1b12b47fea87978d01d3a5733e57109485170f251d8ccbb01e
Instruction ID: 0612b5af73b421c4657f928f8a5ede054f2a3a628fed4daa20777cb559b7b525
Opcode Fuzzy Hash: 742e74ce351c1f1b12b47fea87978d01d3a5733e57109485170f251d8ccbb01e
Instruction Fuzzy Hash: 65B12031108B448FF398EF64D86C79A77E1FB99352F604529E18AC32B0DF798944CB16

Function 00A35D80 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5789849c5df1d235c287a98531861d3ae46835fcbb5b53e9f6bf2dfb16c67bec
Instruction ID: d36a0f940fef19e81d5b4287925c2bf73a33d99f50dc37160dc803ab84fbd880
Opcode Fuzzy Hash: 5789849c5df1d235c287a98531861d3ae46835fcbb5b53e9f6bf2dfb16c67bec
Instruction Fuzzy Hash: D7C17C32609B4486EB04CF65F49076AB770F78AB84F549626FA8D47B69DF7CC844CB40

Function 00A2EA00 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42b1900c2128b6d4f09da6308f9934932028859ec5738839137e36d3acb6f721
Instruction ID: 9375c39dcbe6973c472121493d73a1f480214c16059475e85c90365858c640c8
Opcode Fuzzy Hash: 42b1900c2128b6d4f09da6308f9934932028859ec5738839137e36d3acb6f721
Instruction Fuzzy Hash: 1591FF72B09624CBEB24DF28F8907696762F785B88F88D235DA0D07725DB79C8C5C780

Function 00A17CC0 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33577010ddc080ba9d9ce269e630847f0545611fdd5dd6c56f1addd733da69ca
Instruction ID: 002fd4227a908c01340555c55585a5949483355440614b295354e99cc3cff649
Opcode Fuzzy Hash: 33577010ddc080ba9d9ce269e630847f0545611fdd5dd6c56f1addd733da69ca
Instruction Fuzzy Hash: 6A3180BB315B8991EB448B19F5817EA6762E385BC0F85D132DE4F57769CE38C58AC300

Function 00A23240 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5a7acd6965f656c70168b1ae0f5dee71d817a5538690fe68639afad6aa71994
Instruction ID: 61c8c2c7031e08d38d482b634db879364d501d96b1bba9bf8876a204dbfba8db
Opcode Fuzzy Hash: a5a7acd6965f656c70168b1ae0f5dee71d817a5538690fe68639afad6aa71994
Instruction Fuzzy Hash: A4215E33608B85C1DA10CB25F44536AB761F35ABD8F449221EEAD47BA9DB3DC191CB40

Function 000001B27A4D6DC0 Relevance: 18.0, APIs: 11, Instructions: 1455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5a17312eacb160121f9eea0b528651a09acfa2ad52bd57e63ccf263f8cb0842
Instruction ID: c4ae167a6c419576d114064797e1354ce48416cef22f2997b73fb7b51c9c548b
Opcode Fuzzy Hash: c5a17312eacb160121f9eea0b528651a09acfa2ad52bd57e63ccf263f8cb0842
Instruction Fuzzy Hash: 83C23E30119A88DFF7B5EB54D4587EA73E0FBBA311F60092ED58AC21A1DF359489CB06

Function 000001B27A4CF740 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 159
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE ref: 000001B27A4CF77E
LocalAlloc.KERNELBASE ref: 000001B27A4CF7A4
CreateFileW.KERNELBASE ref: 000001B27A4CF873
LocalFree.KERNELBASE ref: 000001B27A4CF92F

Strings

P, xrefs: 000001B27A4CF8A7

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: CreateLocal$AllocDirectoryFileFree
String ID: P
API String ID: 1520254948-3110715001
Opcode ID: da20fc7a7724216b2506d8b5ae4f75a843dfdb9977f341af6ed6c5acbf74433f
Instruction ID: 5db038d3dc429a46aa52218bd407ae81b52e5ae7ab2c0f138ae19f5fe2c2b741
Opcode Fuzzy Hash: da20fc7a7724216b2506d8b5ae4f75a843dfdb9977f341af6ed6c5acbf74433f
Instruction Fuzzy Hash: 9F61DF311197548FEBB4EB68C49C79AB7E1FBA5315F504A2DD08EC21E0CF799485CB06

Function 000001B27A4D2000 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 144
processmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE ref: 000001B27A4D203C

Part of subcall function 000001B27A4E6C1C: _errno.LIBCMT ref: 000001B27A4E6C53
Part of subcall function 000001B27A4E6C1C: _invalid_parameter_noinfo.LIBCMT ref: 000001B27A4E6C5E

CreateProcessW.KERNELBASE ref: 000001B27A4D2189
LocalFree.KERNELBASE ref: 000001B27A4D2199
LocalFree.KERNELBASE ref: 000001B27A4D21A4

Strings

h, xrefs: 000001B27A4D2137

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: Local$Free$AllocCreateProcess_errno_invalid_parameter_noinfo
String ID: h
API String ID: 4074914292-2439710439
Opcode ID: 14ca2ddfcce8b4881243e4c524c2883a0a1c3527abb3c7557773b7ebc18441d8
Instruction ID: 219a53d31803fc0dd2056144b1ed7739928fde619f86c324ee89dcf07da07552
Opcode Fuzzy Hash: 14ca2ddfcce8b4881243e4c524c2883a0a1c3527abb3c7557773b7ebc18441d8
Instruction Fuzzy Hash: CE51FD30118B488FE754EB24D8597ABB7E1FB98302F60492DE586C32B0DF79D885CB46

Function 000001B278C7EF64 Relevance: 6.1, APIs: 4, Instructions: 133
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001B278C81814: LoadLibraryA.KERNELBASE ref: 000001B278C818E2

VirtualProtect.KERNELBASE ref: 000001B278C7EFE0
VirtualProtect.KERNELBASE ref: 000001B278C7F009
VirtualProtect.KERNELBASE ref: 000001B278C7F04E
VirtualProtect.KERNELBASE ref: 000001B278C7F072

Memory Dump Source

Source File: 00000000.00000002.2178027279.000001B278C10000.00000040.00000020.00020000.00000000.sdmp, Offset: 000001B278C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b278c10000_file.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: d24d4ce7223a552c1b01d238479d20a295a89e3d53a7350efd5ba8d12bfb46a0
Instruction ID: 6e83928c218b75a12787411abb56748361cf0647c4c87724be923b86b10a9386
Opcode Fuzzy Hash: d24d4ce7223a552c1b01d238479d20a295a89e3d53a7350efd5ba8d12bfb46a0
Instruction Fuzzy Hash: A8318B3131CA094FDB5CAA29A88A7A977D5E7D4720F00076EE84BC72C5DF70DD0A46D5

Function 000001B278C7EFD3 Relevance: 6.1, APIs: 4, Instructions: 89
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 000001B278C7EFE0
VirtualProtect.KERNELBASE ref: 000001B278C7F009
VirtualProtect.KERNELBASE ref: 000001B278C7F04E
VirtualProtect.KERNELBASE ref: 000001B278C7F072

Memory Dump Source

Source File: 00000000.00000002.2178027279.000001B278C10000.00000040.00000020.00020000.00000000.sdmp, Offset: 000001B278C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b278c10000_file.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f2b484dd179f3dd10506a7a62fe75bc60ed010a6cf5ae84582fe1852291c4020
Instruction ID: 8df8c7021df6adaeb95077df5413e2444f6c8489fae0a2b3eb1e5b5cabb73e91
Opcode Fuzzy Hash: f2b484dd179f3dd10506a7a62fe75bc60ed010a6cf5ae84582fe1852291c4020
Instruction Fuzzy Hash: 9521813131CA084BDB5CA92DB89A3A973D5E7D8720F10026EE84BC72CADF70DD0646C5

Function 000001B27A4DC980 Relevance: 6.1, APIs: 4, Instructions: 75
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 000001B27A4DC9BA
LocalAlloc.KERNELBASE ref: 000001B27A4DC9F4
ReadFile.KERNELBASE ref: 000001B27A4DCA24
CloseHandle.KERNELBASE ref: 000001B27A4DCA3D

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: File$AllocCloseCreateHandleLocalRead
String ID:
API String ID: 1443864953-0
Opcode ID: d5fc9f4b33cbbbcc9f8f3db8ab93582bc92b71007fb63339fe9d281fc4954cf0
Instruction ID: 3eb75600047d996920d5d1f170478dce00535a1ea18b510d6feb4f7ed101ccd2
Opcode Fuzzy Hash: d5fc9f4b33cbbbcc9f8f3db8ab93582bc92b71007fb63339fe9d281fc4954cf0
Instruction Fuzzy Hash: 0F21FD30118B448FE754DF68C45871BBBF0FB99355F504A1DE586C32A0CBB5D885CB42

Function 000001B27A4C8D30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000001B27A4E6C1C: _errno.LIBCMT ref: 000001B27A4E6C53
Part of subcall function 000001B27A4E6C1C: _invalid_parameter_noinfo.LIBCMT ref: 000001B27A4E6C5E

RegCreateKeyExW.KERNELBASE ref: 000001B27A4C8D92
RegCloseKey.KERNELBASE ref: 000001B27A4C8DA5

Strings

?, xrefs: 000001B27A4C8D70

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: CloseCreate_errno_invalid_parameter_noinfo
String ID: ?
API String ID: 3067000685-1684325040
Opcode ID: e1fa8e690777478dbb7aaf1e3c6718a9e7df1082e362113efa4485b0f282c34c
Instruction ID: e2930b3aad760cc8a6230e0b3dbfb4ed2602e41720010ddb2f1abdf5d769aac9
Opcode Fuzzy Hash: e1fa8e690777478dbb7aaf1e3c6718a9e7df1082e362113efa4485b0f282c34c
Instruction Fuzzy Hash: 902157301186448BF794EB64C8647EBB7E1FBA1315F500A2DE44BC21E1EFB9D549CB85

Function 000001B27A4C8F60 Relevance: 4.6, APIs: 3, Instructions: 87registryCOMMON

Download Yara Rule

APIs

Part of subcall function 000001B27A4DC980: CreateFileW.KERNELBASE ref: 000001B27A4DC9BA
Part of subcall function 000001B27A4DC980: LocalAlloc.KERNELBASE ref: 000001B27A4DC9F4
Part of subcall function 000001B27A4DC980: ReadFile.KERNELBASE ref: 000001B27A4DCA24
Part of subcall function 000001B27A4DC980: CloseHandle.KERNELBASE ref: 000001B27A4DCA3D

Part of subcall function 000001B27A4E6C1C: _errno.LIBCMT ref: 000001B27A4E6C53
Part of subcall function 000001B27A4E6C1C: _invalid_parameter_noinfo.LIBCMT ref: 000001B27A4E6C5E

RegOpenKeyW.ADVAPI32 ref: 000001B27A4C9013
RegSetValueExW.KERNELBASE ref: 000001B27A4C904D
LocalFree.KERNELBASE ref: 000001B27A4C906D

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: FileLocal$AllocCloseCreateFreeHandleOpenReadValue_errno_invalid_parameter_noinfo
String ID:
API String ID: 9688765-0
Opcode ID: 59493ee6c7077778934f02759ea539db7f92bfe724745750aa23e1573cf8735b
Instruction ID: d2b02508e69c9ceb8f49fe60978e64bbb92fdf0c1c2ad4ec5cd142f2f9096d22
Opcode Fuzzy Hash: 59493ee6c7077778934f02759ea539db7f92bfe724745750aa23e1573cf8735b
Instruction Fuzzy Hash: ED31FF301186449FE7A4EB64D89CBDA73E1FBD4305F50092DE54EC21A1EF759544CB46

Function 000001B278C81814 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 104libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 000001B278C818E2

Strings

l, xrefs: 000001B278C8187C

Memory Dump Source

Source File: 00000000.00000002.2178027279.000001B278C10000.00000040.00000020.00020000.00000000.sdmp, Offset: 000001B278C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b278c10000_file.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: l
API String ID: 1029625771-2517025534
Opcode ID: 1385f4a438fc17bb376d03bd0145f1e19b120c532c3e81762a8c516170bfbca4
Instruction ID: 0fa657f0827813c9b8c6f52ccc7c63093ebe4411b622919d3bee1efe8b8c1dcf
Opcode Fuzzy Hash: 1385f4a438fc17bb376d03bd0145f1e19b120c532c3e81762a8c516170bfbca4
Instruction Fuzzy Hash: 6731F330558B858FE799DB2DC049B62BBD5FBA9308F2547ADC0DACB193DB70D80A8705

Function 000001B27A4D01B0 Relevance: 3.1, APIs: 2, Instructions: 87COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE ref: 000001B27A4D0263
LocalFree.KERNELBASE ref: 000001B27A4D028B

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: CreateDirectoryFreeLocal
String ID:
API String ID: 2937684288-0
Opcode ID: 3d6c5400fb6232b5440fa9e95e054a6000238df74fb640f1787ec0ff3ebb7f51
Instruction ID: f80e72ab7a7ce1ed0ca9d37472e243af4d539328bd639ca6c37fbd0a077f3531
Opcode Fuzzy Hash: 3d6c5400fb6232b5440fa9e95e054a6000238df74fb640f1787ec0ff3ebb7f51
Instruction Fuzzy Hash: 9631DC30118B448FE7A4EB58D85C76AB7F1FBD9312F90082EF146C31A4DB799885CB06

Function 000001B27A4C76C0 Relevance: 3.1, APIs: 2, Instructions: 75registryCOMMON

Download Yara Rule

APIs

Part of subcall function 000001B27A4E6C1C: _errno.LIBCMT ref: 000001B27A4E6C53
Part of subcall function 000001B27A4E6C1C: _invalid_parameter_noinfo.LIBCMT ref: 000001B27A4E6C5E

RegOpenKeyW.ADVAPI32 ref: 000001B27A4C7733
RegSetValueExW.KERNELBASE ref: 000001B27A4C7775

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: OpenValue_errno_invalid_parameter_noinfo
String ID:
API String ID: 809911093-0
Opcode ID: bafd6c7505aa3cec60dc00240c711fa44000b726ee165bdf6933eea115b47741
Instruction ID: bf9981390b40c135d785963ff94e8ebbf96fbabd96305653824fe4d4af8a1120
Opcode Fuzzy Hash: bafd6c7505aa3cec60dc00240c711fa44000b726ee165bdf6933eea115b47741
Instruction Fuzzy Hash: 7F215431118A488BF364EB24E898BEB73E5FBD8315F500539E54AC3194EF79D584CB45

Function 000001B278C7F090 Relevance: 3.1, APIs: 2, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000001B278C81814: LoadLibraryA.KERNELBASE ref: 000001B278C818E2

VirtualProtect.KERNELBASE ref: 000001B278C7F0DE
VirtualProtect.KERNELBASE ref: 000001B278C7F106

Memory Dump Source

Source File: 00000000.00000002.2178027279.000001B278C10000.00000040.00000020.00020000.00000000.sdmp, Offset: 000001B278C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b278c10000_file.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: b17c4479f7010fd41cbad95f9fb04bd4be79ef02ed8fc175b75ead6b9ebb131e
Instruction ID: 66c3c48f728984b6b7691daf8d83a1ed674015827a9f19fd49e70bfd339dc978
Opcode Fuzzy Hash: b17c4479f7010fd41cbad95f9fb04bd4be79ef02ed8fc175b75ead6b9ebb131e
Instruction Fuzzy Hash: F0116531718A084BDB99EB19D8C97AA77D5FBD8700F04066EEC4ACB289DF70DE458781

Function 000001B27A4C8EB0 Relevance: 3.1, APIs: 2, Instructions: 51registryCOMMON

Download Yara Rule

APIs

Part of subcall function 000001B27A4E6C1C: _errno.LIBCMT ref: 000001B27A4E6C53
Part of subcall function 000001B27A4E6C1C: _invalid_parameter_noinfo.LIBCMT ref: 000001B27A4E6C5E

RegOpenKeyW.ADVAPI32 ref: 000001B27A4C8EEA
RegSetValueExW.KERNELBASE ref: 000001B27A4C8F22

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: OpenValue_errno_invalid_parameter_noinfo
String ID:
API String ID: 809911093-0
Opcode ID: dabac1a20c07f68502351d61ad0aafea07900113097daaf66410e45343aed6c1
Instruction ID: 9f695b6efaf7101cc589637b8a9b3d32ec0e2a2e1f30247af5a1dc25e0503433
Opcode Fuzzy Hash: dabac1a20c07f68502351d61ad0aafea07900113097daaf66410e45343aed6c1
Instruction Fuzzy Hash: 291180302286449FE394EF24D858BAA77E5FBA5305F500929F48AC22A0DFB9C904CB46

Function 000001B27A4C91E0 Relevance: 1.6, APIs: 1, Instructions: 130COMMON

Download Yara Rule

APIs

Part of subcall function 000001B27A4E6C1C: _errno.LIBCMT ref: 000001B27A4E6C53
Part of subcall function 000001B27A4E6C1C: _invalid_parameter_noinfo.LIBCMT ref: 000001B27A4E6C5E

StrCmpIW.KERNELBASE ref: 000001B27A4C9358

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID:
API String ID: 2959964966-0
Opcode ID: a40e8e4882deb632cbb976bceb1dbfc021a17528ebf96bf44d647521f47a5f93
Instruction ID: 6e7a0d3c45370f113f414fffd53825b05a4c5dd275ec201ac92bbff5456a7cb4
Opcode Fuzzy Hash: a40e8e4882deb632cbb976bceb1dbfc021a17528ebf96bf44d647521f47a5f93
Instruction Fuzzy Hash: 7D412131218A888BE760EB34D8547DBB3D1FB98300F614A3A958EC32A1EF35D645C746

Function 000001B27A4DCA80 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 000001B27A4DCAC7

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: 11272a2e7ab32d03185ac6325af245eb3004fbee0aa731c5a7eb43ec361abfc4
Instruction ID: 3a8ed3094063761f5dde6f5c375bd82ce7631ad37964a1644168bfa2fcfd0e63
Opcode Fuzzy Hash: 11272a2e7ab32d03185ac6325af245eb3004fbee0aa731c5a7eb43ec361abfc4
Instruction Fuzzy Hash: F4111870118B888FE754DF54D85879BFBF0FB95345F50092DE58AC22A0DBB9C945CB42

Function 000001B27A4D72E3 Relevance: 1.5, APIs: 1, Instructions: 47libraryCOMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE ref: 000001B27A4D734C
LoadLibraryExW.KERNELBASE ref: 000001B27A4D73F8

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: AddressCallerLibraryLoadProc
String ID:
API String ID: 4215043672-0
Opcode ID: d3c6e82d341fdc58c4ee0e0beb1d402abe7649a5e2826e12daa8f3b61ba4bcb1
Instruction ID: 5b65e2938332007e78a23aebce1a3ae5c8b3cb6869b527abea7e3b8b955f3d26
Opcode Fuzzy Hash: d3c6e82d341fdc58c4ee0e0beb1d402abe7649a5e2826e12daa8f3b61ba4bcb1
Instruction Fuzzy Hash: 5F11DB34218B888FE775EB55D4987EBB3E4FBA6311F90091ED48ED2150DF395445CB02

Function 000001B27A4D7F29 Relevance: 1.5, APIs: 1, Instructions: 47libraryCOMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE ref: 000001B27A4D7F8F
LoadLibraryExW.KERNELBASE ref: 000001B27A4D8038

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: AddressCallerLibraryLoadProc
String ID:
API String ID: 4215043672-0
Opcode ID: 175f4f39c38ea6b1026292fd509b3c5c591c0c80c5e03c7319577518d773177d
Instruction ID: 8ca2f0605cfb4a06bb0281faa6b0b2b3029b222a7d88c178f43ba6d775f474a3
Opcode Fuzzy Hash: 175f4f39c38ea6b1026292fd509b3c5c591c0c80c5e03c7319577518d773177d
Instruction Fuzzy Hash: A711C53461CB888EE775EB58C494BEAB3E0FBE6311F90491DD18EC21A0DB796495CB43

Function 000001B27A4D805F Relevance: 1.5, APIs: 1, Instructions: 47libraryCOMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE ref: 000001B27A4D80C5
LoadLibraryExW.KERNELBASE ref: 000001B27A4D816E

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: AddressCallerLibraryLoadProc
String ID:
API String ID: 4215043672-0
Opcode ID: 0af500e9fc0feaf599aacb806cbe120ad5ae0dc2b63974d019f6ddcc2e35b223
Instruction ID: 19602c33f236372ad2cddfb02d741a8c172f6980205b4c8bb3932d3695e91f42
Opcode Fuzzy Hash: 0af500e9fc0feaf599aacb806cbe120ad5ae0dc2b63974d019f6ddcc2e35b223
Instruction Fuzzy Hash: 0F116D34218B888FE774FB58C4587EA73E0FBA9301F50491EC08AC3191DF765589CB86

Function 00A57CE0 Relevance: 1.5, APIs: 1, Instructions: 46fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE ref: 00A57D78

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d0420e7b245c68536b1289b904fe6097933a37c154ff1c15fd575de53d0a58cb
Instruction ID: 919297549562f8c176c01ffad5bb3e2cf94caf76ef2d5c655bc8fa957219ff85
Opcode Fuzzy Hash: d0420e7b245c68536b1289b904fe6097933a37c154ff1c15fd575de53d0a58cb
Instruction Fuzzy Hash: 84115E36A05F80C1DB218B1AE84132D7374F748BE4F244225DFAD67BA4DB39E1A2CB40

Function 000001B27A4C8E20 Relevance: 1.5, APIs: 1, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 000001B27A4E6C1C: _errno.LIBCMT ref: 000001B27A4E6C53
Part of subcall function 000001B27A4E6C1C: _invalid_parameter_noinfo.LIBCMT ref: 000001B27A4E6C5E

RegGetValueW.KERNELBASE ref: 000001B27A4C8E8A

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: Value_errno_invalid_parameter_noinfo
String ID:
API String ID: 4005939669-0
Opcode ID: 5cbe764aeda1c5945a6e93de4f8dccfc6a9e97416addf78d358c4e106c5a5808
Instruction ID: 1693e95f4177f72d50eb90480cd276e9e3e7e9ea72d4ffe80c3ca868f9533732
Opcode Fuzzy Hash: 5cbe764aeda1c5945a6e93de4f8dccfc6a9e97416addf78d358c4e106c5a5808
Instruction Fuzzy Hash: F8013130118A488FF790EB54D859B9AB7E4F7A4305F500A2EE84DC3190EBB9D648CB46

Function 000001B27A4E1B30 Relevance: 1.5, APIs: 1, Instructions: 20synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexExW.KERNELBASE ref: 000001B27A4E1B48

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: f814f6e7bafc190a419314394220be9ea48f845bea0626bfb9e640e2b12b39a9
Instruction ID: 8485fb5e311afa0a6999317eec00e34703dc052001bed545d72450eebabd7193
Opcode Fuzzy Hash: f814f6e7bafc190a419314394220be9ea48f845bea0626bfb9e640e2b12b39a9
Instruction Fuzzy Hash: 7EE086B4D459088FFB68E769EED839131B5F376316F504425D409C51E0EB7EC298874D

Function 000001B27A4CF8B3 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

LocalFree.KERNELBASE ref: 000001B27A4CF92F

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: FreeLocal
String ID:
API String ID: 2826327444-0
Opcode ID: f992e332d222a4d17fc7fb876d1f1a6f1a1439ebee4c827675b39005004bd709
Instruction ID: c0e70b0a493032bbf4a6e5a348518fe6b2a0361c9255f1531c3d8842affeb421
Opcode Fuzzy Hash: f992e332d222a4d17fc7fb876d1f1a6f1a1439ebee4c827675b39005004bd709
Instruction Fuzzy Hash: D7D012301186048BEB70F754D82976977A1F7A5312F54002A901BC21A0CF7D4885CB06

Non-executed Functions

Function 000001B27A4EB030 Relevance: 29.0, APIs: 14, Strings: 2, Instructions: 1050COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001B27A4E7B70: _getptd.LIBCMT ref: 000001B27A4E7B82

_errno.LIBCMT ref: 000001B27A4EB09B
_errno.LIBCMT ref: 000001B27A4EB0AC
_invalid_parameter_noinfo.LIBCMT ref: 000001B27A4EB0B7
_fileno.LIBCMT ref: 000001B27A4EB0F0
_errno.LIBCMT ref: 000001B27A4EB163
_invalid_parameter_noinfo.LIBCMT ref: 000001B27A4EB16E
write_multi_char.LIBCMT ref: 000001B27A4EB747
write_multi_char.LIBCMT ref: 000001B27A4EB782
write_multi_char.LIBCMT ref: 000001B27A4EB835
free.LIBCMT ref: 000001B27A4EB84D
write_char.LIBCMT ref: 000001B27A4EB98E
write_char.LIBCMT ref: 000001B27A4EB9B9

Strings

@, xrefs: 000001B27A4EB0DC
, xrefs: 000001B27A4EB717

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: _errnowrite_multi_char$_invalid_parameter_noinfowrite_char$_fileno_getptdfree
String ID: $@
API String ID: 920461082-1077428164
Opcode ID: e2fee4e15932b786adf0fe852ccd7b16741be36214435e4bb46e0613915b18e9
Instruction ID: 63c076bb0d98cef0aae351af797f59fca9dc9a421c880586730113c6c33f899a
Opcode Fuzzy Hash: e2fee4e15932b786adf0fe852ccd7b16741be36214435e4bb46e0613915b18e9
Instruction Fuzzy Hash: 5D72C53051C7598AE7689A9884653EB77E0FBB7324F34861DD586C32D2DF36C80B864A

Function 000001B27A4EDFC4 Relevance: 21.7, APIs: 11, Strings: 1, Instructions: 704COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000001B27A4EE01A
_errno.LIBCMT ref: 000001B27A4EE021
_invalid_parameter_noinfo.LIBCMT ref: 000001B27A4EE02C

Strings

U, xrefs: 000001B27A4EE5A8

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: 5f4b7be45a5ff0a78e4e8128bc43395c487008e499688c2a984ed18db5922cb4
Instruction ID: d8311f16e6b7d147eccfa3023a29b7c9c3c6a06f12d31fb8d5b5954011d7142e
Opcode Fuzzy Hash: 5f4b7be45a5ff0a78e4e8128bc43395c487008e499688c2a984ed18db5922cb4
Instruction Fuzzy Hash: 8D32F73111CA44DBE7189FA8C8567EA73E1FBA6320F64051DE486C3192DF36D84AC78E

Function 00A0A940 Relevance: 18.2, Strings: 14, Instructions: 703COMMON

Download Yara Rule

Strings

+]M[<=1-{}Ly%x: i), )(M [("")) ) @s -> Pn=][}]> +25LlLtLuMn"\\?nilintmapptr... m=EOFfinobjgc %: gp *(in n= ) - NaN P MPC= < end > ]:???pc= G125625adxaesshaavxfmanetcgodnstcpudpfilereadseekopenpipebindtrueboolint8uintchanfunccallkind on allgall, xrefs: 00A0B216, 00A0B3B6
, xrefs: 00A0AF1F
gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault tab= top=[...], fp:1562578125Greeksse41sse42ssse3filesKeyKey SysidreadatlistensocketStringFormat[]bytestringuint16uint32uint64structchan<-<-chan ValueGetACPsysmontimersefenceselect, not object next= , xrefs: 00A0AA04
gc done but gcphase != _GCoffruntime: p.gcMarkWorkerMode= scanobject of a noscan objectruntime: marking free object addspecial on invalid pointerruntime: summary max pages = runtime: levelShift[level] = doRecordGoroutineProfile gp1=timeBegin/EndPeriod not foun, xrefs: 00A0B73A
., xrefs: 00A0B02A
@s -> Pn=][}]> +25LlLtLuMn"\\?nilintmapptr... m=EOFfinobjgc %: gp *(in n= ) - NaN P MPC= < end > ]:???pc= G125625adxaesshaavxfmanetcgodnstcpudpfilereadseekopenpipebindtrueboolint8uintchanfunccallkind on allgallprootitabsbrkidledead is LEAFbase , xrefs: 00A0B0CC
MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, xrefs: 00A0B525
MB goal, s.state = s.base()= heapGoal=GOMEMLIMIT KiB now, pages at sweepgen= sweepgen , bound = , limit = tracefree(tracegc()exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException , xrefs: 00A0B4E5
gc %: gp *(in n= ) - NaN P MPC= < end > ]:???pc= G125625adxaesshaavxfmanetcgodnstcpudpfilereadseekopenpipebindtrueboolint8uintchanfunccallkind on allgallprootitabsbrkidledead is LEAFbase of ) = <==GOGC] = pc=+Inf-Inf: p=cas1cas2cas3cas4cas5cas6 at m, xrefs: 00A0B0AE
ms cpu, (forced) wbuf1.n= wbuf2.n= s.limit= s.state= B work ( B exp.) marked unmarked in use), size = bad prune, tail = recover: not in [ctxt != 0, oldval=, newval= threads=: status= blocked= lockedg=atomicor8 runtime= m->curg=(unknown)traceback} stack=, xrefs: 00A0B46B
failed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPre, xrefs: 00A0B729
ms clock, nBSSRoots=runtime: P exp.) for minTrigger=GOMEMLIMIT=bad m value, elemsize= freeindex= span.list=, npages = tracealloc( p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32, xrefs: 00A0B24A
/_`+]M[<=1-{}Ly%x: i), )(M [("")) ) @s -> Pn=][}]> +25LlLtLuMn"\\?nilintmapptr... m=EOFfinobjgc %: gp *(in n= ) - NaN P MPC= < end > ]:???pc= G125625adxaesshaavxfmanetcgodnstcpudpfilereadseekopenpipebindtrueboolint8uintchanfunccallkind on allg, xrefs: 00A0B385
non-concurrent sweep failed to drain all sweep queuescompileCallback: argument size is larger than uintptrmin size of malloc header is not a size class boundarygcControllerState.findRunnable: blackening not enabledno goroutines (main called runtime.Goexit) - d, xrefs: 00A0B718

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID: $ @s -> Pn=][}]> +25LlLtLuMn"\\?nilintmapptr... m=EOFfinobjgc %: gp *(in n= ) - NaN P MPC= < end > ]:???pc= G125625adxaesshaavxfmanetcgodnstcpudpfilereadseekopenpipebindtrueboolint8uintchanfunccallkind on allgallprootitabsbrkidledead is LEAFbase $ MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:$ MB goal, s.state = s.base()= heapGoal=GOMEMLIMIT KiB now, pages at sweepgen= sweepgen , bound = , limit = tracefree(tracegc()exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException $ ms clock, nBSSRoots=runtime: P exp.) for minTrigger=GOMEMLIMIT=bad m value, elemsize= freeindex= span.list=, npages = tracealloc( p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32$ ms cpu, (forced) wbuf1.n= wbuf2.n= s.limit= s.state= B work ( B exp.) marked unmarked in use), size = bad prune, tail = recover: not in [ctxt != 0, oldval=, newval= threads=: status= blocked= lockedg=atomicor8 runtime= m->curg=(unknown)traceback} stack=$+]M[<=1-{}Ly%x: i), )(M [("")) ) @s -> Pn=][}]> +25LlLtLuMn"\\?nilintmapptr... m=EOFfinobjgc %: gp *(in n= ) - NaN P MPC= < end > ]:???pc= G125625adxaesshaavxfmanetcgodnstcpudpfilereadseekopenpipebindtrueboolint8uintchanfunccallkind on allgall$.$/_`+]M[<=1-{}Ly%x: i), )(M [("")) ) @s -> Pn=][}]> +25LlLtLuMn"\\?nilintmapptr... m=EOFfinobjgc %: gp *(in n= ) - NaN P MPC= < end > ]:???pc= G125625adxaesshaavxfmanetcgodnstcpudpfilereadseekopenpipebindtrueboolint8uintchanfunccallkind on allg$failed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPre$gc %: gp *(in n= ) - NaN P MPC= < end > ]:???pc= G125625adxaesshaavxfmanetcgodnstcpudpfilereadseekopenpipebindtrueboolint8uintchanfunccallkind on allgallprootitabsbrkidledead is LEAFbase of ) = <==GOGC] = pc=+Inf-Inf: p=cas1cas2cas3cas4cas5cas6 at m$gc done but gcphase != _GCoffruntime: p.gcMarkWorkerMode= scanobject of a noscan objectruntime: marking free object addspecial on invalid pointerruntime: summary max pages = runtime: levelShift[level] = doRecordGoroutineProfile gp1=timeBegin/EndPeriod not foun$gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault tab= top=[...], fp:1562578125Greeksse41sse42ssse3filesKeyKey SysidreadatlistensocketStringFormat[]bytestringuint16uint32uint64structchan<-<-chan ValueGetACPsysmontimersefenceselect, not object next= $non-concurrent sweep failed to drain all sweep queuescompileCallback: argument size is larger than uintptrmin size of malloc header is not a size class boundarygcControllerState.findRunnable: blackening not enabledno goroutines (main called runtime.Goexit) - d
API String ID: 0-1845765171
Opcode ID: b456c3adb1f6e1899da67e5c6ac102f20f7dd5960f155d34da9cf683050448be
Instruction ID: 1bdd5e6931c6752ffbee06c3fb7d516e2c6e2cf0cbca2300858a44ba11867e5b
Opcode Fuzzy Hash: b456c3adb1f6e1899da67e5c6ac102f20f7dd5960f155d34da9cf683050448be
Instruction Fuzzy Hash: 3E728D36215BC886EB20DF25F9817AA7365F78AB84F448226DA8D03B6ADF3CC444C751

Function 00A1BAA0 Relevance: 16.8, Strings: 13, Instructions: 542COMMON

Download Yara Rule

Strings

, levelBits[level] = runtime: searchIdx = defer on system stackpanic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime:, xrefs: 00A1C3A5
runtime: npages = runtime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to threadruntime.semacreateruntime.semawakeupuse of closed fileCM_MapCr, xrefs: 00A1BE4F
runtime: p.searchAddr = range partially overlapsstack trace unavailablebindm in unexpected GOOSrunqsteal: runq overflowdouble traceGCSweepStartbad use of trace.seqlockAllocateAndInitializeSidBuildSecurityDescriptorWAssignProcessToJobObjectGenerateConsoleCtrlE, xrefs: 00A1C305
, )(M [("")) ) @s -> Pn=][}]> +25LlLtLuMn"\\?nilintmapptr... m=EOFfinobjgc %: gp *(in n= ) - NaN P MPC= < end > ]:???pc= G125625adxaesshaavxfmanetcgodnstcpudpfilereadseekopenpipebindtrueboolint8uintchanfunccallkind on allgallprootitabsbrkidled, xrefs: 00A1BDF3, 00A1BE0F, 00A1C231, 00A1C24F
runtime: levelShift[level] = doRecordGoroutineProfile gp1=timeBegin/EndPeriod not foundruntime: sudog with non-nil cgfput: bad status (not Gdead)semacquire not on the G stackruntime: split stack overflowstring concatenation too longinvalid function symbol tabl, xrefs: 00A1C385
, j0 = head = panic: nmsys= locks= dying= allocsGODEBUG m->g0= pad1= pad2= text= minpc= value= (scan)types : type FreeSidSleepEx19531259765625avx512fos/execruntime#internno anodeCancelIoReadFileAcceptExWSAIoctlshutdownGoStringscavengepollDesctraceBufdeadl, xrefs: 00A1C2BA
, npages = tracealloc( p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32nan2GOTRACEBACK) at entry+ (targetpc= , plugin: runtime: g : frame.sp=created by i/o timeoutsechost.dllversion, xrefs: 00A1C29C
] = (usageinit ms, fault tab= top=[...], fp:1562578125Greeksse41sse42ssse3filesKeyKey SysidreadatlistensocketStringFormat[]bytestringuint16uint32uint64structchan<-<-chan ValueGetACPsysmontimersefenceselect, not object next= jobs= goid sweep B -> % util alloc, xrefs: 00A1BDD8
][}]> +25LlLtLuMn"\\?nilintmapptr... m=EOFfinobjgc %: gp *(in n= ) - NaN P MPC= < end > ]:???pc= G125625adxaesshaavxfmanetcgodnstcpudpfilereadseekopenpipebindtrueboolint8uintchanfunccallkind on allgallprootitabsbrkidledead is LEAFbase of ) = <=, xrefs: 00A1BDBA, 00A1C1FB
] = pc=+Inf-Inf: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp= gp= mp=) m=3125Atoiermssse3avx2bmi1bmi2icmpigmp<nil>writeclosentohsfalseErrorint16int32int64uint8arrayslice and defersweeptestRtestWexecWexecRschedhchansudoggscanmheaptracepanicsleep cnt=gcin, xrefs: 00A1C216
bad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod, xrefs: 00A1BE7C, 00A1C5CC
runtime: summary[runtime: level = , p.searchAddr = RtlGetCurrentPeb, xrefs: 00A1BD9F, 00A1C1D6
, i = code= addr= m->p= p->m=SCHED curg= ctxt: min= max= (...) m=nil base sendto390625Commonrdtscppopcntcmd/gonetdnsheaderAnswer%s: %xconsoleCopySidWSARecvWSASendconnectfloat32float64invaliduintptrChanDir Value>forcegcallocmWcpuprofallocmRunknowngctraceIO, xrefs: 00A1C325

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID: , )(M [("")) ) @s -> Pn=][}]> +25LlLtLuMn"\\?nilintmapptr... m=EOFfinobjgc %: gp *(in n= ) - NaN P MPC= < end > ]:???pc= G125625adxaesshaavxfmanetcgodnstcpudpfilereadseekopenpipebindtrueboolint8uintchanfunccallkind on allgallprootitabsbrkidled$, i = code= addr= m->p= p->m=SCHED curg= ctxt: min= max= (...) m=nil base sendto390625Commonrdtscppopcntcmd/gonetdnsheaderAnswer%s: %xconsoleCopySidWSARecvWSASendconnectfloat32float64invaliduintptrChanDir Value>forcegcallocmWcpuprofallocmRunknowngctraceIO$, j0 = head = panic: nmsys= locks= dying= allocsGODEBUG m->g0= pad1= pad2= text= minpc= value= (scan)types : type FreeSidSleepEx19531259765625avx512fos/execruntime#internno anodeCancelIoReadFileAcceptExWSAIoctlshutdownGoStringscavengepollDesctraceBufdeadl$, levelBits[level] = runtime: searchIdx = defer on system stackpanic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime:$, npages = tracealloc( p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64nan3float32nan2GOTRACEBACK) at entry+ (targetpc= , plugin: runtime: g : frame.sp=created by i/o timeoutsechost.dllversion$] = pc=+Inf-Inf: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp= gp= mp=) m=3125Atoiermssse3avx2bmi1bmi2icmpigmp<nil>writeclosentohsfalseErrorint16int32int64uint8arrayslice and defersweeptestRtestWexecWexecRschedhchansudoggscanmheaptracepanicsleep cnt=gcin$] = (usageinit ms, fault tab= top=[...], fp:1562578125Greeksse41sse42ssse3filesKeyKey SysidreadatlistensocketStringFormat[]bytestringuint16uint32uint64structchan<-<-chan ValueGetACPsysmontimersefenceselect, not object next= jobs= goid sweep B -> % util alloc$][}]> +25LlLtLuMn"\\?nilintmapptr... m=EOFfinobjgc %: gp *(in n= ) - NaN P MPC= < end > ]:???pc= G125625adxaesshaavxfmanetcgodnstcpudpfilereadseekopenpipebindtrueboolint8uintchanfunccallkind on allgallprootitabsbrkidledead is LEAFbase of ) = <=$bad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod$runtime: levelShift[level] = doRecordGoroutineProfile gp1=timeBegin/EndPeriod not foundruntime: sudog with non-nil cgfput: bad status (not Gdead)semacquire not on the G stackruntime: split stack overflowstring concatenation too longinvalid function symbol tabl$runtime: npages = runtime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to threadruntime.semacreateruntime.semawakeupuse of closed fileCM_MapCr$runtime: p.searchAddr = range partially overlapsstack trace unavailablebindm in unexpected GOOSrunqsteal: runq overflowdouble traceGCSweepStartbad use of trace.seqlockAllocateAndInitializeSidBuildSecurityDescriptorWAssignProcessToJobObjectGenerateConsoleCtrlE$runtime: summary[runtime: level = , p.searchAddr = RtlGetCurrentPeb
API String ID: 0-1428436601
Opcode ID: de35b0db16cd01a02109349835d96b36eb4538067745b50c02b28b304f9ce963
Instruction ID: af7fc33cdc21ad7876d035a0abf33ae4fa96e7cce54e62cc16e29be2efc0cdc0
Opcode Fuzzy Hash: de35b0db16cd01a02109349835d96b36eb4538067745b50c02b28b304f9ce963
Instruction Fuzzy Hash: 1E32CD76724BD481DB20AB16F9813DAB326F789BD0F408122EE9D07B5ADF78C985C740

Function 00A3F160 Relevance: 15.4, Strings: 12, Instructions: 364COMMON

Download Yara Rule

Strings

(targetpc= , plugin: runtime: g : frame.sp=created by i/o timeoutsechost.dllversion.dllGetFileTimeVirtualFreeCoGetObjectEnumWindowsMessageBoxW30517578125gocachehashgocachetesthttp2clienthttp2serverarchive/tartls10servercrypto/x509archive/zipClassHESIODinvalid, xrefs: 00A3F517, 00A3F698
+]M[<=1-{}Ly%x: i), )(M [("")) ) @s -> Pn=][}]> +25LlLtLuMn"\\?nilintmapptr... m=EOFfinobjgc %: gp *(in n= ) - NaN P MPC= < end > ]:???pc= G125625adxaesshaavxfmanetcgodnstcpudpfilereadseekopenpipebindtrueboolint8uintchanfunccallkind on allgall, xrefs: 00A3F5D2, 00A3F74F
and defersweeptestRtestWexecWexecRschedhchansudoggscanmheaptracepanicsleep cnt=gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault tab= top=[...], fp:1562578125Greeksse41sse42ssse3filesKeyKey SysidreadatlistensocketStringFormat[]bytestringuint16uint3, xrefs: 00A3F4CF, 00A3F65A
missing stackmapbad symbol tablenon-Go function not in ranges:SetEntriesInAclWSetServiceStatusCryptProtectDataCryptQueryObjectConnectNamedPipeCreateJobObjectWCreateNamedPipeWDefineDosDeviceWFindFirstVolumeWGetLogicalDrivesGetNamedPipeInfoGetPriorityClassSetD, xrefs: 00A3F5F9, 00A3F779
args stack map entries for invalid runtime symbol tableruntime: no module data for traceRegion: alloc too large[originating from goroutine GetSecurityDescriptorControlInitializeSecurityDescriptorSetSecurityDescriptorControlFindFirstChangeNotificationWGetProce, xrefs: 00A3F4EF
runtime: pcdata is bad ABI descriptiondodeltimer: wrong Padjusttimers: bad pfile already existsfile does not existfile already closedQueryServiceConfigWCreatePseudoConsoleGetDiskFreeSpaceExWGetLargePageMinimumGetOverlappedResultGetSystemDirectoryWResizePseudoC, xrefs: 00A3F4B3, 00A3F63F
) @s -> Pn=][}]> +25LlLtLuMn"\\?nilintmapptr... m=EOFfinobjgc %: gp *(in n= ) - NaN P MPC= < end > ]:???pc= G125625adxaesshaavxfmanetcgodnstcpudpfilereadseekopenpipebindtrueboolint8uintchanfunccallkind on allgallprootitabsbrkidledead is LEAFbas, xrefs: 00A3F532, 00A3F6B3
bad symbol tablenon-Go function not in ranges:SetEntriesInAclWSetServiceStatusCryptProtectDataCryptQueryObjectConnectNamedPipeCreateJobObjectWCreateNamedPipeWDefineDosDeviceWFindFirstVolumeWGetLogicalDrivesGetNamedPipeInfoGetPriorityClassSetDllDirectoryWSetF, xrefs: 00A3F54A, 00A3F6CA
untyped args out of range no module dataruntime: seq1=runtime: goid= in goroutine unreachable: ControlServiceCreateServiceWIsWellKnownSidMakeAbsoluteSDSetThreadTokenCreateEventExWCreateMutexExWGetTickCount64IsWow64ProcessLoadLibraryExWSetConsoleModeSizeofRe, xrefs: 00A3F5B7
runtime: frame runtimer: bad ptraceback stuckGetSecurityInfoSetSecurityInfoAddDllDirectoryFindNextVolumeWFindVolumeCloseGetCommTimeoutsIsWow64Process2QueryDosDeviceWSetCommTimeoutsSetVolumeLabelWRtlDefaultNpAclCLSIDFromStringStringFromGUID2IsWindowUnicodeIsWin, xrefs: 00A3F594, 00A3F709
untyped locals missing stackmapbad symbol tablenon-Go function not in ranges:SetEntriesInAclWSetServiceStatusCryptProtectDataCryptQueryObjectConnectNamedPipeCreateJobObjectWCreateNamedPipeWDefineDosDeviceWFindFirstVolumeWGetLogicalDrivesGetNamedPipeInfoGetP, xrefs: 00A3F72C
locals stack map entries for abi mismatch detected between runtime: impossible type kind unsafe.Slice: len out of rangesync: inconsistent mutex statesync: unlock of unlocked mutexGetSecurityDescriptorRMControlQueryServiceDynamicInformationSetSecurityDescripto, xrefs: 00A3F675

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID: (targetpc= , plugin: runtime: g : frame.sp=created by i/o timeoutsechost.dllversion.dllGetFileTimeVirtualFreeCoGetObjectEnumWindowsMessageBoxW30517578125gocachehashgocachetesthttp2clienthttp2serverarchive/tartls10servercrypto/x509archive/zipClassHESIODinvalid$ and defersweeptestRtestWexecWexecRschedhchansudoggscanmheaptracepanicsleep cnt=gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault tab= top=[...], fp:1562578125Greeksse41sse42ssse3filesKeyKey SysidreadatlistensocketStringFormat[]bytestringuint16uint3$ args stack map entries for invalid runtime symbol tableruntime: no module data for traceRegion: alloc too large[originating from goroutine GetSecurityDescriptorControlInitializeSecurityDescriptorSetSecurityDescriptorControlFindFirstChangeNotificationWGetProce$ locals stack map entries for abi mismatch detected between runtime: impossible type kind unsafe.Slice: len out of rangesync: inconsistent mutex statesync: unlock of unlocked mutexGetSecurityDescriptorRMControlQueryServiceDynamicInformationSetSecurityDescripto$ untyped args out of range no module dataruntime: seq1=runtime: goid= in goroutine unreachable: ControlServiceCreateServiceWIsWellKnownSidMakeAbsoluteSDSetThreadTokenCreateEventExWCreateMutexExWGetTickCount64IsWow64ProcessLoadLibraryExWSetConsoleModeSizeofRe$ untyped locals missing stackmapbad symbol tablenon-Go function not in ranges:SetEntriesInAclWSetServiceStatusCryptProtectDataCryptQueryObjectConnectNamedPipeCreateJobObjectWCreateNamedPipeWDefineDosDeviceWFindFirstVolumeWGetLogicalDrivesGetNamedPipeInfoGetP$) @s -> Pn=][}]> +25LlLtLuMn"\\?nilintmapptr... m=EOFfinobjgc %: gp *(in n= ) - NaN P MPC= < end > ]:???pc= G125625adxaesshaavxfmanetcgodnstcpudpfilereadseekopenpipebindtrueboolint8uintchanfunccallkind on allgallprootitabsbrkidledead is LEAFbas$+]M[<=1-{}Ly%x: i), )(M [("")) ) @s -> Pn=][}]> +25LlLtLuMn"\\?nilintmapptr... m=EOFfinobjgc %: gp *(in n= ) - NaN P MPC= < end > ]:???pc= G125625adxaesshaavxfmanetcgodnstcpudpfilereadseekopenpipebindtrueboolint8uintchanfunccallkind on allgall$bad symbol tablenon-Go function not in ranges:SetEntriesInAclWSetServiceStatusCryptProtectDataCryptQueryObjectConnectNamedPipeCreateJobObjectWCreateNamedPipeWDefineDosDeviceWFindFirstVolumeWGetLogicalDrivesGetNamedPipeInfoGetPriorityClassSetDllDirectoryWSetF$missing stackmapbad symbol tablenon-Go function not in ranges:SetEntriesInAclWSetServiceStatusCryptProtectDataCryptQueryObjectConnectNamedPipeCreateJobObjectWCreateNamedPipeWDefineDosDeviceWFindFirstVolumeWGetLogicalDrivesGetNamedPipeInfoGetPriorityClassSetD$runtime: frame runtimer: bad ptraceback stuckGetSecurityInfoSetSecurityInfoAddDllDirectoryFindNextVolumeWFindVolumeCloseGetCommTimeoutsIsWow64Process2QueryDosDeviceWSetCommTimeoutsSetVolumeLabelWRtlDefaultNpAclCLSIDFromStringStringFromGUID2IsWindowUnicodeIsWin$runtime: pcdata is bad ABI descriptiondodeltimer: wrong Padjusttimers: bad pfile already existsfile does not existfile already closedQueryServiceConfigWCreatePseudoConsoleGetDiskFreeSpaceExWGetLargePageMinimumGetOverlappedResultGetSystemDirectoryWResizePseudoC
API String ID: 0-3467211602
Opcode ID: f3f193e51e106a433b3d046ebee46f28d56ff06fc0161fe3d8ff395cf8286ed8
Instruction ID: 5821020b3b51e5bc313a9b63a3fd9e4bbf3ead6990b35bcd6ab43ad21d17788e
Opcode Fuzzy Hash: f3f193e51e106a433b3d046ebee46f28d56ff06fc0161fe3d8ff395cf8286ed8
Instruction Fuzzy Hash: B1E18B36728B9086DB64EF69F58039AB365F789B80F505132EE8D47B69DF38C944CB10

Function 000001B27A4E8370 Relevance: 14.6, APIs: 9, Instructions: 1062COMMON

Download Yara Rule

APIs

Part of subcall function 000001B27A4E7B70: _getptd.LIBCMT ref: 000001B27A4E7B82

_errno.LIBCMT ref: 000001B27A4E83DF
_errno.LIBCMT ref: 000001B27A4E83F0
_invalid_parameter_noinfo.LIBCMT ref: 000001B27A4E83FB
write_multi_char.LIBCMT ref: 000001B27A4E8AAF
write_multi_char.LIBCMT ref: 000001B27A4E8AED
write_char.LIBCMT ref: 000001B27A4E8B3C
write_multi_char.LIBCMT ref: 000001B27A4E8B99
free.LIBCMT ref: 000001B27A4E8BC0

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: write_multi_char$_errno$_getptd_invalid_parameter_noinfofreewrite_char
String ID:
API String ID: 2983306934-0
Opcode ID: f314fa1a04d89f2d58bebcb04c5c44ad645d9e45fc6ea60ff7cc086cfa18213a
Instruction ID: f7f4bf6ef4c67a119405df332904194c1d8ec6a2369ef20450dcc60f4fa7ba5b
Opcode Fuzzy Hash: f314fa1a04d89f2d58bebcb04c5c44ad645d9e45fc6ea60ff7cc086cfa18213a
Instruction Fuzzy Hash: 0B72DB3151C7858AEF689B9884613BB73E1FBA6322F34052DD586C32D1DF76DC0A874A

Function 00A08FC0 Relevance: 14.1, Strings: 11, Instructions: 368COMMON

Download Yara Rule

Strings

, not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failed, xrefs: 00A09610
runtime.SetFinalizer: pointer not in allocated blockruntime: use of FixAlloc_Alloc before FixAlloc_Initspan set block with unpopped elements found in resetruntime: GetQueuedCompletionStatusEx failed (errno= casfrom_Gscanstatus: gp->status is not in scan state, xrefs: 00A095CB
runtime.SetFinalizer: first argument is failed to acquire lock to reset capacitymarkWorkerStop: unknown mark worker modecannot free workbufs when work.full != 0runtime: out of memory: cannot allocate runtime.preemptM: duplicatehandle failedglobal runq empty wi, xrefs: 00A0961F
, not a functiongc: unswept span KiB work (bg), mheap.sweepgen=runtime: nelems=workbuf is emptymSpanList.removemSpanList.insertbad special kindbad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod, xrefs: 00A09525
because dotdotdotruntime: npages = runtime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to threadruntime.semacreateruntime.semawakeupuse of c, xrefs: 00A094C6
runtime.SetFinalizer: first argument is nilruntime.SetFinalizer: finalizer already setgcBgMarkWorker: unexpected gcMarkWorkerModenon in-use span found with specials bit setgrew heap, but no adequate free space foundroot level max pages doesn't fit in summaryru, xrefs: 00A09630
runtime.SetFinalizer: cannot pass too many pages allocated in chunk?mspan.ensureSwept: m is not lockedVirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workruntime: g is running but p is notdoaddtimer: P already , xrefs: 00A09443, 00A09497, 00A09501
runtime.SetFinalizer: first argument was allocated into an arenacompileCallback: expected function with one uintptr-sized resultuser arena chunk size is not a multiple of the physical page sizeruntime: function marked with #cgo nocallback called back into Goru, xrefs: 00A095DC
runtime.SetFinalizer: second argument is gcSweep being done but phase is not GCoffobjects added out of order or overlappingmheap.freeSpanLocked - invalid stack freemheap.freeSpanLocked - invalid span stateattempted to add zero-sized address rangeruntime: block, xrefs: 00A09534
runtime.SetFinalizer: pointer not at beginning of allocated blockreflect: reflect.Value.UnsafePointer on an invalid notinheap pointertoo many concurrent operations on a single file or socket (max 1048575)MapIter.Next called on an iterator that does not have an, xrefs: 00A0954A
nil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated timeEndPeriod, xrefs: 00A095ED

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID: because dotdotdotruntime: npages = runtime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to threadruntime.semacreateruntime.semawakeupuse of c$, not a functiongc: unswept span KiB work (bg), mheap.sweepgen=runtime: nelems=workbuf is emptymSpanList.removemSpanList.insertbad special kindbad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod$, not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failed$nil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated timeEndPeriod$runtime.SetFinalizer: cannot pass too many pages allocated in chunk?mspan.ensureSwept: m is not lockedVirtualQuery for stack base failedforEachP: sched.safePointWait != 0schedule: spinning with local workruntime: g is running but p is notdoaddtimer: P already $runtime.SetFinalizer: first argument is failed to acquire lock to reset capacitymarkWorkerStop: unknown mark worker modecannot free workbufs when work.full != 0runtime: out of memory: cannot allocate runtime.preemptM: duplicatehandle failedglobal runq empty wi$runtime.SetFinalizer: first argument is nilruntime.SetFinalizer: finalizer already setgcBgMarkWorker: unexpected gcMarkWorkerModenon in-use span found with specials bit setgrew heap, but no adequate free space foundroot level max pages doesn't fit in summaryru$runtime.SetFinalizer: first argument was allocated into an arenacompileCallback: expected function with one uintptr-sized resultuser arena chunk size is not a multiple of the physical page sizeruntime: function marked with #cgo nocallback called back into Goru$runtime.SetFinalizer: pointer not at beginning of allocated blockreflect: reflect.Value.UnsafePointer on an invalid notinheap pointertoo many concurrent operations on a single file or socket (max 1048575)MapIter.Next called on an iterator that does not have an$runtime.SetFinalizer: pointer not in allocated blockruntime: use of FixAlloc_Alloc before FixAlloc_Initspan set block with unpopped elements found in resetruntime: GetQueuedCompletionStatusEx failed (errno= casfrom_Gscanstatus: gp->status is not in scan state$runtime.SetFinalizer: second argument is gcSweep being done but phase is not GCoffobjects added out of order or overlappingmheap.freeSpanLocked - invalid stack freemheap.freeSpanLocked - invalid span stateattempted to add zero-sized address rangeruntime: block
API String ID: 0-2314801022
Opcode ID: 39e2d0ff2fa3e28e40b74329a15a9c1535a50fcbdf139f64e5763b0bd31ed27b
Instruction ID: 9254aa18a8f8da70aadb919bcc468650885bb1a0e9f4eafee13c8077dba46ef4
Opcode Fuzzy Hash: 39e2d0ff2fa3e28e40b74329a15a9c1535a50fcbdf139f64e5763b0bd31ed27b
Instruction Fuzzy Hash: 80F1AF32709B8885EB609B21F4903AF77A4F789B80F488236DA8D17BD6DF38D594C711

Function 00A155C0 Relevance: 13.3, Strings: 10, Instructions: 811COMMON

Download Yara Rule

Strings

mspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignalruntime: casgstatus: oldval=gcstopm: negative nmspinningfindrunnable: netpoll with psave on system g not allowednewproc1, xrefs: 00A1643B
swept cached spanmarkBits overflowruntime: summary[runtime: level = , p.searchAddr = RtlGetCurrentPeb, xrefs: 00A15FCD
sweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = WSAGetOverlappedResult not found_cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevrunt, xrefs: 00A1610F
mspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcinternal lockOSThread errorruntime: checkdea, xrefs: 00A1642A
mspan.sweep: bad span state after sweepruntime: blocked write on free polldescPowerRegisterSuspendResumeNotification, xrefs: 00A16058
mheap.sweepgen=runtime: nelems=workbuf is emptymSpanList.removemSpanList.insertbad special kindbad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod, xrefs: 00A1602F, 00A16405
nalloc= nfreed=[signal newval= mcount= bytes, stack=[ minLC= maxpc= stack=[ minutes etypes nil PoolwsaioctlEqualSidSetEventIsWindowrecvfrom48828125strconv.parsing ParseIntavx512bwavx512vlgo/typesnet/httpgo/buildnetedns0x509sha1ClassANYQuestionntdll.dllFin, xrefs: 00A160A8
sweep: tried to preserve a user arena spanruntime: blocked write on closing polldescacquireSudog: found s.elem != nil in cachefatal error: cgo callback before cgo callon a locked thread with no template threadunexpected signal during runtime executionattempte, xrefs: 00A15FBC
sweepgen= sweepgen , bound = , limit = tracefree(tracegc()exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException ptrSize= targetpc= until pc=unknown pcruntime: ggoroutine dwmapi.dll, xrefs: 00A1600F, 00A163E5
previous allocCount=, levelBits[level] = runtime: searchIdx = defer on system stackpanic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime:, xrefs: 00A160C5

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID: mheap.sweepgen=runtime: nelems=workbuf is emptymSpanList.removemSpanList.insertbad special kindbad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod$ nalloc= nfreed=[signal newval= mcount= bytes, stack=[ minLC= maxpc= stack=[ minutes etypes nil PoolwsaioctlEqualSidSetEventIsWindowrecvfrom48828125strconv.parsing ParseIntavx512bwavx512vlgo/typesnet/httpgo/buildnetedns0x509sha1ClassANYQuestionntdll.dllFin$ previous allocCount=, levelBits[level] = runtime: searchIdx = defer on system stackpanic on system stackasync stack too largestartm: m is spinningstartlockedm: m has pfindrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime:$ sweepgen= sweepgen , bound = , limit = tracefree(tracegc()exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nanException ptrSize= targetpc= until pc=unknown pcruntime: ggoroutine dwmapi.dll$mspan.sweep: bad span state after sweepruntime: blocked write on free polldescPowerRegisterSuspendResumeNotification$mspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcinternal lockOSThread errorruntime: checkdea$mspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignalruntime: casgstatus: oldval=gcstopm: negative nmspinningfindrunnable: netpoll with psave on system g not allowednewproc1$sweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = WSAGetOverlappedResult not found_cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevrunt$sweep: tried to preserve a user arena spanruntime: blocked write on closing polldescacquireSudog: found s.elem != nil in cachefatal error: cgo callback before cgo callon a locked thread with no template threadunexpected signal during runtime executionattempte$swept cached spanmarkBits overflowruntime: summary[runtime: level = , p.searchAddr = RtlGetCurrentPeb
API String ID: 0-2687929702
Opcode ID: 787fc5d22eff570f9af6940a112434f54d50f104757b637fafdf959c80d0b73d
Instruction ID: 8c41f1eff122e340f65164969452ff85bc5b39e7a6c9c6c50cf4f933446bc73d
Opcode Fuzzy Hash: 787fc5d22eff570f9af6940a112434f54d50f104757b637fafdf959c80d0b73d
Instruction Fuzzy Hash: 3282BC73608BD4C6DB60CB25E5407AEB7A5F389B84F449226EACD43B99DF38C495CB40

Function 000001B27A4D82B0 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 496COMMON

Download Yara Rule

APIs

std::rethrow_exception.LIBCMTD ref: 000001B27A4D8370
std::rethrow_exception.LIBCMTD ref: 000001B27A4D83F4

Strings

h, xrefs: 000001B27A4D84BE

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: std::rethrow_exception
String ID: h
API String ID: 1317400359-2439710439
Opcode ID: 8ee3f583c56d212dec831c16406cf4e4c95e6968c2955d7366080fd8d4f38ae1
Instruction ID: 5f11a5d2bb5c621bfe87361fbc2d12bff3fb4a89724631ae0a6cde317e3e6bca
Opcode Fuzzy Hash: 8ee3f583c56d212dec831c16406cf4e4c95e6968c2955d7366080fd8d4f38ae1
Instruction Fuzzy Hash: D022083011C7888FE7B5DF58C4987EAB7E1FBA9316F50492DE18AC2290DF759948CB06

Function 00A2F480 Relevance: 7.2, Strings: 5, Instructions: 943COMMON

Download Yara Rule

Strings

findrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativeruntime: name offset out of rangeruntime: type offset out of r, xrefs: 00A303DD
findrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime: newstack sp=runtime: confused by pcHeader.textStart= timer data corruptionunsupported operationCM_Get_DevNode_StatusChangeServiceConfig2WDeregist, xrefs: 00A303EE
findrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did not unwind completelyruntime: createevent failed; errno=file type does not support deadlineSubscribeServiceChangeNotifications17763568394002504646778106689453125888178419700125, xrefs: 00A303BB
findrunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid runtime symbol tableruntime: no module data for traceReg, xrefs: 00A303CC
global runq empty with non-zero runqsizemust be able to track idle limiter eventruntime: SyscallN has too many argumentsHad a bad time getting restore point: %v13877787807814456755295395851135253906256938893903907228377647697925567626953125ryuFtoaFixed32 calle, xrefs: 00A303AA

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID: findrunnable: negative nmspinningfreeing stack not in a stack spanstackalloc not on scheduler stackruntime: goroutine stack exceeds runtime: text offset out of rangetimer period must be non-negativeruntime: name offset out of rangeruntime: type offset out of r$findrunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid runtime symbol tableruntime: no module data for traceReg$findrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did not unwind completelyruntime: createevent failed; errno=file type does not support deadlineSubscribeServiceChangeNotifications17763568394002504646778106689453125888178419700125$findrunnable: wrong ppreempt at unknown pcreleasep: invalid argcheckdead: runnable gruntime: newstack at runtime: newstack sp=runtime: confused by pcHeader.textStart= timer data corruptionunsupported operationCM_Get_DevNode_StatusChangeServiceConfig2WDeregist$global runq empty with non-zero runqsizemust be able to track idle limiter eventruntime: SyscallN has too many argumentsHad a bad time getting restore point: %v13877787807814456755295395851135253906256938893903907228377647697925567626953125ryuFtoaFixed32 calle
API String ID: 0-3828683212
Opcode ID: ed6c1dc0b3413130e9eb2e06fc107d8702b8b30a48cda57b938ba7c8689e7e25
Instruction ID: 8db753957db96b92990acbfbe101665870bed91e51cb6d5636c524a527c7820b
Opcode Fuzzy Hash: ed6c1dc0b3413130e9eb2e06fc107d8702b8b30a48cda57b938ba7c8689e7e25
Instruction Fuzzy Hash: 90929D32209B948AEB358F25F5907EAB360F785B94F488236DA8D57B64CF7DC885C740

Function 00A4AD20 Relevance: 6.7, Strings: 5, Instructions: 451COMMON

Download Yara Rule

Strings

) @s -> Pn=][}]> +25LlLtLuMn"\\?nilintmapptr... m=EOFfinobjgc %: gp *(in n= ) - NaN P MPC= < end > ]:???pc= G125625adxaesshaavxfmanetcgodnstcpudpfilereadseekopenpipebindtrueboolint8uintchanfunccallkind on allgallprootitabsbrkidledead is LEAFbas, xrefs: 00A4B20D
... m=EOFfinobjgc %: gp *(in n= ) - NaN P MPC= < end > ]:???pc= G125625adxaesshaavxfmanetcgodnstcpudpfilereadseekopenpipebindtrueboolint8uintchanfunccallkind on allgallprootitabsbrkidledead is LEAFbase of ) = <==GOGC] = pc=+Inf-Inf: p=cas1cas2cas3cas4, xrefs: 00A4B1B7
non-Go function at pc=EnumDependentServicesWWaitForMultipleObjectsNtSetSystemInformationRtlDeleteFunctionTableSetupDiEnumDriverInfoWSetupDiGetClassDevsExWWSAGetOverlappedResultWSALookupServiceBeginW4656612873077392578125device or resource busyinterrupted syste, xrefs: 00A4B4DB
sp= sp: lr: fp= gp= mp=) m=3125Atoiermssse3avx2bmi1bmi2icmpigmp<nil>writeclosentohsfalseErrorint16int32int64uint8arrayslice and defersweeptestRtestWexecWexecRschedhchansudoggscanmheaptracepanicsleep cnt=gcing MB, got= ... max=scav ptr ] = (usageinit ms, f, xrefs: 00A4B392
fp= gp= mp=) m=3125Atoiermssse3avx2bmi1bmi2icmpigmp<nil>writeclosentohsfalseErrorint16int32int64uint8arrayslice and defersweeptestRtestWexecWexecRschedhchansudoggscanmheaptracepanicsleep cnt=gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault tab= to, xrefs: 00A4B372

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID: fp= gp= mp=) m=3125Atoiermssse3avx2bmi1bmi2icmpigmp<nil>writeclosentohsfalseErrorint16int32int64uint8arrayslice and defersweeptestRtestWexecWexecRschedhchansudoggscanmheaptracepanicsleep cnt=gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault tab= to$ sp= sp: lr: fp= gp= mp=) m=3125Atoiermssse3avx2bmi1bmi2icmpigmp<nil>writeclosentohsfalseErrorint16int32int64uint8arrayslice and defersweeptestRtestWexecWexecRschedhchansudoggscanmheaptracepanicsleep cnt=gcing MB, got= ... max=scav ptr ] = (usageinit ms, f$) @s -> Pn=][}]> +25LlLtLuMn"\\?nilintmapptr... m=EOFfinobjgc %: gp *(in n= ) - NaN P MPC= < end > ]:???pc= G125625adxaesshaavxfmanetcgodnstcpudpfilereadseekopenpipebindtrueboolint8uintchanfunccallkind on allgallprootitabsbrkidledead is LEAFbas$... m=EOFfinobjgc %: gp *(in n= ) - NaN P MPC= < end > ]:???pc= G125625adxaesshaavxfmanetcgodnstcpudpfilereadseekopenpipebindtrueboolint8uintchanfunccallkind on allgallprootitabsbrkidledead is LEAFbase of ) = <==GOGC] = pc=+Inf-Inf: p=cas1cas2cas3cas4$non-Go function at pc=EnumDependentServicesWWaitForMultipleObjectsNtSetSystemInformationRtlDeleteFunctionTableSetupDiEnumDriverInfoWSetupDiGetClassDevsExWWSAGetOverlappedResultWSALookupServiceBeginW4656612873077392578125device or resource busyinterrupted syste
API String ID: 0-1608628172
Opcode ID: f3d885babe3141f07c383dc8b006a5b01e1068689c97c277d279a79fdbaa125a
Instruction ID: f19846dff0715834b8dff811e41ba18bbe901edc9a8887e7f95a43af76bc27f8
Opcode Fuzzy Hash: f3d885babe3141f07c383dc8b006a5b01e1068689c97c277d279a79fdbaa125a
Instruction Fuzzy Hash: 4422453A219BC086DB609B25F5903AFB761F7C9B80F545126EE8D07B6ACF39C485CB10

Function 00A281A0 Relevance: 6.5, Strings: 5, Instructions: 298COMMON

Download Yara Rule

Strings

suspendG from non-preemptible goroutineruntime: casfrom_Gscanstatus failed gp=stack growth not allowed in system calltraceback: unexpected SPWRITE function RtlDosPathNameToNtPathName_U_WithStatus27755575615628913510590791702270507812584804f99e2c7ab8aee611d256a, xrefs: 00A286CA
, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp, xrefs: 00A28610
runtime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to threadruntime.semacreateruntime.semawakeupuse of closed fileCM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidGetSidSu, xrefs: 00A285DA
, goid= s=nil (scan MB in pacer: % CPU ( zombie, j0 = head = panic: nmsys= locks= dying= allocsGODEBUG m->g0= pad1= pad2= text= minpc= value= (scan)types : type FreeSidSleepEx19531259765625avx512fos/execruntime#internno anodeCancelIoReadFileAcceptExWSAI, xrefs: 00A285F5, 00A28677
invalid g statuscastogscanstatusbad g transitionschedule: in cgoreflect mismatch untyped locals missing stackmapbad symbol tablenon-Go function not in ranges:SetEntriesInAclWSetServiceStatusCryptProtectDataCryptQueryObjectConnectNamedPipeCreateJobObjectWCrea, xrefs: 00A286B9

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID: , goid= s=nil (scan MB in pacer: % CPU ( zombie, j0 = head = panic: nmsys= locks= dying= allocsGODEBUG m->g0= pad1= pad2= text= minpc= value= (scan)types : type FreeSidSleepEx19531259765625avx512fos/execruntime#internno anodeCancelIoReadFileAcceptExWSAI$, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp$invalid g statuscastogscanstatusbad g transitionschedule: in cgoreflect mismatch untyped locals missing stackmapbad symbol tablenon-Go function not in ranges:SetEntriesInAclWSetServiceStatusCryptProtectDataCryptQueryObjectConnectNamedPipeCreateJobObjectWCrea$runtime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to threadruntime.semacreateruntime.semawakeupuse of closed fileCM_MapCrToWin32ErrCloseServiceHandleCreateWellKnownSidGetSidSu$suspendG from non-preemptible goroutineruntime: casfrom_Gscanstatus failed gp=stack growth not allowed in system calltraceback: unexpected SPWRITE function RtlDosPathNameToNtPathName_U_WithStatus27755575615628913510590791702270507812584804f99e2c7ab8aee611d256a
API String ID: 0-3225884625
Opcode ID: 6c0d8734fb2c820db0d7e1074ac7526651c0ecec466191c50a63645a191e1424
Instruction ID: 7d388080ec6f99bb174bec4662572d83e5b03c839c832773d527596feefb2359
Opcode Fuzzy Hash: 6c0d8734fb2c820db0d7e1074ac7526651c0ecec466191c50a63645a191e1424
Instruction Fuzzy Hash: ECD14A76609B9082DB14DB29F18176ABB61F38AB90F448176FE9D07B6ACF7CC441CB50

Function 00A10D80 Relevance: 6.4, Strings: 5, Instructions: 179COMMON

Download Yara Rule

Strings

+]M[<=1-{}Ly%x: i), )(M [("")) ) @s -> Pn=][}]> +25LlLtLuMn"\\?nilintmapptr... m=EOFfinobjgc %: gp *(in n= ) - NaN P MPC= < end > ]:???pc= G125625adxaesshaavxfmanetcgodnstcpudpfilereadseekopenpipebindtrueboolint8uintchanfunccallkind on allgall, xrefs: 00A11025
pacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitws2_32.dll not foundpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubdodeltimer0: wrong P, xrefs: 00A10F86
MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= runtime: pid=: unknown pc called from DeleteServiceStartServiceW, xrefs: 00A11005
(scan MB in pacer: % CPU ( zombie, j0 = head = panic: nmsys= locks= dying= allocsGODEBUG m->g0= pad1= pad2= text= minpc= value= (scan)types : type FreeSidSleepEx19531259765625avx512fos/execruntime#internno anodeCancelIoReadFileAcceptExWSAIoctlshutdownGo, xrefs: 00A10FA5
-> Pn=][}]> +25LlLtLuMn"\\?nilintmapptr... m=EOFfinobjgc %: gp *(in n= ) - NaN P MPC= < end > ]:???pc= G125625adxaesshaavxfmanetcgodnstcpudpfilereadseekopenpipebindtrueboolint8uintchanfunccallkind on allgallprootitabsbrkidledead is LEAFbase of ), xrefs: 00A10FE5

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID: (scan MB in pacer: % CPU ( zombie, j0 = head = panic: nmsys= locks= dying= allocsGODEBUG m->g0= pad1= pad2= text= minpc= value= (scan)types : type FreeSidSleepEx19531259765625avx512fos/execruntime#internno anodeCancelIoReadFileAcceptExWSAIoctlshutdownGo$ MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= runtime: pid=: unknown pc called from DeleteServiceStartServiceW$+]M[<=1-{}Ly%x: i), )(M [("")) ) @s -> Pn=][}]> +25LlLtLuMn"\\?nilintmapptr... m=EOFfinobjgc %: gp *(in n= ) - NaN P MPC= < end > ]:???pc= G125625adxaesshaavxfmanetcgodnstcpudpfilereadseekopenpipebindtrueboolint8uintchanfunccallkind on allgall$-> Pn=][}]> +25LlLtLuMn"\\?nilintmapptr... m=EOFfinobjgc %: gp *(in n= ) - NaN P MPC= < end > ]:???pc= G125625adxaesshaavxfmanetcgodnstcpudpfilereadseekopenpipebindtrueboolint8uintchanfunccallkind on allgallprootitabsbrkidledead is LEAFbase of )$pacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitws2_32.dll not foundpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubdodeltimer0: wrong P
API String ID: 0-951795110
Opcode ID: 651526a418da869414f2405ebb532c774cbb2d7d2c0f3b9b9b434e305fbc6d28
Instruction ID: 9748bd50018194f215566f10ce744ad61e75600ef54317ac5ecc249db22fe5c3
Opcode Fuzzy Hash: 651526a418da869414f2405ebb532c774cbb2d7d2c0f3b9b9b434e305fbc6d28
Instruction Fuzzy Hash: 81718032618F9485D601EF65E44079AB7A8FB8ABC0F449736EA8E27B25CF78C491C750

Function 00A103C0 Relevance: 6.4, Strings: 5, Instructions: 177COMMON

Download Yara Rule

Strings

+]M[<=1-{}Ly%x: i), )(M [("")) ) @s -> Pn=][}]> +25LlLtLuMn"\\?nilintmapptr... m=EOFfinobjgc %: gp *(in n= ) - NaN P MPC= < end > ]:???pc= G125625adxaesshaavxfmanetcgodnstcpudpfilereadseekopenpipebindtrueboolint8uintchanfunccallkind on allgall, xrefs: 00A105C5
marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during , xrefs: 00A1063E
greyobject: obj not pointer-alignedmismatched begin/end of activeSweepmheap.freeSpanLocked - invalid freeattempt to clear non-empty span setruntime: close polldesc w/o unblockfindrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did n, xrefs: 00A1064F
base of ) = <==GOGC] = pc=+Inf-Inf: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp= gp= mp=) m=3125Atoiermssse3avx2bmi1bmi2icmpigmp<nil>writeclosentohsfalseErrorint16int32int64uint8arrayslice and defersweeptestRtestWexecWexecRschedhchansudoggscanmheaptrac, xrefs: 00A105FB
runtime: marking free object addspecial on invalid pointerruntime: summary max pages = runtime: levelShift[level] = doRecordGoroutineProfile gp1=timeBegin/EndPeriod not foundruntime: sudog with non-nil cgfput: bad status (not Gdead)semacquire not on the G stac, xrefs: 00A10587

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID: +]M[<=1-{}Ly%x: i), )(M [("")) ) @s -> Pn=][}]> +25LlLtLuMn"\\?nilintmapptr... m=EOFfinobjgc %: gp *(in n= ) - NaN P MPC= < end > ]:???pc= G125625adxaesshaavxfmanetcgodnstcpudpfilereadseekopenpipebindtrueboolint8uintchanfunccallkind on allgall$base of ) = <==GOGC] = pc=+Inf-Inf: p=cas1cas2cas3cas4cas5cas6 at m= sp= sp: lr: fp= gp= mp=) m=3125Atoiermssse3avx2bmi1bmi2icmpigmp<nil>writeclosentohsfalseErrorint16int32int64uint8arrayslice and defersweeptestRtestWexecWexecRschedhchansudoggscanmheaptrac$greyobject: obj not pointer-alignedmismatched begin/end of activeSweepmheap.freeSpanLocked - invalid freeattempt to clear non-empty span setruntime: close polldesc w/o unblockfindrunnable: netpoll with spinningpidleput: P has non-empty run queuetraceback did n$marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during $runtime: marking free object addspecial on invalid pointerruntime: summary max pages = runtime: levelShift[level] = doRecordGoroutineProfile gp1=timeBegin/EndPeriod not foundruntime: sudog with non-nil cgfput: bad status (not Gdead)semacquire not on the G stac
API String ID: 0-1677810536
Opcode ID: 6e8dca77a695ae99fa981dcbf0d8dbeafad27a8ae70bd285c30a1cfbf87065a0
Instruction ID: b68a920097d87ce51ae21bd8d3928d72b82f6f04026e40b07b24094dd1720607
Opcode Fuzzy Hash: 6e8dca77a695ae99fa981dcbf0d8dbeafad27a8ae70bd285c30a1cfbf87065a0
Instruction Fuzzy Hash: B561EC72614B8086DB009F15E5407ADBB75F78ABD0F845126EF8E07B66CBB8C5E4C740

Function 009FBEA0 Relevance: 6.3, Strings: 5, Instructions: 80COMMON

Download Yara Rule

Strings

packed=BAD RANK status unknown(trigger= npages= nalloc= nfreed=[signal newval= mcount= bytes, stack=[ minLC= maxpc= stack=[ minutes etypes nil PoolwsaioctlEqualSidSetEventIsWindowrecvfrom48828125strconv.parsing ParseIntavx512bwavx512vlgo/typesnet/httpgo/b, xrefs: 009FBF65
lfstack.push span.limit= span.state=bad flushGen MB stacks, worker mode nDataRoots= nSpanRoots= wbuf1=<nil> wbuf2=<nil> gcscandone runtime: gp= found at *( s.elemsize= B (goal , cons/mark maxTrigger= pages/byte s.sweepgen= allocCount end tracegcProces, xrefs: 009FBFAF
runtime: lfstack.push invalid packing: node=out of memory allocating heap arena metadata/cpu/classes/scavenge/background:cpu-secondsruntime: unexpected metric registration for gcmarknewobject called while doing checkmarkactive sweepers found at start of mark p, xrefs: 009FBF25
-> node= ms cpu, (forced) wbuf1.n= wbuf2.n= s.limit= s.state= B work ( B exp.) marked unmarked in use), size = bad prune, tail = recover: not in [ctxt != 0, oldval=, newval= threads=: status= blocked= lockedg=atomicor8 runtime= m->curg=(unknown)tracebac, xrefs: 009FBF85
cnt=gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault tab= top=[...], fp:1562578125Greeksse41sse42ssse3filesKeyKey SysidreadatlistensocketStringFormat[]bytestringuint16uint32uint64structchan<-<-chan ValueGetACPsysmontimersefenceselect, not object n, xrefs: 009FBF45

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID: -> node= ms cpu, (forced) wbuf1.n= wbuf2.n= s.limit= s.state= B work ( B exp.) marked unmarked in use), size = bad prune, tail = recover: not in [ctxt != 0, oldval=, newval= threads=: status= blocked= lockedg=atomicor8 runtime= m->curg=(unknown)tracebac$ cnt=gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault tab= top=[...], fp:1562578125Greeksse41sse42ssse3filesKeyKey SysidreadatlistensocketStringFormat[]bytestringuint16uint32uint64structchan<-<-chan ValueGetACPsysmontimersefenceselect, not object n$ packed=BAD RANK status unknown(trigger= npages= nalloc= nfreed=[signal newval= mcount= bytes, stack=[ minLC= maxpc= stack=[ minutes etypes nil PoolwsaioctlEqualSidSetEventIsWindowrecvfrom48828125strconv.parsing ParseIntavx512bwavx512vlgo/typesnet/httpgo/b$lfstack.push span.limit= span.state=bad flushGen MB stacks, worker mode nDataRoots= nSpanRoots= wbuf1=<nil> wbuf2=<nil> gcscandone runtime: gp= found at *( s.elemsize= B (goal , cons/mark maxTrigger= pages/byte s.sweepgen= allocCount end tracegcProces$runtime: lfstack.push invalid packing: node=out of memory allocating heap arena metadata/cpu/classes/scavenge/background:cpu-secondsruntime: unexpected metric registration for gcmarknewobject called while doing checkmarkactive sweepers found at start of mark p
API String ID: 0-3066382416
Opcode ID: 4655a93cf0c610fa6299d2d38cc22161067603a125096b4d4a5d2e9d7c3019f6
Instruction ID: 1586f3399bf39ea5e3ace2fd6258f7e405d8bf0dc20b6f88e5c730769b11e58e
Opcode Fuzzy Hash: 4655a93cf0c610fa6299d2d38cc22161067603a125096b4d4a5d2e9d7c3019f6
Instruction Fuzzy Hash: D3214A36624B54C6D700EF15F9813AAB768F74AB80F889531EB8D07B2ACF38C545C750

Function 00A09D60 Relevance: 5.3, Strings: 4, Instructions: 334COMMON

Download Yara Rule

Strings

!= sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase, xrefs: 00A0A2D1
p mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitws2_32.dll not foundpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRight, xrefs: 00A0A2F8
flushGen MB goal, s.state = s.base()= heapGoal=GOMEMLIMIT KiB now, pages at sweepgen= sweepgen , bound = , limit = tracefree(tracegc()exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nan, xrefs: 00A0A2B6
runtime: p ms clock, nBSSRoots=runtime: P exp.) for minTrigger=GOMEMLIMIT=bad m value, elemsize= freeindex= span.list=, npages = tracealloc( p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64, xrefs: 00A0A29B

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID: != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase$ flushGen MB goal, s.state = s.base()= heapGoal=GOMEMLIMIT KiB now, pages at sweepgen= sweepgen , bound = , limit = tracefree(tracegc()exitThreadBad varintGC forced runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanfloat32nan$p mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitws2_32.dll not foundpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRight$runtime: p ms clock, nBSSRoots=runtime: P exp.) for minTrigger=GOMEMLIMIT=bad m value, elemsize= freeindex= span.list=, npages = tracealloc( p->status= in status idleprocs= gcwaiting= schedtick= timerslen= mallocing=bad timedivfloat64nan1float64nan2float64
API String ID: 0-4177187854
Opcode ID: 965289f310d441236374574f136103cdceb4876b7db0c619e19848f1691dbc68
Instruction ID: 5d906c38e490f82f1fdc0d62b39c4514e9be62f25376553ae099acff3353469e
Opcode Fuzzy Hash: 965289f310d441236374574f136103cdceb4876b7db0c619e19848f1691dbc68
Instruction Fuzzy Hash: 59E1A132204B48CAEB10DF65F58175FB765F78AB90F448226EA9D43BA6DF39C485CB01

Function 009F3980 Relevance: 5.3, Strings: 4, Instructions: 294COMMON

Download Yara Rule

Strings

2-by, xrefs: 009F39A6
expa, xrefs: 009F3988
nd 3, xrefs: 009F3997
te k, xrefs: 009F39B5

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID: 2-by$expa$nd 3$te k
API String ID: 0-3581043453
Opcode ID: d0a0678b136faf6cdae2b5bb443573c909990b14ac4f0b67f8b4f134291ae36c
Instruction ID: 0c71f4ba0b98ea64ad8700245c74ae3ff760222ec817bf0c77dbc5df3d1e57c8
Opcode Fuzzy Hash: d0a0678b136faf6cdae2b5bb443573c909990b14ac4f0b67f8b4f134291ae36c
Instruction Fuzzy Hash: 77B1B066F25FD94AF323A63910036B7EB185FFB9C9A40E327FC9474A87D72095036254

Function 00A2BD80 Relevance: 5.3, Strings: 4, Instructions: 266COMMON

Download Yara Rule

Strings

casgstatus: bad incoming valuesresetspinning: not a spinning mentersyscallblock inconsistent runtime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeCertDuplicateCertificateContextSetupDiGetDeviceInfoListDetailW113686837721, xrefs: 00A2C18F
newval= mcount= bytes, stack=[ minLC= maxpc= stack=[ minutes etypes nil PoolwsaioctlEqualSidSetEventIsWindowrecvfrom48828125strconv.parsing ParseIntavx512bwavx512vlgo/typesnet/httpgo/buildnetedns0x509sha1ClassANYQuestionntdll.dllFindCloseLocalFreeMoveFileW, xrefs: 00A2C165
casgstatus: waiting for Gwaiting but is Grunnablepe32 optional header has unexpected Magic of 0x%xnot enough significant bits after mult128bitPow10runtime: unable to acquire - semaphore out of syncmallocgc called with gcphase == _GCmarkterminationrecursive cal, xrefs: 00A2C0FB
runtime: casgstatus: oldval=gcstopm: negative nmspinningfindrunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid , xrefs: 00A2C147

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID: newval= mcount= bytes, stack=[ minLC= maxpc= stack=[ minutes etypes nil PoolwsaioctlEqualSidSetEventIsWindowrecvfrom48828125strconv.parsing ParseIntavx512bwavx512vlgo/typesnet/httpgo/buildnetedns0x509sha1ClassANYQuestionntdll.dllFindCloseLocalFreeMoveFileW$casgstatus: bad incoming valuesresetspinning: not a spinning mentersyscallblock inconsistent runtime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeCertDuplicateCertificateContextSetupDiGetDeviceInfoListDetailW113686837721$casgstatus: waiting for Gwaiting but is Grunnablepe32 optional header has unexpected Magic of 0x%xnot enough significant bits after mult128bitPow10runtime: unable to acquire - semaphore out of syncmallocgc called with gcphase == _GCmarkterminationrecursive cal$runtime: casgstatus: oldval=gcstopm: negative nmspinningfindrunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid
API String ID: 0-447271998
Opcode ID: 143d95079a5e92aee5f953a8ffb61dcc81ff63b34b9b936becde4a502d0ef55e
Instruction ID: e72c9cb2849fd265473681cebf6295130019921205d489f1894b144956737106
Opcode Fuzzy Hash: 143d95079a5e92aee5f953a8ffb61dcc81ff63b34b9b936becde4a502d0ef55e
Instruction Fuzzy Hash: D2B1B236609A94C6D704CB29E58536EBB71F34AB94F148232EF9C43B65CF3AC455CB41

Function 00A289E0 Relevance: 5.2, Strings: 4, Instructions: 221COMMON

Download Yara Rule

Strings

runtime/internal/thread exhaustionlocked m0 woke upentersyscallblock spinningthreads=unknown caller pcstack: frame={sp:runtime: nameOff runtime: typeOff runtime: textOff AdjustTokenGroupsIsTokenRestrictedCertFindExtensionCryptDecodeObjectReadProcessMemoryQuery, xrefs: 00A28BA5
runtime., xrefs: 00A28B72
reflect., xrefs: 00A28BCC
bad restart PC-thread limitstopm spinning nmidlelocked= needspinning=randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module dataruntime: seq1=runtime: goid= in goroutine unreachable: ControlS, xrefs: 00A28C93

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID: bad restart PC-thread limitstopm spinning nmidlelocked= needspinning=randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module dataruntime: seq1=runtime: goid= in goroutine unreachable: ControlS$reflect.$runtime.$runtime/internal/thread exhaustionlocked m0 woke upentersyscallblock spinningthreads=unknown caller pcstack: frame={sp:runtime: nameOff runtime: typeOff runtime: textOff AdjustTokenGroupsIsTokenRestrictedCertFindExtensionCryptDecodeObjectReadProcessMemoryQuery
API String ID: 0-1732337880
Opcode ID: 8886a7b3a7af4100c379caafe067bfe1de48abdc4cdbfc41e31d2dd6bb3fbac8
Instruction ID: e1840a97d8dbc314280dd55969c1cf9a00a055f03e0b8f91c8f5092a31ee2c2c
Opcode Fuzzy Hash: 8886a7b3a7af4100c379caafe067bfe1de48abdc4cdbfc41e31d2dd6bb3fbac8
Instruction Fuzzy Hash: 6A719D72716A608ADB14CF28A18036AA765F389B94F4C4639EF4D57B44DF3CD8918710

Function 000001B27A4D03A0 Relevance: 4.5, Strings: 3, Instructions: 750COMMON

Download Yara Rule

Strings

@, xrefs: 000001B27A4D0890
h, xrefs: 000001B27A4D041F
@, xrefs: 000001B27A4D07C0

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID:
String ID: @$@$h
API String ID: 0-1939477041
Opcode ID: 4a462c65aaa5ee4cb5eefe34262d9c9c718cb0a949f1d5267bcc6d3551e0ea6f
Instruction ID: c04b45093501c7eee2d40a852082db048ad7a6e2610a280f3ca3c411fe281640
Opcode Fuzzy Hash: 4a462c65aaa5ee4cb5eefe34262d9c9c718cb0a949f1d5267bcc6d3551e0ea6f
Instruction Fuzzy Hash: 1E629470118B889FE7A5EF18C498BDAB7E1FB98305F50491DE4CEC3260DBB99585CB42

Function 000001B27A4D2EF0 Relevance: 4.4, Strings: 3, Instructions: 689COMMON

Download Yara Rule

Strings

h, xrefs: 000001B27A4D2F24
@, xrefs: 000001B27A4D3392
@, xrefs: 000001B27A4D32C2

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID:
String ID: @$@$h
API String ID: 0-1939477041
Opcode ID: 28de4c54f65f17b84dbf6bfcea711746423dcc068f0d4871044aa6d515b88c96
Instruction ID: 3503a968a16b573088611508c3445f7519d9ae062a08eccd9f9edb671e04ad78
Opcode Fuzzy Hash: 28de4c54f65f17b84dbf6bfcea711746423dcc068f0d4871044aa6d515b88c96
Instruction Fuzzy Hash: DE527770118B888FE7A5EF58C498BDBB7E1FB98305F504A1DD48EC3260DB799585CB42

Function 00A2C6E0 Relevance: 4.0, Strings: 3, Instructions: 245COMMON

Download Yara Rule

Strings

stopTheWorld: not stopped (stopwait != 0)fail to read relocation block item %d: %v34694469519536141888238489627838134765625strconv: illegal AppendInt/FormatInt baseMapIter.Value called on exhausted iteratorpersistentalloc: align is not a power of 2out of memor, xrefs: 00A2CA00
stopTheWorld: holding locksgcstopm: not waiting for gcinternal lockOSThread errorruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len ou, xrefs: 00A2CAC5
stopTheWorld: not stopped (status != _Pgcstop)signal arrived during external code executioncompileCallback: float arguments not supportedruntime: name offset base pointer out of rangeruntime: type offset base pointer out of rangeruntime: text offset base poin, xrefs: 00A2CA7B

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID: stopTheWorld: holding locksgcstopm: not waiting for gcinternal lockOSThread errorruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len ou$stopTheWorld: not stopped (status != _Pgcstop)signal arrived during external code executioncompileCallback: float arguments not supportedruntime: name offset base pointer out of rangeruntime: type offset base pointer out of rangeruntime: text offset base poin$stopTheWorld: not stopped (stopwait != 0)fail to read relocation block item %d: %v34694469519536141888238489627838134765625strconv: illegal AppendInt/FormatInt baseMapIter.Value called on exhausted iteratorpersistentalloc: align is not a power of 2out of memor
API String ID: 0-1561105388
Opcode ID: 0d42c8e3c527ddbcea903b0d0fdcd355ee8c66cf86be2783a3cbfb8205c2a0d6
Instruction ID: 024857cac836779bc5ada75dd3b90a79bc0ca21ea7b086871bd2c3ef4af24919
Opcode Fuzzy Hash: 0d42c8e3c527ddbcea903b0d0fdcd355ee8c66cf86be2783a3cbfb8205c2a0d6
Instruction Fuzzy Hash: A7A1AD32209B9486EB14CF29F55076EB7A1F38AB94F548236DE8D43B65DF38C445CB40

Function 000001B27A4E4520 Relevance: 3.4, APIs: 2, Instructions: 403COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c47dd10ad2ffc75a4fb68eec796e3029fb36d07deac5f587a2ed2ad7d380ff7d
Instruction ID: dffec980990487419d227a48df8a1925e377ccb4503479d5a22bc2df5c156f55
Opcode Fuzzy Hash: c47dd10ad2ffc75a4fb68eec796e3029fb36d07deac5f587a2ed2ad7d380ff7d
Instruction Fuzzy Hash: 14020E74518644CFF7A4DB74D95C79B77E1FBA6325F204929E146C21E0CFBA8888CB0A

Function 000001B27A4ED01C Relevance: 3.2, APIs: 2, Instructions: 240COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_error_mode.LIBCMT ref: 000001B27A4ED061
_set_error_mode.LIBCMT ref: 000001B27A4ED072

Part of subcall function 000001B27A4F0B64: _errno.LIBCMT ref: 000001B27A4F0B83
Part of subcall function 000001B27A4F0B64: _invalid_parameter_noinfo.LIBCMT ref: 000001B27A4F0B8F

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: _set_error_mode$_errno_invalid_parameter_noinfo
String ID:
API String ID: 1239817535-0
Opcode ID: 61e198cd96bf3a7d6d01e63f616d7615256a84a0dabeda641be1faa46d329df0
Instruction ID: 0d22d5568604ec3db817aa7bb82983a456c9d8c42a485785a93ebe6232d53c08
Opcode Fuzzy Hash: 61e198cd96bf3a7d6d01e63f616d7615256a84a0dabeda641be1faa46d329df0
Instruction Fuzzy Hash: A961083031C9484FEB5CEB6898653AB73C6E7E6310F24452EE85BC31D6DF35C9098649

Function 000001B27A4CB340 Relevance: 3.2, Strings: 2, Instructions: 681COMMON

Download Yara Rule

Strings

2, xrefs: 000001B27A4CB54E
h, xrefs: 000001B27A4CBA24

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: Timer$ChangeConcurrency::details::platform::__Queue
String ID: 2$h
API String ID: 19862154-1781522464
Opcode ID: adc0e538de935e29b1200ddc316d70f42cae9e69c8baf8df58ba3b730e764b05
Instruction ID: 8bd1b0c0fb0f5f2dc3889e0263d419ea44078fac1b1eca0d1ee9a03f55297c6a
Opcode Fuzzy Hash: adc0e538de935e29b1200ddc316d70f42cae9e69c8baf8df58ba3b730e764b05
Instruction Fuzzy Hash: A852B631118A888FE7B5EF18D898BDBB7E5FBA4305F50092ED48EC2160DF759685CB42

Function 000001B27A4CE700 Relevance: 3.1, Strings: 2, Instructions: 645COMMON

Download Yara Rule

Strings

h, xrefs: 000001B27A4CED9D
2, xrefs: 000001B27A4CE90E

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID:
String ID: 2$h
API String ID: 0-1781522464
Opcode ID: 933841f83ee4cd8a2178f92730b9b63252a466f6bf167bd2332cfe478ca586c4
Instruction ID: 0561e36701d22088b2636bcb9d26fa7244f9d691085dda0e514ce2f5c8c21ad7
Opcode Fuzzy Hash: 933841f83ee4cd8a2178f92730b9b63252a466f6bf167bd2332cfe478ca586c4
Instruction Fuzzy Hash: AE42B471118B888FE775EF14D498BDBB7E5FBA4311F500A2ED08EC2160DF3596898B46

Function 000001B27A4D4AC0 Relevance: 3.1, Strings: 2, Instructions: 603COMMON

Download Yara Rule

Strings

h, xrefs: 000001B27A4D509C
2, xrefs: 000001B27A4D4CCA

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID:
String ID: 2$h
API String ID: 0-1781522464
Opcode ID: 46210806302b553765d2aefdbf89518961dd7be77563453aa79eaab9da8b6dfb
Instruction ID: eb38e7474da1086168d2d956b5be73edb8005f509eb77c5f13cf3d8ed8da77c5
Opcode Fuzzy Hash: 46210806302b553765d2aefdbf89518961dd7be77563453aa79eaab9da8b6dfb
Instruction Fuzzy Hash: B242D531118B888FE775EF14D898BDBB7E5FBA9301F604A2ED48EC2160DF3495498B46

Function 000001B27A4C7D70 Relevance: 2.4, Strings: 1, Instructions: 1110COMMON

Download Yara Rule

Strings

d, xrefs: 000001B27A4C7E24

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 66b57e7f80cdc274b7313cfeb5881d25c78d462638225719946137e9c4768fb8
Instruction ID: 50b0ae95179a0e1cc11f5e2778caff5428fc7530e3860251958bb5f1b42a0111
Opcode Fuzzy Hash: 66b57e7f80cdc274b7313cfeb5881d25c78d462638225719946137e9c4768fb8
Instruction Fuzzy Hash: D0A2A735109A88CFE7B5EB18C458BEAB7E1FBA9312F54096DD08EC3261DF719944CB42

Function 000001B27A4D8AA0 Relevance: 1.7, Strings: 1, Instructions: 468COMMON

Download Yara Rule

Strings

h, xrefs: 000001B27A4D8C62

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID:
String ID: h
API String ID: 0-2439710439
Opcode ID: a07e33f896b3e8815cac824815d3d86c5292d43a2d484c7fd0c4945bd6e46fcb
Instruction ID: e5e5e669a87e6880a3aa537ca87637712235e170e1096171c1b3256171b003af
Opcode Fuzzy Hash: a07e33f896b3e8815cac824815d3d86c5292d43a2d484c7fd0c4945bd6e46fcb
Instruction Fuzzy Hash: 3E12DB301187888FE7B4DF69C8687EBB7E1FB99315F10492DE18AC3290DB759885CB46

Function 00A3BE40 Relevance: 1.7, Strings: 1, Instructions: 441COMMON

Download Yara Rule

Strings

!"#$%%&&''((()))*++,,,,,------....//////0001123333333333444444444455666677777888888888889999999999::::::;;;;;;;;;;;;;;;;<<<<<<<<<<<<<<<<=====>>>>>>>>>>>??????????@@@@@@@@@@@@@@@@@@@@@@AAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC, xrefs: 00A3BF4D, 00A3C056, 00A3C197, 00A3C2BF

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID: !"#$%%&&''((()))*++,,,,,------....//////0001123333333333444444444455666677777888888888889999999999::::::;;;;;;;;;;;;;;;;<<<<<<<<<<<<<<<<=====>>>>>>>>>>>??????????@@@@@@@@@@@@@@@@@@@@@@AAAAAAAAAAAAAAAAAAAAABBBBBBBBBBBCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
API String ID: 0-2911004680
Opcode ID: 5ed3aa6a43838c8b28439dc7834d93543f151ae1690b73d3d5615f3a05c120d9
Instruction ID: 3c1357025784da9a40f29793e722b57d5b2727b9a0da74d8350e1b750ef1eab3
Opcode Fuzzy Hash: 5ed3aa6a43838c8b28439dc7834d93543f151ae1690b73d3d5615f3a05c120d9
Instruction Fuzzy Hash: 07F1F032355A84C6EA00DB25E8057BAA766F784BE0F994126FF5E27B95CF7CC845C700

Function 000001B27A4D92E0 Relevance: 1.6, Strings: 1, Instructions: 356COMMON

Download Yara Rule

Strings

h, xrefs: 000001B27A4D94C2

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID:
String ID: h
API String ID: 0-2439710439
Opcode ID: d382f11ba5a69f70f62551fcb19b99bbd528cd8ca2d54e000dc28b20ef4a62b0
Instruction ID: 3ac8ad472872f37459f2c29c428bb76cf33d53c792bc8c7638c81bc815fd8f9c
Opcode Fuzzy Hash: d382f11ba5a69f70f62551fcb19b99bbd528cd8ca2d54e000dc28b20ef4a62b0
Instruction Fuzzy Hash: 3BE118305187888FE7B5DF68C8587EAB7E1FBA9305F10492EE18ED3690DB749485CB42

Function 00A1EC60 Relevance: 1.5, Strings: 1, Instructions: 266COMMON

Download Yara Rule

Strings

runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listcasgstatus: bad incoming valuesresetspinnin, xrefs: 00A1F005

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listcasgstatus: bad incoming valuesresetspinnin
API String ID: 0-429552053
Opcode ID: fe40db33e75f3ec8ef636a34b92cde33c6badab1a5aa60edf01a5fa9eb0cc8b8
Instruction ID: 80b41a864794c53d971910d02c3a3a78397330a272f9ff4d6b478ae89493c414
Opcode Fuzzy Hash: fe40db33e75f3ec8ef636a34b92cde33c6badab1a5aa60edf01a5fa9eb0cc8b8
Instruction Fuzzy Hash: 59A15976618B9482DA24CB16F4407AAA775F3C9BC0F585522EF8E57B29CF38C991CB40

Function 00A04A80 Relevance: 1.5, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

bulkBarrierPreWrite: unaligned argumentsrefill of span with free space remaining/cpu/classes/scavenge/assist:cpu-secondsruntime.SetFinalizer: first argument is failed to acquire lock to reset capacitymarkWorkerStop: unknown mark worker modecannot free workbufs, xrefs: 00A04E27

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID: bulkBarrierPreWrite: unaligned argumentsrefill of span with free space remaining/cpu/classes/scavenge/assist:cpu-secondsruntime.SetFinalizer: first argument is failed to acquire lock to reset capacitymarkWorkerStop: unknown mark worker modecannot free workbufs
API String ID: 0-866072839
Opcode ID: 7bc90c1452cbbc7e1b93d138c682f504b26b8733e46facca209e7fd7f81b64aa
Instruction ID: 409bfb1127a1ac438c24e5af297028e063c02cdfe0992e02687078d7e92712fd
Opcode Fuzzy Hash: 7bc90c1452cbbc7e1b93d138c682f504b26b8733e46facca209e7fd7f81b64aa
Instruction Fuzzy Hash: 7F918BB6719A9882DB108B56F4403AAB765F38EFC0F588126EF8D57B58DB38C4A1C700

Function 00A1DE40 Relevance: 1.4, Strings: 1, Instructions: 189COMMON

Download Yara Rule

Strings

bad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod, xrefs: 00A1E107

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID: bad summary dataruntime: addr = runtime: base = runtime: head = timeBeginPeriod
API String ID: 0-2099802129
Opcode ID: f497cace111e24177e3f2929a9120ef36b0710a6e1229a6dbecb2e8b2ed37383
Instruction ID: dd72103016bd455a93c08221116999653ad163c74a1d08b4d056d49ca476d9f9
Opcode Fuzzy Hash: f497cace111e24177e3f2929a9120ef36b0710a6e1229a6dbecb2e8b2ed37383
Instruction Fuzzy Hash: 4D61CDB3750B8882DB00DB16E44039A77A6F78ABD4F849226EF9D17B99CB7CD585C340

Function 00A0A420 Relevance: 1.4, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault tab= top=[...], fp:1562578125Greeksse41sse42ssse3filesKeyKey SysidreadatlistensocketStringFormat[]bytestringuint16uint32uint64structchan<-<-chan ValueGetACPsysmontimersefenceselect, not object next= , xrefs: 00A0A5F4

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID: gcing MB, got= ... max=scav ptr ] = (usageinit ms, fault tab= top=[...], fp:1562578125Greeksse41sse42ssse3filesKeyKey SysidreadatlistensocketStringFormat[]bytestringuint16uint32uint64structchan<-<-chan ValueGetACPsysmontimersefenceselect, not object next=
API String ID: 0-2827204213
Opcode ID: 177bd78426176aa971dae05c8ea15b451086d80e2902ed32e6907b63e309a476
Instruction ID: bb98d9bd1021f100baac3829e9b11c19ab3e261659379bf2154297bdbb894ca6
Opcode Fuzzy Hash: 177bd78426176aa971dae05c8ea15b451086d80e2902ed32e6907b63e309a476
Instruction Fuzzy Hash: 77817C32208B84C6E700DF20F48575AB774F39A794F558326EA9D837A5EF7AC489CB01

Function 00A10B00 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

gcmarknewobject called while doing checkmarkactive sweepers found at start of mark phaseno P available, write barriers are forbiddencompileCallback: float results not supportedcannot trace user goroutine on its own stackunsafe.Slice: ptr is nil and len is not , xrefs: 00A10BF0

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID: gcmarknewobject called while doing checkmarkactive sweepers found at start of mark phaseno P available, write barriers are forbiddencompileCallback: float results not supportedcannot trace user goroutine on its own stackunsafe.Slice: ptr is nil and len is not
API String ID: 0-3110597650
Opcode ID: 3fb25025385263e90aba77d5286d80a85059c15c3ddd45348806f1429adaff7e
Instruction ID: 2c7315d90518299d4349569df283b91b274c5e1b8511d9a5441fbb861c6aae90
Opcode Fuzzy Hash: 3fb25025385263e90aba77d5286d80a85059c15c3ddd45348806f1429adaff7e
Instruction Fuzzy Hash: 0421CFF3B06A8446EB058F29D4803A86B22E75AFD8F49A075CF4D57756CA68C596C300

Function 000001B278C83AB4 Relevance: .7, Instructions: 730COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2178027279.000001B278C10000.00000040.00000020.00020000.00000000.sdmp, Offset: 000001B278C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b278c10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f830e609fe5cee47e6c16999e452ce305c1c12be961c10b305ce6362bf0b176d
Instruction ID: f6fe584ad53d6cd92f9fb9bc5980e0a34cc66f00a37b6a3771561f22d906ef55
Opcode Fuzzy Hash: f830e609fe5cee47e6c16999e452ce305c1c12be961c10b305ce6362bf0b176d
Instruction Fuzzy Hash: DA527D715443019FE768CF26C849BABB7E5AF98704F044A2DF9859F2C1DBB0E848CB95

Function 000001B27A4DACD0 Relevance: .6, Instructions: 601COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a583ae86051e2f7dd8e1f5aad3c29afd1add19ea6dbc22acd9425ae77474c6f
Instruction ID: 57926ea9eae2b5ad98d74fa2671e79c172517ce85b0a05c2235f61e70f7f127c
Opcode Fuzzy Hash: 5a583ae86051e2f7dd8e1f5aad3c29afd1add19ea6dbc22acd9425ae77474c6f
Instruction Fuzzy Hash: B22272707082419FD74CCB2CD8A1A2EB7E2ABDC344F54892DF59AD7391DA30E915CB4A

Function 000001B27A4DAD51 Relevance: .5, Instructions: 510COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee4bf9ab2e29397760fc8cb3bc6385edb1bd6fffdce0efa5aaa3d0e99b23b852
Instruction ID: 49b96194504ccdf6f1240f0ff1a012c5d7fe34f7fa3d74143e7d6006a5f1c1ab
Opcode Fuzzy Hash: ee4bf9ab2e29397760fc8cb3bc6385edb1bd6fffdce0efa5aaa3d0e99b23b852
Instruction Fuzzy Hash: 2B1255747092019F974CCB2CD8A1A2EB7E2ABCC744F44892DF59AD7381DA30ED15CB4A

Function 000001B278C7F120 Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2178027279.000001B278C10000.00000040.00000020.00020000.00000000.sdmp, Offset: 000001B278C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b278c10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 629590470d97b874860c088878d19a79a4e01a140465c2e63e0b89389eaa0b6e
Instruction ID: ad846f34f53fd6d8957bfefdcd2171cb8400718fdef9b7d4236e943f7c46f79a
Opcode Fuzzy Hash: 629590470d97b874860c088878d19a79a4e01a140465c2e63e0b89389eaa0b6e
Instruction Fuzzy Hash: 79E17430618A498BEB6CDF29D8897EEB7E5FB58701F00432DE85AC7280DF70E9158785

Function 000001B278C803D8 Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2178027279.000001B278C10000.00000040.00000020.00020000.00000000.sdmp, Offset: 000001B278C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b278c10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a66aa8eccb36b3c863fa0cf2326f118ce4658279e53cce5a51b176019e00911a
Instruction ID: cf3d48de496c557f19ebf9bfabec57d2b55e9ab4edcf8e76f0b0e238758762a7
Opcode Fuzzy Hash: a66aa8eccb36b3c863fa0cf2326f118ce4658279e53cce5a51b176019e00911a
Instruction Fuzzy Hash: CAD16E31508A088FEB59DF28C889AEAB7E1FF98310F14462DE88ACB155DF30E545CB45

Function 00A64320 Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5db96014bc2057459a5de57d795ac0494fa1063507bb8748ea6a2b77d000882
Instruction ID: de2e4c6a76d66fb147fad6ffb8f4f5d4e8de04026e9e6f66491aa263d7dd4b81
Opcode Fuzzy Hash: e5db96014bc2057459a5de57d795ac0494fa1063507bb8748ea6a2b77d000882
Instruction Fuzzy Hash: 77C1C577B08A9482CA14CF16F401BAAA775F39AFC4F485521EE8E87B19CB79C945C740

Function 000001B278C812BC Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2178027279.000001B278C10000.00000040.00000020.00020000.00000000.sdmp, Offset: 000001B278C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b278c10000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eb60552c2100443aaec2c648c47b59461eb5170d6947b4f16a84231dc1554a0
Instruction ID: 80bb89dca05d8b2aef9f440b708c118023c2c164ebba28b1e21f720818636e33
Opcode Fuzzy Hash: 2eb60552c2100443aaec2c648c47b59461eb5170d6947b4f16a84231dc1554a0
Instruction Fuzzy Hash: FEA12C31508A0C8FDB59EF28C889BEA77E5FB68315F10466FE44AC7160EB30D644CB85

Function 00A0E140 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa490ab6571b93393d0a1a4a94c8c4e5444e5b9063051b146d42770c6ade12ea
Instruction ID: 415826a09075281bf82f4d2ec674b0bd69f49647238e5eda5f22293c8358a0b5
Opcode Fuzzy Hash: fa490ab6571b93393d0a1a4a94c8c4e5444e5b9063051b146d42770c6ade12ea
Instruction Fuzzy Hash: 83B12432309B88C6EB05CB21F4543AABB65F386B84F088A35EA9D137D4DF39D485D701

Function 000001B27A4DB880 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51cd065529514eff7a7f141582a7417b104afbf881e1d1e60466e9b6a8fbc7b2
Instruction ID: d7e5b6cd81af0867ae2a5f442fe69b6b079e17191ab3ed37a150cce822db1570
Opcode Fuzzy Hash: 51cd065529514eff7a7f141582a7417b104afbf881e1d1e60466e9b6a8fbc7b2
Instruction Fuzzy Hash: 9BA16C302087488FF778EB69D8687AB77E1FBAA312F104529D54AC22A0DF798945CB45

Function 00A30640 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0351977f8a9c6ad20ec25c8f94d0c4112283a0eae10307cc46bc89dd75069b69
Instruction ID: babd2c91fc05a2ec396b4e9d01ad6c74239e637c2f029e2afeaf597a5f1d5513
Opcode Fuzzy Hash: 0351977f8a9c6ad20ec25c8f94d0c4112283a0eae10307cc46bc89dd75069b69
Instruction Fuzzy Hash: 3D91D3727196808AD724CB66B560F6BBB61F799BC0F589125FE8D47F19CB38C8508B40

Function 00A536E9 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b52b00425498a556b8e8e77816f0c5cafaf55d5da3e93247ae1f2a6147883f2
Instruction ID: c91e3a47b19b221ba89efe4a6de35835a0604c1582682c49c1dfe5d272e217f6
Opcode Fuzzy Hash: 2b52b00425498a556b8e8e77816f0c5cafaf55d5da3e93247ae1f2a6147883f2
Instruction Fuzzy Hash: D8B11A16D18FCA20F6135778D403B762A146FF36C4F01D72ABAC6F16B3DB566A04B922

Function 00A1B5E0 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7223a579b979f01d93bbfcd00fa344795459571650b7942a5d2e5933e787820
Instruction ID: 795858132940f5aed3d9d27646e7fa01de5aca91a7d0c6afcdb91f74b186c428
Opcode Fuzzy Hash: b7223a579b979f01d93bbfcd00fa344795459571650b7942a5d2e5933e787820
Instruction Fuzzy Hash: CBA14876618B8482DB10CB25F18029AB7A5F789BD4F545226EFED57BA9CF3CD091CB00

Function 00A1CA60 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5802199e9b15065e1c2173d735624e98e10ed4ac0cbec300296e7e546346cedb
Instruction ID: 1cf6fa46dadc03f4884419d25f9ed072e71b6b5e597253a6bd4ae279e4ac8d67
Opcode Fuzzy Hash: 5802199e9b15065e1c2173d735624e98e10ed4ac0cbec300296e7e546346cedb
Instruction Fuzzy Hash: DD819D73718B8482DB108B15E5803EAA762F79ABD0F585226EF8D57B5ACB3CC494C740

Function 000001B27A4E0A10 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67fee4663bc745c6a5a2df735d6d59c7405c2b46a96bc890505430404ad3a281
Instruction ID: 6df6bcca8f4baf5164663f437fb8b3b287ac3a789c973142d19389161018c734
Opcode Fuzzy Hash: 67fee4663bc745c6a5a2df735d6d59c7405c2b46a96bc890505430404ad3a281
Instruction Fuzzy Hash: 9A71B0B4208608CFF7A8EF64D92D7EA73E1F7AA315F10452ED446C21A0DF798588CB49

Function 00A64B40 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fd0a24f60d9856ce55c1014a38e6b70657eb8710e95823019aa89749b6cc77a
Instruction ID: 0ab4b6527f3a793cbc45e554da88a804f841dde2780f3b477150a6f07f0c2d17
Opcode Fuzzy Hash: 2fd0a24f60d9856ce55c1014a38e6b70657eb8710e95823019aa89749b6cc77a
Instruction Fuzzy Hash: 8E41573274AA5482CB18DB19D511B6DAA31F3DDFD0F99521ADE1B07B81CE7ACC45C384

Function 009F9F80 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf61a254f4b2648dcf3111e7e7c633afb370ea62aa868d77fd3444ef2bb033a4
Instruction ID: 9357a616f04d78127e0689ab099c259860a903b202812f2a8ac2fd2d69630204
Opcode Fuzzy Hash: bf61a254f4b2648dcf3111e7e7c633afb370ea62aa868d77fd3444ef2bb033a4
Instruction Fuzzy Hash: 92410AD5701A5981AE048F6795201BAA361E74BFD039CE633CF1D77B68CA3CD902D344

Function 00A40380 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8b0b1f45454a5469b54204aac39b17cb437c0de978e696865ce4b20dffb7cd4
Instruction ID: 5220f122e7bf1789897ddedc9e157b9bf1f1cdc0a362b021d7ac8aba390b8b4b
Opcode Fuzzy Hash: c8b0b1f45454a5469b54204aac39b17cb437c0de978e696865ce4b20dffb7cd4
Instruction Fuzzy Hash: 3141D53AB81A448BCB149F34A441BBA6286D7C0774FCC8674DF6D4B3C2E67C84E5BA10

Function 00A16A00 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 232779ea1d360234e4bbd75473a090e227ddaa2c60edee6d735021a4b2af9bdd
Instruction ID: 8f42f0aabb8b38d0c0de79f2678beacd8c1019bef07dac3b0fe9f9c7bb19bacc
Opcode Fuzzy Hash: 232779ea1d360234e4bbd75473a090e227ddaa2c60edee6d735021a4b2af9bdd
Instruction Fuzzy Hash: 5B51F772649B8485DA05CB35E48036AA375FB8ABE0F188725EA5EA7B94DF38D0C18700

Function 000001B27A4E0A86 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID:
API String ID: 2959964966-0
Opcode ID: 47bec2cab459e606d8e94f63c52c019478015b28cd6406e527822758cc017737
Instruction ID: e46f48e2b315786eb30a9a140dbaedc6902fce17752efe106eae2d426b657173
Opcode Fuzzy Hash: 47bec2cab459e606d8e94f63c52c019478015b28cd6406e527822758cc017737
Instruction Fuzzy Hash: 0D5190B4108608CFF764EF60D9687EB73E5F7AA315F60452ED446C21A0DF798588CB4A

Function 00A12660 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b29f9cdf8554c025d6ca51dbd0cdd2e34d02295294e4587bcfa64bdc961bb353
Instruction ID: c0f5e4d067a9e7d61d40c8e4bac1fc5ee496ce58df8143f1ddb7ce2a2df01774
Opcode Fuzzy Hash: b29f9cdf8554c025d6ca51dbd0cdd2e34d02295294e4587bcfa64bdc961bb353
Instruction Fuzzy Hash: E1312EB1B0BE0849ED0BD77A9461B65921B9F93BE4F54D7219C3F765E4EB29C0E28300

Function 00A1F9E0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d559122a1f6f0b69832be9421c7c214fb777efde5fa0d191de61b1ee1601c01b
Instruction ID: 37264136081b2b230ff4ffec9f2f3842a356ba4b283d2614991bc7591c2c09ea
Opcode Fuzzy Hash: d559122a1f6f0b69832be9421c7c214fb777efde5fa0d191de61b1ee1601c01b
Instruction Fuzzy Hash: 8931E8B5719BC44ADB94CB229A243C963ABF798BC0F15D175DF0C93718EB38E5918340

Function 00A103B1 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c674deb00d230c80aa69741c84338d33708ba9b5a9c10745acb9a9f1fc901b11
Instruction ID: a746d06703e68395b5cfb85e68e54b2ba195f1b75f4604b85574992493b64c43
Opcode Fuzzy Hash: c674deb00d230c80aa69741c84338d33708ba9b5a9c10745acb9a9f1fc901b11
Instruction Fuzzy Hash: E221F2E36456C097EB128F26E140BE87B32F302BC4F44A015DF8E07642C7A8C6E8D700

Function 009FE520 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04eb0b3ddef3c53d4ed474fa1367046bc3a2d6401958521f328fa5e76c32f96a
Instruction ID: 59921bc2c04307f4243a3b1c1847b32e670bdc99d48854dbd9d52b90dbd4fa65
Opcode Fuzzy Hash: 04eb0b3ddef3c53d4ed474fa1367046bc3a2d6401958521f328fa5e76c32f96a
Instruction Fuzzy Hash: 721100E1E36F480ADA47C73A5551311810B5FA7BD0F28D322BD1BB67A6E72595D34200

Function 00A56440 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2176094777.00000000009F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009F0000, based on PE: true

Associated: 00000000.00000002.2176057849.00000000009F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176201813.0000000000AB6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176333221.0000000000C2B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176354996.0000000000C2D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176377291.0000000000C36000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176395931.0000000000C42000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C43000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000C63000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176412502.0000000000CCA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176481951.0000000000CCF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176502800.0000000000CD5000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2176520734.0000000000CD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e7b355c84e3535949f97abed5442f9bcc5c482bc638cbc6a7056c7ac6c4d10a
Instruction ID: 58bfbbea4c306c1731cebaa769e2fa56cc385789a16573b13e0417f4e284c231
Opcode Fuzzy Hash: 0e7b355c84e3535949f97abed5442f9bcc5c482bc638cbc6a7056c7ac6c4d10a
Instruction Fuzzy Hash: 51C08CB090ABC218FB10C300B20270439A19B24382ED08084825801615963CC6884104

Function 000001B27A4EFFD8 Relevance: 107.8, APIs: 86, Instructions: 270COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 000001B27A4EFFED

Part of subcall function 000001B27A4EAC60: _errno.LIBCMT ref: 000001B27A4EAC80

free.LIBCMT ref: 000001B27A4EFFF6
free.LIBCMT ref: 000001B27A4EFFFF
free.LIBCMT ref: 000001B27A4F0008
free.LIBCMT ref: 000001B27A4F0011
free.LIBCMT ref: 000001B27A4F001A
free.LIBCMT ref: 000001B27A4F0022
free.LIBCMT ref: 000001B27A4F002B
free.LIBCMT ref: 000001B27A4F0034
free.LIBCMT ref: 000001B27A4F003D
free.LIBCMT ref: 000001B27A4F0046
free.LIBCMT ref: 000001B27A4F004F
free.LIBCMT ref: 000001B27A4F0058
free.LIBCMT ref: 000001B27A4F0061
free.LIBCMT ref: 000001B27A4F006A
free.LIBCMT ref: 000001B27A4F0073
free.LIBCMT ref: 000001B27A4F007F
free.LIBCMT ref: 000001B27A4F008B
free.LIBCMT ref: 000001B27A4F0097
free.LIBCMT ref: 000001B27A4F00A3
free.LIBCMT ref: 000001B27A4F00AF
free.LIBCMT ref: 000001B27A4F00BB
free.LIBCMT ref: 000001B27A4F00C7
free.LIBCMT ref: 000001B27A4F00D3
free.LIBCMT ref: 000001B27A4F00DF
free.LIBCMT ref: 000001B27A4F00EB
free.LIBCMT ref: 000001B27A4F00F7
free.LIBCMT ref: 000001B27A4F0103
free.LIBCMT ref: 000001B27A4F010F
free.LIBCMT ref: 000001B27A4F011B
free.LIBCMT ref: 000001B27A4F0127
free.LIBCMT ref: 000001B27A4F0133
free.LIBCMT ref: 000001B27A4F013F
free.LIBCMT ref: 000001B27A4F014B
free.LIBCMT ref: 000001B27A4F0157
free.LIBCMT ref: 000001B27A4F0163
free.LIBCMT ref: 000001B27A4F016F
free.LIBCMT ref: 000001B27A4F017B
free.LIBCMT ref: 000001B27A4F0187
free.LIBCMT ref: 000001B27A4F0193
free.LIBCMT ref: 000001B27A4F019F
free.LIBCMT ref: 000001B27A4F01AB
free.LIBCMT ref: 000001B27A4F01B7
free.LIBCMT ref: 000001B27A4F01C3
free.LIBCMT ref: 000001B27A4F01CF
free.LIBCMT ref: 000001B27A4F01DB
free.LIBCMT ref: 000001B27A4F01E7
free.LIBCMT ref: 000001B27A4F01F3
free.LIBCMT ref: 000001B27A4F01FF
free.LIBCMT ref: 000001B27A4F020B
free.LIBCMT ref: 000001B27A4F0217
free.LIBCMT ref: 000001B27A4F0223
free.LIBCMT ref: 000001B27A4F022F
free.LIBCMT ref: 000001B27A4F023B
free.LIBCMT ref: 000001B27A4F0247
free.LIBCMT ref: 000001B27A4F0253
free.LIBCMT ref: 000001B27A4F025F
free.LIBCMT ref: 000001B27A4F026B
free.LIBCMT ref: 000001B27A4F0277
free.LIBCMT ref: 000001B27A4F0283
free.LIBCMT ref: 000001B27A4F028F
free.LIBCMT ref: 000001B27A4F029B
free.LIBCMT ref: 000001B27A4F02A7
free.LIBCMT ref: 000001B27A4F02B3
free.LIBCMT ref: 000001B27A4F02BF
free.LIBCMT ref: 000001B27A4F02CB
free.LIBCMT ref: 000001B27A4F02D7
free.LIBCMT ref: 000001B27A4F02E3
free.LIBCMT ref: 000001B27A4F02EF
free.LIBCMT ref: 000001B27A4F02FB
free.LIBCMT ref: 000001B27A4F0307
free.LIBCMT ref: 000001B27A4F0313
free.LIBCMT ref: 000001B27A4F031F
free.LIBCMT ref: 000001B27A4F032B
free.LIBCMT ref: 000001B27A4F0337
free.LIBCMT ref: 000001B27A4F0343
free.LIBCMT ref: 000001B27A4F034F
free.LIBCMT ref: 000001B27A4F035B
free.LIBCMT ref: 000001B27A4F0367
free.LIBCMT ref: 000001B27A4F0373
free.LIBCMT ref: 000001B27A4F037F
free.LIBCMT ref: 000001B27A4F038B
free.LIBCMT ref: 000001B27A4F0397
free.LIBCMT ref: 000001B27A4F03A3
free.LIBCMT ref: 000001B27A4F03AF
free.LIBCMT ref: 000001B27A4F03BB

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: 892d27b847e74208b98b5f524de7e1165b6f73ba6f7e08818c88c9b05fc7fdc8
Instruction ID: e851e0f4852eba1b567a5d9b0566edc6dbb0216d24cf0bc527b998119da181f5
Opcode Fuzzy Hash: 892d27b847e74208b98b5f524de7e1165b6f73ba6f7e08818c88c9b05fc7fdc8
Instruction Fuzzy Hash: 62B1B43112540CCFE688EBA4C8E97EA7351FB9A711F9985F4D80DDA1A7CF225C49C714

Function 000001B27A4EC8A0 Relevance: 19.6, APIs: 13, Instructions: 135COMMONLIBRARYCODE

Download Yara Rule

APIs

__free_lconv_mon.LIBCMT ref: 000001B27A4EC8F8

Part of subcall function 000001B27A4F0434: free.LIBCMT ref: 000001B27A4F0452
Part of subcall function 000001B27A4F0434: free.LIBCMT ref: 000001B27A4F0464
Part of subcall function 000001B27A4F0434: free.LIBCMT ref: 000001B27A4F0476
Part of subcall function 000001B27A4F0434: free.LIBCMT ref: 000001B27A4F0488
Part of subcall function 000001B27A4F0434: free.LIBCMT ref: 000001B27A4F049A
Part of subcall function 000001B27A4F0434: free.LIBCMT ref: 000001B27A4F04AC
Part of subcall function 000001B27A4F0434: free.LIBCMT ref: 000001B27A4F04BE
Part of subcall function 000001B27A4F0434: free.LIBCMT ref: 000001B27A4F04D0
Part of subcall function 000001B27A4F0434: free.LIBCMT ref: 000001B27A4F04E2
Part of subcall function 000001B27A4F0434: free.LIBCMT ref: 000001B27A4F04F4
Part of subcall function 000001B27A4F0434: free.LIBCMT ref: 000001B27A4F0509
Part of subcall function 000001B27A4F0434: free.LIBCMT ref: 000001B27A4F051E
Part of subcall function 000001B27A4F0434: free.LIBCMT ref: 000001B27A4F0533

free.LIBCMT ref: 000001B27A4EC8EC

Part of subcall function 000001B27A4EAC60: _errno.LIBCMT ref: 000001B27A4EAC80

free.LIBCMT ref: 000001B27A4EC90E
__free_lconv_num.LIBCMT ref: 000001B27A4EC91A
free.LIBCMT ref: 000001B27A4EC926
free.LIBCMT ref: 000001B27A4EC932
free.LIBCMT ref: 000001B27A4EC956
free.LIBCMT ref: 000001B27A4EC96A
free.LIBCMT ref: 000001B27A4EC979
free.LIBCMT ref: 000001B27A4EC985
free.LIBCMT ref: 000001B27A4EC9B2
free.LIBCMT ref: 000001B27A4EC9DA
free.LIBCMT ref: 000001B27A4EC9F4

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: free$__free_lconv_mon__free_lconv_num_errno
String ID:
API String ID: 2822633559-0
Opcode ID: 7b336d24eba5c0ac9b4bfec758739f2f0144249e4441c89cb6f65c36a07eadc0
Instruction ID: b8fa447a58030f0c1186073aebf4b3152265aded28d7f2a2738456f11d09b1e4
Opcode Fuzzy Hash: 7b336d24eba5c0ac9b4bfec758739f2f0144249e4441c89cb6f65c36a07eadc0
Instruction Fuzzy Hash: 10413F3111890DCFEFA5EB98C4B47E67291FBAA321F6905B9D809DA1D2CF329C84C754

Function 000001B27A4EEAF4 Relevance: 18.2, APIs: 12, Instructions: 216COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 000001B27A4EEB28

Part of subcall function 000001B27A4EEACC: _errno.LIBCMT ref: 000001B27A4EEAD5
Part of subcall function 000001B27A4EEACC: _invalid_parameter_noinfo.LIBCMT ref: 000001B27A4EEAE0

_fileno.LIBCMT ref: 000001B27A4EEB43
_fileno.LIBCMT ref: 000001B27A4EEB50
_fileno.LIBCMT ref: 000001B27A4EEB5F

Part of subcall function 000001B27A4E80B8: _fileno.LIBCMT ref: 000001B27A4E80D5
Part of subcall function 000001B27A4E80B8: _errno.LIBCMT ref: 000001B27A4E80E5

_fileno.LIBCMT ref: 000001B27A4EEB89
_fileno.LIBCMT ref: 000001B27A4EEB96
_fileno.LIBCMT ref: 000001B27A4EEBA3
_fileno.LIBCMT ref: 000001B27A4EEBB2
_fileno.LIBCMT ref: 000001B27A4EEBDC
_fileno.LIBCMT ref: 000001B27A4EEBE9
_fileno.LIBCMT ref: 000001B27A4EEBF6
_fileno.LIBCMT ref: 000001B27A4EEC05

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: _fileno$_errno$_invalid_parameter_noinfo
String ID:
API String ID: 482796045-0
Opcode ID: 028979bd5b13ade2da22324f9a5c4af98c9790d4944bca090fd0f536f3016bc3
Instruction ID: 77eb759fdec7817fa903beb449a2f9e5763f51b23888f0bf2993616e80f217d8
Opcode Fuzzy Hash: 028979bd5b13ade2da22324f9a5c4af98c9790d4944bca090fd0f536f3016bc3
Instruction Fuzzy Hash: 2061D73011CE49EAE654ABA984A33FA72D1FB96330F78035DE466C31D1DB35985A834D

Function 000001B27A4EF6BC Relevance: 12.2, APIs: 8, Instructions: 165COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001B27A4EF703
_invalid_parameter_noinfo.LIBCMT ref: 000001B27A4EF70F
_errno.LIBCMT ref: 000001B27A4EF759
_errno.LIBCMT ref: 000001B27A4EF764
_errno.LIBCMT ref: 000001B27A4EF796
_invalid_parameter_noinfo.LIBCMT ref: 000001B27A4EF7A0
_errno.LIBCMT ref: 000001B27A4EF855
_invalid_parameter_noinfo.LIBCMT ref: 000001B27A4EF861

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: ccf1906097c5c7367852938f8d44dc6cf4f8c05bff97315b0985e3b8af237a58
Instruction ID: c0af367cbf229176d00a54bc174c766e48d17ad8447de1882791c8958f3acbdb
Opcode Fuzzy Hash: ccf1906097c5c7367852938f8d44dc6cf4f8c05bff97315b0985e3b8af237a58
Instruction Fuzzy Hash: BE51E832618A0A8FFBA59B9884643EB76E0FB66331FB44259D419C71D2DF33C8498749

Function 000001B27A4EDEE0 Relevance: 10.6, APIs: 7, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000001B27A4EDF03
_errno.LIBCMT ref: 000001B27A4EDF0B

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: cf1cf9e5ee490599d654468345f8dd86778b0f50a3bdec84bd96aa650e994298
Instruction ID: f1f61a408fbd5b9af3dd4b07df3adc551a329bd7043b5c096b12d192546bee93
Opcode Fuzzy Hash: cf1cf9e5ee490599d654468345f8dd86778b0f50a3bdec84bd96aa650e994298
Instruction Fuzzy Hash: C0210E3161D6044EF758EBD8DCA63FA72C0EB67331F650249F505872D7DF76180582AA

Function 000001B27A4EE724 Relevance: 10.6, APIs: 7, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000001B27A4EE747
_errno.LIBCMT ref: 000001B27A4EE74F

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: 253ccbe714b82c328477c76466321d949f30074f1a6150cf967292407ae3f5db
Instruction ID: b6488e6a6c7189eff6c5bc215ea80806a8638be94e2cd32e17f748afc348cc30
Opcode Fuzzy Hash: 253ccbe714b82c328477c76466321d949f30074f1a6150cf967292407ae3f5db
Instruction Fuzzy Hash: 8921F93161C6049EF718ABD89CA73FA7680EB67330F650649F505872D3DBB65809829D

Function 000001B27A4EF20C Relevance: 9.1, APIs: 6, Instructions: 82COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 000001B27A4EF233

Part of subcall function 000001B27A4ED27C: _set_error_mode.LIBCMT ref: 000001B27A4ED285
Part of subcall function 000001B27A4ED27C: _set_error_mode.LIBCMT ref: 000001B27A4ED294

Part of subcall function 000001B27A4ED01C: _set_error_mode.LIBCMT ref: 000001B27A4ED061
Part of subcall function 000001B27A4ED01C: _set_error_mode.LIBCMT ref: 000001B27A4ED072

Part of subcall function 000001B27A4EED2C: malloc.LIBCMT ref: 000001B27A4EED57

_errno.LIBCMT ref: 000001B27A4EF275
_lock.LIBCMT ref: 000001B27A4EF289
free.LIBCMT ref: 000001B27A4EF2AC
_errno.LIBCMT ref: 000001B27A4EF2B1

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: _set_error_mode$_errno$_lockfreemalloc
String ID:
API String ID: 360200360-0
Opcode ID: 52b3feda2cd18445a43c6f8d2fc7ed35086aeb53fe70fc1ac63f9a8d8bfcb4c0
Instruction ID: db8cfd4e55b82a6326e092d5fc62c798dcfc578fbd30e6ad634250ceaeb45295
Opcode Fuzzy Hash: 52b3feda2cd18445a43c6f8d2fc7ed35086aeb53fe70fc1ac63f9a8d8bfcb4c0
Instruction Fuzzy Hash: 9621623561D6098FF7A4BFE4D4657EA72D0EBAA320FA44429E009C31D2DF7B98488749

Function 000001B27A4E7C14 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000001B27A4E7B70: _getptd.LIBCMT ref: 000001B27A4E7B82

_errno.LIBCMT ref: 000001B27A4E7C55
_invalid_parameter_noinfo.LIBCMT ref: 000001B27A4E7C60
_errno.LIBCMT ref: 000001B27A4E7DFD

Strings

$, xrefs: 000001B27A4E7C7A
$, xrefs: 000001B27A4E7CFA

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: _errno$_getptd_invalid_parameter_noinfo
String ID: $$$
API String ID: 2372577547-233714265
Opcode ID: c460adb36a8ff80a267e1a98acf9e65ed31786de6d2f7996c3ef535e335d8ea5
Instruction ID: e68da9553176cff172e15a355e0eb3acbd66ba89ebff0779b5708cd8b0f8d594
Opcode Fuzzy Hash: c460adb36a8ff80a267e1a98acf9e65ed31786de6d2f7996c3ef535e335d8ea5
Instruction Fuzzy Hash: C281243081C6588AF7B95ADC98A57FB36D4FB63730F34125DC4D2861C3EF36884A4A49

Function 000001B27A4DF190 Relevance: 7.7, APIs: 5, Instructions: 208COMMON

Download Yara Rule

APIs

und_memcpy.LIBCMTD ref: 000001B27A4DF22F
und_memcpy.LIBCMTD ref: 000001B27A4DF255

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: und_memcpy
String ID:
API String ID: 2264155635-0
Opcode ID: 233c2dc3f6114190a0c3a58bca7bebfacb80644e2e843f1241ac7ac938ceac0f
Instruction ID: 04b571132be947eec373e35f567512e857a2fe3ec415cdda29fd74f9d5f0f5d0
Opcode Fuzzy Hash: 233c2dc3f6114190a0c3a58bca7bebfacb80644e2e843f1241ac7ac938ceac0f
Instruction Fuzzy Hash: 0A91D6742087849FE7B4DB18C4A4BEAB7E1FBA9314F60882DD58DC3290DF359985CB42

Function 000001B27A4F12CC Relevance: 7.7, APIs: 5, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 000001B27A4F12E7

Part of subcall function 000001B27A4EEACC: _errno.LIBCMT ref: 000001B27A4EEAD5
Part of subcall function 000001B27A4EEACC: _invalid_parameter_noinfo.LIBCMT ref: 000001B27A4EEAE0

_errno.LIBCMT ref: 000001B27A4F12F7
_errno.LIBCMT ref: 000001B27A4F1315
_isatty.LIBCMT ref: 000001B27A4F1376
_getbuf.LIBCMT ref: 000001B27A4F1382

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: _errno$_fileno_getbuf_invalid_parameter_noinfo_isatty
String ID:
API String ID: 2574049805-0
Opcode ID: f6cb1389b3d300155bab13a29e2be79a7747ea1a71811924160686b94840a2be
Instruction ID: 8ea9bbdd66d7e09a47db62813bec5b4919be7a5fb208828668bb88cae7a0cd43
Opcode Fuzzy Hash: f6cb1389b3d300155bab13a29e2be79a7747ea1a71811924160686b94840a2be
Instruction Fuzzy Hash: 2751D3301046098AFB58EF9CC4A23E676E1FB67330F381258D956CB2D6DB76C8498789

Function 000001B27A4E80B8 Relevance: 7.6, APIs: 5, Instructions: 150COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 000001B27A4E80D5

Part of subcall function 000001B27A4EEACC: _errno.LIBCMT ref: 000001B27A4EEAD5
Part of subcall function 000001B27A4EEACC: _invalid_parameter_noinfo.LIBCMT ref: 000001B27A4EEAE0

_errno.LIBCMT ref: 000001B27A4E80E5
_errno.LIBCMT ref: 000001B27A4E8101
_isatty.LIBCMT ref: 000001B27A4E8162
_getbuf.LIBCMT ref: 000001B27A4E816E

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: _errno$_fileno_getbuf_invalid_parameter_noinfo_isatty
String ID:
API String ID: 2574049805-0
Opcode ID: 400924676afdb6542912dbb754b0c6b2f42f88cbdf26364f46bcf7423cf333eb
Instruction ID: 88f0c888fc3c31e8345b2c8c63b6651bac03709ed88ad0c781509d11e8820cdc
Opcode Fuzzy Hash: 400924676afdb6542912dbb754b0c6b2f42f88cbdf26364f46bcf7423cf333eb
Instruction Fuzzy Hash: BC51C430118A888FEF98DFA8C4A17A776D0FB66330F244699D855CB2D7DF36C8458789

Function 000001B27A4F0EC0 Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000001B27A4F0EC9
_errno.LIBCMT ref: 000001B27A4F0ED1

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: cc1a65610d45c684b4d644e34a1a9e911e9c410526ae494b7efd2ca09e7c409c
Instruction ID: 4cd39293d936512b36e2e4fbd240902ebe0ccfed4c193c62c8fbf958fc6cf3fa
Opcode Fuzzy Hash: cc1a65610d45c684b4d644e34a1a9e911e9c410526ae494b7efd2ca09e7c409c
Instruction Fuzzy Hash: 1E01D6315258498EE759EBE488753E53290EBB3331FA88254E105C72D3DF7A0448C225

Function 000001B27A4EC1A4 Relevance: 6.1, APIs: 4, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000001B27A4EC1AE

Part of subcall function 000001B27A4E93EC: _amsg_exit.LIBCMT ref: 000001B27A4E9402

_lock.LIBCMT ref: 000001B27A4EC1DC
free.LIBCMT ref: 000001B27A4EC212
_amsg_exit.LIBCMT ref: 000001B27A4EC24B

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: _amsg_exit$_getptd_lockfree
String ID:
API String ID: 2148533958-0
Opcode ID: 4046e20d8c9ee5f78bc00f49ff3442623897f32c527e484218f0333f02347ad5
Instruction ID: 459149f41b577882691bb97db0cacea1ca7cd841d6194d3867043c5ae7817a28
Opcode Fuzzy Hash: 4046e20d8c9ee5f78bc00f49ff3442623897f32c527e484218f0333f02347ad5
Instruction Fuzzy Hash: 7E211231618A498FEBE5EBD8C4D4BA673E4FB69311FA40169E409C31D1CF319848C795

Function 000001B27A4ECA74 Relevance: 6.0, APIs: 4, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000001B27A4ECA7A

Part of subcall function 000001B27A4E93EC: _amsg_exit.LIBCMT ref: 000001B27A4E9402

_getptd.LIBCMT ref: 000001B27A4ECA9A
_lock.LIBCMT ref: 000001B27A4ECAAD
_amsg_exit.LIBCMT ref: 000001B27A4ECADB

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: _amsg_exit_getptd$_lock
String ID:
API String ID: 3670291111-0
Opcode ID: 9551b0adf5f97ad9614b394a459279b2b61166ac4730dc1e728ddb053ef1bccd
Instruction ID: 4908de0f690f2467c54431dcfd39cebf10c00ff7993d27dc72e44af22e5d1207
Opcode Fuzzy Hash: 9551b0adf5f97ad9614b394a459279b2b61166ac4730dc1e728ddb053ef1bccd
Instruction Fuzzy Hash: 25F03C31619A048BF764EBE8C8E5FE632A4EB29314F640264E419C72D3DFB248588359

Function 000001B27A4E6C1C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000001B27A4E6C53
_invalid_parameter_noinfo.LIBCMT ref: 000001B27A4E6C5E

Strings

B, xrefs: 000001B27A4E6C79

Memory Dump Source

Source File: 00000000.00000002.2178195021.000001B27A4C1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000001B27A4C1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b27a4c1000_file.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: B
API String ID: 2959964966-1255198513
Opcode ID: 5b9fd8484ccd4287e022cca72682e00a1ed95e5f0e740e72b956befb73647925
Instruction ID: de88949c8884a9e2a8abd2a110d38dc65f7744972d6ad04421f8a5042dbfd617
Opcode Fuzzy Hash: 5b9fd8484ccd4287e022cca72682e00a1ed95e5f0e740e72b956befb73647925
Instruction Fuzzy Hash: F931CA3191890CEEEB11EBD8D8A47DEBBF0FB66330F600216E406D62D1DF3294488786

Analysis Process: Edge.exePID: 7020, Parent PID: 3776COMMON

Execution Graph

Execution Coverage:	4.6%
Dynamic/Decrypted Code Coverage:	31.6%
Signature Coverage:	0.7%
Total number of Nodes:	1249
Total number of Limit Nodes:	106

Executed Functions

Function 00000266799F0808 Relevance: 16.8, APIs: 8, Strings: 1, Instructions: 1070memorynativeCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL ref: 00000266799F08D5
NtMapViewOfSection.NTDLL ref: 00000266799F09C0
VirtualAlloc.KERNEL32 ref: 00000266799F0DEB
NtUnmapViewOfSection.NTDLL ref: 00000266799F0E91
NtMapViewOfSection.NTDLL ref: 00000266799F0EFD
VirtualProtect.KERNEL32 ref: 00000266799F0F24
VirtualProtect.KERNEL32 ref: 00000266799F0FF8
VirtualProtect.KERNEL32 ref: 00000266799F103B

Strings

@, xrefs: 00000266799F08C3

Memory Dump Source

Source File: 00000002.00000002.3410605768.0000026679980000.00000040.00000020.00020000.00000000.sdmp, Offset: 0000026679980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_26679980000_Edge.jbxd

Yara matches

Similarity

API ID: SectionVirtual$ProtectView$AllocCreateUnmap
String ID: @
API String ID: 1653215272-2766056989
Opcode ID: c637d99d209d1ca9699a6f6406458f9f86e5ddc939b9afbe853fcc5f8e29eda5
Instruction ID: 2d99f21deb55d051df7154fc3d8fa3f7ec71315e43da19262baded5c7ac32db0
Opcode Fuzzy Hash: c637d99d209d1ca9699a6f6406458f9f86e5ddc939b9afbe853fcc5f8e29eda5
Instruction Fuzzy Hash: 11728A31618B488FEB6ADF28C8497A9F3E6FB6C318F14461DE89AC7141DB35E541CB81

Function 000002667B1C4520 Relevance: 12.4, APIs: 8, Instructions: 403
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c47dd10ad2ffc75a4fb68eec796e3029fb36d07deac5f587a2ed2ad7d380ff7d
Instruction ID: c8db46e20bc1744fa2676c8e3ba2870099393a1e06bc0d853420e1b35a876a1a
Opcode Fuzzy Hash: c47dd10ad2ffc75a4fb68eec796e3029fb36d07deac5f587a2ed2ad7d380ff7d
Instruction Fuzzy Hash: DD023D7451C645CFF7A5EF24D94C76AB7E2FB99309F504A39E08AC21E4CB798884CB06

Function 000002667B1A1000 Relevance: 11.3, APIs: 7, Instructions: 790synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexExW.KERNEL32 ref: 000002667B1A10CC
CreateMutexExW.KERNEL32 ref: 000002667B1A1200
CreateMutexExW.KERNEL32 ref: 000002667B1A12C3
CreateMutexExW.KERNEL32 ref: 000002667B1A130D
_LDint.LIBCPMTD ref: 000002667B1A13C5
_LDint.LIBCPMTD ref: 000002667B1A1406
_LDint.LIBCPMTD ref: 000002667B1A145E

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: CreateMutex$Dint
String ID:
API String ID: 2494643213-0
Opcode ID: f98d3638bcb4881571893d0b64532fb7071e35af9423874bbb812e626070e764
Instruction ID: 82f0668708d20e659a0d350d22018b6096f0f6a1ed1ebd2b209b0b6d4f8330e6
Opcode Fuzzy Hash: f98d3638bcb4881571893d0b64532fb7071e35af9423874bbb812e626070e764
Instruction Fuzzy Hash: F37251701086458FF7A5EF24D85C7AAB7E2FB95309F50092DD18AC21A0DFB9A994CF06

Function 000002667B1C41A0 Relevance: 6.1, APIs: 4, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 192f403424aaaf008d525928eb5116ea02d11db019e28c700354a5fbe7f0df23
Instruction ID: 9694295aeefb49f69ef7bb30102e9d353d6156d32a5e89a4544c56f18872f9c6
Opcode Fuzzy Hash: 192f403424aaaf008d525928eb5116ea02d11db019e28c700354a5fbe7f0df23
Instruction Fuzzy Hash: 85511A742186488FE795DF28D45CBAAB7E1FB9D305F400A3DE48AD72A0DB39DA40CB41

Function 000002667B1C0A10 Relevance: 3.2, APIs: 2, Instructions: 184threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 000002667B1C0A6D
CreateThread.KERNEL32 ref: 000002667B1C0C99

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 67fee4663bc745c6a5a2df735d6d59c7405c2b46a96bc890505430404ad3a281
Instruction ID: f52161aa18358d54e33fc447e712b4cc8bc67d10a7a958765ab3aec909990fa4
Opcode Fuzzy Hash: 67fee4663bc745c6a5a2df735d6d59c7405c2b46a96bc890505430404ad3a281
Instruction Fuzzy Hash: 4C71C2B4204A09CFF7A5EF24DD0DBAAB7E5F799309F00463ED446C21A0DB798684CB49

Function 000002667B1AF1A0 Relevance: 1.8, APIs: 1, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 742e74ce351c1f1b12b47fea87978d01d3a5733e57109485170f251d8ccbb01e
Instruction ID: a62d0471f4257a00f1ff6ed41f2c9ab122f4ab22afc252a6b9a65203e3cc6cf6
Opcode Fuzzy Hash: 742e74ce351c1f1b12b47fea87978d01d3a5733e57109485170f251d8ccbb01e
Instruction Fuzzy Hash: CEB1ED30108B45CFF799EF24D85C75AB7E1FB98346F50492AE48AC32A0DB799A45CF42

Function 000002667B1C0A86 Relevance: 1.6, APIs: 1, Instructions: 138threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 000002667B1C0C99

Part of subcall function 000002667B1C6C1C: _errno.LIBCMT ref: 000002667B1C6C53
Part of subcall function 000002667B1C6C1C: _invalid_parameter_noinfo.LIBCMT ref: 000002667B1C6C5E

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: CreateThread_errno_invalid_parameter_noinfo
String ID:
API String ID: 3352222661-0
Opcode ID: 47bec2cab459e606d8e94f63c52c019478015b28cd6406e527822758cc017737
Instruction ID: 8cb8b1d455b24fdd725e3495d4884b7736d8bd5c83ce4ad7c64dfad7407e95d5
Opcode Fuzzy Hash: 47bec2cab459e606d8e94f63c52c019478015b28cd6406e527822758cc017737
Instruction Fuzzy Hash: B251A1B4104649CFF766EF20D94C7EAB3E5F798309F00463ED446C21A1DB7A9684CB4A

Function 00000266799EFFFC Relevance: 1.6, APIs: 1, Instructions: 382memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00000266799F006F

Memory Dump Source

Source File: 00000002.00000002.3410605768.0000026679980000.00000040.00000020.00020000.00000000.sdmp, Offset: 0000026679980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_26679980000_Edge.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 08c3b473a1f7362871bcf2729fe2c144e163769adb635b581bed10db9dac86c4
Instruction ID: efbdf274a12d495b41b098a85c440f0f2aadccbd9fe80c610ed965f6ddfab582
Opcode Fuzzy Hash: 08c3b473a1f7362871bcf2729fe2c144e163769adb635b581bed10db9dac86c4
Instruction Fuzzy Hash: 54C168317149058FFB9AEB28C48D7A9F3E6FB6C30CF184369E44AC7186DB21D945CA91

Function 000002667B1B6DC0 Relevance: 18.0, APIs: 11, Instructions: 1455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5a17312eacb160121f9eea0b528651a09acfa2ad52bd57e63ccf263f8cb0842
Instruction ID: 095b7b66d5e49d1955c639fb8b92982712a4c8a5f531eee28a625e596e286455
Opcode Fuzzy Hash: c5a17312eacb160121f9eea0b528651a09acfa2ad52bd57e63ccf263f8cb0842
Instruction Fuzzy Hash: B9C2EB30119A89DFF7B6EF18D45C7ABB3E0FBA8305F50092ED44AC26A1DB359585CB42

Function 000002667B1C4B70 Relevance: 11.1, APIs: 5, Strings: 1, Instructions: 628
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

shutdown.WS2_32 ref: 000002667B1C54FE

Strings

8, xrefs: 000002667B1C4DCB

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: shutdown
String ID: 8
API String ID: 2510479042-4194326291
Opcode ID: 0cfbe239d229b35d6fa7e3f7e6a4fdefa61c7d779efab9389671b4e29cc5810e
Instruction ID: fb65ddf1fb801dfd8b6d76ed30d29784f1bc21f3a634570d337592e31a07f030
Opcode Fuzzy Hash: 0cfbe239d229b35d6fa7e3f7e6a4fdefa61c7d779efab9389671b4e29cc5810e
Instruction Fuzzy Hash: C942FE741187898FE3A6EF58D45D7EEB3E1FB98305F604A2DD08AC22A0DF755894CB06

Function 000002667B1C2340 Relevance: 9.4, APIs: 6, Instructions: 403
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 000002667B1C236A

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: 758074d2727f55353240e9f3834a2e572d1aeaaaa783303a230bcacbee708052
Instruction ID: 673e7f1d95fd7f7361a68a4b6d69b36bea5f0f0cd9ab0c7049a0bf2fea7ab08d
Opcode Fuzzy Hash: 758074d2727f55353240e9f3834a2e572d1aeaaaa783303a230bcacbee708052
Instruction Fuzzy Hash: 8302B974618785CFE7B5DF28C49CB9AB7E0FB99315F501A6DE48AC22A0DB35D840CB42

Function 000002667B1AF740 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 159
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNEL32 ref: 000002667B1AF77E
LocalAlloc.KERNEL32 ref: 000002667B1AF7A4
CreateFileW.KERNEL32 ref: 000002667B1AF873
LocalFree.KERNELBASE ref: 000002667B1AF92F

Strings

P, xrefs: 000002667B1AF8A7

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: CreateLocal$AllocDirectoryFileFree
String ID: P
API String ID: 1520254948-3110715001
Opcode ID: da20fc7a7724216b2506d8b5ae4f75a843dfdb9977f341af6ed6c5acbf74433f
Instruction ID: 86bf8e04bb4d0875ab5786177f04478fb9c9976f4ee2fe8639abfb2a04493554
Opcode Fuzzy Hash: da20fc7a7724216b2506d8b5ae4f75a843dfdb9977f341af6ed6c5acbf74433f
Instruction Fuzzy Hash: 4261EB30118755CFE7B5EF28C49C79AF7E1FB95345F504A2EE08AC21A4CB759889CB02

Function 000002667B1C2F40 Relevance: 7.8, APIs: 5, Instructions: 300
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::details::platform::__ChangeTimerQueueTimer.LIBCMTD ref: 000002667B1C2F7F

Part of subcall function 000002667B1C1B70: recv.WS2_32 ref: 000002667B1C1B9C

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: Timer$ChangeConcurrency::details::platform::__Queuerecv
String ID:
API String ID: 2709879575-0
Opcode ID: abcaa5fb699d6715226628e4e26e6b7be2197a5db06b6bcbd745b9b664a01fbc
Instruction ID: 2c56c78cc851ba6ef8cdd18516b234a61270bd54c0f716d0e5fd6116b42b2a43
Opcode Fuzzy Hash: abcaa5fb699d6715226628e4e26e6b7be2197a5db06b6bcbd745b9b664a01fbc
Instruction Fuzzy Hash: 54E1A5742187858FE7B6DF18D44CBAAB7E1FB89309F504A2DD08AC3290DB759885DB43

Function 000002667B1C39B0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 392
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002667B1C3FB0: CoInitializeEx.COMBASE ref: 000002667B1C3FDA
Part of subcall function 000002667B1C3FB0: und_memcpy.LIBCMTD ref: 000002667B1C40B4
Part of subcall function 000002667B1C3FB0: CoUninitialize.COMBASE ref: 000002667B1C40C7

setsockopt.WS2_32 ref: 000002667B1C3AEC

Part of subcall function 000002667B1C3490: Concurrency::details::platform::__ChangeTimerQueueTimer.LIBCMTD ref: 000002667B1C34CF

Part of subcall function 000002667B1C2F40: Concurrency::details::platform::__ChangeTimerQueueTimer.LIBCMTD ref: 000002667B1C2F7F

WSAEventSelect.WS2_32 ref: 000002667B1C3F0F
und_memcpy.LIBCMTD ref: 000002667B1C3F3F

Strings

8, xrefs: 000002667B1C3B07

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: Timer$ChangeConcurrency::details::platform::__Queueund_memcpy$EventInitializeSelectUninitializesetsockopt
String ID: 8
API String ID: 516064979-4194326291
Opcode ID: c6f8f8f1f16e8ede58b5fd9387a850f077d02c8ef557e43fae6377c933ae6fae
Instruction ID: cc9a872fe7e61e34c15628215298dd6c2f44989504f8065a266ef9ef1693ed01
Opcode Fuzzy Hash: c6f8f8f1f16e8ede58b5fd9387a850f077d02c8ef557e43fae6377c933ae6fae
Instruction Fuzzy Hash: A7F1FC705187888FE7A6DF18D48D7DAB7E0FB98305F404A2EE48AC3291DB359584CB87

Function 000002667B1C474B Relevance: 6.2, APIs: 4, Instructions: 218threadCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 000002667B1C47A9
CreateThread.KERNEL32 ref: 000002667B1C4836
shutdown.WS2_32 ref: 000002667B1C497D
closesocket.WS2_32 ref: 000002667B1C4988

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: CreateThreadclosesocketsetsockoptshutdown
String ID:
API String ID: 3942381783-0
Opcode ID: 9b9f5911bb092ffef60129e7ce65391eaeb2486d330d4ccccebe1461689ea821
Instruction ID: 7ed1aa1216a8b24b2f8322feb2d348e94f23b82ff75dfe11973acbd9c226256a
Opcode Fuzzy Hash: 9b9f5911bb092ffef60129e7ce65391eaeb2486d330d4ccccebe1461689ea821
Instruction Fuzzy Hash: FB91FCB4118A458FF395EF64D95C75AB7E2FB95305F504938E08AC21F0CFB99885CB0A

Function 00000266799EEF64 Relevance: 6.1, APIs: 4, Instructions: 133memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00000266799F1814: LoadLibraryA.KERNEL32 ref: 00000266799F18E2

VirtualProtect.KERNEL32 ref: 00000266799EEFE0
VirtualProtect.KERNEL32(?,?,-00000001,00000001,-00000001,00000001,-00000001,00000266799F020E), ref: 00000266799EF009
VirtualProtect.KERNEL32 ref: 00000266799EF04E
VirtualProtect.KERNEL32 ref: 00000266799EF072

Memory Dump Source

Source File: 00000002.00000002.3410605768.0000026679980000.00000040.00000020.00020000.00000000.sdmp, Offset: 0000026679980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_26679980000_Edge.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: d24d4ce7223a552c1b01d238479d20a295a89e3d53a7350efd5ba8d12bfb46a0
Instruction ID: ecff2a857d314afda9beb5657bef4e98a442286bc697d4e031309b86d4a388fc
Opcode Fuzzy Hash: d24d4ce7223a552c1b01d238479d20a295a89e3d53a7350efd5ba8d12bfb46a0
Instruction Fuzzy Hash: 89317632318A084FE759EA58E84E76AB3D5F7D8725F04066AB84BC32C6ED61DD0646C1

Function 000002667B1AFD50 Relevance: 6.1, APIs: 4, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32 ref: 000002667B1AFDEB
RegSetValueExW.KERNEL32 ref: 000002667B1AFE23
RegCloseKey.KERNEL32 ref: 000002667B1AFE2E
LocalFree.KERNELBASE ref: 000002667B1AFE9E

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: CloseFreeLocalOpenValue
String ID:
API String ID: 2435347932-0
Opcode ID: 59d4a1ec69c95c336cf5cdf13455e3c421429cfd994267f0afb70d0c1f720dac
Instruction ID: 6a768b5670812f61583f108f81e8841ce5db7c7697bac906b200e4409aa63d5b
Opcode Fuzzy Hash: 59d4a1ec69c95c336cf5cdf13455e3c421429cfd994267f0afb70d0c1f720dac
Instruction Fuzzy Hash: 7141CC3011CB488FE755EF28D84C66BB7F1FB95346F50092EE58AC21A0DB79D945CB42

Function 00000266799EEFD3 Relevance: 6.1, APIs: 4, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 00000266799EEFE0
VirtualProtect.KERNEL32(?,?,-00000001,00000001,-00000001,00000001,-00000001,00000266799F020E), ref: 00000266799EF009
VirtualProtect.KERNEL32 ref: 00000266799EF04E
VirtualProtect.KERNEL32 ref: 00000266799EF072

Memory Dump Source

Source File: 00000002.00000002.3410605768.0000026679980000.00000040.00000020.00020000.00000000.sdmp, Offset: 0000026679980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_26679980000_Edge.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f2b484dd179f3dd10506a7a62fe75bc60ed010a6cf5ae84582fe1852291c4020
Instruction ID: fcc031a84cd3e296616a7d4cde7985051efafb79ed4550bf1514827f2a44ded0
Opcode Fuzzy Hash: f2b484dd179f3dd10506a7a62fe75bc60ed010a6cf5ae84582fe1852291c4020
Instruction Fuzzy Hash: 4221633270CA084FEB59AA5CE85A769B3D1F7D8715F18026ABC4BC32CADD25DD0646C1

Function 000002667B1BC980 Relevance: 6.1, APIs: 4, Instructions: 75filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 000002667B1BC9BA
LocalAlloc.KERNEL32 ref: 000002667B1BC9F4
ReadFile.KERNEL32 ref: 000002667B1BCA24
CloseHandle.KERNEL32 ref: 000002667B1BCA3D

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: File$AllocCloseCreateHandleLocalRead
String ID:
API String ID: 1443864953-0
Opcode ID: d5fc9f4b33cbbbcc9f8f3db8ab93582bc92b71007fb63339fe9d281fc4954cf0
Instruction ID: e66fbeecb5430318702c40c8361535b4d976da0df8436ad7425a01fb821b1ca5
Opcode Fuzzy Hash: d5fc9f4b33cbbbcc9f8f3db8ab93582bc92b71007fb63339fe9d281fc4954cf0
Instruction Fuzzy Hash: F121C5301187458FE794DF68C45C71BBBF0FB99356F504A2DE58AC32A0DBB59885CB42

Function 000002667B1A8D30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66registryCOMMON

Download Yara Rule

APIs

Part of subcall function 000002667B1C6C1C: _errno.LIBCMT ref: 000002667B1C6C53
Part of subcall function 000002667B1C6C1C: _invalid_parameter_noinfo.LIBCMT ref: 000002667B1C6C5E

RegCreateKeyExW.KERNEL32 ref: 000002667B1A8D92
RegCloseKey.KERNEL32 ref: 000002667B1A8DA5

Strings

?, xrefs: 000002667B1A8D70

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: CloseCreate_errno_invalid_parameter_noinfo
String ID: ?
API String ID: 3067000685-1684325040
Opcode ID: e1fa8e690777478dbb7aaf1e3c6718a9e7df1082e362113efa4485b0f282c34c
Instruction ID: 23ab6fb7471ada971df4e3aa7267a9acdbc796723f93350c1d953a35f84ab360
Opcode Fuzzy Hash: e1fa8e690777478dbb7aaf1e3c6718a9e7df1082e362113efa4485b0f282c34c
Instruction Fuzzy Hash: B2213030518A458BF755EF24C85CBABF7E1FB90308F500A2DA447C21A1EFB9D549CB81

Function 000002667B1A8F60 Relevance: 4.6, APIs: 3, Instructions: 87registryCOMMON

Download Yara Rule

APIs

Part of subcall function 000002667B1BC980: CreateFileW.KERNEL32 ref: 000002667B1BC9BA
Part of subcall function 000002667B1BC980: LocalAlloc.KERNEL32 ref: 000002667B1BC9F4
Part of subcall function 000002667B1BC980: ReadFile.KERNEL32 ref: 000002667B1BCA24
Part of subcall function 000002667B1BC980: CloseHandle.KERNEL32 ref: 000002667B1BCA3D

Part of subcall function 000002667B1C6C1C: _errno.LIBCMT ref: 000002667B1C6C53
Part of subcall function 000002667B1C6C1C: _invalid_parameter_noinfo.LIBCMT ref: 000002667B1C6C5E

RegOpenKeyW.ADVAPI32 ref: 000002667B1A9013
RegSetValueExW.KERNEL32 ref: 000002667B1A904D
LocalFree.KERNELBASE ref: 000002667B1A906D

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: FileLocal$AllocCloseCreateFreeHandleOpenReadValue_errno_invalid_parameter_noinfo
String ID:
API String ID: 9688765-0
Opcode ID: 59493ee6c7077778934f02759ea539db7f92bfe724745750aa23e1573cf8735b
Instruction ID: ccfdef1365ef28e6aaf11c120dabc3f031deebb9c64aa61f9c85562bd71d7827
Opcode Fuzzy Hash: 59493ee6c7077778934f02759ea539db7f92bfe724745750aa23e1573cf8735b
Instruction Fuzzy Hash: F531DE301186448FE7A5EF24DC9CB9BB7E5FBD4345F40092DD44EC61A0DA759584CB45

Function 000002667B1C3FB0 Relevance: 4.6, APIs: 3, Instructions: 86COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE ref: 000002667B1C3FDA
und_memcpy.LIBCMTD ref: 000002667B1C40B4
CoUninitialize.COMBASE ref: 000002667B1C40C7

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: InitializeUninitializeund_memcpy
String ID:
API String ID: 134411786-0
Opcode ID: eef9f7042ad4823ae52cd53c198c972576b3e73edbb49f78d76cbf320d3a596a
Instruction ID: 7d057d973e1f5919a314a4af67b605a25082ae8d7e6d745702ba4760ee8fe32d
Opcode Fuzzy Hash: eef9f7042ad4823ae52cd53c198c972576b3e73edbb49f78d76cbf320d3a596a
Instruction Fuzzy Hash: 78314F30228A498FE7A5EF24C84D79FB7E1FB95304F40453DA4CAC22A1DE399859CB42

Function 000002667B1A4FA0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 738COMMON

Download Yara Rule

APIs

Part of subcall function 000002667B1B02E0: LocalAlloc.KERNEL32 ref: 000002667B1B0313

LocalFree.KERNELBASE ref: 000002667B1A5984

Strings

#, xrefs: 000002667B1A590B

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: Local$AllocFree
String ID: #
API String ID: 2012307162-1885708031
Opcode ID: 64e3b8df7a6dcd6fec4db4893746b054cd88f440b44bdeff192032408970d9ca
Instruction ID: 6061f957e07a034eaccfd649e5cd77622db771db90eff0cd9370b13aea5c072f
Opcode Fuzzy Hash: 64e3b8df7a6dcd6fec4db4893746b054cd88f440b44bdeff192032408970d9ca
Instruction Fuzzy Hash: 5552FA3051CA458FE745EF04EC9996AB7F6FBA8301F40453AE44BC32A4DB79EA45CB42

Function 00000266799F1814 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 104libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00000266799F18E2

Strings

l, xrefs: 00000266799F187C

Memory Dump Source

Source File: 00000002.00000002.3410605768.0000026679980000.00000040.00000020.00020000.00000000.sdmp, Offset: 0000026679980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_26679980000_Edge.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: l
API String ID: 1029625771-2517025534
Opcode ID: 1385f4a438fc17bb376d03bd0145f1e19b120c532c3e81762a8c516170bfbca4
Instruction ID: dcf798c440c84c28d72cfa06cb6e55c975e78fd5db2ce3cb73b4951cbfb9307c
Opcode Fuzzy Hash: 1385f4a438fc17bb376d03bd0145f1e19b120c532c3e81762a8c516170bfbca4
Instruction Fuzzy Hash: 69319430518A858FF766DB28C148B66FBD6FBA930CF2856ACD0DAC7192D721D8468B41

Function 000002667B1B2000 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 144memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 000002667B1B203C

Part of subcall function 000002667B1C6C1C: _errno.LIBCMT ref: 000002667B1C6C53
Part of subcall function 000002667B1C6C1C: _invalid_parameter_noinfo.LIBCMT ref: 000002667B1C6C5E

Strings

h, xrefs: 000002667B1B2137

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: AllocLocal_errno_invalid_parameter_noinfo
String ID: h
API String ID: 259714226-2439710439
Opcode ID: 14ca2ddfcce8b4881243e4c524c2883a0a1c3527abb3c7557773b7ebc18441d8
Instruction ID: 2d7fc7c4b1cabb1b54167baeec94001e46ae1f901231f60febf5c4e9d3cf7941
Opcode Fuzzy Hash: 14ca2ddfcce8b4881243e4c524c2883a0a1c3527abb3c7557773b7ebc18441d8
Instruction Fuzzy Hash: BD51D730118B49CFE754EF24D85DB6BBBE1FB98346F500929A586C32B0DB79D885CB42

Function 000002667B1AA540 Relevance: 3.1, APIs: 2, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 000002667B1AA602
LocalFree.KERNELBASE ref: 000002667B1AA6AC

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: CreateFileFreeLocal
String ID:
API String ID: 3879352100-0
Opcode ID: 147d1cb55de93b4ac58249bf9222c36d3788b614a1a0e0d3871ec9b2fcdb0ee9
Instruction ID: 3b2c06c31753fdbb0eae14eebcf51b90cdcd13da6692217f75f4f5f58530ea3a
Opcode Fuzzy Hash: 147d1cb55de93b4ac58249bf9222c36d3788b614a1a0e0d3871ec9b2fcdb0ee9
Instruction Fuzzy Hash: 3A412D301186458FE755EF28D85C76AB7F2FB99315F50062DE05AC22F0CBBA9945CF82

Function 000002667B1B01B0 Relevance: 3.1, APIs: 2, Instructions: 87COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32 ref: 000002667B1B0263
LocalFree.KERNELBASE ref: 000002667B1B028B

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: CreateDirectoryFreeLocal
String ID:
API String ID: 2937684288-0
Opcode ID: 3d6c5400fb6232b5440fa9e95e054a6000238df74fb640f1787ec0ff3ebb7f51
Instruction ID: c434d0c60d2174a5c7857ae2fcce9b0c0fa3661b725be7ff365489fc9f4328f5
Opcode Fuzzy Hash: 3d6c5400fb6232b5440fa9e95e054a6000238df74fb640f1787ec0ff3ebb7f51
Instruction Fuzzy Hash: CE31BE30118B458FE7A5EF18D85CB5BB7F1FB95346F90482AF446C22A4DB799845CB02

Function 000002667B1A76C0 Relevance: 3.1, APIs: 2, Instructions: 75registryCOMMON

Download Yara Rule

APIs

Part of subcall function 000002667B1C6C1C: _errno.LIBCMT ref: 000002667B1C6C53
Part of subcall function 000002667B1C6C1C: _invalid_parameter_noinfo.LIBCMT ref: 000002667B1C6C5E

RegOpenKeyW.ADVAPI32 ref: 000002667B1A7733
RegSetValueExW.KERNEL32 ref: 000002667B1A7775

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: OpenValue_errno_invalid_parameter_noinfo
String ID:
API String ID: 809911093-0
Opcode ID: bafd6c7505aa3cec60dc00240c711fa44000b726ee165bdf6933eea115b47741
Instruction ID: c70e9a5e511b9315049a34f67524098f388b237920ce71fbe9467c1f57e952a6
Opcode Fuzzy Hash: bafd6c7505aa3cec60dc00240c711fa44000b726ee165bdf6933eea115b47741
Instruction Fuzzy Hash: 41215431118A448BF365EF24E89CBABB3E5FBD8305F400529E54AC3194EE79D684CB45

Function 00000266799EF090 Relevance: 3.1, APIs: 2, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00000266799F1814: LoadLibraryA.KERNEL32 ref: 00000266799F18E2

VirtualProtect.KERNEL32 ref: 00000266799EF0DE
VirtualProtect.KERNEL32 ref: 00000266799EF106

Memory Dump Source

Source File: 00000002.00000002.3410605768.0000026679980000.00000040.00000020.00020000.00000000.sdmp, Offset: 0000026679980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_26679980000_Edge.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: b17c4479f7010fd41cbad95f9fb04bd4be79ef02ed8fc175b75ead6b9ebb131e
Instruction ID: 318c4bf39601cd302baad78dcd4118d0ae86fd905010c94d92031bf10f051a36
Opcode Fuzzy Hash: b17c4479f7010fd41cbad95f9fb04bd4be79ef02ed8fc175b75ead6b9ebb131e
Instruction Fuzzy Hash: F2115632718A084FEB95EF18D88D76AB7D5FBDC704F44066AA84AC7249DE21DD418781

Function 000002667B1A5CB0 Relevance: 1.9, APIs: 1, Instructions: 354fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 000002667B1A5DA3

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 08b2cacf798e75e69b7cb91aea6974694c8ad4a9290dab346ea5e9ab6722fae7
Instruction ID: 803bee4b00b7d07237be587c5961ee0cc96d458e4d97eaa38ea4945fba2b04c7
Opcode Fuzzy Hash: 08b2cacf798e75e69b7cb91aea6974694c8ad4a9290dab346ea5e9ab6722fae7
Instruction Fuzzy Hash: 97E1AC30118B45CFE7A5EF28D45CB9ABBE2FB94305F50492DE09EC32A1DB759885CB42

Function 000002667B1A91E0 Relevance: 1.6, APIs: 1, Instructions: 130COMMON

Download Yara Rule

APIs

Part of subcall function 000002667B1C6C1C: _errno.LIBCMT ref: 000002667B1C6C53
Part of subcall function 000002667B1C6C1C: _invalid_parameter_noinfo.LIBCMT ref: 000002667B1C6C5E

StrCmpIW.SHLWAPI ref: 000002667B1A9358

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID:
API String ID: 2959964966-0
Opcode ID: a40e8e4882deb632cbb976bceb1dbfc021a17528ebf96bf44d647521f47a5f93
Instruction ID: 1b8c1b3ab48a93b54167dd8a36dd2f2de4d6fbc8ca697ef50d96566ff090ba24
Opcode Fuzzy Hash: a40e8e4882deb632cbb976bceb1dbfc021a17528ebf96bf44d647521f47a5f93
Instruction Fuzzy Hash: AB413231228A888BE761EB34D8987DBB3E1FBD4304F504A3A958AC3190EF35D645CB46

Function 000002667B1C4C44 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

shutdown.WS2_32 ref: 000002667B1C54FE

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: 1e324129209cd893a82f5fa77545b34915027e85f67f82c093f94e049304d186
Instruction ID: 562ed6dcce71d9be32fea96c4bc14c88246fe3ebfdca98d304b9678c0043dab0
Opcode Fuzzy Hash: 1e324129209cd893a82f5fa77545b34915027e85f67f82c093f94e049304d186
Instruction Fuzzy Hash: AE21AA74159A85CEF377EF58D45D7EAB3E1FB88319F600A2DC08AC21A1DB365850CB02

Function 000002667B1C5053 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

shutdown.WS2_32 ref: 000002667B1C54FE

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: 4523e242cfff20cbfd5ada0557eb7095d386184abc3efdbd5f50bbc9581a3f54
Instruction ID: 84cca76ba6a3c8cfc5a2e5a0623a3683f8545da5f6ccf1abe1a4fe6984694abf
Opcode Fuzzy Hash: 4523e242cfff20cbfd5ada0557eb7095d386184abc3efdbd5f50bbc9581a3f54
Instruction Fuzzy Hash: C021CA74159A85CFF377EF18D45D7EAB2E1FB89305F600A2DC08AD2190DB369854CB02

Function 000002667B1BCA80 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 000002667B1BCAC7

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: 11272a2e7ab32d03185ac6325af245eb3004fbee0aa731c5a7eb43ec361abfc4
Instruction ID: baed19f9a95fde1dd9bc8475a3bc9cb172362d8c50046ef7ed17f0310b3646dc
Opcode Fuzzy Hash: 11272a2e7ab32d03185ac6325af245eb3004fbee0aa731c5a7eb43ec361abfc4
Instruction Fuzzy Hash: 0C11D670118B888FE754DF14D89879BFBF0FB94345F50092DE48AC62A0DBB9C985CB42

Function 000002667B1C501A Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

shutdown.WS2_32 ref: 000002667B1C54FE

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: b6bb2329e6b7e795b7e53ac47f74e02c624d07dddd1fe4acb381e2845aab207f
Instruction ID: 06c4b901f8a519890afa8c2cc520090683a611d3f97bdc824e1f5e3503c57ac8
Opcode Fuzzy Hash: b6bb2329e6b7e795b7e53ac47f74e02c624d07dddd1fe4acb381e2845aab207f
Instruction Fuzzy Hash: 5E11957415AA49CEF367EF58D45DBEAB2E4FB88315F600A2DC08AD2190DB369850CB02

Function 000002667B1C5093 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

shutdown.WS2_32 ref: 000002667B1C54FE

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: c18aa6a1ffd691c55e1d7561076d591147d0cbf13e51d69eaf643f805061d4c5
Instruction ID: 06c4b901f8a519890afa8c2cc520090683a611d3f97bdc824e1f5e3503c57ac8
Opcode Fuzzy Hash: c18aa6a1ffd691c55e1d7561076d591147d0cbf13e51d69eaf643f805061d4c5
Instruction Fuzzy Hash: 5E11957415AA49CEF367EF58D45DBEAB2E4FB88315F600A2DC08AD2190DB369850CB02

Function 000002667B1C4C87 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

shutdown.WS2_32 ref: 000002667B1C54FE

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: 9261c726d5e8489a350fd0b7f93cc126f99fd9a978a714275ad5321cbc0302af
Instruction ID: 06c4b901f8a519890afa8c2cc520090683a611d3f97bdc824e1f5e3503c57ac8
Opcode Fuzzy Hash: 9261c726d5e8489a350fd0b7f93cc126f99fd9a978a714275ad5321cbc0302af
Instruction Fuzzy Hash: 5E11957415AA49CEF367EF58D45DBEAB2E4FB88315F600A2DC08AD2190DB369850CB02

Function 000002667B1C53A4 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

shutdown.WS2_32 ref: 000002667B1C54FE

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: 648223be3ff819d6a8ec63125f758d837fbbac83531a3cd7abbd8aa1ae355420
Instruction ID: 06c4b901f8a519890afa8c2cc520090683a611d3f97bdc824e1f5e3503c57ac8
Opcode Fuzzy Hash: 648223be3ff819d6a8ec63125f758d837fbbac83531a3cd7abbd8aa1ae355420
Instruction Fuzzy Hash: 5E11957415AA49CEF367EF58D45DBEAB2E4FB88315F600A2DC08AD2190DB369850CB02

Function 000002667B1B805F Relevance: 1.5, APIs: 1, Instructions: 47libraryCOMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE ref: 000002667B1B80C5
LoadLibraryExW.KERNEL32 ref: 000002667B1B816E

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: AddressCallerLibraryLoadProc
String ID:
API String ID: 4215043672-0
Opcode ID: 0af500e9fc0feaf599aacb806cbe120ad5ae0dc2b63974d019f6ddcc2e35b223
Instruction ID: 13094f6f56e9a957dfaa64609e9cd00d7e3d59f533acd191cf487af567031f33
Opcode Fuzzy Hash: 0af500e9fc0feaf599aacb806cbe120ad5ae0dc2b63974d019f6ddcc2e35b223
Instruction Fuzzy Hash: C2111B34218B89CEE775FB18C44C7EAB3E0FB98305F40492ED08AC2695DB769581CB82

Function 000002667B1B72E3 Relevance: 1.5, APIs: 1, Instructions: 47libraryCOMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE ref: 000002667B1B734C
LoadLibraryExW.KERNEL32 ref: 000002667B1B73F8

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: AddressCallerLibraryLoadProc
String ID:
API String ID: 4215043672-0
Opcode ID: d3c6e82d341fdc58c4ee0e0beb1d402abe7649a5e2826e12daa8f3b61ba4bcb1
Instruction ID: 192da0511809b428672e8c2148dfb0079899ed06ad03286ab25eec45b5900091
Opcode Fuzzy Hash: d3c6e82d341fdc58c4ee0e0beb1d402abe7649a5e2826e12daa8f3b61ba4bcb1
Instruction Fuzzy Hash: 4811DB34218B89CFE775EB18C48C7EBB3E4FBA5305F90091ED48AC22A0DB355545CB02

Function 000002667B1B7F29 Relevance: 1.5, APIs: 1, Instructions: 47libraryCOMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE ref: 000002667B1B7F8F
LoadLibraryExW.KERNEL32 ref: 000002667B1B8038

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: AddressCallerLibraryLoadProc
String ID:
API String ID: 4215043672-0
Opcode ID: 175f4f39c38ea6b1026292fd509b3c5c591c0c80c5e03c7319577518d773177d
Instruction ID: b05036a8bc5798d94d383a8877bb60f3dd85e492d13646e431cc8377faf21918
Opcode Fuzzy Hash: 175f4f39c38ea6b1026292fd509b3c5c591c0c80c5e03c7319577518d773177d
Instruction Fuzzy Hash: C411B734608B898EE775EB18C4587ABB3E0FBE6305F90491D908EC2650DB796495CB42

Function 000002667B1A8E20 Relevance: 1.5, APIs: 1, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 000002667B1C6C1C: _errno.LIBCMT ref: 000002667B1C6C53
Part of subcall function 000002667B1C6C1C: _invalid_parameter_noinfo.LIBCMT ref: 000002667B1C6C5E

RegGetValueW.KERNEL32 ref: 000002667B1A8E8A

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: Value_errno_invalid_parameter_noinfo
String ID:
API String ID: 4005939669-0
Opcode ID: 5cbe764aeda1c5945a6e93de4f8dccfc6a9e97416addf78d358c4e106c5a5808
Instruction ID: 29715549de7d5a4a8eb3751d93d6a82ec2f12b379acd1a146882c6b71f98c894
Opcode Fuzzy Hash: 5cbe764aeda1c5945a6e93de4f8dccfc6a9e97416addf78d358c4e106c5a5808
Instruction Fuzzy Hash: CF013130118A498FF750EF14D84DB9AB7E4F794305F500A3EA849C3190EBB9D648CB46

Function 000002667B1CDD3C Relevance: 1.5, APIs: 1, Instructions: 28memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32 ref: 000002667B1CDD52

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: f9a3cc9fd730fe19b287c6fb143de30e0ba3d7c76e97619f8157a05a0651c429
Instruction ID: 18ac4e6510003b4e9725b5d48e9ae762b561b5a24835134d20b141e4a4a95d0b
Opcode Fuzzy Hash: f9a3cc9fd730fe19b287c6fb143de30e0ba3d7c76e97619f8157a05a0651c429
Instruction Fuzzy Hash: 7FF06D74614A054BF789AF78EC5E76676E2FB88306F808439F48AC21D0DE3CC4918709

Function 000002667B1C1B30 Relevance: 1.5, APIs: 1, Instructions: 20synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexExW.KERNEL32 ref: 000002667B1C1B48

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: f814f6e7bafc190a419314394220be9ea48f845bea0626bfb9e640e2b12b39a9
Instruction ID: fee788a173503a7370099dbd0d1029648779496817f40ea5e9cd7099bef6d97c
Opcode Fuzzy Hash: f814f6e7bafc190a419314394220be9ea48f845bea0626bfb9e640e2b12b39a9
Instruction Fuzzy Hash: 76E02CB0800A0A8BFB2CEB24EECC31032B0E324308F804432C402C40E0EA7E82A48B0A

Function 000002667B1AA6D0 Relevance: 1.3, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

LocalFree.KERNELBASE ref: 000002667B1AA7C9

Part of subcall function 000002667B1C6C1C: _errno.LIBCMT ref: 000002667B1C6C53
Part of subcall function 000002667B1C6C1C: _invalid_parameter_noinfo.LIBCMT ref: 000002667B1C6C5E

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: FreeLocal_errno_invalid_parameter_noinfo
String ID:
API String ID: 2288270173-0
Opcode ID: 9919e05bc297d9058610392caa52114b2fac805a0e07c5d48dad8591bd573e09
Instruction ID: 38be04e7d449752c0ac774673e067a892cb327a124e370cc23ca287a24942a18
Opcode Fuzzy Hash: 9919e05bc297d9058610392caa52114b2fac805a0e07c5d48dad8591bd573e09
Instruction Fuzzy Hash: D231DA302286458FE7A4AF64D85C72A77E5FB88309F640538E54AD26A0DB3DE946CB42

Function 000002667B1B02E0 Relevance: 1.3, APIs: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 000002667B1B0313

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 4f85c4b8513adf3e20e9bbdad4db3ea0823c1d40a0288d0d0f5561b5b1c209b7
Instruction ID: f56a97a5bd7ab9c963b04537e8598e2985ee334e437acf63c4af9564b3b84ba9
Opcode Fuzzy Hash: 4f85c4b8513adf3e20e9bbdad4db3ea0823c1d40a0288d0d0f5561b5b1c209b7
Instruction Fuzzy Hash: 3F11EC30118B469FE394EF28C85CA2ABBE1FB94342F90542AB446C36B0DB78D545CB46

Function 00B07CE0 Relevance: 1.3, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00B07D78

Memory Dump Source

Source File: 00000002.00000002.3408540168.0000000000AA1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000002.00000002.3408517548.0000000000AA0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3408608631.0000000000B66000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3408715014.0000000000CDB000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3408732017.0000000000CDD000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3408749285.0000000000CE6000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3408767888.0000000000CF2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3408783469.0000000000CF3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3408783469.0000000000D0D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3408783469.0000000000D13000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3408783469.0000000000D7A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3408864798.0000000000D7F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3408881063.0000000000D85000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3408895899.0000000000D86000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_aa0000_Edge.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: d0420e7b245c68536b1289b904fe6097933a37c154ff1c15fd575de53d0a58cb
Instruction ID: 586da2f59400bc42474d681669a7e93731841ad1ee1a19783554dc4dccf0f6d5
Opcode Fuzzy Hash: d0420e7b245c68536b1289b904fe6097933a37c154ff1c15fd575de53d0a58cb
Instruction Fuzzy Hash: 8A115276A45F40C1DB118B1AE44132973B4E748BE4F244365DFAD577A4DF29E1A2C740

Function 000002667B1AF8B3 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

LocalFree.KERNELBASE ref: 000002667B1AF92F

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: FreeLocal
String ID:
API String ID: 2826327444-0
Opcode ID: f992e332d222a4d17fc7fb876d1f1a6f1a1439ebee4c827675b39005004bd709
Instruction ID: e79c3713fbe6f7e4cc6654c2ed7af7215229d780baf7859bf22948b40d566b54
Opcode Fuzzy Hash: f992e332d222a4d17fc7fb876d1f1a6f1a1439ebee4c827675b39005004bd709
Instruction Fuzzy Hash: 79D05B341085048FE770FB14D85D71D77A1F795346F44002BA016C21B0CE7958C5CF03

Function 000002667B1C311C Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 000002667B1C3456

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: d7fd0beb65e5d93ff19426dc30d770c5b11bcaa72caf2a115345622c9e999f62
Instruction ID: 4bc73ede27e7d8d3800a6e2c6bb8def524624b90ee53e6a4c2e22f3e44ec1e5f
Opcode Fuzzy Hash: d7fd0beb65e5d93ff19426dc30d770c5b11bcaa72caf2a115345622c9e999f62
Instruction Fuzzy Hash: 9CE0EC70128241CFE2B39F04D04CBAAB2E0FB81709F804538A4C582190D7754840CA42

Function 000002667B1C33C1 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 000002667B1C3456

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: c3060fa1f2f046b91dd97d40c36785eed85d94b812621f463d5283587dc24e0d
Instruction ID: 4bc73ede27e7d8d3800a6e2c6bb8def524624b90ee53e6a4c2e22f3e44ec1e5f
Opcode Fuzzy Hash: c3060fa1f2f046b91dd97d40c36785eed85d94b812621f463d5283587dc24e0d
Instruction Fuzzy Hash: 9CE0EC70128241CFE2B39F04D04CBAAB2E0FB81709F804538A4C582190D7754840CA42

Function 000002667B1C33F6 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 000002667B1C3456

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 35f35497773284dcd6208a393df6b65e13f0b0a98477e349121de233afb7f61f
Instruction ID: 4bc73ede27e7d8d3800a6e2c6bb8def524624b90ee53e6a4c2e22f3e44ec1e5f
Opcode Fuzzy Hash: 35f35497773284dcd6208a393df6b65e13f0b0a98477e349121de233afb7f61f
Instruction Fuzzy Hash: 9CE0EC70128241CFE2B39F04D04CBAAB2E0FB81709F804538A4C582190D7754840CA42

Function 000002667B1C343E Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 000002667B1C3456

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a45a3181f08a1ad416db12fa2930dc51fb798c15210a78e7d8dbfc87fafb0470
Instruction ID: 4bc73ede27e7d8d3800a6e2c6bb8def524624b90ee53e6a4c2e22f3e44ec1e5f
Opcode Fuzzy Hash: a45a3181f08a1ad416db12fa2930dc51fb798c15210a78e7d8dbfc87fafb0470
Instruction Fuzzy Hash: 9CE0EC70128241CFE2B39F04D04CBAAB2E0FB81709F804538A4C582190D7754840CA42

Function 000002667B1C32BE Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 000002667B1C3456

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 39f14356bcb22ffdf3dfa4a6e53cc2734c55786cb066a729666eda9afd83ce1d
Instruction ID: 4bc73ede27e7d8d3800a6e2c6bb8def524624b90ee53e6a4c2e22f3e44ec1e5f
Opcode Fuzzy Hash: 39f14356bcb22ffdf3dfa4a6e53cc2734c55786cb066a729666eda9afd83ce1d
Instruction Fuzzy Hash: 9CE0EC70128241CFE2B39F04D04CBAAB2E0FB81709F804538A4C582190D7754840CA42

Function 000002667B1C330D Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 000002667B1C3456

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 9ad0a2e42fb40ed54dcc3dd8e4847c35b2bef5224b856b91ac6f9c81089941a7
Instruction ID: 4bc73ede27e7d8d3800a6e2c6bb8def524624b90ee53e6a4c2e22f3e44ec1e5f
Opcode Fuzzy Hash: 9ad0a2e42fb40ed54dcc3dd8e4847c35b2bef5224b856b91ac6f9c81089941a7
Instruction Fuzzy Hash: 9CE0EC70128241CFE2B39F04D04CBAAB2E0FB81709F804538A4C582190D7754840CA42

Function 000002667B1C3330 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 000002667B1C3456

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 20d295bb1bbdee28ab4bf1431ed95a1322f7ced704c44d6a164dde1c9af259ec
Instruction ID: 4bc73ede27e7d8d3800a6e2c6bb8def524624b90ee53e6a4c2e22f3e44ec1e5f
Opcode Fuzzy Hash: 20d295bb1bbdee28ab4bf1431ed95a1322f7ced704c44d6a164dde1c9af259ec
Instruction Fuzzy Hash: 9CE0EC70128241CFE2B39F04D04CBAAB2E0FB81709F804538A4C582190D7754840CA42

Function 000002667B1C31DB Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 000002667B1C3456

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 1fdbc7bcf96cf6089f9b0486ed61ddb46f0fde7b31438bb0dab5b8de26ef8062
Instruction ID: 4bc73ede27e7d8d3800a6e2c6bb8def524624b90ee53e6a4c2e22f3e44ec1e5f
Opcode Fuzzy Hash: 1fdbc7bcf96cf6089f9b0486ed61ddb46f0fde7b31438bb0dab5b8de26ef8062
Instruction Fuzzy Hash: 9CE0EC70128241CFE2B39F04D04CBAAB2E0FB81709F804538A4C582190D7754840CA42

Function 000002667B1C31EF Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 000002667B1C3456

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 1db0ee7de8519c4bb6de4c1fa1cf369719725ed1916abfe87c92e5fb5d0ca813
Instruction ID: 4bc73ede27e7d8d3800a6e2c6bb8def524624b90ee53e6a4c2e22f3e44ec1e5f
Opcode Fuzzy Hash: 1db0ee7de8519c4bb6de4c1fa1cf369719725ed1916abfe87c92e5fb5d0ca813
Instruction Fuzzy Hash: 9CE0EC70128241CFE2B39F04D04CBAAB2E0FB81709F804538A4C582190D7754840CA42

Non-executed Functions

Function 000002667B1B82B0 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 496COMMON

Download Yara Rule

APIs

std::rethrow_exception.LIBCMTD ref: 000002667B1B8370
std::rethrow_exception.LIBCMTD ref: 000002667B1B83F4

Strings

h, xrefs: 000002667B1B84BE

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: std::rethrow_exception
String ID: h
API String ID: 1317400359-2439710439
Opcode ID: d08b3387592623105df3724b1a06e7f04148ea0100b718e9429cf766d36afdeb
Instruction ID: 02edef24dd74eb03b2c1ef24ed23cfcae53d1253186d9836214a6530b666b512
Opcode Fuzzy Hash: d08b3387592623105df3724b1a06e7f04148ea0100b718e9429cf766d36afdeb
Instruction Fuzzy Hash: 2422D630118B89CFE7B5EF28C49C7EBB7E1FB98305F50492DA18AC2690DB759945CB42

Function 000002667B1CFFD8 Relevance: 107.8, APIs: 86, Instructions: 270COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 000002667B1CFFED

Part of subcall function 000002667B1CAC60: _errno.LIBCMT ref: 000002667B1CAC80

free.LIBCMT ref: 000002667B1CFFF6
free.LIBCMT ref: 000002667B1CFFFF
free.LIBCMT ref: 000002667B1D0008
free.LIBCMT ref: 000002667B1D0011
free.LIBCMT ref: 000002667B1D001A
free.LIBCMT ref: 000002667B1D0022
free.LIBCMT ref: 000002667B1D002B
free.LIBCMT ref: 000002667B1D0034
free.LIBCMT ref: 000002667B1D003D
free.LIBCMT ref: 000002667B1D0046
free.LIBCMT ref: 000002667B1D004F
free.LIBCMT ref: 000002667B1D0058
free.LIBCMT ref: 000002667B1D0061
free.LIBCMT ref: 000002667B1D006A
free.LIBCMT ref: 000002667B1D0073
free.LIBCMT ref: 000002667B1D007F
free.LIBCMT ref: 000002667B1D008B
free.LIBCMT ref: 000002667B1D0097
free.LIBCMT ref: 000002667B1D00A3
free.LIBCMT ref: 000002667B1D00AF
free.LIBCMT ref: 000002667B1D00BB
free.LIBCMT ref: 000002667B1D00C7
free.LIBCMT ref: 000002667B1D00D3
free.LIBCMT ref: 000002667B1D00DF
free.LIBCMT ref: 000002667B1D00EB
free.LIBCMT ref: 000002667B1D00F7
free.LIBCMT ref: 000002667B1D0103
free.LIBCMT ref: 000002667B1D010F
free.LIBCMT ref: 000002667B1D011B
free.LIBCMT ref: 000002667B1D0127
free.LIBCMT ref: 000002667B1D0133
free.LIBCMT ref: 000002667B1D013F
free.LIBCMT ref: 000002667B1D014B
free.LIBCMT ref: 000002667B1D0157
free.LIBCMT ref: 000002667B1D0163
free.LIBCMT ref: 000002667B1D016F
free.LIBCMT ref: 000002667B1D017B
free.LIBCMT ref: 000002667B1D0187
free.LIBCMT ref: 000002667B1D0193
free.LIBCMT ref: 000002667B1D019F
free.LIBCMT ref: 000002667B1D01AB
free.LIBCMT ref: 000002667B1D01B7
free.LIBCMT ref: 000002667B1D01C3
free.LIBCMT ref: 000002667B1D01CF
free.LIBCMT ref: 000002667B1D01DB
free.LIBCMT ref: 000002667B1D01E7
free.LIBCMT ref: 000002667B1D01F3
free.LIBCMT ref: 000002667B1D01FF
free.LIBCMT ref: 000002667B1D020B
free.LIBCMT ref: 000002667B1D0217
free.LIBCMT ref: 000002667B1D0223
free.LIBCMT ref: 000002667B1D022F
free.LIBCMT ref: 000002667B1D023B
free.LIBCMT ref: 000002667B1D0247
free.LIBCMT ref: 000002667B1D0253
free.LIBCMT ref: 000002667B1D025F
free.LIBCMT ref: 000002667B1D026B
free.LIBCMT ref: 000002667B1D0277
free.LIBCMT ref: 000002667B1D0283
free.LIBCMT ref: 000002667B1D028F
free.LIBCMT ref: 000002667B1D029B
free.LIBCMT ref: 000002667B1D02A7
free.LIBCMT ref: 000002667B1D02B3
free.LIBCMT ref: 000002667B1D02BF
free.LIBCMT ref: 000002667B1D02CB
free.LIBCMT ref: 000002667B1D02D7
free.LIBCMT ref: 000002667B1D02E3
free.LIBCMT ref: 000002667B1D02EF
free.LIBCMT ref: 000002667B1D02FB
free.LIBCMT ref: 000002667B1D0307
free.LIBCMT ref: 000002667B1D0313
free.LIBCMT ref: 000002667B1D031F
free.LIBCMT ref: 000002667B1D032B
free.LIBCMT ref: 000002667B1D0337
free.LIBCMT ref: 000002667B1D0343
free.LIBCMT ref: 000002667B1D034F
free.LIBCMT ref: 000002667B1D035B
free.LIBCMT ref: 000002667B1D0367
free.LIBCMT ref: 000002667B1D0373
free.LIBCMT ref: 000002667B1D037F
free.LIBCMT ref: 000002667B1D038B
free.LIBCMT ref: 000002667B1D0397
free.LIBCMT ref: 000002667B1D03A3
free.LIBCMT ref: 000002667B1D03AF
free.LIBCMT ref: 000002667B1D03BB

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: 892d27b847e74208b98b5f524de7e1165b6f73ba6f7e08818c88c9b05fc7fdc8
Instruction ID: 3cd03477f58568958754232609583ad5cd42f1355561c964f5db93ee65cb1bf9
Opcode Fuzzy Hash: 892d27b847e74208b98b5f524de7e1165b6f73ba6f7e08818c88c9b05fc7fdc8
Instruction Fuzzy Hash: 7AB1537013150E8BE78BEF24C8DD7E8A351FB48304F8486F5984D9A1BBCE126845C754

Function 000002667B1CA218 Relevance: 30.2, APIs: 14, Strings: 3, Instructions: 493COMMONLIBRARYCODE

Download Yara Rule

APIs

__GetUnwindTryBlock.LIBCMT ref: 000002667B1CA27C
__SetUnwindTryBlock.LIBCMT ref: 000002667B1CA2A3
__GetUnwindTryBlock.LIBCMT ref: 000002667B1CA2AD
_getptd.LIBCMT ref: 000002667B1CA303
_getptd.LIBCMT ref: 000002667B1CA316
_getptd.LIBCMT ref: 000002667B1CA322
_SetThrowImageBase.LIBCMT ref: 000002667B1CA336
_getptd.LIBCMT ref: 000002667B1CA386
_getptd.LIBCMT ref: 000002667B1CA399
_getptd.LIBCMT ref: 000002667B1CA3A5
type_info::operator==.LIBCMT ref: 000002667B1CA40C
std::exception::exception.LIBCMT ref: 000002667B1CA445
_getptd.LIBCMT ref: 000002667B1CA678
std::exception::exception.LIBCMT ref: 000002667B1CA6F1

Strings

csm, xrefs: 000002667B1CA351
csm, xrefs: 000002667B1CA46A
csm, xrefs: 000002667B1CA2C3

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: _getptd$BlockUnwind$std::exception::exception$BaseImageThrowtype_info::operator==
String ID: csm$csm$csm
API String ID: 3798665358-393685449
Opcode ID: eca50f8fb2abfa1cd0a0d9359a125e8eb5c3fc85873ccf6f5cb86d1b7bb4f752
Instruction ID: 56eb67591e0778191d73c869fddb406aa0eac20c15e02d0ea1fd999310349451
Opcode Fuzzy Hash: eca50f8fb2abfa1cd0a0d9359a125e8eb5c3fc85873ccf6f5cb86d1b7bb4f752
Instruction Fuzzy Hash: A4F1B430624A0A8BEB5BAF68844D3A8F3E1FB54309F54577DE44AC3286DB76D841C782

Function 000002667B1CC8A0 Relevance: 19.6, APIs: 13, Instructions: 135COMMONLIBRARYCODE

Download Yara Rule

APIs

__free_lconv_mon.LIBCMT ref: 000002667B1CC8F8

Part of subcall function 000002667B1D0434: free.LIBCMT ref: 000002667B1D0452
Part of subcall function 000002667B1D0434: free.LIBCMT ref: 000002667B1D0464
Part of subcall function 000002667B1D0434: free.LIBCMT ref: 000002667B1D0476
Part of subcall function 000002667B1D0434: free.LIBCMT ref: 000002667B1D0488
Part of subcall function 000002667B1D0434: free.LIBCMT ref: 000002667B1D049A
Part of subcall function 000002667B1D0434: free.LIBCMT ref: 000002667B1D04AC
Part of subcall function 000002667B1D0434: free.LIBCMT ref: 000002667B1D04BE
Part of subcall function 000002667B1D0434: free.LIBCMT ref: 000002667B1D04D0
Part of subcall function 000002667B1D0434: free.LIBCMT ref: 000002667B1D04E2
Part of subcall function 000002667B1D0434: free.LIBCMT ref: 000002667B1D04F4
Part of subcall function 000002667B1D0434: free.LIBCMT ref: 000002667B1D0509
Part of subcall function 000002667B1D0434: free.LIBCMT ref: 000002667B1D051E
Part of subcall function 000002667B1D0434: free.LIBCMT ref: 000002667B1D0533

free.LIBCMT ref: 000002667B1CC8EC

Part of subcall function 000002667B1CAC60: _errno.LIBCMT ref: 000002667B1CAC80

free.LIBCMT ref: 000002667B1CC90E
__free_lconv_num.LIBCMT ref: 000002667B1CC91A
free.LIBCMT ref: 000002667B1CC926
free.LIBCMT ref: 000002667B1CC932
free.LIBCMT ref: 000002667B1CC956
free.LIBCMT ref: 000002667B1CC96A
free.LIBCMT ref: 000002667B1CC979
free.LIBCMT ref: 000002667B1CC985
free.LIBCMT ref: 000002667B1CC9B2
free.LIBCMT ref: 000002667B1CC9DA
free.LIBCMT ref: 000002667B1CC9F4

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: free$__free_lconv_mon__free_lconv_num_errno
String ID:
API String ID: 2822633559-0
Opcode ID: 7b336d24eba5c0ac9b4bfec758739f2f0144249e4441c89cb6f65c36a07eadc0
Instruction ID: fbc12e2c6d4f8d064fdaabeefa1f1cdedff4075d169f1256a6a8bb64a9346273
Opcode Fuzzy Hash: 7b336d24eba5c0ac9b4bfec758739f2f0144249e4441c89cb6f65c36a07eadc0
Instruction Fuzzy Hash: 12410F3012190F8FEF97EF28C49D7A5B3D1FB58308F4816B99809DA1DACB269C81C751

Function 000002667B1C9A54 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000002667B1C9A84
_getptd.LIBCMT ref: 000002667B1C9A98
_getptd.LIBCMT ref: 000002667B1C9AD2
_getptd.LIBCMT ref: 000002667B1C9ADE
_getptd.LIBCMT ref: 000002667B1C9AEA
_CreateFrameInfo.LIBCMT ref: 000002667B1C9AFF

Part of subcall function 000002667B1C7580: _getptd.LIBCMT ref: 000002667B1C758C
Part of subcall function 000002667B1C7580: _getptd.LIBCMT ref: 000002667B1C759A
Part of subcall function 000002667B1C7580: _getptd.LIBCMT ref: 000002667B1C75AE

_getptd.LIBCMT ref: 000002667B1C9B1D
_getptd.LIBCMT ref: 000002667B1C9C23
_getptd.LIBCMT ref: 000002667B1C9C2F

Strings

csm, xrefs: 000002667B1C9BE3

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: _getptd$CreateFrameInfo
String ID: csm
API String ID: 4181383844-1018135373
Opcode ID: 271a7680a82432de43731500a77e144aee1314da8a6568f0176dc0a870e35dee
Instruction ID: 97f008c4574e8488189f930ce38a510e276d892809f300c4da30acac5b31db5b
Opcode Fuzzy Hash: 271a7680a82432de43731500a77e144aee1314da8a6568f0176dc0a870e35dee
Instruction Fuzzy Hash: B8517570518F068FDBA5EF18844DBA9B3E0FB95355F00167EE09DC3592E731A841CB82

Function 000002667B1CF6BC Relevance: 12.2, APIs: 8, Instructions: 165COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002667B1CF703
_invalid_parameter_noinfo.LIBCMT ref: 000002667B1CF70F
_errno.LIBCMT ref: 000002667B1CF759
_errno.LIBCMT ref: 000002667B1CF764
_errno.LIBCMT ref: 000002667B1CF796
_invalid_parameter_noinfo.LIBCMT ref: 000002667B1CF7A0
_errno.LIBCMT ref: 000002667B1CF855
_invalid_parameter_noinfo.LIBCMT ref: 000002667B1CF861

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: ccf1906097c5c7367852938f8d44dc6cf4f8c05bff97315b0985e3b8af237a58
Instruction ID: 46578f2fd2d2f42ce2b3870bc909e2c80a27ffa22267b8983851dc1e721848bc
Opcode Fuzzy Hash: ccf1906097c5c7367852938f8d44dc6cf4f8c05bff97315b0985e3b8af237a58
Instruction Fuzzy Hash: 6B519130610B5B8BFBA79F6888AC3AEB7E0FB45318F644379D419C71D1DA36C8498791

Function 000002667B1CDEE0 Relevance: 10.6, APIs: 7, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000002667B1CDF03
_errno.LIBCMT ref: 000002667B1CDF0B

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: 8332160193843562de71c4d289b8d58b8c6d2cf8480fac3b4b3b286cd7da33ad
Instruction ID: 5b9434b268cc8ba857f73ba94c5a069fc82a457265882955b83f151803e90ee1
Opcode Fuzzy Hash: 8332160193843562de71c4d289b8d58b8c6d2cf8480fac3b4b3b286cd7da33ad
Instruction Fuzzy Hash: AC2108316187464FF35BAF58DC8E7B8B3C4FB46324F110369E546872E3E6661C0282A2

Function 000002667B1CE724 Relevance: 10.6, APIs: 7, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000002667B1CE747
_errno.LIBCMT ref: 000002667B1CE74F

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: d179daee219c0a372b9c0c2fe675cded6413435e6b79e95031c9228548ac58a3
Instruction ID: fabf0ce72f1aba07e08f71ffa86f5fe3b30ef3409120466de197283c618b9165
Opcode Fuzzy Hash: d179daee219c0a372b9c0c2fe675cded6413435e6b79e95031c9228548ac58a3
Instruction Fuzzy Hash: D12108326087464FF75BAF58DC8E3B8B3C4EB45324F214729F546871D3E6A6280182D2

Function 000002667B1D1A20 Relevance: 10.6, APIs: 7, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000002667B1D1A39
_errno.LIBCMT ref: 000002667B1D1A41
_close_nolock.LIBCMT ref: 000002667B1D1A98

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: __doserrno_close_nolock_errno
String ID:
API String ID: 186997739-0
Opcode ID: 6fdfbaea6ec1a0d85f6374b39f0373fa194745ef1886cd0bed5a2f71856c5be3
Instruction ID: e5cd47f1731c6d2fdbdd0a9c6a1cae0afc3419590b94463402cf03ff89827dab
Opcode Fuzzy Hash: 6fdfbaea6ec1a0d85f6374b39f0373fa194745ef1886cd0bed5a2f71856c5be3
Instruction Fuzzy Hash: B4212731109AC24FF747AF34E89E368F695EF41328F220A2CE016872D3E6768850C252

Function 000002667B1C9738 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000002667B1C9757

Part of subcall function 000002667B1CAB34: _getptd.LIBCMT ref: 000002667B1CAB38

_getptd.LIBCMT ref: 000002667B1C9769
_getptd.LIBCMT ref: 000002667B1C9777

Strings

RCC, xrefs: 000002667B1C973F
csm, xrefs: 000002667B1C974F
MOC, xrefs: 000002667B1C9747

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: _getptd
String ID: MOC$RCC$csm
API String ID: 3186804695-2671469338
Opcode ID: 9b1d25e41cb6f60ff9d10fea1865af2b516c1639544035d129adf6bb36f99700
Instruction ID: ad81dbdaf68ca080171a794acb223b893d077a0c8a5cbf72f4ebddd00a7b8103
Opcode Fuzzy Hash: 9b1d25e41cb6f60ff9d10fea1865af2b516c1639544035d129adf6bb36f99700
Instruction Fuzzy Hash: BAF06D340112068EEB576F74814D3A8B1E4FF9838EF9667B594048A1E3E7BE5A80CA52

Function 000002667B1CC568 Relevance: 9.2, APIs: 6, Instructions: 164COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000002667B1CC587

Part of subcall function 000002667B1CC1A4: _getptd.LIBCMT ref: 000002667B1CC1AE

Part of subcall function 000002667B1CED2C: malloc.LIBCMT ref: 000002667B1CED57

free.LIBCMT ref: 000002667B1CC612

Part of subcall function 000002667B1CAC60: _errno.LIBCMT ref: 000002667B1CAC80

_lock.LIBCMT ref: 000002667B1CC642
free.LIBCMT ref: 000002667B1CC6E5
free.LIBCMT ref: 000002667B1CC711
_errno.LIBCMT ref: 000002667B1CC716

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: free$_errno_getptd$_lockmalloc
String ID:
API String ID: 1369581901-0
Opcode ID: 2cc960a6f43093fd45155cd576aa14387d6ccd6b150f6a58f040748e57cd9b75
Instruction ID: d31f88260279026c0293d1c9016f30ef44164db2048f1ccfca7b57a61c366148
Opcode Fuzzy Hash: 2cc960a6f43093fd45155cd576aa14387d6ccd6b150f6a58f040748e57cd9b75
Instruction Fuzzy Hash: FC51E630614A458FE792DF68958D769B7E1FB88318F205279D84EC32D3DB369C42C782

Function 000002667B1C7F08 Relevance: 9.1, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 000002667B1C7F85
_FF_MSGBANNER.LIBCMT ref: 000002667B1C7FB0
_RTC_Initialize.LIBCMT ref: 000002667B1C7FC9
__setargv.LIBCMT ref: 000002667B1C7FFB
_cinit.LIBCMT ref: 000002667B1C8026
_wincmdln.LIBCMT ref: 000002667B1C8036

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: Initialize__setargv_cinit_wincmdln
String ID:
API String ID: 3072666766-0
Opcode ID: 9948d73fcbdb1ea35829390051104b9a8a354d6fb15230b932ca35e5377ed127
Instruction ID: bfcd0637c789aaf1ece5e3c1d87b92005d1e641af10d6d0210b3a972faae4036
Opcode Fuzzy Hash: 9948d73fcbdb1ea35829390051104b9a8a354d6fb15230b932ca35e5377ed127
Instruction Fuzzy Hash: DC417A306006478AFBA67FB4999D7B9B2D1EB8130CF000739A512C62D3EE7B9841C796

Function 000002667B1CF20C Relevance: 9.1, APIs: 6, Instructions: 82COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 000002667B1CF233

Part of subcall function 000002667B1CD27C: _set_error_mode.LIBCMT ref: 000002667B1CD285
Part of subcall function 000002667B1CD27C: _set_error_mode.LIBCMT ref: 000002667B1CD294

Part of subcall function 000002667B1CD01C: _set_error_mode.LIBCMT ref: 000002667B1CD061
Part of subcall function 000002667B1CD01C: _set_error_mode.LIBCMT ref: 000002667B1CD072

Part of subcall function 000002667B1CED2C: malloc.LIBCMT ref: 000002667B1CED57

_errno.LIBCMT ref: 000002667B1CF275
_lock.LIBCMT ref: 000002667B1CF289
free.LIBCMT ref: 000002667B1CF2AC
_errno.LIBCMT ref: 000002667B1CF2B1

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: _set_error_mode$_errno$_lockfreemalloc
String ID:
API String ID: 360200360-0
Opcode ID: bd98f887ec16922817506143df98f8845ac85a219d2c625c9cc3db4b33229072
Instruction ID: f8393382604a5c7256f03f20e34c2bb2f65489179c28cc1ca6d1ceecae8a6c86
Opcode Fuzzy Hash: bd98f887ec16922817506143df98f8845ac85a219d2c625c9cc3db4b33229072
Instruction Fuzzy Hash: 9A213D3461860B8FF7A6BFA4D45D769B390EB58318F504639A009C31D2DB7AD848C742

Function 000002667B1C7C14 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000002667B1C7B70: _getptd.LIBCMT ref: 000002667B1C7B82

_errno.LIBCMT ref: 000002667B1C7C55
_invalid_parameter_noinfo.LIBCMT ref: 000002667B1C7C60
_errno.LIBCMT ref: 000002667B1C7DFD

Strings

$, xrefs: 000002667B1C7CFA
$, xrefs: 000002667B1C7C7A

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: _errno$_getptd_invalid_parameter_noinfo
String ID: $$$
API String ID: 2372577547-233714265
Opcode ID: c460adb36a8ff80a267e1a98acf9e65ed31786de6d2f7996c3ef535e335d8ea5
Instruction ID: 1c2780fdd1268b26609e8124d25d142a736459ed26dfac91dcff5edff5f7b2fb
Opcode Fuzzy Hash: c460adb36a8ff80a267e1a98acf9e65ed31786de6d2f7996c3ef535e335d8ea5
Instruction Fuzzy Hash: D5812331418A5B4AFB7B5E58D88D3B9F6D4FB42718F24137DC8D2871C3DAA68C428386

Function 000002667B1C9FE0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 224COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000002667B1CA011
_getptd.LIBCMT ref: 000002667B1CA02F
_CallSETranslator.LIBCMT ref: 000002667B1CA077

Part of subcall function 000002667B1C7400: _getptd.LIBCMT ref: 000002667B1C7427

Strings

RCC, xrefs: 000002667B1CA04D
MOC, xrefs: 000002667B1CA045

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: _getptd$CallTranslator
String ID: MOC$RCC
API String ID: 3569367362-2084237596
Opcode ID: acedfe0d701db25aceef1ae8689c6b484a9020e323973e641f888c93eb17659d
Instruction ID: 2be798e87fd12fec2318da9bcd96d16cd4bf65f8ce63438c2eae5e4cb0ee85d7
Opcode Fuzzy Hash: acedfe0d701db25aceef1ae8689c6b484a9020e323973e641f888c93eb17659d
Instruction Fuzzy Hash: 46718E30118B0A8EE762EF54C44D7E9F3E1FB80318F504B6ED0498355AEBB5A561C782

Function 000002667B1BF190 Relevance: 7.7, APIs: 5, Instructions: 208COMMON

Download Yara Rule

APIs

und_memcpy.LIBCMTD ref: 000002667B1BF22F
und_memcpy.LIBCMTD ref: 000002667B1BF255

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: und_memcpy
String ID:
API String ID: 2264155635-0
Opcode ID: 233c2dc3f6114190a0c3a58bca7bebfacb80644e2e843f1241ac7ac938ceac0f
Instruction ID: f53abf39e335d8c88cd5840ab3f5054cf54b628a6e9669a3dbe6b2b71e758250
Opcode Fuzzy Hash: 233c2dc3f6114190a0c3a58bca7bebfacb80644e2e843f1241ac7ac938ceac0f
Instruction Fuzzy Hash: B591B2742097899FE7B5DF18C498BEBB7E1FB99304F50882DA48DC7390DA359981CB42

Function 000002667B1D171C Relevance: 7.6, APIs: 5, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002667B1D1735
__doserrno.LIBCMT ref: 000002667B1D17B2
_errno.LIBCMT ref: 000002667B1D17B9

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: _errno$__doserrno
String ID:
API String ID: 2614100947-0
Opcode ID: 4bd1e0fa5e64410cca071e7a41e07a024ac0b2c8312f24266fdc862bd139fbf8
Instruction ID: 5871876326980d781d5ce6336666abf739eb78a16f3095cee332d10aace6e835
Opcode Fuzzy Hash: 4bd1e0fa5e64410cca071e7a41e07a024ac0b2c8312f24266fdc862bd139fbf8
Instruction Fuzzy Hash: D02149306047478FF757AFB8B89E36DF6C4EB45318F26062CE216872E3D66648108356

Function 000002667B1D0EC0 Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 000002667B1D0EC9
_errno.LIBCMT ref: 000002667B1D0ED1

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: cc1a65610d45c684b4d644e34a1a9e911e9c410526ae494b7efd2ca09e7c409c
Instruction ID: 99c10104becc0af9ffc8aefbc1fc955929427e9eaf6d40783df2f906c6958fb4
Opcode Fuzzy Hash: cc1a65610d45c684b4d644e34a1a9e911e9c410526ae494b7efd2ca09e7c409c
Instruction Fuzzy Hash: EA01813152498B8EE79BEF68986D7A4B394EB11329F648365A105C71E2D67A4450C222

Function 000002667B1C9B59 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000002667B1C9B61
_getptd.LIBCMT ref: 000002667B1C9C23
_getptd.LIBCMT ref: 000002667B1C9C2F

Strings

csm, xrefs: 000002667B1C9BE3

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: _getptd
String ID: csm
API String ID: 3186804695-1018135373
Opcode ID: 164f0c1f656baa0ebd7d7a303dff5e04f4e080cf505076c69543e30288755528
Instruction ID: 60c37d50dd11f03741a87f3e32161f88e1eba1bf3cb2f656643cdc95b4ebcca9
Opcode Fuzzy Hash: 164f0c1f656baa0ebd7d7a303dff5e04f4e080cf505076c69543e30288755528
Instruction Fuzzy Hash: 6D318A30118B058FEB66EF18D489BA9B3E0FB94755F40076CD49E83582E732F941C786

Function 000002667B1CBADC Relevance: 6.2, APIs: 4, Instructions: 220COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002667B1CBB0B
_invalid_parameter_noinfo.LIBCMT ref: 000002667B1CBB16
iswctype.LIBCMT ref: 000002667B1CBB4F
_errno.LIBCMT ref: 000002667B1CBC79

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfoiswctype
String ID:
API String ID: 248606491-0
Opcode ID: dced59d46eeafd0b66e48cc28987a4ba37129b116333acfcd2c0ae3b8ac26c49
Instruction ID: 118ac685a244ad541eba205b315247dc06805325da1242f22a9e116f745793a8
Opcode Fuzzy Hash: dced59d46eeafd0b66e48cc28987a4ba37129b116333acfcd2c0ae3b8ac26c49
Instruction Fuzzy Hash: 7051073180461F45FB7AED19998E37BF1C4EB51368F24033AF896C71C6EA67C842428A

Function 000002667B1D12CC Relevance: 6.2, APIs: 4, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000002667B1CEACC: _errno.LIBCMT ref: 000002667B1CEAD5
Part of subcall function 000002667B1CEACC: _invalid_parameter_noinfo.LIBCMT ref: 000002667B1CEAE0

_errno.LIBCMT ref: 000002667B1D12F7
_errno.LIBCMT ref: 000002667B1D1315
_isatty.LIBCMT ref: 000002667B1D1376
_getbuf.LIBCMT ref: 000002667B1D1382

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: _errno$_getbuf_invalid_parameter_noinfo_isatty
String ID:
API String ID: 3655708593-0
Opcode ID: f6cb1389b3d300155bab13a29e2be79a7747ea1a71811924160686b94840a2be
Instruction ID: ddfdd9c9f8ac511289c9b0ce18e55f3cd0c1f42bd9b202af6e1f712a4230424e
Opcode Fuzzy Hash: f6cb1389b3d300155bab13a29e2be79a7747ea1a71811924160686b94840a2be
Instruction Fuzzy Hash: 3D51F53110060A8FEB5AEF2CD4CE3A5B7D1FB44328F354268D856CB2D6D676D9628781

Function 000002667B1C978C Relevance: 6.2, APIs: 4, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000002667B1C71C0: _getptd.LIBCMT ref: 000002667B1C71C4

_getptd.LIBCMT ref: 000002667B1C97CB
_SetImageBase.LIBCMT ref: 000002667B1C989E
_getptd.LIBCMT ref: 000002667B1C98CC
_getptd.LIBCMT ref: 000002667B1C98DA

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: _getptd$BaseImage
String ID:
API String ID: 2482573191-0
Opcode ID: cdd94a6968f71d5886603c0a1a985a3f2cf843edd6b454cac48455dfd8a9b1b8
Instruction ID: 43d92ad9f9afffe328c30db588c0a71c008bed17768b86d20b858831ff518f53
Opcode Fuzzy Hash: cdd94a6968f71d5886603c0a1a985a3f2cf843edd6b454cac48455dfd8a9b1b8
Instruction Fuzzy Hash: A2419531114A068EE3176F6C884E7E9B2D1FB8436CF6457BEE055C71E3EA66E8428385

Function 000002667B1C80B8 Relevance: 6.2, APIs: 4, Instructions: 150COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000002667B1CEACC: _errno.LIBCMT ref: 000002667B1CEAD5
Part of subcall function 000002667B1CEACC: _invalid_parameter_noinfo.LIBCMT ref: 000002667B1CEAE0

_errno.LIBCMT ref: 000002667B1C80E5
_errno.LIBCMT ref: 000002667B1C8101
_isatty.LIBCMT ref: 000002667B1C8162
_getbuf.LIBCMT ref: 000002667B1C816E

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: _errno$_getbuf_invalid_parameter_noinfo_isatty
String ID:
API String ID: 3655708593-0
Opcode ID: 400924676afdb6542912dbb754b0c6b2f42f88cbdf26364f46bcf7423cf333eb
Instruction ID: e3c1dad027b056a64bebc6ab36a12c2e15bf59c8f0b284c826076911c1a32348
Opcode Fuzzy Hash: 400924676afdb6542912dbb754b0c6b2f42f88cbdf26364f46bcf7423cf333eb
Instruction Fuzzy Hash: 8551E030114A4A8FEB9AEF2CC4CD779B6D0FB48318F1443A9D856CB2D6D636D891C781

Function 000002667B1CA70C Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 209COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 000002667B1CA730

Strings

csm, xrefs: 000002667B1CA75D
csm, xrefs: 000002667B1CA867

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: _getptd
String ID: csm$csm
API String ID: 3186804695-3733052814
Opcode ID: 6aff7aa4c748e3a33ad8cb204df13253e198ca2aad936b4e005454528593aa9e
Instruction ID: 52d416ce2247f5ef8464ca3af6fbd0d3b9c42995c7502a1d384a0925d4843257
Opcode Fuzzy Hash: 6aff7aa4c748e3a33ad8cb204df13253e198ca2aad936b4e005454528593aa9e
Instruction Fuzzy Hash: A2617330624B068FEBA79E68808D769B3E0FB58319F645B3DD44DC7299D7329C81C786

Function 000002667B1C6C1C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 000002667B1C6C53
_invalid_parameter_noinfo.LIBCMT ref: 000002667B1C6C5E

Strings

B, xrefs: 000002667B1C6C79

Memory Dump Source

Source File: 00000002.00000002.3410643928.000002667B1A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 000002667B1A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2667b1a1000_Edge.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: B
API String ID: 2959964966-1255198513
Opcode ID: 5b9fd8484ccd4287e022cca72682e00a1ed95e5f0e740e72b956befb73647925
Instruction ID: 1d648f50ee5cf93a6c08425717d6fb4411e2544ff835b053e96d32bf8d0901f9
Opcode Fuzzy Hash: 5b9fd8484ccd4287e022cca72682e00a1ed95e5f0e740e72b956befb73647925
Instruction Fuzzy Hash: 49319531910A1E9AEB52EF98D88D7EDFBF4FB54328F500336A816D7292DB3294448785

Analysis Process: Edge.exePID: 3192, Parent PID: 4004COMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	272
Total number of Limit Nodes:	49

Executed Functions

Function 00000261E54C0808 Relevance: 16.8, APIs: 8, Strings: 1, Instructions: 1070memorynativeCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL ref: 00000261E54C08D5
NtMapViewOfSection.NTDLL ref: 00000261E54C09C0
VirtualAlloc.KERNELBASE ref: 00000261E54C0DEB
NtUnmapViewOfSection.NTDLL ref: 00000261E54C0E91
NtMapViewOfSection.NTDLL ref: 00000261E54C0EFD
VirtualProtect.KERNELBASE ref: 00000261E54C0F24
VirtualProtect.KERNELBASE ref: 00000261E54C0FF8
VirtualProtect.KERNELBASE ref: 00000261E54C103B

Strings

@, xrefs: 00000261E54C08C3

Memory Dump Source

Source File: 00000004.00000002.2350558821.00000261E5450000.00000040.00000020.00020000.00000000.sdmp, Offset: 00000261E5450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_261e5450000_Edge.jbxd

Yara matches

Similarity

API ID: SectionVirtual$ProtectView$AllocCreateUnmap
String ID: @
API String ID: 1653215272-2766056989
Opcode ID: c637d99d209d1ca9699a6f6406458f9f86e5ddc939b9afbe853fcc5f8e29eda5
Instruction ID: 96e02dbbe88be8084ae780d2dbd5045d6cfed03ed6b97afe888b8ad22d2bae11
Opcode Fuzzy Hash: c637d99d209d1ca9699a6f6406458f9f86e5ddc939b9afbe853fcc5f8e29eda5
Instruction Fuzzy Hash: A8727830618B488BEB6DDF28C8897A973E1FB98314F14451ED89BC7285EF36F5528B41

Function 00000261E6CE1000 Relevance: 9.8, APIs: 6, Instructions: 790synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexExW.KERNELBASE ref: 00000261E6CE10CC
CloseHandle.KERNELBASE ref: 00000261E6CE11E4
ExitProcess.KERNEL32 ref: 00000261E6CE11EC
_LDint.LIBCPMTD ref: 00000261E6CE13C5
_LDint.LIBCPMTD ref: 00000261E6CE1406
_LDint.LIBCPMTD ref: 00000261E6CE145E

Memory Dump Source

Source File: 00000004.00000002.2350671493.00000261E6CE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000261E6CE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_261e6ce1000_Edge.jbxd

Similarity

API ID: Dint$CloseCreateExitHandleMutexProcess
String ID:
API String ID: 3586310-0
Opcode ID: f98d3638bcb4881571893d0b64532fb7071e35af9423874bbb812e626070e764
Instruction ID: 33c5d08852ba7aa3eb3bb8871a684ae0a4e65c1ae60344b7799505b656bbeccf
Opcode Fuzzy Hash: f98d3638bcb4881571893d0b64532fb7071e35af9423874bbb812e626070e764
Instruction Fuzzy Hash: A57277702086448FFB64EB24DC5C7BA77E2FB94305FA4052DE58AC31A1DB7AD590CB46

Function 00000261E54BFFFC Relevance: 1.6, APIs: 1, Instructions: 382
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00000261E54C006F

Memory Dump Source

Source File: 00000004.00000002.2350558821.00000261E5450000.00000040.00000020.00020000.00000000.sdmp, Offset: 00000261E5450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_261e5450000_Edge.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 08c3b473a1f7362871bcf2729fe2c144e163769adb635b581bed10db9dac86c4
Instruction ID: 599d4abc7607d85b501eae9353fef5f21b8236e3679ebaa9ab1e92f57079621e
Opcode Fuzzy Hash: 08c3b473a1f7362871bcf2729fe2c144e163769adb635b581bed10db9dac86c4
Instruction Fuzzy Hash: C8C15530614A054BFB5EEE2884997ADB3D1FBD8300F18426BDC4EC7196EB27F9718691

Function 00000261E6CF6DC0 Relevance: 18.0, APIs: 11, Instructions: 1455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2350671493.00000261E6CE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000261E6CE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_261e6ce1000_Edge.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5a17312eacb160121f9eea0b528651a09acfa2ad52bd57e63ccf263f8cb0842
Instruction ID: c9ced2c4c3f22ffe8f8823bbb42e72c9c0e359f8a9bb86df4e2b9fe9f771a2e1
Opcode Fuzzy Hash: c5a17312eacb160121f9eea0b528651a09acfa2ad52bd57e63ccf263f8cb0842
Instruction Fuzzy Hash: B7C22230219A88DFFB75EB18D4487EA77E0FBA4301FA4091ED44AC31A1DB36A5D5CB52

Function 00000261E54BEF64 Relevance: 6.1, APIs: 4, Instructions: 133
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000261E54C1814: LoadLibraryA.KERNELBASE ref: 00000261E54C18E2

VirtualProtect.KERNELBASE ref: 00000261E54BEFE0
VirtualProtect.KERNELBASE ref: 00000261E54BF009
VirtualProtect.KERNELBASE ref: 00000261E54BF04E
VirtualProtect.KERNELBASE ref: 00000261E54BF072

Memory Dump Source

Source File: 00000004.00000002.2350558821.00000261E5450000.00000040.00000020.00020000.00000000.sdmp, Offset: 00000261E5450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_261e5450000_Edge.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: d24d4ce7223a552c1b01d238479d20a295a89e3d53a7350efd5ba8d12bfb46a0
Instruction ID: d186c5c54439a64e2f25b99ce8fe6ead5d47af0a3bc98662db23cab4c01e15a4
Opcode Fuzzy Hash: d24d4ce7223a552c1b01d238479d20a295a89e3d53a7350efd5ba8d12bfb46a0
Instruction Fuzzy Hash: 8A31763131CA084BE758EE18984976AB3D5E7D4720F14066BAC4FC32D6ED63ED2647C1

Function 00000261E54BEFD3 Relevance: 6.1, APIs: 4, Instructions: 89
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00000261E54BEFE0
VirtualProtect.KERNELBASE ref: 00000261E54BF009
VirtualProtect.KERNELBASE ref: 00000261E54BF04E
VirtualProtect.KERNELBASE ref: 00000261E54BF072

Memory Dump Source

Source File: 00000004.00000002.2350558821.00000261E5450000.00000040.00000020.00020000.00000000.sdmp, Offset: 00000261E5450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_261e5450000_Edge.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f2b484dd179f3dd10506a7a62fe75bc60ed010a6cf5ae84582fe1852291c4020
Instruction ID: 6ffe06d081b5af64ff40f9c4a8862e174fe0cfdf3692f237a705b02f748d74d8
Opcode Fuzzy Hash: f2b484dd179f3dd10506a7a62fe75bc60ed010a6cf5ae84582fe1852291c4020
Instruction Fuzzy Hash: A321513170CA084BDB98AD5CA859769B3D1E7C8710F14016BAD4FC32DAED66ED2647C1

Function 00000261E54C1814 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 104
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000261E54C18E2

Strings

l, xrefs: 00000261E54C187C

Memory Dump Source

Source File: 00000004.00000002.2350558821.00000261E5450000.00000040.00000020.00020000.00000000.sdmp, Offset: 00000261E5450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_261e5450000_Edge.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: l
API String ID: 1029625771-2517025534
Opcode ID: 1385f4a438fc17bb376d03bd0145f1e19b120c532c3e81762a8c516170bfbca4
Instruction ID: b7f8d6b7ae815501d121283d771bf9f22bad59d11e1c417b6dec3c983e8afba9
Opcode Fuzzy Hash: 1385f4a438fc17bb376d03bd0145f1e19b120c532c3e81762a8c516170bfbca4
Instruction Fuzzy Hash: DB31B47051CA858FF759DF288048B22BBD5FBE9308F2856ADD4DAC3192E722D8168711

Function 00000261E54BF090 Relevance: 3.1, APIs: 2, Instructions: 63
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000261E54C1814: LoadLibraryA.KERNELBASE ref: 00000261E54C18E2

VirtualProtect.KERNELBASE ref: 00000261E54BF0DE
VirtualProtect.KERNELBASE ref: 00000261E54BF106

Memory Dump Source

Source File: 00000004.00000002.2350558821.00000261E5450000.00000040.00000020.00020000.00000000.sdmp, Offset: 00000261E5450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_261e5450000_Edge.jbxd

Yara matches

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: b17c4479f7010fd41cbad95f9fb04bd4be79ef02ed8fc175b75ead6b9ebb131e
Instruction ID: 96d700db53da09cbbfcbfb438e7e1e546208f414956447dde476d18757729d29
Opcode Fuzzy Hash: b17c4479f7010fd41cbad95f9fb04bd4be79ef02ed8fc175b75ead6b9ebb131e
Instruction Fuzzy Hash: B3116931718A184BDB94EF28D88976A77D5FBD8740F04056AAC4FC7249EE23ED518781

Function 00000261E6CE91E0 Relevance: 1.6, APIs: 1, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000261E6D06C1C: _errno.LIBCMT ref: 00000261E6D06C53
Part of subcall function 00000261E6D06C1C: _invalid_parameter_noinfo.LIBCMT ref: 00000261E6D06C5E

StrCmpIW.KERNELBASE ref: 00000261E6CE9358

Memory Dump Source

Source File: 00000004.00000002.2350671493.00000261E6CE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000261E6CE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_261e6ce1000_Edge.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID:
API String ID: 2959964966-0
Opcode ID: a40e8e4882deb632cbb976bceb1dbfc021a17528ebf96bf44d647521f47a5f93
Instruction ID: 853d57c62872eb997db1eed9d931d7cee44a6d0eed4671d5634952674b6473c7
Opcode Fuzzy Hash: a40e8e4882deb632cbb976bceb1dbfc021a17528ebf96bf44d647521f47a5f93
Instruction Fuzzy Hash: 1E413331218A884BE760EB34D8547DB77E2FB94300FA0493A958EC3195EF36D655C786

Function 00000261E6CF805F Relevance: 1.5, APIs: 1, Instructions: 47
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddressForCaller.KERNELBASE ref: 00000261E6CF80C5
LoadLibraryExW.KERNELBASE ref: 00000261E6CF816E

Memory Dump Source

Source File: 00000004.00000002.2350671493.00000261E6CE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000261E6CE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_261e6ce1000_Edge.jbxd

Similarity

API ID: AddressCallerLibraryLoadProc
String ID:
API String ID: 4215043672-0
Opcode ID: 0af500e9fc0feaf599aacb806cbe120ad5ae0dc2b63974d019f6ddcc2e35b223
Instruction ID: 2c1d47e2d4e55386d0cadafc601b53c51e51b1402c66cec3972bec8632fab288
Opcode Fuzzy Hash: 0af500e9fc0feaf599aacb806cbe120ad5ae0dc2b63974d019f6ddcc2e35b223
Instruction Fuzzy Hash: 73111E34218B488EE775FB18C4487EA73E0FB98301F50491ED48AC3195DB76A595CBC2

Function 00000261E6CF7F29 Relevance: 1.5, APIs: 1, Instructions: 47
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddressForCaller.KERNELBASE ref: 00000261E6CF7F8F
LoadLibraryExW.KERNELBASE ref: 00000261E6CF8038

Memory Dump Source

Source File: 00000004.00000002.2350671493.00000261E6CE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000261E6CE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_261e6ce1000_Edge.jbxd

Similarity

API ID: AddressCallerLibraryLoadProc
String ID:
API String ID: 4215043672-0
Opcode ID: 175f4f39c38ea6b1026292fd509b3c5c591c0c80c5e03c7319577518d773177d
Instruction ID: ce83ec733bdadb8d58b06cabac91c30aa2d297a5622d31d2db318871aef7f327
Opcode Fuzzy Hash: 175f4f39c38ea6b1026292fd509b3c5c591c0c80c5e03c7319577518d773177d
Instruction Fuzzy Hash: 4D11BA346087888EE775EB14C4587AA73E0FBD6301F90491DD48EC3151DB7AA595CB82

Function 00000261E6CF72E3 Relevance: 1.5, APIs: 1, Instructions: 47libraryCOMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE ref: 00000261E6CF734C
LoadLibraryExW.KERNELBASE ref: 00000261E6CF73F8

Memory Dump Source

Source File: 00000004.00000002.2350671493.00000261E6CE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000261E6CE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_261e6ce1000_Edge.jbxd

Similarity

API ID: AddressCallerLibraryLoadProc
String ID:
API String ID: 4215043672-0
Opcode ID: d3c6e82d341fdc58c4ee0e0beb1d402abe7649a5e2826e12daa8f3b61ba4bcb1
Instruction ID: 532336d7ca81b09fc64ef78e319d3a2d319b75115d03d8929cb40af472aceb23
Opcode Fuzzy Hash: d3c6e82d341fdc58c4ee0e0beb1d402abe7649a5e2826e12daa8f3b61ba4bcb1
Instruction Fuzzy Hash: EA11DB34219B888FEB75EB14D4887EB77E4FB95301F90091ED48AC3191DB36A495CB42

Non-executed Functions

Function 00000261E6CF82B0 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 496
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::rethrow_exception.LIBCMTD ref: 00000261E6CF8370
std::rethrow_exception.LIBCMTD ref: 00000261E6CF83F4

Strings

h, xrefs: 00000261E6CF84BE

Memory Dump Source

Source File: 00000004.00000002.2350671493.00000261E6CE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000261E6CE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_261e6ce1000_Edge.jbxd

Similarity

API ID: std::rethrow_exception
String ID: h
API String ID: 1317400359-2439710439
Opcode ID: 8ee3f583c56d212dec831c16406cf4e4c95e6968c2955d7366080fd8d4f38ae1
Instruction ID: b759bda493615d4e8df8f70dad4a3431cac42819bfbc92f45f3774664215a3e8
Opcode Fuzzy Hash: 8ee3f583c56d212dec831c16406cf4e4c95e6968c2955d7366080fd8d4f38ae1
Instruction Fuzzy Hash: E422F93021CB888FE7B5DF18C4587EAB7E1FB98305F64492DE58AC3291DB359985CB42

Function 00000261E6D0FFD8 Relevance: 107.8, APIs: 86, Instructions: 270
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.LIBCMT ref: 00000261E6D0FFED

Part of subcall function 00000261E6D0AC60: _errno.LIBCMT ref: 00000261E6D0AC80

free.LIBCMT ref: 00000261E6D0FFF6
free.LIBCMT ref: 00000261E6D0FFFF
free.LIBCMT ref: 00000261E6D10008
free.LIBCMT ref: 00000261E6D10011
free.LIBCMT ref: 00000261E6D1001A
free.LIBCMT ref: 00000261E6D10022
free.LIBCMT ref: 00000261E6D1002B
free.LIBCMT ref: 00000261E6D10034
free.LIBCMT ref: 00000261E6D1003D
free.LIBCMT ref: 00000261E6D10046
free.LIBCMT ref: 00000261E6D1004F
free.LIBCMT ref: 00000261E6D10058
free.LIBCMT ref: 00000261E6D10061
free.LIBCMT ref: 00000261E6D1006A
free.LIBCMT ref: 00000261E6D10073
free.LIBCMT ref: 00000261E6D1007F
free.LIBCMT ref: 00000261E6D1008B
free.LIBCMT ref: 00000261E6D10097
free.LIBCMT ref: 00000261E6D100A3
free.LIBCMT ref: 00000261E6D100AF
free.LIBCMT ref: 00000261E6D100BB
free.LIBCMT ref: 00000261E6D100C7
free.LIBCMT ref: 00000261E6D100D3
free.LIBCMT ref: 00000261E6D100DF
free.LIBCMT ref: 00000261E6D100EB
free.LIBCMT ref: 00000261E6D100F7
free.LIBCMT ref: 00000261E6D10103
free.LIBCMT ref: 00000261E6D1010F
free.LIBCMT ref: 00000261E6D1011B
free.LIBCMT ref: 00000261E6D10127
free.LIBCMT ref: 00000261E6D10133
free.LIBCMT ref: 00000261E6D1013F
free.LIBCMT ref: 00000261E6D1014B
free.LIBCMT ref: 00000261E6D10157
free.LIBCMT ref: 00000261E6D10163
free.LIBCMT ref: 00000261E6D1016F
free.LIBCMT ref: 00000261E6D1017B
free.LIBCMT ref: 00000261E6D10187
free.LIBCMT ref: 00000261E6D10193
free.LIBCMT ref: 00000261E6D1019F
free.LIBCMT ref: 00000261E6D101AB
free.LIBCMT ref: 00000261E6D101B7
free.LIBCMT ref: 00000261E6D101C3
free.LIBCMT ref: 00000261E6D101CF
free.LIBCMT ref: 00000261E6D101DB
free.LIBCMT ref: 00000261E6D101E7
free.LIBCMT ref: 00000261E6D101F3
free.LIBCMT ref: 00000261E6D101FF
free.LIBCMT ref: 00000261E6D1020B
free.LIBCMT ref: 00000261E6D10217
free.LIBCMT ref: 00000261E6D10223
free.LIBCMT ref: 00000261E6D1022F
free.LIBCMT ref: 00000261E6D1023B
free.LIBCMT ref: 00000261E6D10247
free.LIBCMT ref: 00000261E6D10253
free.LIBCMT ref: 00000261E6D1025F
free.LIBCMT ref: 00000261E6D1026B
free.LIBCMT ref: 00000261E6D10277
free.LIBCMT ref: 00000261E6D10283
free.LIBCMT ref: 00000261E6D1028F
free.LIBCMT ref: 00000261E6D1029B
free.LIBCMT ref: 00000261E6D102A7
free.LIBCMT ref: 00000261E6D102B3
free.LIBCMT ref: 00000261E6D102BF
free.LIBCMT ref: 00000261E6D102CB
free.LIBCMT ref: 00000261E6D102D7
free.LIBCMT ref: 00000261E6D102E3
free.LIBCMT ref: 00000261E6D102EF
free.LIBCMT ref: 00000261E6D102FB
free.LIBCMT ref: 00000261E6D10307
free.LIBCMT ref: 00000261E6D10313
free.LIBCMT ref: 00000261E6D1031F
free.LIBCMT ref: 00000261E6D1032B
free.LIBCMT ref: 00000261E6D10337
free.LIBCMT ref: 00000261E6D10343
free.LIBCMT ref: 00000261E6D1034F
free.LIBCMT ref: 00000261E6D1035B
free.LIBCMT ref: 00000261E6D10367
free.LIBCMT ref: 00000261E6D10373
free.LIBCMT ref: 00000261E6D1037F
free.LIBCMT ref: 00000261E6D1038B
free.LIBCMT ref: 00000261E6D10397
free.LIBCMT ref: 00000261E6D103A3
free.LIBCMT ref: 00000261E6D103AF
free.LIBCMT ref: 00000261E6D103BB

Memory Dump Source

Source File: 00000004.00000002.2350671493.00000261E6CE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000261E6CE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_261e6ce1000_Edge.jbxd

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: 892d27b847e74208b98b5f524de7e1165b6f73ba6f7e08818c88c9b05fc7fdc8
Instruction ID: 44d5448b90bc9f59ab6c43e5e4d77b7c0e1573fbfa41d967404bdf0348ab1385
Opcode Fuzzy Hash: 892d27b847e74208b98b5f524de7e1165b6f73ba6f7e08818c88c9b05fc7fdc8
Instruction Fuzzy Hash: C5B1633812150D8BE6C9EB24C8D97E86352BB48340FED81F99C8DDA1E7CE53AC55C794

Function 00000261E6D0C8A0 Relevance: 19.6, APIs: 13, Instructions: 135
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__free_lconv_mon.LIBCMT ref: 00000261E6D0C8F8

Part of subcall function 00000261E6D10434: free.LIBCMT ref: 00000261E6D10452
Part of subcall function 00000261E6D10434: free.LIBCMT ref: 00000261E6D10464
Part of subcall function 00000261E6D10434: free.LIBCMT ref: 00000261E6D10476
Part of subcall function 00000261E6D10434: free.LIBCMT ref: 00000261E6D10488
Part of subcall function 00000261E6D10434: free.LIBCMT ref: 00000261E6D1049A
Part of subcall function 00000261E6D10434: free.LIBCMT ref: 00000261E6D104AC
Part of subcall function 00000261E6D10434: free.LIBCMT ref: 00000261E6D104BE
Part of subcall function 00000261E6D10434: free.LIBCMT ref: 00000261E6D104D0
Part of subcall function 00000261E6D10434: free.LIBCMT ref: 00000261E6D104E2
Part of subcall function 00000261E6D10434: free.LIBCMT ref: 00000261E6D104F4
Part of subcall function 00000261E6D10434: free.LIBCMT ref: 00000261E6D10509
Part of subcall function 00000261E6D10434: free.LIBCMT ref: 00000261E6D1051E
Part of subcall function 00000261E6D10434: free.LIBCMT ref: 00000261E6D10533

free.LIBCMT ref: 00000261E6D0C8EC

Part of subcall function 00000261E6D0AC60: _errno.LIBCMT ref: 00000261E6D0AC80

free.LIBCMT ref: 00000261E6D0C90E
__free_lconv_num.LIBCMT ref: 00000261E6D0C91A
free.LIBCMT ref: 00000261E6D0C926
free.LIBCMT ref: 00000261E6D0C932
free.LIBCMT ref: 00000261E6D0C956
free.LIBCMT ref: 00000261E6D0C96A
free.LIBCMT ref: 00000261E6D0C979
free.LIBCMT ref: 00000261E6D0C985
free.LIBCMT ref: 00000261E6D0C9B2
free.LIBCMT ref: 00000261E6D0C9DA
free.LIBCMT ref: 00000261E6D0C9F4

Memory Dump Source

Source File: 00000004.00000002.2350671493.00000261E6CE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000261E6CE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_261e6ce1000_Edge.jbxd

Similarity

API ID: free$__free_lconv_mon__free_lconv_num_errno
String ID:
API String ID: 2822633559-0
Opcode ID: 7b336d24eba5c0ac9b4bfec758739f2f0144249e4441c89cb6f65c36a07eadc0
Instruction ID: 87095d55b7302f99ecdf23c6ce0a8d9032b1a75aec14ed6ef1472dd1c0762a35
Opcode Fuzzy Hash: 7b336d24eba5c0ac9b4bfec758739f2f0144249e4441c89cb6f65c36a07eadc0
Instruction Fuzzy Hash: 0D410A3811090D8BEFD5EB58D4997A47292FB58385FFD01B99C89DA1D3CA33E8A1C790

Function 00000261E6D0EAF4 Relevance: 18.2, APIs: 12, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fileno.LIBCMT ref: 00000261E6D0EB28

Part of subcall function 00000261E6D0EACC: _errno.LIBCMT ref: 00000261E6D0EAD5
Part of subcall function 00000261E6D0EACC: _invalid_parameter_noinfo.LIBCMT ref: 00000261E6D0EAE0

_fileno.LIBCMT ref: 00000261E6D0EB43
_fileno.LIBCMT ref: 00000261E6D0EB50
_fileno.LIBCMT ref: 00000261E6D0EB5F

Part of subcall function 00000261E6D080B8: _fileno.LIBCMT ref: 00000261E6D080D5
Part of subcall function 00000261E6D080B8: _errno.LIBCMT ref: 00000261E6D080E5

_fileno.LIBCMT ref: 00000261E6D0EB89
_fileno.LIBCMT ref: 00000261E6D0EB96
_fileno.LIBCMT ref: 00000261E6D0EBA3
_fileno.LIBCMT ref: 00000261E6D0EBB2
_fileno.LIBCMT ref: 00000261E6D0EBDC
_fileno.LIBCMT ref: 00000261E6D0EBE9
_fileno.LIBCMT ref: 00000261E6D0EBF6
_fileno.LIBCMT ref: 00000261E6D0EC05

Memory Dump Source

Source File: 00000004.00000002.2350671493.00000261E6CE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000261E6CE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_261e6ce1000_Edge.jbxd

Similarity

API ID: _fileno$_errno$_invalid_parameter_noinfo
String ID:
API String ID: 482796045-0
Opcode ID: 028979bd5b13ade2da22324f9a5c4af98c9790d4944bca090fd0f536f3016bc3
Instruction ID: 05ecd881503a9a07e95518c27782c3795d461b37960639f823ae6bbe87f9934d
Opcode Fuzzy Hash: 028979bd5b13ade2da22324f9a5c4af98c9790d4944bca090fd0f536f3016bc3
Instruction Fuzzy Hash: 7B61C938114E494AE698AB2844993B976D6FB49350FFC0219E8FAC31D3D627E46293C5

Function 00000261E6D0F6BC Relevance: 12.2, APIs: 8, Instructions: 165
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 00000261E6D0F703
_invalid_parameter_noinfo.LIBCMT ref: 00000261E6D0F70F
_errno.LIBCMT ref: 00000261E6D0F759
_errno.LIBCMT ref: 00000261E6D0F764
_errno.LIBCMT ref: 00000261E6D0F796
_invalid_parameter_noinfo.LIBCMT ref: 00000261E6D0F7A0
_errno.LIBCMT ref: 00000261E6D0F855
_invalid_parameter_noinfo.LIBCMT ref: 00000261E6D0F861

Memory Dump Source

Source File: 00000004.00000002.2350671493.00000261E6CE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000261E6CE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_261e6ce1000_Edge.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: ccf1906097c5c7367852938f8d44dc6cf4f8c05bff97315b0985e3b8af237a58
Instruction ID: 0d3450c4557553c5670f4fcd495f7e2ad2fc3d8007e09248dcaf687054b04750
Opcode Fuzzy Hash: ccf1906097c5c7367852938f8d44dc6cf4f8c05bff97315b0985e3b8af237a58
Instruction Fuzzy Hash: 2851A634914A098BEBD5DB1884583AB36E2FB84790FFC1259DC99C71D3CA37E85587C2

Function 00000261E6D0DEE0 Relevance: 10.6, APIs: 7, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00000261E6D0DF03
_errno.LIBCMT ref: 00000261E6D0DF0B

Memory Dump Source

Source File: 00000004.00000002.2350671493.00000261E6CE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000261E6CE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_261e6ce1000_Edge.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: cf1cf9e5ee490599d654468345f8dd86778b0f50a3bdec84bd96aa650e994298
Instruction ID: b5435effb7f816cf6278616c31d95476ea7ccb4f3bba78dd028a28c9db19b151
Opcode Fuzzy Hash: cf1cf9e5ee490599d654468345f8dd86778b0f50a3bdec84bd96aa650e994298
Instruction Fuzzy Hash: BD216E746187444EF398AB58D88A3B877C5FB45360FF8420AED858B1E3D6A7B81182D2

Function 00000261E6D0E724 Relevance: 10.6, APIs: 7, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00000261E6D0E747
_errno.LIBCMT ref: 00000261E6D0E74F

Memory Dump Source

Source File: 00000004.00000002.2350671493.00000261E6CE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000261E6CE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_261e6ce1000_Edge.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: 253ccbe714b82c328477c76466321d949f30074f1a6150cf967292407ae3f5db
Instruction ID: 49593647c505961bcc3aa1ee7e6eabd9e111402d14027dec3dbec18419391478
Opcode Fuzzy Hash: 253ccbe714b82c328477c76466321d949f30074f1a6150cf967292407ae3f5db
Instruction Fuzzy Hash: 0B212975A0C7044EF398AB58988A37833D6FB85360FF80609FD954B1E3D6A7B81182D1

Function 00000261E6D0F20C Relevance: 9.1, APIs: 6, Instructions: 82COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 00000261E6D0F233

Part of subcall function 00000261E6D0D27C: _set_error_mode.LIBCMT ref: 00000261E6D0D285
Part of subcall function 00000261E6D0D27C: _set_error_mode.LIBCMT ref: 00000261E6D0D294

Part of subcall function 00000261E6D0D01C: _set_error_mode.LIBCMT ref: 00000261E6D0D061
Part of subcall function 00000261E6D0D01C: _set_error_mode.LIBCMT ref: 00000261E6D0D072

Part of subcall function 00000261E6D0ED2C: malloc.LIBCMT ref: 00000261E6D0ED57

_errno.LIBCMT ref: 00000261E6D0F275
_lock.LIBCMT ref: 00000261E6D0F289
free.LIBCMT ref: 00000261E6D0F2AC
_errno.LIBCMT ref: 00000261E6D0F2B1

Memory Dump Source

Source File: 00000004.00000002.2350671493.00000261E6CE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000261E6CE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_261e6ce1000_Edge.jbxd

Similarity

API ID: _set_error_mode$_errno$_lockfreemalloc
String ID:
API String ID: 360200360-0
Opcode ID: 52b3feda2cd18445a43c6f8d2fc7ed35086aeb53fe70fc1ac63f9a8d8bfcb4c0
Instruction ID: c6193cca57f8897ed3f2b76bfed1a6cc285637be6a53725b128e2ced30e84349
Opcode Fuzzy Hash: 52b3feda2cd18445a43c6f8d2fc7ed35086aeb53fe70fc1ac63f9a8d8bfcb4c0
Instruction Fuzzy Hash: 9C216D3C5196498FF7E4ABA4D44976A7292F754380FF814299889C31D3DA7BE86087C1

Function 00000261E6D07C14 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00000261E6D07B70: _getptd.LIBCMT ref: 00000261E6D07B82

_errno.LIBCMT ref: 00000261E6D07C55
_invalid_parameter_noinfo.LIBCMT ref: 00000261E6D07C60
_errno.LIBCMT ref: 00000261E6D07DFD

Strings

$, xrefs: 00000261E6D07C7A
$, xrefs: 00000261E6D07CFA

Memory Dump Source

Source File: 00000004.00000002.2350671493.00000261E6CE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000261E6CE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_261e6ce1000_Edge.jbxd

Similarity

API ID: _errno$_getptd_invalid_parameter_noinfo
String ID: $$$
API String ID: 2372577547-233714265
Opcode ID: c460adb36a8ff80a267e1a98acf9e65ed31786de6d2f7996c3ef535e335d8ea5
Instruction ID: 20c68c88d9e9ab990558db85091d48beb46a2b1fec499f94ba2ffc996e6de195
Opcode Fuzzy Hash: c460adb36a8ff80a267e1a98acf9e65ed31786de6d2f7996c3ef535e335d8ea5
Instruction Fuzzy Hash: A18103384186198AF7F95618988D3B93AD2FB827B0FFC125DCCD28E1C3D527E86242D5

Function 00000261E6CFF190 Relevance: 7.7, APIs: 5, Instructions: 208COMMON

Download Yara Rule

APIs

und_memcpy.LIBCMTD ref: 00000261E6CFF22F
und_memcpy.LIBCMTD ref: 00000261E6CFF255

Memory Dump Source

Source File: 00000004.00000002.2350671493.00000261E6CE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000261E6CE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_261e6ce1000_Edge.jbxd

Similarity

API ID: und_memcpy
String ID:
API String ID: 2264155635-0
Opcode ID: 233c2dc3f6114190a0c3a58bca7bebfacb80644e2e843f1241ac7ac938ceac0f
Instruction ID: b0afab174b7e4ec0dfe8e3bdb26e7770af0ec5a91c0cd778db667c98c788e4f1
Opcode Fuzzy Hash: 233c2dc3f6114190a0c3a58bca7bebfacb80644e2e843f1241ac7ac938ceac0f
Instruction Fuzzy Hash: A191C7747087849FE7B4DB18C494BEAB7E1FB99304F60882D948DC7291DB35E985CB42

Function 00000261E6D112CC Relevance: 7.7, APIs: 5, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 00000261E6D112E7

Part of subcall function 00000261E6D0EACC: _errno.LIBCMT ref: 00000261E6D0EAD5
Part of subcall function 00000261E6D0EACC: _invalid_parameter_noinfo.LIBCMT ref: 00000261E6D0EAE0

_errno.LIBCMT ref: 00000261E6D112F7
_errno.LIBCMT ref: 00000261E6D11315
_isatty.LIBCMT ref: 00000261E6D11376
_getbuf.LIBCMT ref: 00000261E6D11382

Memory Dump Source

Source File: 00000004.00000002.2350671493.00000261E6CE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000261E6CE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_261e6ce1000_Edge.jbxd

Similarity

API ID: _errno$_fileno_getbuf_invalid_parameter_noinfo_isatty
String ID:
API String ID: 2574049805-0
Opcode ID: f6cb1389b3d300155bab13a29e2be79a7747ea1a71811924160686b94840a2be
Instruction ID: 929b61e66110f06fd204087a87d4fcd95779e4b82e3bc9c31f9a57196e7fa920
Opcode Fuzzy Hash: f6cb1389b3d300155bab13a29e2be79a7747ea1a71811924160686b94840a2be
Instruction Fuzzy Hash: AA51C3341046098AE798EF58C88E36576D1FB44350FF80259DCA5CB1DBD6B7EC6286C1

Function 00000261E6D080B8 Relevance: 7.6, APIs: 5, Instructions: 150COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 00000261E6D080D5

Part of subcall function 00000261E6D0EACC: _errno.LIBCMT ref: 00000261E6D0EAD5
Part of subcall function 00000261E6D0EACC: _invalid_parameter_noinfo.LIBCMT ref: 00000261E6D0EAE0

_errno.LIBCMT ref: 00000261E6D080E5
_errno.LIBCMT ref: 00000261E6D08101
_isatty.LIBCMT ref: 00000261E6D08162
_getbuf.LIBCMT ref: 00000261E6D0816E

Memory Dump Source

Source File: 00000004.00000002.2350671493.00000261E6CE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000261E6CE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_261e6ce1000_Edge.jbxd

Similarity

API ID: _errno$_fileno_getbuf_invalid_parameter_noinfo_isatty
String ID:
API String ID: 2574049805-0
Opcode ID: 400924676afdb6542912dbb754b0c6b2f42f88cbdf26364f46bcf7423cf333eb
Instruction ID: a34a01fb235fe69004509b834c1e4788f4532d3ba37c74dfef4bc515c5f61467
Opcode Fuzzy Hash: 400924676afdb6542912dbb754b0c6b2f42f88cbdf26364f46bcf7423cf333eb
Instruction Fuzzy Hash: D451BF34114A084FEBD89F28C48976576D2FB543A0FF80259DCA5CB2D7D6A7E87187C1

Function 00000261E6D10EC0 Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00000261E6D10EC9
_errno.LIBCMT ref: 00000261E6D10ED1

Memory Dump Source

Source File: 00000004.00000002.2350671493.00000261E6CE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000261E6CE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_261e6ce1000_Edge.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: cc1a65610d45c684b4d644e34a1a9e911e9c410526ae494b7efd2ca09e7c409c
Instruction ID: c6c80bce8208007420d80395ebb06e0613acc5b539ce0ce67c6860d3452a2639
Opcode Fuzzy Hash: cc1a65610d45c684b4d644e34a1a9e911e9c410526ae494b7efd2ca09e7c409c
Instruction Fuzzy Hash: 9001D67552494D8EF759BB24885A36432D1FB10321FF88254A955CB1E3CABBE461C291

Function 00000261E6D0C1A4 Relevance: 6.1, APIs: 4, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000261E6D0C1AE

Part of subcall function 00000261E6D093EC: _amsg_exit.LIBCMT ref: 00000261E6D09402

_lock.LIBCMT ref: 00000261E6D0C1DC
free.LIBCMT ref: 00000261E6D0C212
_amsg_exit.LIBCMT ref: 00000261E6D0C24B

Memory Dump Source

Source File: 00000004.00000002.2350671493.00000261E6CE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000261E6CE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_261e6ce1000_Edge.jbxd

Similarity

API ID: _amsg_exit$_getptd_lockfree
String ID:
API String ID: 2148533958-0
Opcode ID: 4046e20d8c9ee5f78bc00f49ff3442623897f32c527e484218f0333f02347ad5
Instruction ID: 05bd6191f9e19e0f5f5cf227d9d58cf08f793dd3f0ab12e6c8c02231b1de71c7
Opcode Fuzzy Hash: 4046e20d8c9ee5f78bc00f49ff3442623897f32c527e484218f0333f02347ad5
Instruction Fuzzy Hash: 22212E34614A488FE7D5EB68C4C8B6572E5FB58340FF81169E849C31D2DB32E8548792

Function 00000261E6D0CA74 Relevance: 6.0, APIs: 4, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00000261E6D0CA7A

Part of subcall function 00000261E6D093EC: _amsg_exit.LIBCMT ref: 00000261E6D09402

_getptd.LIBCMT ref: 00000261E6D0CA9A
_lock.LIBCMT ref: 00000261E6D0CAAD
_amsg_exit.LIBCMT ref: 00000261E6D0CADB

Memory Dump Source

Source File: 00000004.00000002.2350671493.00000261E6CE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000261E6CE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_261e6ce1000_Edge.jbxd

Similarity

API ID: _amsg_exit_getptd$_lock
String ID:
API String ID: 3670291111-0
Opcode ID: 9551b0adf5f97ad9614b394a459279b2b61166ac4730dc1e728ddb053ef1bccd
Instruction ID: 3f55774b8f624fa8d728642d955223191135a966bfdeb91cdc0efa94563b8b1c
Opcode Fuzzy Hash: 9551b0adf5f97ad9614b394a459279b2b61166ac4730dc1e728ddb053ef1bccd
Instruction Fuzzy Hash: B6F04F386119048BF7C4EBA8C4D9FA522A6FB08380FF81274DC89C71D3DA67A864C791

Function 00000261E6D06C1C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00000261E6D06C53
_invalid_parameter_noinfo.LIBCMT ref: 00000261E6D06C5E

Strings

B, xrefs: 00000261E6D06C79

Memory Dump Source

Source File: 00000004.00000002.2350671493.00000261E6CE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 00000261E6CE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_261e6ce1000_Edge.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: B
API String ID: 2959964966-1255198513
Opcode ID: 5b9fd8484ccd4287e022cca72682e00a1ed95e5f0e740e72b956befb73647925
Instruction ID: 92daae16a2b749ed16d3ff2ba87f9d828b8c7ac9b76cf3b694ebacada58d89d2
Opcode Fuzzy Hash: 5b9fd8484ccd4287e022cca72682e00a1ed95e5f0e740e72b956befb73647925
Instruction Fuzzy Hash: 5931F634914A4C9AEF91EB68D8887DD7BB1FB44360FF40226AC45D6292DA33E45087C1

Analysis Process: Edge.exePID: 6052, Parent PID: 4004COMMON

Execution Graph

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	15.4%
Signature Coverage:	0%
Total number of Nodes:	996
Total number of Limit Nodes:	92

Executed Functions

Function 0000018F784D0808 Relevance: 16.8, APIs: 8, Strings: 1, Instructions: 1070memorynativeCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL ref: 0000018F784D08D5
NtMapViewOfSection.NTDLL ref: 0000018F784D09C0
VirtualAlloc.KERNELBASE ref: 0000018F784D0DEB
NtUnmapViewOfSection.NTDLL ref: 0000018F784D0E91
NtMapViewOfSection.NTDLL ref: 0000018F784D0EFD
VirtualProtect.KERNELBASE ref: 0000018F784D0F24
VirtualProtect.KERNELBASE ref: 0000018F784D0FF8
VirtualProtect.KERNELBASE ref: 0000018F784D103B

Strings

@, xrefs: 0000018F784D08C3

Memory Dump Source

Source File: 00000005.00000002.2435764747.0000018F78460000.00000040.00000020.00020000.00000000.sdmp, Offset: 0000018F78460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_18f78460000_Edge.jbxd

Yara matches

Similarity

API ID: SectionVirtual$ProtectView$AllocCreateUnmap
String ID: @
API String ID: 1653215272-2766056989
Opcode ID: 4b22fe138627849a766478aa8e442552939c912139603cedaa36243b0ace8e26
Instruction ID: 89c4fddccd3e0805c22bc8c7b46cad32ba4f02f7de5c0a3fa45412c8f38f480a
Opcode Fuzzy Hash: 4b22fe138627849a766478aa8e442552939c912139603cedaa36243b0ace8e26
Instruction Fuzzy Hash: 7E72B830628B488BEB69DF28C8857E9B3E1FB98310F14853DD98BC7241DF74E6528B55

Function 0000018F784CFFFC Relevance: 1.6, APIs: 1, Instructions: 382memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 0000018F784D006F

Memory Dump Source

Source File: 00000005.00000002.2435764747.0000018F78460000.00000040.00000020.00020000.00000000.sdmp, Offset: 0000018F78460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_18f78460000_Edge.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a3c9e5f65659c10088e35569a0d5ca214acd241ea4d0d9f80ecf011f2679decb
Instruction ID: 6fcb1f69e42be6a718ddba0e0dd1b88308a79522c01fe8834f5c73954a32c876
Opcode Fuzzy Hash: a3c9e5f65659c10088e35569a0d5ca214acd241ea4d0d9f80ecf011f2679decb
Instruction Fuzzy Hash: ADC19731624A058BFB59EE28C4897E9B3D1FB94300F54813ED54BC3386DF60EA6387A5

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Edge\Edge.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Statistics

Windows Analysis Report
file.exe

Function 009FCDC0 Relevance: 14.1, Strings: 11, Instructions: 384
COMMON

Function 009F2020 Relevance: 8.0, Strings: 6, Instructions: 474
COMMON

Function 000001B27A4CF740 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 159
memoryfileCOMMON

Function 000001B27A4D2000 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 144
processmemoryCOMMON

Function 000001B278C7EF64 Relevance: 6.1, APIs: 4, Instructions: 133
memoryCOMMON

Function 000001B278C7EFD3 Relevance: 6.1, APIs: 4, Instructions: 89
memoryCOMMON

Function 000001B27A4DC980 Relevance: 6.1, APIs: 4, Instructions: 75
filememoryCOMMON

Function 000001B27A4C8D30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
registryCOMMON