Edit tour

Windows Analysis Report
Mol2sxTjLw.exe

Overview

General Information

Sample name:	Mol2sxTjLw.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original sample name:	2ac6056ec233651a6d250a79e90067501fcb160d575451484da5e96f7c930030
Analysis ID:	1431956
MD5:	f1f1e44ce2d94e04b8bcfd71e77f3e08
SHA1:	878526629858534871c263cde4b97da4a9c5eb9a
SHA256:	2ac6056ec233651a6d250a79e90067501fcb160d575451484da5e96f7c930030
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Found direct / indirect Syscall (likely to bypass EDR)

Contains functionality to dynamically determine API calls

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found evasive API chain (might use process or thread times for sandbox detection)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Program does not show much activity (idle)

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

Mol2sxTjLw.exe (PID: 3484 cmdline: "C:\Users\user\Desktop\Mol2sxTjLw.exe" MD5: F1F1E44CE2D94E04B8BCFD71E77F3E08)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Mol2sxTjLw.exe

Virustotal: Detection: 7%

Perma Link

Source: C:\Users\user\Desktop\Mol2sxTjLw.exe

Code function: 0_2_00007FF726AB6270 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,_Init_thread_header,GetSystemTimeAsFileTime,GetCurrentProcessId,

0_2_00007FF726AB6270

Source: Mol2sxTjLw.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: .d?.v {.xqTM.}W.G\p.DIim.pM].VF.jM.u m C[.k.vg KqvC&] y f.y?n9 gP.tW.sd er Q.WeP.XScA }.H?O.TJUtQN@x b.}S.q.oP.gh U+ D.h.{m) q.{TEI?GGF.pDbkr%. source: Mol2sxTjLw.exe, 00000000.00000000.1639430585.00007FF726D93000.00000002.00000001.01000000.00000003.sdmp, Mol2sxTjLw.exe, 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmp

Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF7269D9000 FindFirstFileExW,FindNextFileW,FindNextFileW,GetLastError,GetLastError,FindClose,_Init_thread_header,		0_2_00007FF7269D9000
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726AB5120 GetCommandLineW,FindFirstFileW,FindNextFileW,FindClose,_Init_thread_header,GetModuleFileNameW,GetLongPathNameW,GetLastError,_Init_thread_header,_Init_thread_header,_Init_thread_header,_Init_thread_header,		0_2_00007FF726AB5120

Source: Mol2sxTjLw.exe	String found in binary or memory: http://llvm.org/):
Source: Mol2sxTjLw.exe	String found in binary or memory: https://github.com/llvm/llvm-project/issues/

Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726935430	0_2_00007FF726935430
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF72699B7D0	0_2_00007FF72699B7D0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF7269AEFD0	0_2_00007FF7269AEFD0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726A31FC0	0_2_00007FF726A31FC0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF72695C7D0	0_2_00007FF72695C7D0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF7269C97B0	0_2_00007FF7269C97B0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF7269B4800	0_2_00007FF7269B4800
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF7269D4010	0_2_00007FF7269D4010
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726A8CFF0	0_2_00007FF726A8CFF0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF7269BAFE0	0_2_00007FF7269BAFE0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726A33F90	0_2_00007FF726A33F90
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF7269470D0	0_2_00007FF7269470D0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF7269628D0	0_2_00007FF7269628D0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726A8A0A0	0_2_00007FF726A8A0A0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726AC3900	0_2_00007FF726AC3900
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726A33100	0_2_00007FF726A33100
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF72697C8F0	0_2_00007FF72697C8F0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726AFE850	0_2_00007FF726AFE850
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF72695D040	0_2_00007FF72695D040
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726946080	0_2_00007FF726946080
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726A30880	0_2_00007FF726A30880
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF72697D870	0_2_00007FF72697D870
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF7269B5DC0	0_2_00007FF7269B5DC0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726951DD0	0_2_00007FF726951DD0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726A7C5F0	0_2_00007FF726A7C5F0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726988DF0	0_2_00007FF726988DF0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF7269BAFE0	0_2_00007FF7269BAFE0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF72697D550	0_2_00007FF72697D550
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726985D30	0_2_00007FF726985D30
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF7269B3D80	0_2_00007FF7269B3D80
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF7269CD570	0_2_00007FF7269CD570
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726946EB0	0_2_00007FF726946EB0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726AFDEF0	0_2_00007FF726AFDEF0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF72697CEF0	0_2_00007FF72697CEF0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726963E40	0_2_00007FF726963E40
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726A72650	0_2_00007FF726A72650
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726AAEE30	0_2_00007FF726AAEE30
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF72695E620	0_2_00007FF72695E620
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF7269A8E60	0_2_00007FF7269A8E60
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726962E60	0_2_00007FF726962E60
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726982E70	0_2_00007FF726982E70
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF7269B73D0	0_2_00007FF7269B73D0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF72695DBD0	0_2_00007FF72695DBD0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726A30BB0	0_2_00007FF726A30BB0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF72697CBB0	0_2_00007FF72697CBB0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF7269CCC00	0_2_00007FF7269CCC00
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726AFEC10	0_2_00007FF726AFEC10
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726A86C00	0_2_00007FF726A86C00
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF7269D2BE0	0_2_00007FF7269D2BE0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726A81350	0_2_00007FF726A81350
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF7269B6380	0_2_00007FF7269B6380
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726A8FB80	0_2_00007FF726A8FB80
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726ABEB60	0_2_00007FF726ABEB60
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726952370	0_2_00007FF726952370
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF72694FCA0	0_2_00007FF72694FCA0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726AB0D10	0_2_00007FF726AB0D10
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726AAE4F0	0_2_00007FF726AAE4F0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726B14C90	0_2_00007FF726B14C90
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726A32480	0_2_00007FF726A32480
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726AB8C70	0_2_00007FF726AB8C70
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF7269D39C0	0_2_00007FF7269D39C0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF7269801A0	0_2_00007FF7269801A0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF7269A99B0	0_2_00007FF7269A99B0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF7269B6200	0_2_00007FF7269B6200
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726963A10	0_2_00007FF726963A10
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726A911E0	0_2_00007FF726A911E0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF72698F150	0_2_00007FF72698F150
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726AB5120	0_2_00007FF726AB5120
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726A58920	0_2_00007FF726A58920
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF7269D6180	0_2_00007FF7269D6180
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726946990	0_2_00007FF726946990
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726A85170	0_2_00007FF726A85170
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF72697A160	0_2_00007FF72697A160
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF7269C8970	0_2_00007FF7269C8970
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726A32AC0	0_2_00007FF726A32AC0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF7269DB2A0	0_2_00007FF7269DB2A0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726B172A0	0_2_00007FF726B172A0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF7269AAB10	0_2_00007FF7269AAB10
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726A95AF0	0_2_00007FF726A95AF0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF7269B1A20	0_2_00007FF7269B1A20
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726A8C220	0_2_00007FF726A8C220
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726A7F280	0_2_00007FF726A7F280
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726ABBA70	0_2_00007FF726ABBA70
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726964A60	0_2_00007FF726964A60
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726A72A70	0_2_00007FF726A72A70

Source: C:\Users\user\Desktop\Mol2sxTjLw.exe

Code function: String function: 00007FF7269CFF40 appears 48 times

Source: Mol2sxTjLw.exe	Binary or memory string: llvm.ppc.altivec.vbpermd
Source: Mol2sxTjLw.exe	Binary or memory string: llvm.s390.vbperm
Source: Mol2sxTjLw.exe, 00000000.00000000.1639430585.00007FF726D93000.00000002.00000001.01000000.00000003.sdmp, Mol2sxTjLw.exe, 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: P iiL-.M.r\|.y.h.M.O1 OBui;V.VbP iVXniWGu.OREE q Cuup.y.R mfd u.B ty.D1
Source: Mol2sxTjLw.exe	Binary or memory string: llvm.ppc.altivec.vbpermq

Source: classification engine

Classification label: mal52.evad.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\Mol2sxTjLw.exe

Code function: 0_2_00007FF726AC0D00 GetLastError,FormatMessageA,LocalFree,

0_2_00007FF726AC0D00

Source: Mol2sxTjLw.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Mol2sxTjLw.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Mol2sxTjLw.exe

Virustotal: Detection: 7%

Source: Mol2sxTjLw.exe	String found in binary or memory: --help
Source: Mol2sxTjLw.exe	String found in binary or memory: --help
Source: Mol2sxTjLw.exe	String found in binary or memory: -help
Source: Mol2sxTjLw.exe	String found in binary or memory: -help
Source: Mol2sxTjLw.exe	String found in binary or memory: --help'
Source: Mol2sxTjLw.exe	String found in binary or memory: --help'
Source: Mol2sxTjLw.exe	String found in binary or memory: --help
Source: Mol2sxTjLw.exe	String found in binary or memory: --help
Source: Mol2sxTjLw.exe	String found in binary or memory: <subcommand> --help" to get more help on a specific subcommand
Source: Mol2sxTjLw.exe	String found in binary or memory: <subcommand> --help" to get more help on a specific subcommand
Source: Mol2sxTjLw.exe	String found in binary or memory: --help'
Source: Mol2sxTjLw.exe	String found in binary or memory: --help'
Source: Mol2sxTjLw.exe	String found in binary or memory: --help'H
Source: Mol2sxTjLw.exe	String found in binary or memory: --help'H
Source: Mol2sxTjLw.exe	String found in binary or memory: --help
Source: Mol2sxTjLw.exe	String found in binary or memory: --help
Source: Mol2sxTjLw.exe	String found in binary or memory: cated.v2i64.v4i1cde.vcx1q.prediccde.vcx2q.predicrget-enforcementbranch-target-enn-return-addresssign-return-addrage Info SectionObjective-C Imagrbage CollectionObjective-C Garbectorizer.unrollf16.dpbf16ps.128avx512bf16.dpbf1f16.dpbf16ps.256f16.dpbf16ps.512cvtneps2bf16.256avx512bf16.cvtnecvtneps2bf16.512cvtneps2bf16.128avx512bf16.mask.vtne2ps2bf16.128vtne2ps2bf16.256vtne2ps2bf16.512.mask.cmp.pd.128.mask.cmp.pd.256.mask.cmp.pd.512.mask.cmp.ps.128.mask.cmp.ps.256.mask.cmp.ps.512512.mask.vfmadd.add.
Source: Mol2sxTjLw.exe	String found in binary or memory: cated.v2i64.v4i1cde.vcx1q.prediccde.vcx2q.predicrget-enforcementbranch-target-enn-return-addresssign-return-addrage Info SectionObjective-C Imagrbage CollectionObjective-C Garbectorizer.unrollf16.dpbf16ps.128avx512bf16.dpbf1f16.dpbf16ps.256f16.dpbf16ps.512cvtneps2bf16.256avx512bf16.cvtnecvtneps2bf16.512cvtneps2bf16.128avx512bf16.mask.vtne2ps2bf16.128vtne2ps2bf16.256vtne2ps2bf16.512.mask.cmp.pd.128.mask.cmp.pd.256.mask.cmp.pd.512.mask.cmp.ps.128.mask.cmp.ps.256.mask.cmp.ps.512512.mask.vfmadd.add.sub.2.mask3.vfnmsub..mask.vfmaddsub.maskz.vfmaddsub.mask3.vfmaddsub.mask3.vfmsubadd.512.mask.pcmpeq.512.mask.pcmpgt.f.b.avx512.mask.pshuavx512.mask.cvtud2dq.256d2ps.256sk.vcvtph2ps.128sk.vcvtph2ps.256sk.cvttpd2dq.256avx512.mask.cvttsk.cvttps2dq.128sk.cvttps2dq.256var.mask.pmul.hr.sw.h.w.2.mask.pmulhu.w.2.mask.pmaddw.d.avx512.mask.pmadmask.pmaddubs.w.2.mask.packsswb.avx512.mask.pack2.mask.packssdw.2.mask.packuswb.2.mask.packusdw.bqmask.vpermilvar..d.q.wiv2.mask.dbpsadbw.avx512.mask.dbps512.mask.vpshld.512.mask.vpshrd.ldv.rdv.2.maskz.vpshldv.2.maskz.vpshrdv..pmultishift.qb.2.mask.conflict.avx512.mask.conf512.mask.storeu.avx512.mask.stor512.mask.store.pe.b.e.w.e.d.e.q.u.nd.bnd.wnd.dnd.qnd.p.mask.compress.b.mask.compress.w.mask.compress.d.mask.compress.q.mask.compress.p.broadcastf32x4..broadcastf64x2..broadcastf32x8..broadcastf64x4..broadcasti32x4..broadcasti64x2..broadcasti32x8..broadcasti64x4.v.avx512.mask.pavg
Source: Mol2sxTjLw.exe	String found in binary or memory: --relative-address
Source: Mol2sxTjLw.exe	String found in binary or memory: use-dbg-addr
Source: Mol2sxTjLw.exe	String found in binary or memory: full-stop
Source: Mol2sxTjLw.exe	String found in binary or memory: Alias for --help
Source: Mol2sxTjLw.exe	String found in binary or memory: Alias for --help
Source: Mol2sxTjLw.exe	String found in binary or memory: -help
Source: Mol2sxTjLw.exe	String found in binary or memory: <subcommand> --help" to get more help on a specific subcommand
Source: Mol2sxTjLw.exe	String found in binary or memory: <subcommand> --help" to get more help on a specific subcommand
Source: Mol2sxTjLw.exe	String found in binary or memory: Display list of available options (--help-list-hidden for more)
Source: Mol2sxTjLw.exe	String found in binary or memory: Display list of available options (--help-list-hidden for more)
Source: Mol2sxTjLw.exe	String found in binary or memory: Display available options (--help-hidden for more)
Source: Mol2sxTjLw.exe	String found in binary or memory: Display available options (--help-hidden for more)
Source: Mol2sxTjLw.exe	String found in binary or memory: See each individual command --help for more details.
Source: Mol2sxTjLw.exe	String found in binary or memory: See each individual command --help for more details.
Source: Mol2sxTjLw.exe	String found in binary or memory: --help'
Source: Mol2sxTjLw.exe	String found in binary or memory: --help'
Source: Mol2sxTjLw.exe	String found in binary or memory: <command> -help

Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Section loaded: winhttp.dll	Jump to behavior

Source: Mol2sxTjLw.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Mol2sxTjLw.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: Mol2sxTjLw.exe

Static file information: File size 5901312 > 1048576

Source: Mol2sxTjLw.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x37d200
Source: Mol2sxTjLw.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x141400

Source: Mol2sxTjLw.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Source: Mol2sxTjLw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Mol2sxTjLw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Mol2sxTjLw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Mol2sxTjLw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Mol2sxTjLw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Mol2sxTjLw.exe

Code function: 0_2_00007FF726ABA0F0 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,EnterCriticalSection,InitializeCriticalSection,EnterCriticalSection,SetUnhandledExceptionFilter,SetConsoleCtrlHandler,

0_2_00007FF726ABA0F0

Source: Mol2sxTjLw.exe	Static PE information: section name: .00cfg
Source: Mol2sxTjLw.exe	Static PE information: section name: .voltbl

Source: C:\Users\user\Desktop\Mol2sxTjLw.exe

0_2_00007FF726ABA0F0

Source: C:\Users\user\Desktop\Mol2sxTjLw.exe

Code function: 0_2_00007FF726ABFDF0 WaitForSingleObject,TerminateProcess,WaitForSingleObject,CloseHandle,GetProcessTimes,K32GetProcessMemoryInfo,GetExitCodeProcess,GetLastError,CloseHandle,SetLastError,CloseHandle,

0_2_00007FF726ABFDF0

Source: C:\Users\user\Desktop\Mol2sxTjLw.exe

API coverage: 1.4 %

Source: C:\Users\user\Desktop\Mol2sxTjLw.exe TID: 5016

Thread sleep time: -1000000s >= -30000s

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF7269D9000 FindFirstFileExW,FindNextFileW,FindNextFileW,GetLastError,GetLastError,FindClose,_Init_thread_header,		0_2_00007FF7269D9000
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726AB5120 GetCommandLineW,FindFirstFileW,FindNextFileW,FindClose,_Init_thread_header,GetModuleFileNameW,GetLongPathNameW,GetLastError,_Init_thread_header,_Init_thread_header,_Init_thread_header,_Init_thread_header,		0_2_00007FF726AB5120

Source: C:\Users\user\Desktop\Mol2sxTjLw.exe

Code function: 0_2_00007FF7269D8FC0 GetSystemInfo,

0_2_00007FF7269D8FC0

Source: Mol2sxTjLw.exe	Binary or memory string: IR.yd.l.dG P.jD.Jg2MJ oG D Il.GQEMU+.R`c.{0pnJC.u n d u U qo G w.f.
Source: Mol2sxTjLw.exe	Binary or memory string: QEMU+.R`c.{0p

Source: C:\Users\user\Desktop\Mol2sxTjLw.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Mol2sxTjLw.exe

0_2_00007FF726ABA0F0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726ABA0F0 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,EnterCriticalSection,InitializeCriticalSection,EnterCriticalSection,SetUnhandledExceptionFilter,SetConsoleCtrlHandler,		0_2_00007FF726ABA0F0
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	Code function: 0_2_00007FF726CACD8C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00007FF726CACD8C

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	NtClose: Indirect: 0x7FF726DB76F1
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	NtQuerySystemInformation: Indirect: 0x7FF726DB7825	Jump to behavior
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	NtCreateThreadEx: Indirect: 0x7FF726DB7AA6	Jump to behavior
Source: C:\Users\user\Desktop\Mol2sxTjLw.exe	NtQueueApcThread: Indirect: 0x7FF726DB78AA	Jump to behavior

Source: C:\Users\user\Desktop\Mol2sxTjLw.exe

Code function: 0_2_00007FF726CAD868 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF726CAD868

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	2 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Abuse Elevation Control Mechanism	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	3 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Mol2sxTjLw.exe	4%	ReversingLabs
Mol2sxTjLw.exe	7%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/llvm/llvm-project/issues/	Mol2sxTjLw.exe	false		high
http://llvm.org/):	Mol2sxTjLw.exe	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431956
Start date and time:	2024-04-26 04:06:16 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Mol2sxTjLw.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original Sample Name:	2ac6056ec233651a6d250a79e90067501fcb160d575451484da5e96f7c930030
Detection:	MAL
Classification:	mal52.evad.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Stop behavior analysis, all processes terminated

Simulations

Behavior and APIs

Time	Type	Description
04:07:04	API Interceptor	1x Sleep call for process: Mol2sxTjLw.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.535112381346819
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Mol2sxTjLw.exe
File size:	5'901'312 bytes
MD5:	f1f1e44ce2d94e04b8bcfd71e77f3e08
SHA1:	878526629858534871c263cde4b97da4a9c5eb9a
SHA256:	2ac6056ec233651a6d250a79e90067501fcb160d575451484da5e96f7c930030
SHA512:	748e33a5b8cb7aeb31e51a79c116fb78e8ce572f490ec0c93d00c8241060e6138a03da12ab0c2f3e03fefc9435a761e36996b6c42f3572ed4bebc809130456e3
SSDEEP:	49152:NvX/aPftKKrS0T4Ma/9rYzypYrBbXBzFOh3nf5X0R2VAbXBFibvV7pWS7l0k5to+:0PfAJG01a4p509hsmtUv2O
TLSH:	16567C0BF25A50EDC8ADC179631B6136E6797C8907317DEF5784AB212E22BE16F39700
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d....w.d..........".......7...........7........@..............................Z.......Z...`........................................

File Icon


Icon Hash:	34f3d3d3d3d3c0d5

Static PE Info

General

Entrypoint:	0x14037d1e0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x648977D9 [Wed Jun 14 08:18:33 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	b54b1ef811f6b0401efda3c7b931445c

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F03607D2044h
dec eax
add esp, 28h
jmp 00007F03607D1837h
int3
int3
dec eax
mov dword ptr [esp+08h], ebx
push edi
dec eax
sub esp, 20h
dec eax
mov eax, dword ptr [000CFF43h]
mov edi, 00000001h
dec eax
cmp eax, edi
je 00007F03607D1A35h
dec eax
test eax, eax
jne 00007F03607D1A2Bh
dec eax
lea ecx, dword ptr [000C168Dh]
call dword ptr [000C24CFh]
dec eax
mov ebx, eax
dec eax
test eax, eax
jne 00007F03607D19C7h
dec eax
mov ebx, edi
jmp 00007F03607D19FAh
dec eax
lea edx, dword ptr [000C15FBh]
dec eax
mov ecx, ebx
call dword ptr [000C24C2h]
dec eax
test eax, eax
je 00007F03607D19A8h
dec eax
lea edx, dword ptr [000C15CEh]
dec eax
mov dword ptr [000CFEFFh], eax
dec eax
mov ecx, ebx
call dword ptr [000C24A6h]
dec eax
test eax, eax
je 00007F03607D198Ch
dec eax
mov dword ptr [000CFEF2h], eax
xor eax, eax
dec eax
cmpxchg dword ptr [000CFED7h], ebx
jne 00007F03607D19C7h
dec eax
cmp ebx, edi
je 00007F03607D19CCh
dec eax
cmp eax, edi
je 00007F03607D19C7h
inc eax
mov al, bh
jmp 00007F03607D19C4h
xor al, al
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
add esp, 20h
pop edi
ret
int3
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], esi
dec eax
mov dword ptr [esp+18h], edi
dec esp
arpl word ptr [FFC82D96h], ax
dec eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x43eb2e	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x463000	0x1e768	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x44e000	0x1104c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5a5000	0x8f58	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x3c2b18	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3c29d0	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x43f428	0x7c8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x43ea70	0x60	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x37d074	0x37d200	7f1c88e32eb19c02d56e14e64749cfde	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x37f000	0xc5194	0xc5200	57bc3f135ebadf0bab01caea9d15d9d6	False	0.2477533489220038	data	5.685241725640412	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x445000	0x81b0	0x2800	2de76f79725762a8261d83c49a27e17d	False	0.21640625	DIY-Thermocam raw data (Lepton 2.x), scale -8169-14400, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 0.013077	4.438603483086372	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x44e000	0x1104c	0x11200	ce94da9e35ab152f5a868b5d1184a5b0	False	0.5118470574817519	data	6.0165755401348475	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.00cfg	0x460000	0x28	0x200	61b26ac82f5ef59e2f85a690ab847e8b	False	0.056640625	data	0.38705962180443587	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x461000	0x21	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.voltbl	0x462000	0x1c	0x200	23f0a60c1fae6a32fd2809c95392fbdf	False	0.080078125	data	0.48861744622245973	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x463000	0x141300	0x141400	6fcd83c3bb1d66a802525b568a2a8efe	False	0.6834417558365758	data	5.710708507362896	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x5a5000	0x8f58	0x9000	1e13149911cc83d93f1fac6aec76bebb	False	0.07294379340277778	data	5.436495275113697	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x4630a0	0x1e6b3	PNG image data, 4096 x 4096, 8-bit/color RGBA, non-interlaced	English	United States	0.46371042176652355
RT_GROUP_ICON	0x481754	0x14	data	English	United States	1.1

Imports

DLL

Import

KERNEL32.dll

AcquireSRWLockExclusive, AcquireSRWLockShared, AssignProcessToJobObject, CloseHandle, CreateDirectoryW, CreateEventW, CreateFileMappingW, CreateFileW, CreateJobObjectW, CreateProcessW, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, ExpandEnvironmentStringsW, FindClose, FindFirstFileExW, FindFirstFileW, FindNextFileW, FlushFileBuffers, FormatMessageA, FreeLibrary, GetCommandLineW, GetConsoleMode, GetConsoleScreenBufferInfo, GetCurrentDirectoryW, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetDriveTypeW, GetEnvironmentVariableW, GetExitCodeProcess, GetFileAttributesW, GetFileInformationByHandle, GetFileType, GetFinalPathNameByHandleW, GetLastError, GetLogicalProcessorInformationEx, GetLongPathNameW, GetModuleFileNameW, GetModuleHandleW, GetNativeSystemInfo, GetProcAddress, GetProcessAffinityMask, GetProcessGroupAffinity, GetProcessTimes, GetStdHandle, GetSystemInfo, GetSystemTime, GetSystemTimeAsFileTime, GetVolumePathNameW, InitializeCriticalSection, InitializeCriticalSectionAndSpinCount, InitializeSListHead, IsDebuggerPresent, IsProcessorFeaturePresent, K32GetProcessMemoryInfo, LeaveCriticalSection, LoadLibraryExA, LoadLibraryW, LocalFree, MapViewOfFile, MultiByteToWideChar, QueryPerformanceCounter, RaiseException, ReadFile, ReleaseSRWLockExclusive, ReleaseSRWLockShared, ResetEvent, ResumeThread, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, SearchPathW, SetConsoleCtrlHandler, SetConsoleTextAttribute, SetCurrentDirectoryW, SetErrorMode, SetEvent, SetFileTime, SetInformationJobObject, SetLastError, SetProcessAffinityMask, SetThreadGroupAffinity, SetUnhandledExceptionFilter, SystemTimeToFileTime, TerminateProcess, UnhandledExceptionFilter, UnmapViewOfFile, VirtualProtect, VirtualQuery, WaitForSingleObject, WaitForSingleObjectEx, WideCharToMultiByte, WriteConsoleW

ADVAPI32.dll

CryptAcquireContextW, CryptGenRandom, CryptReleaseContext, RegCloseKey, RegGetValueW, RegOpenKeyExA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	04:07:03
Start date:	26/04/2024
Path:	C:\Users\user\Desktop\Mol2sxTjLw.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Mol2sxTjLw.exe"
Imagebase:	0x7ff726930000
File size:	5'901'312 bytes
MD5 hash:	F1F1E44CE2D94E04B8BCFD71E77F3E08
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	46.3%
Total number of Nodes:	54
Total number of Limit Nodes:	4

Executed Functions

Function 00007FF726935430 Relevance: 28.7, APIs: 1, Strings: 15, Instructions: 659
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FF726935E34

Strings

: No command specified!, xrefs: 00007FF7269356FD
show, xrefs: 00007FF7269355F2
OVERVIEW: LLVM profile data tools, xrefs: 00007FF72693583A
6}h, xrefs: 00007FF726935D5F
<merge|show|overlap> [args...], xrefs: 00007FF7269357D0
USAGE: , xrefs: 00007FF72693574A, 00007FF726935BE4, 00007FF726935CB9
<command> [args...], xrefs: 00007FF726935C6A
GE: , xrefs: 00007FF726935CD7
cified!, xrefs: 00007FF72693571E
overlap, xrefs: 00007FF726935609
ls, xrefs: 00007FF726935BC4
merge, xrefs: 00007FF7269355DB
-help, xrefs: 00007FF726935637
rgs...], xrefs: 00007FF726935C92
--help, xrefs: 00007FF72693564E

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: ProtectVirtual
String ID: <command> [args...]$ <merge|show|overlap> [args...]$--help$-help$6}h$: No command specified!$GE: $OVERVIEW: LLVM profile data tools$USAGE: $cified!$ls$merge$overlap$rgs...]$show
API String ID: 544645111-1968154355
Opcode ID: 237a9df9ace36cb324f413c71c3cbef107e073be6914d4ae12211dafabbbf0b7
Instruction ID: 3d7423ef41a5c3e8834ebd6cdc39eed99620ec2e541dd2c62c8d62ad2786cc02
Opcode Fuzzy Hash: 237a9df9ace36cb324f413c71c3cbef107e073be6914d4ae12211dafabbbf0b7
Instruction Fuzzy Hash: 9F52C662B1878582EA20AB25ED443BFA761FB89BD4F804136DE8D47B95DF3CE451CB10

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF726A30BB0 Relevance: 118.3, Strings: 94, Instructions: 754COMMON

Download Yara Rule

Strings

mipsisa32r6el, xrefs: 00007FF726A30E08
spirv32v1.5, xrefs: 00007FF726A31034
%, xrefs: 00007FF726A30C6A
le64, xrefs: 00007FF726A31410
cv64, xrefs: 00007FF726A314C3
s390, xrefs: 00007FF726A315C8
spirv64v1.4, xrefs: 00007FF726A31156
amdi, xrefs: 00007FF726A3157E
spirv64v1.1, xrefs: 00007FF726A311A7
powerpcspe, xrefs: 00007FF726A30CD7
mips64r6, xrefs: 00007FF726A30EA9
nvpt, xrefs: 00007FF726A31564
4, xrefs: 00007FF726A311EC
agon, xrefs: 00007FF726A314E0
mips64r6el, xrefs: 00007FF726A30FA6
spirv64v1.5, xrefs: 00007FF726A3113B
spirv32v1.2, xrefs: 00007FF726A31085
tx64, xrefs: 00007FF726A3156B
ngarch64, xrefs: 00007FF726A319BB
script64, xrefs: 00007FF726A313B4
tcel, xrefs: 00007FF726A315FE
arme, xrefs: 00007FF726A31B2A
thum, xrefs: 00007FF726A31B61
spirv64v1.3, xrefs: 00007FF726A31171
spirv64v1.2, xrefs: 00007FF726A3118C
spir, xrefs: 00007FF726A3111D
mipsn32, xrefs: 00007FF726A30EDF
rc64, xrefs: 00007FF726A31551
i686, xrefs: 00007FF726A30BF1
mipsallegrex, xrefs: 00007FF726A30D82
mipsr6el, xrefs: 00007FF726A30DED
spar, xrefs: 00007FF726A31548
mipsn32r6, xrefs: 00007FF726A30E8E
powerpc, xrefs: 00007FF726A30CF2
spar, xrefs: 00007FF726A31510
mipseb, xrefs: 00007FF726A30D9D
imba, xrefs: 00007FF726A3135D
rv64, xrefs: 00007FF726A31124
mips64eb, xrefs: 00007FF726A30EF4
rcv9, xrefs: 00007FF726A31531
ch64, xrefs: 00007FF726A31D5E
mipsel, xrefs: 00007FF726A30E3E
msp4, xrefs: 00007FF726A31BB7
m68k, xrefs: 00007FF726A31BA6
script32, xrefs: 00007FF726A31397
il64, xrefs: 00007FF726A31587
loongarc, xrefs: 00007FF726A3198B
thum, xrefs: 00007FF726A31B43
mbeb, xrefs: 00007FF726A31B6A
cv32, xrefs: 00007FF726A314AB
le32, xrefs: 00007FF726A31404
ngarch32, xrefs: 00007FF726A3199E
spirv32v1.0, xrefs: 00007FF726A310BB
temz, xrefs: 00007FF726A314FD
mipsn32el, xrefs: 00007FF726A30FDC
hsai, xrefs: 00007FF726A3159C
hexa, xrefs: 00007FF726A314D9
mipsallegrexel, xrefs: 00007FF726A30E23
mips64el, xrefs: 00007FF726A30F74
r600, xrefs: 00007FF726A313D7
spirv32v1.4, xrefs: 00007FF726A3104F
i386, xrefs: 00007FF726A30C42
mipsisa64r6el, xrefs: 00007FF726A30FC1
mipsr6, xrefs: 00007FF726A30D4C
spirv32v1.1, xrefs: 00007FF726A310A0
rcel, xrefs: 00007FF726A3151B
nvpt, xrefs: 00007FF726A31634
thum, xrefs: 00007FF726A31D39
rendersc, xrefs: 00007FF726A31384
kali, xrefs: 00007FF726A31354
mipsn32r6el, xrefs: 00007FF726A30F8B
spir, xrefs: 00007FF726A31A37
risc, xrefs: 00007FF726A314A0
i486, xrefs: 00007FF726A30C27
amdi, xrefs: 00007FF726A3164F
arm6, xrefs: 00007FF726A31843
i586, xrefs: 00007FF726A30C0C
ppc32, xrefs: 00007FF726A30CA1
xcor, xrefs: 00007FF726A31619
spir, xrefs: 00007FF726A31A5C
spir, xrefs: 00007FF726A3141C
mipsisa64r6, xrefs: 00007FF726A30EC4
spirv64v1.0, xrefs: 00007FF726A311C2
mipsisa32r6, xrefs: 00007FF726A30D67
syst, xrefs: 00007FF726A314F6
aarc, xrefs: 00007FF726A31D56
spirv32v1.3, xrefs: 00007FF726A3106A
mips, xrefs: 00007FF726A31BDF
mips64, xrefs: 00007FF726A30F09
rv32, xrefs: 00007FF726A31A63
amdg, xrefs: 00007FF726A31328
spar, xrefs: 00007FF726A315E3
hsai, xrefs: 00007FF726A3166A
ppc, xrefs: 00007FF726A30CBC

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: %$4$aarc$agon$amdg$amdi$amdi$arm6$arme$ch64$cv32$cv64$hexa$hsai$hsai$i386$i486$i586$i686$il64$imba$kali$le32$le64$loongarc$m68k$mbeb$mips$mips64$mips64eb$mips64el$mips64r6$mips64r6el$mipsallegrex$mipsallegrexel$mipseb$mipsel$mipsisa32r6$mipsisa32r6el$mipsisa64r6$mipsisa64r6el$mipsn32$mipsn32el$mipsn32r6$mipsn32r6el$mipsr6$mipsr6el$msp4$ngarch32$ngarch64$nvpt$nvpt$powerpc$powerpcspe$ppc$ppc32$r600$rc64$rcel$rcv9$rendersc$risc$rv32$rv64$s390$script32$script64$spar$spar$spar$spir$spir$spir$spir$spirv32v1.0$spirv32v1.1$spirv32v1.2$spirv32v1.3$spirv32v1.4$spirv32v1.5$spirv64v1.0$spirv64v1.1$spirv64v1.2$spirv64v1.3$spirv64v1.4$spirv64v1.5$syst$tcel$temz$thum$thum$thum$tx64$xcor
API String ID: 0-2280737712
Opcode ID: 0ccceccd13d77beb86a0183e031d424eba6a83f58cf04197a4ccc01a6963f241
Instruction ID: 790478d7f16849babf900fe65a5d65eb174f4cf870703223665d8e6b26db2df4
Opcode Fuzzy Hash: 0ccceccd13d77beb86a0183e031d424eba6a83f58cf04197a4ccc01a6963f241
Instruction Fuzzy Hash: E3827C72608AC681EB70DB14EC50BABB7B0F789784F909136CA8D47A94DF7DD924CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726ABEB60 Relevance: 81.4, APIs: 30, Strings: 16, Instructions: 894COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7269D85E0: GetFileAttributesW.KERNEL32 ref: 00007FF7269D863C

_Init_thread_header.LIBCMT ref: 00007FF726ABECF8
SetLastError.KERNEL32 ref: 00007FF726ABED66

Part of subcall function 00007FF726AC0D00: GetLastError.KERNEL32 ref: 00007FF726AC0D4F
Part of subcall function 00007FF726AC0D00: FormatMessageA.KERNEL32 ref: 00007FF726AC0D80

Strings

/, xrefs: 00007FF726ABF3A5
Unable to set memory limit, xrefs: 00007FF726ABF7D3
.exe, xrefs: 00007FF726ABEC65
can't dup stderr to stdout, xrefs: 00007FF726ABF99F
o UTF-16, xrefs: 00007FF726ABEDA8
,, xrefs: 00007FF726ABF399
Couldn't execute program ', xrefs: 00007FF726ABFA2B
program not executable, xrefs: 00007FF726ABED3C
/, xrefs: 00007FF726ABED85
can't redirect stdin, xrefs: 00007FF726ABF42F
(, xrefs: 00007FF726ABED79
h, xrefs: 00007FF726ABF193
can't redirect stderr, xrefs: 00007FF726ABF57D
@, xrefs: 00007FF726ABEBF3
ecutable, xrefs: 00007FF726ABEE97
can't redirect stdout, xrefs: 00007FF726ABF4AC

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: ErrorLast$AttributesFileFormatInit_thread_headerMessage
String ID: ($,$.exe$/$/$@$Couldn't execute program '$Unable to set memory limit$can't dup stderr to stdout$can't redirect stderr$can't redirect stdin$can't redirect stdout$ecutable$h$o UTF-16$program not executable
API String ID: 1355836787-947015913
Opcode ID: 3db701f36fe53e6491a9c10759a049aa5c070e142b4331107db988afbb280b63
Instruction ID: 5fe812a4bbb76ff9fea4e7948a7f78b0152032ac4b8f50a61b65ccaeb085d721
Opcode Fuzzy Hash: 3db701f36fe53e6491a9c10759a049aa5c070e142b4331107db988afbb280b63
Instruction Fuzzy Hash: EEA29D32A08AC581EA30AB15EC583AFE361FB95794F844236CA9D07BD9DF7CD485CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726A32AC0 Relevance: 59.1, Strings: 47, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

gnuf, xrefs: 00007FF726A32BD0
gnux, xrefs: 00007FF726A32C2A
musleabi, xrefs: 00007FF726A32CD7
eclr, xrefs: 00007FF726A32DA7
gnuabi64, xrefs: 00007FF726A32B66
musl, xrefs: 00007FF726A32D18
nium, xrefs: 00007FF726A32D61
lx32, xrefs: 00007FF726A32D21
musleabi, xrefs: 00007FF726A32CFF
amplific, xrefs: 00007FF726A32FD8
gnuabi64, xrefs: 00007FF726A32B21
rary, xrefs: 00007FF726A32EC8
eabi, xrefs: 00007FF726A32B0D
andr, xrefs: 00007FF726A32CB5
pixe, xrefs: 00007FF726A32E09
fication, xrefs: 00007FF726A32FE5
musl, xrefs: 00007FF726A32D3A
roid, xrefs: 00007FF726A32CBE
raygener, xrefs: 00007FF726A32EE1
geometry, xrefs: 00007FF726A32E4E
hull, xrefs: 00007FF726A32E67
libr, xrefs: 00007FF726A32EBF
core, xrefs: 00007FF726A32D9E
eabi, xrefs: 00007FF726A32AF3
code, xrefs: 00007FF726A32C73
anyh, xrefs: 00007FF726A32F38
pute, xrefs: 00007FF726A32EAC
comp, xrefs: 00007FF726A32EA3
callable, xrefs: 00007FF726A32F9A
gnue, xrefs: 00007FF726A32BA3
miss, xrefs: 00007FF726A32F88
gnus, xrefs: 00007FF726A32C09
cygn, xrefs: 00007FF726A32D7A
closesth, xrefs: 00007FF726A32F5C
doma, xrefs: 00007FF726A32E7C
mesh, xrefs: 00007FF726A32FBE
itan, xrefs: 00007FF726A32D58
simulato, xrefs: 00007FF726A32DC0
intersec, xrefs: 00007FF726A32F12
fication, xrefs: 00007FF726A32EEE
gnuabin3, xrefs: 00007FF726A32B47
vert, xrefs: 00007FF726A32E2A
maca, xrefs: 00007FF726A32DE5
gnueabih, xrefs: 00007FF726A32B79
msvc, xrefs: 00007FF726A32D46
gnu_ilp3, xrefs: 00007FF726A32C4E
eabi, xrefs: 00007FF726A32BAC

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: amplific$andr$anyh$callable$closesth$code$comp$core$cygn$doma$eabi$eabi$eabi$eclr$fication$fication$geometry$gnu_ilp3$gnuabi64$gnuabi64$gnuabin3$gnue$gnueabih$gnuf$gnus$gnux$hull$intersec$itan$libr$lx32$maca$mesh$miss$msvc$musl$musl$musleabi$musleabi$nium$pixe$pute$rary$raygener$roid$simulato$vert
API String ID: 0-2338488602
Opcode ID: 2235c59471a9cfd6533a92e7be23ce71659e4a4e101a8108d3baa70d6f17dced
Instruction ID: 5d56cc152cfd3aa604cb26ff1183e770870830bdf89f8d54ee836c01091438f1
Opcode Fuzzy Hash: 2235c59471a9cfd6533a92e7be23ce71659e4a4e101a8108d3baa70d6f17dced
Instruction Fuzzy Hash: FCE194B3F0D5C381FA796A10AD15E3BD670EF56B40E80A133DA8E17990CD7D66709B21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726AFDEF0 Relevance: 56.5, Strings: 45, Instructions: 288
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

v9.3-a, xrefs: 00007FF726AFE5A7
v8.6-a, xrefs: 00007FF726AFE571
v8a, xrefs: 00007FF726AFE217
v8.7-a, xrefs: 00007FF726AFE57A
v7-m, xrefs: 00007FF726AFE192
v8.7, xrefs: 00007FF726AFE366
v8.1-a, xrefs: 00007FF726AFE4C0
v8m.base, xrefs: 00007FF726AFE510
v8l, xrefs: 00007FF726AFE202
v8-a, xrefs: 00007FF726AFE1B1
v9.2-a, xrefs: 00007FF726AFE59E
v8.5-a, xrefs: 00007FF726AFE568
v9-a, xrefs: 00007FF726AFE4B4, 00007FF726AFE544
v8.9, xrefs: 00007FF726AFE3A2
v8.1m.ma, xrefs: 00007FF726AFE4D8
v8.2, xrefs: 00007FF726AFE2D0
v8-m.main, xrefs: 00007FF726AFE532
v9.3, xrefs: 00007FF726AFE3F6
v8m.main, xrefs: 00007FF726AFE51F
v7hl, xrefs: 00007FF726AFE0B3
v8.3-a, xrefs: 00007FF726AFE54D
v7e-m, xrefs: 00007FF726AFE131
aarch64, xrefs: 00007FF726AFE1E7
v8.2-a, xrefs: 00007FF726AFE53B
v9.4, xrefs: 00007FF726AFE411
arm64, xrefs: 00007FF726AFE1CC
v8.4-a, xrefs: 00007FF726AFE55F
v8.8-a, xrefs: 00007FF726AFE583
v9.4-a, xrefs: 00007FF726AFE428
v9.2, xrefs: 00007FF726AFE3DB
v8.5, xrefs: 00007FF726AFE32A
v8-r, xrefs: 00007FF726AFE4CC
v7-a, xrefs: 00007FF726AFE13F
v8.6, xrefs: 00007FF726AFE348
v9.1, xrefs: 00007FF726AFE3C0
v7em, xrefs: 00007FF726AFE120
v8.3, xrefs: 00007FF726AFE2EE
v8.1-m.main, xrefs: 00007FF726AFE4FF
v8.8, xrefs: 00007FF726AFE384
v8.9-a, xrefs: 00007FF726AFE58C
v8-m.base, xrefs: 00007FF726AFE556
v8.1, xrefs: 00007FF726AFE2AD
v8.4, xrefs: 00007FF726AFE30C
v9.1-a, xrefs: 00007FF726AFE595
v7-r, xrefs: 00007FF726AFE17B

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: aarch64$arm64$v7-a$v7-m$v7-r$v7e-m$v7em$v7hl$v8-a$v8-m.base$v8-m.main$v8-r$v8.1$v8.1-a$v8.1-m.main$v8.1m.ma$v8.2$v8.2-a$v8.3$v8.3-a$v8.4$v8.4-a$v8.5$v8.5-a$v8.6$v8.6-a$v8.7$v8.7-a$v8.8$v8.8-a$v8.9$v8.9-a$v8a$v8l$v8m.base$v8m.main$v9-a$v9.1$v9.1-a$v9.2$v9.2-a$v9.3$v9.3-a$v9.4$v9.4-a
API String ID: 0-2414714687
Opcode ID: 0fe01d6bf5c766af112b75fc655b332d3eb98abb2271b21c0b2ee79ff1bfa753
Instruction ID: 69db1bf1f60da90cb25980df4b59599b4c8ed10dad416687777ae34bc3a9a33e
Opcode Fuzzy Hash: 0fe01d6bf5c766af112b75fc655b332d3eb98abb2271b21c0b2ee79ff1bfa753
Instruction Fuzzy Hash: 22D15D72A0CA9292E674AB20AC10FBBBB71FB55744FC09033C64D07A94DF3ED5548BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726A32480 Relevance: 51.6, Strings: 41, Instructions: 394
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

dermodel, xrefs: 00007FF726A32A60
fuch, xrefs: 00007FF726A3255D
ebsd, xrefs: 00007FF726A3254A
cuda, xrefs: 00007FF726A326B1
emscript, xrefs: 00007FF726A3285A
mesa, xrefs: 00007FF726A327AA
maco, xrefs: 00007FF726A32609
open, xrefs: 00007FF726A328D3
win3, xrefs: 00007FF726A3290F
darw, xrefs: 00007FF726A324E8
rtem, xrefs: 00007FF726A329AB
herm, xrefs: 00007FF726A32808
tvos, xrefs: 00007FF726A3274E
mini, xrefs: 00007FF726A32992
shadermo, xrefs: 00007FF726A32A53
amdp, xrefs: 00007FF726A327EA
wasi, xrefs: 00007FF726A32841
elfiamcu, xrefs: 00007FF726A32730
tiki, xrefs: 00007FF726A327D4
nbsd, xrefs: 00007FF726A328DC
netb, xrefs: 00007FF726A32628
driverki, xrefs: 00007FF726A32786
hsia, xrefs: 00007FF726A32566
nvcl, xrefs: 00007FF726A326C1
hurd, xrefs: 00007FF726A32831
amdh, xrefs: 00007FF726A326D2
dows, xrefs: 00007FF726A3293E
cont, xrefs: 00007FF726A327CB
haik, xrefs: 00007FF726A32979
linu, xrefs: 00007FF726A325C7
wind, xrefs: 00007FF726A32935
sola, xrefs: 00007FF726A328ED
anan, xrefs: 00007FF726A324B2
dragonfl, xrefs: 00007FF726A32522
nacl, xrefs: 00007FF726A3267E
watc, xrefs: 00007FF726A3275F
kfreebsd, xrefs: 00007FF726A325B4
free, xrefs: 00007FF726A32541
chos, xrefs: 00007FF726A32768
aris, xrefs: 00007FF726A328F6
cloudabi, xrefs: 00007FF726A324D5

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: amdh$amdp$anan$aris$chos$cloudabi$cont$cuda$darw$dermodel$dows$dragonfl$driverki$ebsd$elfiamcu$emscript$free$fuch$haik$herm$hsia$hurd$kfreebsd$linu$maco$mesa$mini$nacl$nbsd$netb$nvcl$open$rtem$shadermo$sola$tiki$tvos$wasi$watc$win3$wind
API String ID: 0-149123974
Opcode ID: 5d24597d54c6f5cdc070b48c71008b70beb476a4748eb81515d637c3f265a63b
Instruction ID: 30d7801e0e8296912c10c6a41947e06aaf257e13523da4d2b721a2356f6cc7c3
Opcode Fuzzy Hash: 5d24597d54c6f5cdc070b48c71008b70beb476a4748eb81515d637c3f265a63b
Instruction Fuzzy Hash: 73E1C4A3E0C1D342FA756E205D91E3BEA70EF15B60E959233DD6E136D0CE3869709A60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726ABA0F0 Relevance: 43.8, APIs: 14, Strings: 11, Instructions: 94
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(?,?,?,00000000,00007FF726ABAAF4,?,?,?,00000001,00007FF726ABE7ED,?,?,?,?,00007FF7269C70CD), ref: 00007FF726ABA0FD
GetProcAddress.KERNEL32(?,?,?,00000000,00007FF726ABAAF4,?,?,?,00000001,00007FF726ABE7ED,?,?,?,?,00007FF7269C70CD), ref: 00007FF726ABA120
GetProcAddress.KERNEL32(?,?,?,00000000,00007FF726ABAAF4,?,?,?,00000001,00007FF726ABE7ED,?,?,?,?,00007FF7269C70CD), ref: 00007FF726ABA133
GetProcAddress.KERNEL32(?,?,?,00000000,00007FF726ABAAF4,?,?,?,00000001,00007FF726ABE7ED,?,?,?,?,00007FF7269C70CD), ref: 00007FF726ABA146
GetProcAddress.KERNEL32(?,?,?,00000000,00007FF726ABAAF4,?,?,?,00000001,00007FF726ABE7ED,?,?,?,?,00007FF7269C70CD), ref: 00007FF726ABA159
GetProcAddress.KERNEL32(?,?,?,00000000,00007FF726ABAAF4,?,?,?,00000001,00007FF726ABE7ED,?,?,?,?,00007FF7269C70CD), ref: 00007FF726ABA16C
GetProcAddress.KERNEL32(?,?,?,00000000,00007FF726ABAAF4,?,?,?,00000001,00007FF726ABE7ED,?,?,?,?,00007FF7269C70CD), ref: 00007FF726ABA17F
GetProcAddress.KERNEL32(?,?,?,00000000,00007FF726ABAAF4,?,?,?,00000001,00007FF726ABE7ED,?,?,?,?,00007FF7269C70CD), ref: 00007FF726ABA192
GetProcAddress.KERNEL32(?,?,?,00000000,00007FF726ABAAF4,?,?,?,00000001,00007FF726ABE7ED,?,?,?,?,00007FF7269C70CD), ref: 00007FF726ABA1A5
GetProcAddress.KERNEL32(?,?,?,00000000,00007FF726ABAAF4,?,?,?,00000001,00007FF726ABE7ED,?,?,?,?,00007FF7269C70CD), ref: 00007FF726ABA1B8
GetProcAddress.KERNEL32(?,?,?,00000000,00007FF726ABAAF4,?,?,?,00000001,00007FF726ABE7ED,?,?,?,?,00007FF7269C70CD), ref: 00007FF726ABA1CB
InitializeCriticalSection.KERNEL32(?,?,?,00000000,00007FF726ABAAF4,?,?,?,00000001,00007FF726ABE7ED,?,?,?,?,00007FF7269C70CD), ref: 00007FF726ABA259
EnterCriticalSection.KERNEL32(?,?,?,00000000,00007FF726ABAAF4,?,?,?,00000001,00007FF726ABE7ED,?,?,?,?,00007FF7269C70CD), ref: 00007FF726ABA26D
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00000000,00007FF726ABAAF4,?,?,?,00000001,00007FF726ABE7ED,?,?,?,?,00007FF7269C70CD), ref: 00007FF726ABA281

Strings

SymSetOptions, xrefs: 00007FF726ABA19B
SymGetLineFromAddr64, xrefs: 00007FF726ABA162
MiniDumpWriteDump, xrefs: 00007FF726ABA10F
SymGetModuleInfo64, xrefs: 00007FF726ABA175
EnumerateLoadedModules64, xrefs: 00007FF726ABA1C1
SymInitialize, xrefs: 00007FF726ABA1AE
Dbghelp.dll, xrefs: 00007FF726ABA0F6
SymFunctionTableAccess64, xrefs: 00007FF726ABA188
SymGetModuleBase64, xrefs: 00007FF726ABA13C
SymGetSymFromAddr64, xrefs: 00007FF726ABA14F
StackWalk64, xrefs: 00007FF726ABA129

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: AddressProc$CriticalSection$EnterExceptionFilterInitializeLibraryLoadUnhandled
String ID: Dbghelp.dll$EnumerateLoadedModules64$MiniDumpWriteDump$StackWalk64$SymFunctionTableAccess64$SymGetLineFromAddr64$SymGetModuleBase64$SymGetModuleInfo64$SymGetSymFromAddr64$SymInitialize$SymSetOptions
API String ID: 4289314834-3758892603
Opcode ID: fbcc272d06590f3041c9d5dfd7c7e331e08e211b9acde4b3a3ab0ccf1a568de6
Instruction ID: 16d671be1708209ae46b24a8b5cf4d59c28fd45fa66f4ebd2f08c2a29d6f5384
Opcode Fuzzy Hash: fbcc272d06590f3041c9d5dfd7c7e331e08e211b9acde4b3a3ab0ccf1a568de6
Instruction Fuzzy Hash: 9F412B65D0DA4A91FE02FB25FD801A6A3A4EF59781FC05237C80D167B0EF6CA185CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269DB2A0 Relevance: 26.7, APIs: 13, Strings: 2, Instructions: 418
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLogicalProcessorInformationEx.KERNEL32 ref: 00007FF7269DB2FB
GetLastError.KERNEL32 ref: 00007FF7269DB309
GetLogicalProcessorInformationEx.KERNEL32 ref: 00007FF7269DB337
GetLogicalProcessorInformationEx.KERNEL32 ref: 00007FF7269DB482
GetLastError.KERNEL32 ref: 00007FF7269DB490
GetLogicalProcessorInformationEx.KERNEL32 ref: 00007FF7269DB4BB
GetCurrentProcess.KERNEL32 ref: 00007FF7269DB5AA
GetProcessGroupAffinity.KERNEL32 ref: 00007FF7269DB5BB
GetLastError.KERNEL32 ref: 00007FF7269DB5C9
GetCurrentProcess.KERNEL32 ref: 00007FF7269DB60B
GetProcessGroupAffinity.KERNEL32 ref: 00007FF7269DB61C
GetCurrentProcess.KERNEL32 ref: 00007FF7269DB64B
GetProcessAffinityMask.KERNEL32 ref: 00007FF7269DB65E

Strings

33333333, xrefs: 00007FF7269DB84C
UUUUUUUU, xrefs: 00007FF7269DB839

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: Process$InformationLogicalProcessor$AffinityCurrentErrorLast$Group$Mask
String ID: 33333333$UUUUUUUU
API String ID: 2875734032-3483174168
Opcode ID: f860fced3b8bfe3a75b47358b931bc39645deab4d35eddee48ec6908058e847c
Instruction ID: 4422beef02bb76788cd0b1680b739f38e8b6b7b7b343c23097aa7a2e155e8175
Opcode Fuzzy Hash: f860fced3b8bfe3a75b47358b931bc39645deab4d35eddee48ec6908058e847c
Instruction Fuzzy Hash: C702B7A1A1DA4582EA14AF55EC5837BE761FB84BD4F84423BEA8E03798DF3CD145CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726ABFDF0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 185
synchronizationtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF726ABFE65
TerminateProcess.KERNEL32 ref: 00007FF726ABFE92
WaitForSingleObject.KERNEL32 ref: 00007FF726ABFEA9
CloseHandle.KERNEL32 ref: 00007FF726ABFEB3
GetProcessTimes.KERNEL32 ref: 00007FF726ABFEDF
K32GetProcessMemoryInfo.KERNEL32 ref: 00007FF726ABFEF8
GetExitCodeProcess.KERNEL32 ref: 00007FF726ABFF6C
GetLastError.KERNEL32 ref: 00007FF726ABFF75
CloseHandle.KERNEL32 ref: 00007FF726ABFF86

Strings

program, xrefs: 00007FF726AC00C1
%, xrefs: 00007FF726AC0097
/, xrefs: 00007FF726AC00A0

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: Process$CloseHandleObjectSingleWait$CodeErrorExitInfoLastMemoryTerminateTimes
String ID: program$%$/
API String ID: 4249095958-2761700234
Opcode ID: 4a08588205c64f127ce973b60c26ba3ed77de9d8b330805d76077c59f1c4a634
Instruction ID: 984edda34c42f9a9239861eac34258de2cdea45b16d21adc905e7205f9619d47
Opcode Fuzzy Hash: 4a08588205c64f127ce973b60c26ba3ed77de9d8b330805d76077c59f1c4a634
Instruction Fuzzy Hash: AA81E262A08B8681EB10AF25EC4077BB7A1FF85B84F449136DE8D063A5DF7DE485CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726AB5120 Relevance: 23.4, APIs: 12, Strings: 1, Instructions: 610
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00007FF726AB514E
GetModuleFileNameW.KERNEL32 ref: 00007FF726AB58E0
GetLongPathNameW.KERNEL32 ref: 00007FF726AB5902
_Init_thread_header.LIBCMT ref: 00007FF726AB5D90

Strings

\\?\, xrefs: 00007FF726AB5366

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: Name$CommandFileInit_thread_headerLineLongModulePath
String ID: \\?\
API String ID: 2344869028-4282027825
Opcode ID: 83cfd1d6df5f49e16826f8b643feb21dff7d949258ea90d555f1763d5ceb6160
Instruction ID: af42bea04f374317256bade2c40ad464d5440ea5ace8a20379720eda559143dc
Opcode Fuzzy Hash: 83cfd1d6df5f49e16826f8b643feb21dff7d949258ea90d555f1763d5ceb6160
Instruction Fuzzy Hash: 91625A72A0CAC681EA71EF15EC547ABA360FB94784F804136DA8D47A99DF3CE584CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726B172A0 Relevance: 18.8, Strings: 14, Instructions: 1253COMMON

Download Yara Rule

Strings

", xrefs: 00007FF726B17520
unable to read an extended symbol table at index , xrefs: 00007FF726B18CAA
), but unable to locate the extended symbol index table, xrefs: 00007FF726B18C23
, but got , xrefs: 00007FF726B173A9
) which is not a multiple of its sh_entsize (, xrefs: 00007FF726B1730F
section , xrefs: 00007FF726B17366, 00007FF726B17411, 00007FF726B1747E, 00007FF726B174AC, 00007FF726B176BF, 00007FF726B177B9, 00007FF726B177E7, 00007FF726B17A22, 00007FF726B17B77, 00007FF726B17BA5, 00007FF726B180A8, 00007FF726B180D6
has an invalid sh_size (, xrefs: 00007FF726B17864
has a sh_offset (0x, xrefs: 00007FF726B17C22, 00007FF726B18153
) + sh_size (0x, xrefs: 00007FF726B1764B, 00007FF726B179BA
has invalid sh_entsize: expected , xrefs: 00007FF726B17529
) that cannot be represented, xrefs: 00007FF726B17604
found an extended symbol index (, xrefs: 00007FF726B18BFE
) that is greater than the file size (0x, xrefs: 00007FF726B1797C
(0x, xrefs: 00007FF726B1819F

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: (0x$ has a sh_offset (0x$ has an invalid sh_size ($ has invalid sh_entsize: expected $"$) + sh_size (0x$) that cannot be represented$) that is greater than the file size (0x$) which is not a multiple of its sh_entsize ($), but unable to locate the extended symbol index table$, but got $found an extended symbol index ($section $unable to read an extended symbol table at index
API String ID: 0-2279413966
Opcode ID: 1a703a97410a61ab90fad26c6de289e9a53753964d9f488cb2aeac03a8c7b528
Instruction ID: 7d935df1aadaa0b9ef7289517239b0fb404ce9e6ac6be55744398e65cc33448a
Opcode Fuzzy Hash: 1a703a97410a61ab90fad26c6de289e9a53753964d9f488cb2aeac03a8c7b528
Instruction Fuzzy Hash: 7AE26772A0CBC591EA759B14E8483EFB7A1FB95384F905126CACD03A99DF7CD188CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726AB8C70 Relevance: 16.6, APIs: 2, Strings: 7, Instructions: 826COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF726AB917F
_Init_thread_header.LIBCMT ref: 00007FF726AB9C82

Strings

symbolizer-input, xrefs: 00007FF726AB9204
llvm-symbolizer, xrefs: 00007FF726AB8CF0
, xrefs: 00007FF726AB91B5
, xrefs: 00007FF726AB91DD
LLVM_SYMBOLIZER_PATH, xrefs: 00007FF726AB8D6E
LLVM_DISABLE_SYMBOLIZATION, xrefs: 00007FF726AB8CB4
symbolizer-output, xrefs: 00007FF726AB926B

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: CurrentInit_thread_headerProcess
String ID: $ $LLVM_DISABLE_SYMBOLIZATION$LLVM_SYMBOLIZER_PATH$llvm-symbolizer$symbolizer-input$symbolizer-output
API String ID: 3343153627-368381080
Opcode ID: e27624b1eac9a984c850d73ac8a914f1dd14c7bca464020323c444169c299318
Instruction ID: f93cf8215b1729d0ce883a8582ef27082f1c482ba402ef26571ad38b922d0e36
Opcode Fuzzy Hash: e27624b1eac9a984c850d73ac8a914f1dd14c7bca464020323c444169c299318
Instruction Fuzzy Hash: C2927E32A0CAC685EA70AB15EC447EBA3A0FB95754F840136DA9D07B99DF7CE184CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726B14C90 Relevance: 15.8, Strings: 12, Instructions: 812COMMON

Download Yara Rule

Strings

is empty, xrefs: 00007FF726B15890
rminated, xrefs: 00007FF726B1578E
[index , xrefs: 00007FF726B14EC0, 00007FF726B14F29, 00007FF726B14F57, 00007FF726B15116
, xrefs: 00007FF726B1561D
is empt, xrefs: 00007FF726B158D0
invalid sh_type for string table section , xrefs: 00007FF726B151A9, 00007FF726B1521A, 00007FF726B15247
is non-null terminated, xrefs: 00007FF726B1573F
-, xrefs: 00007FF726B14DDB
[unknown, xrefs: 00007FF726B14D7D
n index], xrefs: 00007FF726B14D8A
SHT_STRTAB string table section , xrefs: 00007FF726B1558E, 00007FF726B15611, 00007FF726B15691, 00007FF726B156BF, 00007FF726B157E2, 00007FF726B15810
: expected SHT_STRTAB, but got , xrefs: 00007FF726B152CC

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: $ is empt$ is empty$ is non-null terminated$-$: expected SHT_STRTAB, but got $SHT_STRTAB string table section $[index $[unknown$invalid sh_type for string table section $n index]$rminated
API String ID: 0-3476031541
Opcode ID: 16e3a3277b7ca7db68c07f2a0290a21f3017fbfa6a055085ccd896109d01b61a
Instruction ID: baf8051834818f2506cb6a3011935159975b4ba1e9431df247df0996a07fc3af
Opcode Fuzzy Hash: 16e3a3277b7ca7db68c07f2a0290a21f3017fbfa6a055085ccd896109d01b61a
Instruction Fuzzy Hash: 9F82E3A2608BC591EB20EB15EC583AFA361FB857C4F905536DA8D07B85DF7CD188CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72697D870 Relevance: 15.5, Strings: 12, Instructions: 525
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

# ValueKind = , xrefs: 00007FF72697DC17
# Counter Values:, xrefs: 00007FF72697DA16
# Num Value Kinds:, xrefs: 00007FF72697DB1F
# Func Hash:, xrefs: 00007FF72697D91B
# Func H, xrefs: 00007FF72697D943
ds:, xrefs: 00007FF72697DB43
# ValueK, xrefs: 00007FF72697DC3A
# NumValueSites:, xrefs: 00007FF72697DD33
# Num Counters:, xrefs: 00007FF72697D99D
c Hash:, xrefs: 00007FF72697D935
eKind = , xrefs: 00007FF72697DC2C
** External Symbol **, xrefs: 00007FF72697DFA3, 00007FF72697DFC0

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: # Counter Values:$# Func H$# Func Hash:$# Num Counters:$# Num Value Kinds:$# NumValueSites:$# ValueK$# ValueKind = $** External Symbol **$c Hash:$ds:$eKind =
API String ID: 0-2073926981
Opcode ID: 5c1e852f5d5fd404b87e22ffdee72f47b3565d6f75e9175f43c34916a2e72bea
Instruction ID: 72875fd08237789f63a5df68884f803780f2b082967afcaa5954735a1381ecb4
Opcode Fuzzy Hash: 5c1e852f5d5fd404b87e22ffdee72f47b3565d6f75e9175f43c34916a2e72bea
Instruction Fuzzy Hash: 3522A862B0965581EE25AB1ADC4027BA760FB89FC4F85403BDE8E077D5DE3CE444CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726AC0D00 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 497windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF726AC0D4F
FormatMessageA.KERNEL32 ref: 00007FF726AC0D80
LocalFree.KERNEL32(?), ref: 00007FF726AC1562

Part of subcall function 00007FF726CAC038: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF726CAC068

Strings

0123456789ABCDEF, xrefs: 00007FF726AC105A
wn error, xrefs: 00007FF726AC11A8
0, xrefs: 00007FF726AC1226
: Unknow, xrefs: 00007FF726AC119A
(0x, xrefs: 00007FF726AC1277, 00007FF726AC12E0, 00007FF726AC130E

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: Concurrency::cancel_current_taskErrorFormatFreeLastLocalMessage
String ID: (0x$0$0123456789ABCDEF$: Unknow$wn error
API String ID: 2211550869-1876815273
Opcode ID: b499fb46336316a6e3819437ab9ad0778570bdd89c4f00d615371faba2b56e5e
Instruction ID: d3b3e2cea88c0d3febdd751edb1070d18e4016c2a3b4f8215d5b67033a36be5c
Opcode Fuzzy Hash: b499fb46336316a6e3819437ab9ad0778570bdd89c4f00d615371faba2b56e5e
Instruction Fuzzy Hash: 5222D062708BC181EB20EB19EC147ABA361FB55794F804636DAAD07BC6DF7DE484CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269D9000 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7269D7740: GetCurrentDirectoryW.KERNEL32 ref: 00007FF7269D7826

FindFirstFileExW.KERNEL32 ref: 00007FF7269D91C2
FindNextFileW.KERNEL32 ref: 00007FF7269D9241
GetLastError.KERNEL32 ref: 00007FF7269D924E
GetLastError.KERNEL32 ref: 00007FF7269D926D
FindClose.KERNEL32 ref: 00007FF7269D9645

Strings

., xrefs: 00007FF7269D985A
., xrefs: 00007FF7269D9230

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: Find$ErrorFileLast$CloseCurrentDirectoryFirstNext
String ID: .$.
API String ID: 3458012863-3769392785
Opcode ID: b563e2f7cc334077acc01c9c16dc62711087a5e03da8952e94883c8414167cd4
Instruction ID: cfe039bb6d2a544d6e19d707b02b4cc0bb033b155b2371cab56e5755db7dcac1
Opcode Fuzzy Hash: b563e2f7cc334077acc01c9c16dc62711087a5e03da8952e94883c8414167cd4
Instruction Fuzzy Hash: 86F16C62A08AC184EA70BB15EC583FBA360FB85794F804636DBDD12A99DF3CD184CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726A31FC0 Relevance: 12.6, Strings: 10, Instructions: 140COMMON

Download Yara Rule

Strings

arm6, xrefs: 00007FF726A32053
kalimba3, xrefs: 00007FF726A32191
r6el, xrefs: 00007FF726A32160
mips, xrefs: 00007FF726A31FEB
powerpcs, xrefs: 00007FF726A32009
64ec, xrefs: 00007FF726A3205A
kalimba4, xrefs: 00007FF726A321BB
spir, xrefs: 00007FF726A32079
kalimba5, xrefs: 00007FF726A321E3
arm6, xrefs: 00007FF726A32031

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: 64ec$arm6$arm6$kalimba3$kalimba4$kalimba5$mips$powerpcs$r6el$spir
API String ID: 0-1622657226
Opcode ID: 37505e1a22a6f2d1f86a9399e49f035e865dbe598971cd01fc898d3ec01a9647
Instruction ID: 717c3be86493faf48a0c4ef2b58aa39d12bf1d607b8c055a519cdc1c4736113d
Opcode Fuzzy Hash: 37505e1a22a6f2d1f86a9399e49f035e865dbe598971cd01fc898d3ec01a9647
Instruction Fuzzy Hash: 3851E322A1C5C182FA70AB54ED54B7AE6B1EBC2780FD08133D68D03A98DE3DE555CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726A30880 Relevance: 11.4, Strings: 9, Instructions: 167COMMON

Download Yara Rule

Strings

mips, xrefs: 00007FF726A30A6C
mipsel, xrefs: 00007FF726A30B03
sn32, xrefs: 00007FF726A30A58
mips, xrefs: 00007FF726A30A4F
mipsr6el, xrefs: 00007FF726A30AD9
mipsr6, xrefs: 00007FF726A30AEE
mips, xrefs: 00007FF726A30B18
mipsisa3, xrefs: 00007FF726A30AAE
mipsisa6, xrefs: 00007FF726A30A8F

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: mips$mips$mips$mipsel$mipsisa3$mipsisa6$mipsr6$mipsr6el$sn32
API String ID: 0-1372953735
Opcode ID: 003c546cad711431938a11c69675a7d8a677270d616e439d9d4d8521d622d38f
Instruction ID: cfa3dad08df75918951431903964db941a55d3fb2fbd7062c4eec02239452245
Opcode Fuzzy Hash: 003c546cad711431938a11c69675a7d8a677270d616e439d9d4d8521d622d38f
Instruction Fuzzy Hash: 6C816232918AC686E6719B29E8517ABF3B0FB84744F405136DB8D43A95EF3CE195CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726ABBA70 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 124registryCOMMON

Download Yara Rule

APIs

RegGetValueW.ADVAPI32 ref: 00007FF726ABBACC
RegGetValueW.ADVAPI32 ref: 00007FF726ABBB83
ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF726ABBBD2
ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF726ABBC45

Strings

DumpFolder, xrefs: 00007FF726ABBABB, 00007FF726ABBB6F
SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps, xrefs: 00007FF726ABBA78

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: EnvironmentExpandStringsValue
String ID: DumpFolder$SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps
API String ID: 2654294330-1401551644
Opcode ID: 4ff6eabffe0c8f3193e5a0dadde95e54f3a724bc0867937144b59ff9f56e1b85
Instruction ID: a1c9eaaaad6af2e3529320cd962282753b3a0fdf986509c105c692c212f1aead
Opcode Fuzzy Hash: 4ff6eabffe0c8f3193e5a0dadde95e54f3a724bc0867937144b59ff9f56e1b85
Instruction Fuzzy Hash: 2351846261CA8581EB60EB62FC947ABE7A1FB84784F804136DE8D47A99CF7CD045CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726AFEC10 Relevance: 10.1, Strings: 8, Instructions: 105COMMON

Download Yara Rule

Strings

mbeb, xrefs: 00007FF726AFEC77
arme, xrefs: 00007FF726AFEC46
thum, xrefs: 00007FF726AFECD4
aarc, xrefs: 00007FF726AFED1B
_46hcraa, xrefs: 00007FF726AFED3F
thum, xrefs: 00007FF726AFEC6E
aarch64_, xrefs: 00007FF726AFEC8F
ch64, xrefs: 00007FF726AFED22

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: _46hcraa$aarc$aarch64_$arme$ch64$mbeb$thum$thum
API String ID: 0-2372471509
Opcode ID: 6e0041820c8904dab7b9bb4e0ff6ae0a325f741c2fdc6cf2cc717a5239751501
Instruction ID: 0eb08bc2bf2d447e86d40e3a1ddb669f7b93fe32f242a6e50ed33cc634133a0f
Opcode Fuzzy Hash: 6e0041820c8904dab7b9bb4e0ff6ae0a325f741c2fdc6cf2cc717a5239751501
Instruction Fuzzy Hash: 453149667144A541EB989B35CD10D3F7AF2FB84F80F889433EA0D47A84CD2EE50197A2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72694FCA0 Relevance: 9.6, APIs: 2, Strings: 3, Instructions: 834COMMON

Download Yara Rule

APIs

_Init_thread_header.LIBCMT ref: 00007FF726950D01
_Init_thread_header.LIBCMT ref: 00007FF726950D37

Part of subcall function 00007FF726CAC038: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF726CAC068

Strings

(, xrefs: 00007FF7269507B4
Merge IR generated profile with Clang generated profile., xrefs: 00007FF72695027C
Cannot merge MemProf profile with Clang generated profile., xrefs: 00007FF726950122

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: Init_thread_header$Concurrency::cancel_current_task
String ID: ($Cannot merge MemProf profile with Clang generated profile.$Merge IR generated profile with Clang generated profile.
API String ID: 1801012595-3942102893
Opcode ID: a87198f76f89ae145f4d61fd19ec21106bd91d7a5c7853343bf0286357bef463
Instruction ID: 078db61738d49590c8f4e019db665a16770f7bff418f04b4318171f15ba27b82
Opcode Fuzzy Hash: a87198f76f89ae145f4d61fd19ec21106bd91d7a5c7853343bf0286357bef463
Instruction Fuzzy Hash: BF926D32A08AC681EA20EB15EC543EBA360FB85794F804636DADD07799DF7CE585CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726AB6270 Relevance: 9.1, APIs: 6, Instructions: 65encryptiontimeCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32 ref: 00007FF726AB629E
CryptGenRandom.ADVAPI32 ref: 00007FF726AB62BA
CryptReleaseContext.ADVAPI32 ref: 00007FF726AB62D0
_Init_thread_header.LIBCMT ref: 00007FF726AB6321
GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF726AB6337
GetCurrentProcessId.KERNEL32 ref: 00007FF726AB633D

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: Crypt$ContextTime$AcquireCurrentFileInit_thread_headerProcessRandomReleaseSystem
String ID:
API String ID: 2604069323-0
Opcode ID: d59b388c44af764cece726bc5e1a73a31028c2b1c203ece1b764f194ad9e80db
Instruction ID: 4bd233ae188933f99caf815030a4f8d51e231ede6bdeb2e35c1388dbab5f9ecc
Opcode Fuzzy Hash: d59b388c44af764cece726bc5e1a73a31028c2b1c203ece1b764f194ad9e80db
Instruction Fuzzy Hash: 84214F62A0CA4686FB50BB15EC506BBB371FB98B90F901137DA4D47A64DE3CE846CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726AFE850 Relevance: 8.9, Strings: 7, Instructions: 197COMMON

Download Yara Rule

Strings

ch64, xrefs: 00007FF726AFE980
arm64_32, xrefs: 00007FF726AFE8A7
aarc, xrefs: 00007FF726AFE977
arm6, xrefs: 00007FF726AFE8DD
thum, xrefs: 00007FF726AFE94B
arm6, xrefs: 00007FF726AFE8BF
aarch64_, xrefs: 00007FF726AFE8FE

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: aarc$aarch64_$arm6$arm6$arm64_32$ch64$thum
API String ID: 0-1501599320
Opcode ID: 15711ea6ecc459a7afd04f65b7ff0539c823105e8c921a081b6fc619ada2f95e
Instruction ID: d940d0cba2d8d9ea7162290f47eb107d301950c3b8878a74192abcae2a882631
Opcode Fuzzy Hash: 15711ea6ecc459a7afd04f65b7ff0539c823105e8c921a081b6fc619ada2f95e
Instruction Fuzzy Hash: 1F81F961608A8151EE74AB15DC50A3BE3F1FB847A4F908333E6AE037D4DE2EE5418F52

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726A72A70 Relevance: 6.6, Strings: 5, Instructions: 364COMMON

Download Yara Rule

Strings

___Z, xrefs: 00007FF726A72B4B
invocation function for block in , xrefs: 00007FF726A72FB9
_block_invoke, xrefs: 00007FF726A72D53
____, xrefs: 00007FF726A72B81
____Z, xrefs: 00007FF726A72C1E

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: ___Z$____$____Z$_block_invoke$invocation function for block in
API String ID: 0-2021201366
Opcode ID: 45dbda355c18307aa34d754526c07a1e7f918eea2fa5ce68520e14de1e515a72
Instruction ID: fef978d0e5eb64915716af0d99230913ea6ddcf5b04a8603879a91b8f80497a8
Opcode Fuzzy Hash: 45dbda355c18307aa34d754526c07a1e7f918eea2fa5ce68520e14de1e515a72
Instruction Fuzzy Hash: 09E10B21709A8642EA669B11EC90BBFE3B5EB45B90FC44136DB9D07791DF3CE151CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72698F150 Relevance: 6.5, Strings: 5, Instructions: 295COMMON

Download Yara Rule

Strings

profile-symbol-list-cutoff, xrefs: 00007FF72698F523
v, xrefs: 00007FF72698F4EF
generate-merged-base-profiles, xrefs: 00007FF72698F561
Cutoff value about how many symbols in profile symbol list will be used. This is very useful for performance debugging, xrefs: 00007FF72698F4E3
When generating nested context-sensitive profiles, always generate extra base profile for function with all its context profiles merged into it., xrefs: 00007FF72698F545

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: Cutoff value about how many symbols in profile symbol list will be used. This is very useful for performance debugging$When generating nested context-sensitive profiles, always generate extra base profile for function with all its context profiles merged into it.$generate-merged-base-profiles$profile-symbol-list-cutoff$v
API String ID: 0-420232138
Opcode ID: 99a06e4e1f5c385000b7a71a62f6859cd67511500c09d758769cc1018c07c792
Instruction ID: 63d4b56d29d7da209cb732900be39ab67e26a487e9b4aa7f192c7cc1bd2fd459
Opcode Fuzzy Hash: 99a06e4e1f5c385000b7a71a62f6859cd67511500c09d758769cc1018c07c792
Instruction Fuzzy Hash: BDC1C1A2A09B8185EA50EF11EC443AAB7A4FB84BC4F95543BEE8D03795DF3CD484CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726988DF0 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 829COMMON

Download Yara Rule

Strings

unordered_map/set too long, xrefs: 00007FF726989173
======== Dump profile symbol list ========, xrefs: 00007FF7269896D6

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: ======== Dump profile symbol list ========$unordered_map/set too long
API String ID: 118556049-1450276711
Opcode ID: 787593f02f81c33c732fad3e2da643243c67e4cd13a4f557002d166c57b6fe35
Instruction ID: aa7a5be269ca115b9d2abc1556a7455901bad45188449aa4139e3fff0b742f60
Opcode Fuzzy Hash: 787593f02f81c33c732fad3e2da643243c67e4cd13a4f557002d166c57b6fe35
Instruction Fuzzy Hash: 5072E862A09B8585EA10EF19EC4437AA7A0FB45B94F84463BDEAD077D5DF3CE481CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72699B7D0 Relevance: 5.8, APIs: 1, Strings: 2, Instructions: 537COMMON

Download Yara Rule

APIs

_Init_thread_header.LIBCMT ref: 00007FF72699BDDD

Strings

adcg*704, xrefs: 00007FF72699BB58
Could not create remapper: , xrefs: 00007FF72699BE55, 00007FF72699BFF9, 00007FF72699C026, 00007FF72699C041

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: Init_thread_header
String ID: Could not create remapper: $adcg*704
API String ID: 3738618077-1870079897
Opcode ID: a3f837424b5f909f2368c711d4bf0ca0d1c8a28d523e483bec383cb6e49b505d
Instruction ID: 52e7796ae0fa86b92f931d918953ad1b4c729105deae8aa4030c3fb36eb97d72
Opcode Fuzzy Hash: a3f837424b5f909f2368c711d4bf0ca0d1c8a28d523e483bec383cb6e49b505d
Instruction Fuzzy Hash: 0C32D462A09BC181EB60EB15EC547FBA364FB54788F818636DA9D07795EF3CD184CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269D2BE0 Relevance: 5.5, Strings: 4, Instructions: 464COMMON

Download Yara Rule

Strings

, xrefs: 00007FF7269D2C29
, xrefs: 00007FF7269D2C51
, xrefs: 00007FF7269D2C79
, xrefs: 00007FF7269D2CA1

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: $ $ $
API String ID: 0-3535155489
Opcode ID: 464e835d217ae0c70a7af64fecf74d3b9bd18d04c5c32d438c166557133b916a
Instruction ID: a0adb828421f22bf3cdd32e78acd081eb17cca3002de97292b73b489846e865d
Opcode Fuzzy Hash: 464e835d217ae0c70a7af64fecf74d3b9bd18d04c5c32d438c166557133b916a
Instruction Fuzzy Hash: 35223132608AC185E660FB15EC987ABA761FB85B80F80843ACBCD47B95CF38D545DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726A7C5F0 Relevance: 5.4, Strings: 3, Instructions: 1685COMMON

Download Yara Rule

Strings

srN, xrefs: 00007FF726A87CDC
__uuidof, xrefs: 00007FF726A7DEBD
throw, xrefs: 00007FF726A7D875

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: __uuidof$srN$throw
API String ID: 0-1997068531
Opcode ID: f6c77c071cf532023e716424db44ec6741b06e553c6e4000f68a11fff50193fe
Instruction ID: 8a4b6dce84206f19393832b2a8a0f4bcd3dee92eb46abb52a726cdd903e64481
Opcode Fuzzy Hash: f6c77c071cf532023e716424db44ec6741b06e553c6e4000f68a11fff50193fe
Instruction Fuzzy Hash: 2FE2A262A09B8285FA65AB15EC50ABFE7B0FB45B80F844137DA8E07795DF3CE541CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726A33100 Relevance: 5.1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

Strings

wasm, xrefs: 00007FF726A331BE
xcof, xrefs: 00007FF726A33147
spir, xrefs: 00007FF726A331D3
mach, xrefs: 00007FF726A3319F

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: mach$spir$wasm$xcof
API String ID: 0-3906802617
Opcode ID: bcb05a51e83e7e5f6836311c2ed59403d66ba185cae96b7b90fe25175dfed985
Instruction ID: edbba383c953eaa42262835f0a0adfa0e75731d6b344a39a27a80e730e693abe
Opcode Fuzzy Hash: bcb05a51e83e7e5f6836311c2ed59403d66ba185cae96b7b90fe25175dfed985
Instruction Fuzzy Hash: C9218AB2B0E0C242EEB092215D38E3FEDF1DB91B10FC04173CA2682CD0EE3C94148662

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269A99B0 Relevance: 4.7, Strings: 3, Instructions: 999COMMON

Download Yara Rule

Strings

<invalid, xrefs: 00007FF7269A9CE1
no entries in callstack map after symbolization, xrefs: 00007FF7269AAA4D
memprof/memprof_, xrefs: 00007FF7269A9D66

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: <invalid$memprof/memprof_$no entries in callstack map after symbolization
API String ID: 0-2626238654
Opcode ID: 2bee0b407bab733d7ad16ecc2c707380d6637f8303679381276a91f192d23ea1
Instruction ID: 4bd7c2b9e824b71d081014a722bfb0278c297c38f5af4902af02ce39c9a35c07
Opcode Fuzzy Hash: 2bee0b407bab733d7ad16ecc2c707380d6637f8303679381276a91f192d23ea1
Instruction Fuzzy Hash: DE92C572B19A8286DA60DB15D8407EAB3A1F784BA4F804337DAEE537D4DF38D945CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726A7F280 Relevance: 4.0, Strings: 3, Instructions: 228COMMON

Download Yara Rule

Strings

union, xrefs: 00007FF726A7F353
struct, xrefs: 00007FF726A7F343
enum, xrefs: 00007FF726A7F333

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: enum$struct$union
API String ID: 0-1076304440
Opcode ID: d736a2c3cb40734918442d521e2abaab1a2ffc16a84d23fa8e6975c636d7664d
Instruction ID: 68bad86140dd62caba233c239988b5f8f2a9da660a03a200910862b17ea226e9
Opcode Fuzzy Hash: d736a2c3cb40734918442d521e2abaab1a2ffc16a84d23fa8e6975c636d7664d
Instruction Fuzzy Hash: CD91D422B09A8586EA66AB11FD04BBFA3A5EB447D4FC44137DA5E07784DF3CE241CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726A8A0A0 Relevance: 3.5, Strings: 2, Instructions: 967COMMON

Download Yara Rule

Strings

yptn, xrefs: 00007FF726A8A25C
'block-literal', xrefs: 00007FF726A8A54B

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: 'block-literal'$yptn
API String ID: 0-137333645
Opcode ID: 8e0ed3df8173837006b289698a9d598bcb13af8fcb31f61c36f6f8999b9cb398
Instruction ID: 66b5083f210fd25b6a9136be505bcef245c0cd73b819626afe503505d52b9921
Opcode Fuzzy Hash: 8e0ed3df8173837006b289698a9d598bcb13af8fcb31f61c36f6f8999b9cb398
Instruction Fuzzy Hash: 8592D522609B8586EB65AB25EC447BBB3B4FB44B90F844136DBAE47795DF3CE140CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269801A0 Relevance: 3.3, Strings: 2, Instructions: 793COMMON

Download Yara Rule

Strings

(, xrefs: 00007FF726980612
gfffffff, xrefs: 00007FF7269801B9

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: ($gfffffff
API String ID: 0-1609257259
Opcode ID: 2ba096716ff6435272d6c1700d891756d0946a70e8546cc4b8c068e648dee93a
Instruction ID: dcd699f4868d924c5f6f723a94338481efa6b9c3cbd8400fc155c8db17d79f52
Opcode Fuzzy Hash: 2ba096716ff6435272d6c1700d891756d0946a70e8546cc4b8c068e648dee93a
Instruction Fuzzy Hash: 7662C1A2B09A8185EA20EF15EC4477AA794EB04FD4F84473BDA9D47785EF7CE181C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269A8E60 Relevance: 3.2, Strings: 2, Instructions: 656COMMON

Download Yara Rule

Strings

memprof raw profile has different segment information, xrefs: 00007FF7269A901D
memprof raw profile got different call stack for same id, xrefs: 00007FF7269A9861

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: memprof raw profile got different call stack for same id$memprof raw profile has different segment information
API String ID: 0-1590913111
Opcode ID: cd7e652b15d96e0e9b6c64d293b2809dabe01dcd26b83ab3967e18d5f220aa8a
Instruction ID: 1c4d289457a96f22d8b39b26461fa437126ebade5fe9374b59e41a98ac5d9c2a
Opcode Fuzzy Hash: cd7e652b15d96e0e9b6c64d293b2809dabe01dcd26b83ab3967e18d5f220aa8a
Instruction Fuzzy Hash: 0852C572B19A8185EA60EB05DC407BBB3A1FB84B94F804237DADE43794DF38E945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269B6380 Relevance: 3.0, Strings: 2, Instructions: 484COMMON

Download Yara Rule

Strings

A, xrefs: 00007FF7269B6A1C
0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 00007FF7269B64D5, 00007FF7269B66E9, 00007FF7269B680A, 00007FF7269B69BD

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$A
API String ID: 0-443916768
Opcode ID: 605bfbdabc8fd2f64119da3fa837ed95b8f87109047cd7d068eba55872cec97b
Instruction ID: 8444541fef7a6dd9134af7848431bbc896bd968c3abae43cd489738176423b83
Opcode Fuzzy Hash: 605bfbdabc8fd2f64119da3fa837ed95b8f87109047cd7d068eba55872cec97b
Instruction Fuzzy Hash: 5D12CA72608A8682EB24DB15EC506BBE761E745B94FA44037CB9E47B95CF3DF441CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726A33F90 Relevance: 2.9, Strings: 2, Instructions: 354COMMON

Download Yara Rule

Strings

-, xrefs: 00007FF726A344DD
-, xrefs: 00007FF726A340B4

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: -$-
API String ID: 0-2078519666
Opcode ID: c11ae1e9dabcd5aa3f600dd67870e75794c4a1e426ca4495e9f9d13e8e4d1268
Instruction ID: 54e564538ad896b5925cae119eec3d0b8ae88917295d7b88c600eea0aa3a43fa
Opcode Fuzzy Hash: c11ae1e9dabcd5aa3f600dd67870e75794c4a1e426ca4495e9f9d13e8e4d1268
Instruction Fuzzy Hash: 1512D13260CBC585DAB18B15F8407EBB3A5FB99394F50422ADADD47B99EF7CC0948B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726A81350 Relevance: 2.2, Strings: 1, Instructions: 904COMMON

Download Yara Rule

Strings

std, xrefs: 00007FF726A813D2

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: std
API String ID: 0-2826573480
Opcode ID: 21152e131dbf32d28299c000e68e5c3b464c2222493f311a523f90dde1306f8f
Instruction ID: 02096353cb8c708d2c7ef78e8d9ef89a6aaceda46028bc8c8beacae472404f48
Opcode Fuzzy Hash: 21152e131dbf32d28299c000e68e5c3b464c2222493f311a523f90dde1306f8f
Instruction Fuzzy Hash: 8082076261978682EA65AB11EC40BBBF7B4FB44794F944536DB9E07780EF3CE640CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726946080 Relevance: 2.0, APIs: 1, Instructions: 504COMMON

Download Yara Rule

APIs

_Init_thread_header.LIBCMT ref: 00007FF72694694D

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: Init_thread_header
String ID:
API String ID: 3738618077-0
Opcode ID: 03cf08a649a94d0f9886583098e5f6737cd512ad112a9e333639cad1b8efdde6
Instruction ID: a3c8ff1471ee1009a138683e6315d9a8c521b8b063fb5d8b6175c66d46bfbd14
Opcode Fuzzy Hash: 03cf08a649a94d0f9886583098e5f6737cd512ad112a9e333639cad1b8efdde6
Instruction Fuzzy Hash: B1229FB2B08B8982DA50EF15F8406EBAB65F7857C4F949037EA8D07B68DE3CD545CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269AAB10 Relevance: 1.9, Strings: 1, Instructions: 612COMMON

Download Yara Rule

Strings

memprof callstack record does not contain id: , xrefs: 00007FF7269AB220

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: memprof callstack record does not contain id:
API String ID: 0-1725947181
Opcode ID: c9d340d2d9ec7961826678867e681d6e05cdd4a63d4b92304c6ca8aeaa5e00c7
Instruction ID: a14f958e8fc68664b6b02705ab468c9154df03742a0010d83137bf042b670f37
Opcode Fuzzy Hash: c9d340d2d9ec7961826678867e681d6e05cdd4a63d4b92304c6ca8aeaa5e00c7
Instruction Fuzzy Hash: 08528332719A8586DA609B15E8407BFB3A5FB44794F844237CADD43BD8DF38E945CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269B73D0 Relevance: 1.8, APIs: 1, Instructions: 313COMMON

Download Yara Rule

APIs

_Init_thread_header.LIBCMT ref: 00007FF7269B7821

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: Init_thread_header
String ID:
API String ID: 3738618077-0
Opcode ID: 334087813f4d970d8f24d9379e25f7fe88580ebaa195a24c92d209ba29340a5a
Instruction ID: a1010f1f38266285681949c207e890ff665892a0dabd6246150b6d66e869a8bf
Opcode Fuzzy Hash: 334087813f4d970d8f24d9379e25f7fe88580ebaa195a24c92d209ba29340a5a
Instruction Fuzzy Hash: B6A196A1F8467443DC04DF4A6C525AAE709BB48BD4B48E533EE4C6BB99DD3CDA42C308

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72695C7D0 Relevance: 1.7, Strings: 1, Instructions: 495COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF72695C9A1

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: f5e99b6033a4986bd1e5f92f2193611779d36d93b8d4e7ae09860b6ec0320ef3
Instruction ID: 1547ce1d896d8257a61d0ad4fe2f4dcea14b120b688a2d93b5d282f204c6d27f
Opcode Fuzzy Hash: f5e99b6033a4986bd1e5f92f2193611779d36d93b8d4e7ae09860b6ec0320ef3
Instruction Fuzzy Hash: 8B12F362A15A81C2EB14EF19D9443BA7761EB54B94F84873ACBAD077D5EF78E181C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726A8CFF0 Relevance: 1.7, Strings: 1, Instructions: 422COMMON

Download Yara Rule

Strings

typename, xrefs: 00007FF726A8D5B8

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: typename
API String ID: 0-291471645
Opcode ID: eb82070c9842f15bfb5189a9d8692f77c33469d3e07c89279ed405845686b4a3
Instruction ID: f3cfe43f8a63290a04f211a7b08e7527f06bfa5cc2ba0b449122d42a9381664d
Opcode Fuzzy Hash: eb82070c9842f15bfb5189a9d8692f77c33469d3e07c89279ed405845686b4a3
Instruction Fuzzy Hash: A8F1E072B05B5582EA65EB05ED44B6AA3B8EF44BC0F848132DA9E077D4EF3CE941C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726952370 Relevance: 1.7, Strings: 1, Instructions: 412COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF7269523B2

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: gfffffff
API String ID: 118556049-1523873471
Opcode ID: 11a289049a9b1fa03782b0b25e810e9f03da382683e64461dd6289c22a8f3cf7
Instruction ID: 49e19697b3ef813869071af7d0085cb20cfd96f2428374879ae31a3a2f0484a3
Opcode Fuzzy Hash: 11a289049a9b1fa03782b0b25e810e9f03da382683e64461dd6289c22a8f3cf7
Instruction Fuzzy Hash: 9C02CF23A06B8581EB00EF15EC847AA7760EB54B94F828736EEAD07394DF38E1C5C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726951DD0 Relevance: 1.6, Strings: 1, Instructions: 397COMMON

Download Yara Rule

Strings

Multiple errors:, xrefs: 00007FF7269522B0

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: Multiple errors:
API String ID: 0-2037660629
Opcode ID: 6e342d4e6981d4f6faedba58b6d95e9e0ad273899bf80be5c83b8cc4f8be74ef
Instruction ID: 4b8e343582f1823bc98841059db8a0b68821725402522528475a3e4ab3637fc4
Opcode Fuzzy Hash: 6e342d4e6981d4f6faedba58b6d95e9e0ad273899bf80be5c83b8cc4f8be74ef
Instruction Fuzzy Hash: 07E1E152F19A8582EA149B25DD403BAA350FB55BB4F918337DEBE033D5DF38E192C610

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726AAE4F0 Relevance: 1.6, Strings: 1, Instructions: 324COMMON

Download Yara Rule

Strings

.opd, xrefs: 00007FF726AAE858

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: .opd
API String ID: 0-1203918779
Opcode ID: cc39d18105e2bbe762ff0942c249f4587c9c6520ce3a040ea2b5fea004ab94f0
Instruction ID: 91e6172081c0dec7a4904a0665c961101574faef575102455a5704aaa9f77c01
Opcode Fuzzy Hash: cc39d18105e2bbe762ff0942c249f4587c9c6520ce3a040ea2b5fea004ab94f0
Instruction Fuzzy Hash: 27E19022609BC481DA60AF15E8407AAB7B0FB89B94F858533DFCD07759DF38D884CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269B5DC0 Relevance: 1.6, Strings: 1, Instructions: 319COMMON

Download Yara Rule

Strings

0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 00007FF7269B5DC4

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
API String ID: 0-442858466
Opcode ID: 86f213a1873ede3e55da46e4b8fff523c902963a88d54741d7358d946062d1e7
Instruction ID: 903f2238e31bb17e81f383fe789a0971fd2f44fdb5858f503d13f84018b4e38a
Opcode Fuzzy Hash: 86f213a1873ede3e55da46e4b8fff523c902963a88d54741d7358d946062d1e7
Instruction Fuzzy Hash: 6CB1E072B15A4682EA28FF16EC5077AF750EB95B90F94813ACA9E477D0DE3CE440CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269D8FC0 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FF7269D8FD9

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 7543c4f9afe357dad474a1012b02c03aa86c451865f4bbeb709eb75fe58fdbb6
Instruction ID: 12492db9e76c4c2af9fbb827904f21618df9cfdb0f4e41d2775dd4e43cec4edb
Opcode Fuzzy Hash: 7543c4f9afe357dad474a1012b02c03aa86c451865f4bbeb709eb75fe58fdbb6
Instruction Fuzzy Hash: F2D0EC22A0895482EA10AB54FC610ABB3A0EF98BA0F810432E98D07724CD6CE4C28F40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269C97B0 Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

Allocation failed, xrefs: 00007FF7269C98DD

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: Allocation failed
API String ID: 0-2506524949
Opcode ID: 95c03cd85836b003fa09de8b9719cbed3c513db497dc8402fba6340980d61ed7
Instruction ID: d28dbeeda026e9082e71251c2d149f8f0ad825cf7d911549f49e754200aedb43
Opcode Fuzzy Hash: 95c03cd85836b003fa09de8b9719cbed3c513db497dc8402fba6340980d61ed7
Instruction Fuzzy Hash: 2E41ED23B0491246E664AB26AD00E6AA754FB5CBB4F945336CE7D03BD0DE39E847CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726982E70 Relevance: .9, Instructions: 884COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e0da624eb01d14e2b1b1c0a228d3c4725499db89182e5ad570340462a994d32
Instruction ID: 3eb46e52d80f15fbb587b8dd1b39131a097d03be5c09be3397665dcb06f311d6
Opcode Fuzzy Hash: 1e0da624eb01d14e2b1b1c0a228d3c4725499db89182e5ad570340462a994d32
Instruction Fuzzy Hash: DB72C392B0DA9181EE10AA56DC0427BE351FB45FD4F84463BEE9D47BD9DE3CE4818B20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269B4800 Relevance: .8, Instructions: 832COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 675b8680e6656d8ee6438ff21b3e4f3138a595bedcf9691fee8585f7940a7f09
Instruction ID: 39f0169555bb5c384b95c429459d022e4781d6c3c7d01b45ba4db81ac9810464
Opcode Fuzzy Hash: 675b8680e6656d8ee6438ff21b3e4f3138a595bedcf9691fee8585f7940a7f09
Instruction Fuzzy Hash: 4E720772A1864587EB20DF259C0477EB750FBA6BA4F848336DAAA437D4DF38B554CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269C8970 Relevance: .7, Instructions: 676COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffc151aa177f04060d9889f6a7f8c63f99dbde3931970ce43604e2d5efc10e56
Instruction ID: 00ed80a2d26b0b4e10caa199d5f028157239011bfef54eb93b53d4d7538d7da6
Opcode Fuzzy Hash: ffc151aa177f04060d9889f6a7f8c63f99dbde3931970ce43604e2d5efc10e56
Instruction Fuzzy Hash: BB227FFBE345A14BE3158F5AA541F1B7E61B39078CF91B018EF4767F14E239DA128A40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269CCC00 Relevance: .4, Instructions: 393COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c92051d8efbc830cc971e50e4469bb014b225a5e51364dcff7adddc370abd1e
Instruction ID: 894515a3df68c03c501e1ae4b7c40b2d22e9ad585a649cf4d09ca327e6c68c16
Opcode Fuzzy Hash: 3c92051d8efbc830cc971e50e4469bb014b225a5e51364dcff7adddc370abd1e
Instruction Fuzzy Hash: 0FE1D722B09A41C6EA64AB29DC107BAA7A0FB48B94F844137DF5E477D0DF28E855CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269D39C0 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b810894f52c704ec0206ff0c2e1c132b2c91daee66a5ad61f773813027abc13f
Instruction ID: bbd23cddbf3f203de69514724218cf85bdb941a5213d47c33decb4f313cfd819
Opcode Fuzzy Hash: b810894f52c704ec0206ff0c2e1c132b2c91daee66a5ad61f773813027abc13f
Instruction Fuzzy Hash: A0021B1690C68240FB6B761D8D4C37BD6A0CF13746F54923ADE9E062E6CF6DE582DA20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726A58920 Relevance: .4, Instructions: 375COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9476ca31d4c64a60032575a734e89988b5a046f44a780e7704671abc60e09880
Instruction ID: 6c142fef112a74b796da1f8508a8b852e7fafe8e7edf9776677f7f380856ecc9
Opcode Fuzzy Hash: 9476ca31d4c64a60032575a734e89988b5a046f44a780e7704671abc60e09880
Instruction Fuzzy Hash: D0E12552E18BD543EA21CF25AD01ABEE770FB64788F859232DF8D06646EB38E5D1C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726A8C220 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f46ca6749c12a0c41490ac274863164ca634cfbc38545922de95e611efb9f6cc
Instruction ID: 08d2e44e437b0d6a43ebbc5580a1fe5f35d8dd64974761e543e854166dae83e0
Opcode Fuzzy Hash: f46ca6749c12a0c41490ac274863164ca634cfbc38545922de95e611efb9f6cc
Instruction Fuzzy Hash: 4CE1C762709B8182EA65AB11EC44BBBB765EB44BD4F844136DAAE477C4DF3CE141CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726AC3900 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9664eb91f307d17994120c2d1e8fbbaa7f24b53e34d4d8c107dccad92a630922
Instruction ID: ffad166ff0cc657ec3c524088de9c69b2ea178ca6ad249e063124627cd32680d
Opcode Fuzzy Hash: 9664eb91f307d17994120c2d1e8fbbaa7f24b53e34d4d8c107dccad92a630922
Instruction Fuzzy Hash: 9DE15E32618BC586DA109B69F85035BF7A1F7893A0F644225EBDD42BA9DF7DD085CF00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726A86C00 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80c9026033579c71356e97d148df86091492a70cc5cff011c444caae31909f9d
Instruction ID: 494f4b49216073a50b9d0bf37c37eb04789b3b8befe5f5c65d14c0f8e1273fec
Opcode Fuzzy Hash: 80c9026033579c71356e97d148df86091492a70cc5cff011c444caae31909f9d
Instruction Fuzzy Hash: D9C1C162B09A8586EA65AB15EC40BBFA7B0EB44B90F944136DB9E47780DF3CF541CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72697A160 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba4dcb14cb72e79e87d75f142db56227227937370e510a2daa79fde086ce49b9
Instruction ID: c6ca8104f111536f1764eac1810bd09cecef089b742e06e8ecbedd198f365eb6
Opcode Fuzzy Hash: ba4dcb14cb72e79e87d75f142db56227227937370e510a2daa79fde086ce49b9
Instruction Fuzzy Hash: 45C1E962B18A4581DA11EB25EC407BBA350FB857A4F908636EEAE437D4DF3CE585CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72695DBD0 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2d837cd9b2f7693ff70d31723e61888ac8b041e4c380ce9377465b6475309b7
Instruction ID: cc8077b6ed47fe279d66688a5a46a2e9ec4cf2f2c0db28da972d7ac4969bb8cd
Opcode Fuzzy Hash: c2d837cd9b2f7693ff70d31723e61888ac8b041e4c380ce9377465b6475309b7
Instruction Fuzzy Hash: CBC1C162B14B9982EA10DF1AEC045AEA761F714BD4F808236DFAE573C5CF78E485C714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726AB0D10 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84dc72dcd8f8fae9b39c82c8372a211413c53e15efa4931ae2c391d8d8966537
Instruction ID: e57ae310d264bc87a9aea39f828d35348795663dc2ffba2c95d04bd068c8f623
Opcode Fuzzy Hash: 84dc72dcd8f8fae9b39c82c8372a211413c53e15efa4931ae2c391d8d8966537
Instruction Fuzzy Hash: 52D1C453E08B8482E611CB29D9015BDA360FB69BA4F859722DFAD137D2EF38E1D5C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269BAFE0 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0ae1e7852ba62ab7fb5aa06299014776c5ec824b2e379af178ff0e86128ad20
Instruction ID: 465cfc664c35d88e6923a2f362f513c2a86d3120c45febcbc80ebb5aaffb844c
Opcode Fuzzy Hash: c0ae1e7852ba62ab7fb5aa06299014776c5ec824b2e379af178ff0e86128ad20
Instruction Fuzzy Hash: 0FE12B32609AC181EA70EB11EC587EFA365FB84B94F84413ACA8D47B99DF7CD085CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72695D040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee7feada95fd6af65e3a6cfbdace2017854c01b946ab04ed7469ef6975cb506b
Instruction ID: 9edaaf0eddca1c3e5cb8613a0c1d6e9c94243c2abf4795474fe8e12c3914c1fb
Opcode Fuzzy Hash: ee7feada95fd6af65e3a6cfbdace2017854c01b946ab04ed7469ef6975cb506b
Instruction Fuzzy Hash: 74D1D222A18A8582EA109F19DD045FEA360F759B98F859236DFDD132D5EF38F1CAC710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72695E620 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d219ab1346ad103a72136c0eb7527b20254134baae9c9dbc8ed693a69303b300
Instruction ID: 9e204a3bad99ada3c44165672fd68cfa568c68416033368c49781a88f45b66f7
Opcode Fuzzy Hash: d219ab1346ad103a72136c0eb7527b20254134baae9c9dbc8ed693a69303b300
Instruction Fuzzy Hash: 6EB1C162B18B8982FA10DF16AC415BAA354E714BE4F858637DFEE17385DE3EE041C790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726A95AF0 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7be5e0fb955e2cb9c7a6b1c02c123d433ce6c80f5f7aac7308550de260ab904c
Instruction ID: dc6fe89596c20408c10f1de9f5584b1b252ac9b0d843092fa7de7ca50152a5ac
Opcode Fuzzy Hash: 7be5e0fb955e2cb9c7a6b1c02c123d433ce6c80f5f7aac7308550de260ab904c
Instruction Fuzzy Hash: 72D1C472608A848AD725EF15EC406AAB770F785784F940136EB9E47B98EF3DE640CF00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269D4010 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 255c0740533a1b290c99347d006bb036fb270b18ebbbc5cd7f23ddee4428aea7
Instruction ID: 07c2ab35f9d6c6b731bb1d219d3e50faf62b1f5f6ebdd8dca51f6c0b7db56549
Opcode Fuzzy Hash: 255c0740533a1b290c99347d006bb036fb270b18ebbbc5cd7f23ddee4428aea7
Instruction Fuzzy Hash: 77D1B921A0C38244F76F7A599D1C7BA9D90CF63B84F44423ACB990B7E6CF6DA185C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726A911E0 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a09343d637f6ef2daf343fcc53563eb6a6c199aa7766768f12700adf6ba88744
Instruction ID: 5b01f6840e0e98c9a1d1573a491ce90ff3dadb3ba0e1911daecd6bf89106642c
Opcode Fuzzy Hash: a09343d637f6ef2daf343fcc53563eb6a6c199aa7766768f12700adf6ba88744
Instruction Fuzzy Hash: 28C14D62B0A68142EA65A715AD00BBFE7B5EB457D0FD40136DA9E077C1EF3CEA41CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726AAEE30 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6c24745f5d7c445cd93b2becb872d1e32f5011120fd4cca9a71bd227e031d94
Instruction ID: a218fbfc94331091c086aadbba1276f8106aeb8e0e912529bde51b37adae2efa
Opcode Fuzzy Hash: e6c24745f5d7c445cd93b2becb872d1e32f5011120fd4cca9a71bd227e031d94
Instruction Fuzzy Hash: 75B1C432A09A8585EA24AF19ED003BAB3B0FB54798F844233DE8D17795DF3CE585CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269D6180 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65fd9828a93059340d5fe71b4d20544b554ed8b68ff946b2002e0e52e819bf4d
Instruction ID: 7f88d3a39b155bcb765447d99f6be851a053b1b5117f319947569a517ddaa09a
Opcode Fuzzy Hash: 65fd9828a93059340d5fe71b4d20544b554ed8b68ff946b2002e0e52e819bf4d
Instruction Fuzzy Hash: 93D1153260CAC291EA70AB11E8547EBE3A4FB85784F94413ADBCD07A59DF7CD089DB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726A8FB80 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbe25fff2abbc05a8932db65442528b7810d8f8d8409e67079d5a1b4923a597
Instruction ID: 655d55492fd1818b929d3fae164fc0127a0debe3519e2e557e5464791c8186d6
Opcode Fuzzy Hash: 2fbe25fff2abbc05a8932db65442528b7810d8f8d8409e67079d5a1b4923a597
Instruction Fuzzy Hash: 85B1D622A09B8342EF65AB11AC40BBBE2A5EF45BD0F944136DA9D077C5DF3CE541CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726A85170 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b34f743769e33bd8170930bb992328d68c955085acb8441ff049ed66d6f230f
Instruction ID: 22921c30b6965509b5ecc712a0e72ddf4172a7e7f4f76ee1d8a03b24615a0508
Opcode Fuzzy Hash: 9b34f743769e33bd8170930bb992328d68c955085acb8441ff049ed66d6f230f
Instruction Fuzzy Hash: 72A1FB22A0978586EBA5AF15AC407BFE7A1EB84B94F840136DE9E07784DF3CE551CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726962E60 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 658f60de41e95a11fed2580dcc01c5b4c92e7e72d0af88d8f40c57abb6a52829
Instruction ID: c3dc75ae25b513cf34caf98142fbf4c0c97e1ccf3f04af9c227fab6d5016f4b3
Opcode Fuzzy Hash: 658f60de41e95a11fed2580dcc01c5b4c92e7e72d0af88d8f40c57abb6a52829
Instruction Fuzzy Hash: C6A1C022A15F8585EA52EB39DC5163BB364FF567C4F42D32BEE5E22650DF38E4828700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269B3D80 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5442804429211f87c1d5e8effadf212f6e549938ea8e78cd908e63f315c3d1f
Instruction ID: 65e14bbe771d792c9e56786c1fdc3a3924aaa87cd78e0d2fd2b787f9cac2fe60
Opcode Fuzzy Hash: f5442804429211f87c1d5e8effadf212f6e549938ea8e78cd908e63f315c3d1f
Instruction Fuzzy Hash: 6E71FB62B1464643EB54EE16AC1427FF652EB95BD0F88823BDE9E477C4DE3CE8019B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269628D0 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01abe0dd8cf27e65e8f0201d6e002b961e78fcb80ced531ce4ae69ce846ad42f
Instruction ID: e3186f8fd1eb9147f83ed9f2b5cd2941a19ec942171d78911abad0405909736e
Opcode Fuzzy Hash: 01abe0dd8cf27e65e8f0201d6e002b961e78fcb80ced531ce4ae69ce846ad42f
Instruction Fuzzy Hash: 16812953E29B8141DA129B399C511BAA360FFD6BD4F50973BDE9E23391EF38E581C600

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726985D30 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8db798f9dba8ee9a919ba30d2de066c09c01fe636c87599217614e0428a0ceb8
Instruction ID: 5817d57bbd4eb080b2770175d343722ff0a33f22026160ce0a2043cf2e3e87ea
Opcode Fuzzy Hash: 8db798f9dba8ee9a919ba30d2de066c09c01fe636c87599217614e0428a0ceb8
Instruction Fuzzy Hash: D871D0F1A1964692EA60AE059D042BAE753EB55FC4FC4423ADF9E07781DE3CF905CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72697CBB0 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ae32ec992b0a09d619c8bc15b7c50a4406576796c83bcbd8fd86b045e3239df
Instruction ID: bb31e28f6221f2ac831f3145790e33d4cc49269abed2a37b4d515eabe04d4b06
Opcode Fuzzy Hash: 7ae32ec992b0a09d619c8bc15b7c50a4406576796c83bcbd8fd86b045e3239df
Instruction Fuzzy Hash: C881D1A2714A05CAFE61AB16DC0476BAB64FB49BD4F84813BEE8D0B794DE3CD541CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72697CEF0 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90a5bd18fe944d145f98409c7674ddd1fd33efb3f9b91061aee746c814359086
Instruction ID: 3763f70e38cc608ea2961c44fe5e2ab764f53f92a65b335ab0a03823d59889af
Opcode Fuzzy Hash: 90a5bd18fe944d145f98409c7674ddd1fd33efb3f9b91061aee746c814359086
Instruction Fuzzy Hash: 4771AF6272865186EA25AB16DC0436BAB90FB4ABC4F80913BEEDD47785DF3DD101CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72697C8F0 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c190279b81858a2543755868a29043998ef9ec335caa70a2f0a246358776d3f0
Instruction ID: aff953285b7b903a9fa02a7025081ff256c16d6723550b9abe8940ea37e72d0c
Opcode Fuzzy Hash: c190279b81858a2543755868a29043998ef9ec335caa70a2f0a246358776d3f0
Instruction Fuzzy Hash: D661A372718B45C6EA55AB26DC003AAA7A1FB49BD4F80513BEE8D07B44DF3CE151CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF72697D550 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4a13eb7cbaaa7fd6bfbc693e01c93c03547ade0e4bd78759ce0543d67fc80d1
Instruction ID: ac9c70a4fc80336381fff01a15be672dac0a33747f396ab664773428e550df32
Opcode Fuzzy Hash: d4a13eb7cbaaa7fd6bfbc693e01c93c03547ade0e4bd78759ce0543d67fc80d1
Instruction Fuzzy Hash: BA61D8A2708A8581EA51EF19DC403BBB790FB84B94F849236DE9E537D4DF38D949CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726963E40 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42c811b6780832f41fbaa7d1d8f98580e0492c7377d6a479e891913604b807e3
Instruction ID: 563256760621458e090019cd470dcf8b308c5b5feccdd9889c54c0d9c54516eb
Opcode Fuzzy Hash: 42c811b6780832f41fbaa7d1d8f98580e0492c7377d6a479e891913604b807e3
Instruction Fuzzy Hash: 42513863B1574147EB259A329D0022AAAA1FF95BD0F48D339DF6B53B81EF3CE0558710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726946990 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56356264ff5d9f786e01c6ad7269cc06c844ccad726b2286a67cceaecda63175
Instruction ID: 392f49b28a9736c970daeeca825553e3a84562ef96d9f5b12918deb1774c17a0
Opcode Fuzzy Hash: 56356264ff5d9f786e01c6ad7269cc06c844ccad726b2286a67cceaecda63175
Instruction Fuzzy Hash: D8516AE2B45A6843ED08DB5A6C228BADB56E3D8FC0785E037EE4E57394DD3CD645C200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269AEFD0 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f833a07b69cc64efa917a4b762666a10a94aac88684601427120dfb977dbb90
Instruction ID: ed4a2e590443be65766523c2c471dbad31fae710984ef081bcee7f7066f65511
Opcode Fuzzy Hash: 4f833a07b69cc64efa917a4b762666a10a94aac88684601427120dfb977dbb90
Instruction Fuzzy Hash: 665114A3B15A4182EA459F25DC003B9A690E744BB4F80933BCEBE173D8EF78D991C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726964A60 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3890630d99347d38a884470a7af5bfa8cb0aab664709641698bdcf190af8bf70
Instruction ID: 402acaeb673c1fa63660404f2f562b861a263e5abd62d3548f8475b3a87a1b26
Opcode Fuzzy Hash: 3890630d99347d38a884470a7af5bfa8cb0aab664709641698bdcf190af8bf70
Instruction Fuzzy Hash: DA517B73E2E76146DA229B71ED10AA9A610EF13FC4B95C336DE5D23AC5DF30D4928704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726A72650 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5062850c9fc2ca1f92da2fc79e9f8a5b03707a4e8660c7f7bcd0698a380a4f33
Instruction ID: 007d706f7f1f6d2275ec52b2a80a918ddf7278d081006fad33b06af7e2f3f050
Opcode Fuzzy Hash: 5062850c9fc2ca1f92da2fc79e9f8a5b03707a4e8660c7f7bcd0698a380a4f33
Instruction Fuzzy Hash: 21510822B0C6C542FA669B24EC40BAFA7A1EB44794F845236DEAD437C8DF2DE541CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726946EB0 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08437b7bba205a07da11589563883baa253979146a0f540571b7698a3dc96eec
Instruction ID: 92ee2602658998da266a299766b90a532cd34980f132810e32a2d1243d495645
Opcode Fuzzy Hash: 08437b7bba205a07da11589563883baa253979146a0f540571b7698a3dc96eec
Instruction Fuzzy Hash: EA414862F41A2587DA24EF16BC12BABE764F754BC8F885022EF8D4BB51DE3CE541C604

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269CD570 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3adedc40d8be8c01d2473806a1f0789a3003cf65887a970c9d60731358c20fe6
Instruction ID: 2fb9d1f5e0ff8304c133473415f20b420a16ca005194480f50466764c3e0258d
Opcode Fuzzy Hash: 3adedc40d8be8c01d2473806a1f0789a3003cf65887a970c9d60731358c20fe6
Instruction Fuzzy Hash: A84101A2B16A8583FE49DE1A9D143797651E7487B4F84873ACE7E033C0DE3CE895CA10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726963A10 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88149ea2517c0ffc31827766d4ca7d4b89d2f7af9dcf1f4b4e6cb9b3ae329e76
Instruction ID: 3e1e8916a7389ebd5b4141d7292b7e75a0d11347105d4dc42391d1c827ea15a6
Opcode Fuzzy Hash: 88149ea2517c0ffc31827766d4ca7d4b89d2f7af9dcf1f4b4e6cb9b3ae329e76
Instruction Fuzzy Hash: 4C413752B18B4541FE10AA2A9C112BBF291DF55BF0F54A33EDEBD07BC1EE3DA4419A10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269B6200 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41c1c4fa0aca6c16a172649c6f70414ea8877c7622f33cddfb8076576715455a
Instruction ID: 4b4b3127484002d6f39553719816f70cbee42cd7060ab3ced22ac6b7b8de4fb6
Opcode Fuzzy Hash: 41c1c4fa0aca6c16a172649c6f70414ea8877c7622f33cddfb8076576715455a
Instruction Fuzzy Hash: 7041C4F3F19A4643EA58DA50DC109796722FB92BF0BE0E33ACA6A077C4DF2C74418610

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269470D0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 645f91ae4e229d71b80288715c2ea3a9f5e2166dfefa8600bc7b9c4c9a15cc1e
Instruction ID: 319b6f7a9d1cea77b5ff9e2c44a3a707988de08464f5a6db42206f02d192542d
Opcode Fuzzy Hash: 645f91ae4e229d71b80288715c2ea3a9f5e2166dfefa8600bc7b9c4c9a15cc1e
Instruction Fuzzy Hash: 5D2107D274521943AD08AFA76E618BBC255BB98BC0745B033DE4D5FF94DD3CE151C200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269B1A20 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3024f791a60bcf654e32cbf337686ee0e594fbc30427d05e970742da49c9df52
Instruction ID: aa05e3ff0cadaf9da142e36df27fb32020a2c9015ecb0806638389e23a0450f0
Opcode Fuzzy Hash: 3024f791a60bcf654e32cbf337686ee0e594fbc30427d05e970742da49c9df52
Instruction Fuzzy Hash: 9E2149A3B1586903FA28DE026D51936E641EB84FF0B98913ACD5E17BD0ED38A841CD10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269D8B50 Relevance: 24.2, APIs: 16, Instructions: 157
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNEL32 ref: 00007FF7269D8BC3
MapViewOfFile.KERNEL32 ref: 00007FF7269D8C01
VirtualQuery.KERNEL32 ref: 00007FF7269D8C28
CloseHandle.KERNEL32 ref: 00007FF7269D8C42
GetCurrentProcess.KERNEL32 ref: 00007FF7269D8C53
GetCurrentProcess.KERNEL32 ref: 00007FF7269D8C59
DuplicateHandle.KERNEL32 ref: 00007FF7269D8C80
GetLastError.KERNEL32 ref: 00007FF7269D8CFA
GetLastError.KERNEL32 ref: 00007FF7269D8D0C
CloseHandle.KERNEL32 ref: 00007FF7269D8D1F
GetLastError.KERNEL32 ref: 00007FF7269D8D27
UnmapViewOfFile.KERNEL32 ref: 00007FF7269D8D3B
GetLastError.KERNEL32 ref: 00007FF7269D8D60
UnmapViewOfFile.KERNEL32 ref: 00007FF7269D8D74
_Init_thread_header.LIBCMT ref: 00007FF7269D8D83
_Init_thread_header.LIBCMT ref: 00007FF7269D8DB9

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: ErrorFileLast$HandleView$CloseCurrentInit_thread_headerProcessUnmap$CreateDuplicateMappingQueryVirtual
String ID:
API String ID: 1008269210-0
Opcode ID: 51fb7619efac73553371b278ba13fa55993630ccd7263edf129eab70f8755630
Instruction ID: 16872141a1751f759a63aec14670c95c4ce9d148a219b1cdacebebea0fdb2223
Opcode Fuzzy Hash: 51fb7619efac73553371b278ba13fa55993630ccd7263edf129eab70f8755630
Instruction Fuzzy Hash: 38615E21A09A0696EF10BB61EC5467BA3A0FB44B90FD0453BDA5E437A1DF3CE945CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726ABA340 Relevance: 19.5, APIs: 3, Strings: 8, Instructions: 294
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF726ABA431
GetCurrentThread.KERNEL32 ref: 00007FF726ABA48B
GetCurrentProcess.KERNEL32 ref: 00007FF726ABA494

Strings

, <unknown module>, xrefs: 00007FF726ABA7EA
, %s, line %lu + 0x%lX byte(s), xrefs: 00007FF726ABA902
, xrefs: 00007FF726ABA842
, %s() + 0x%llX byte(s), xrefs: 00007FF726ABA887
(, xrefs: 00007FF726ABA8E2
<unknown module>, xrefs: 00007FF726ABA7BA
, %s(0x%016llX) + 0x%llX byte(s), xrefs: 00007FF726ABA747
0x%016llX, xrefs: 00007FF726ABA6B1

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: Current$CaptureContextProcessThread
String ID: $ <unknown module>$($, %s() + 0x%llX byte(s)$, %s(0x%016llX) + 0x%llX byte(s)$, %s, line %lu + 0x%lX byte(s)$, <unknown module>$0x%016llX
API String ID: 2575623420-2378759734
Opcode ID: 9bc3b0c22a99c9d9eff0e964a6668da6a5293d3ec7c5b5305d712701bc36a914
Instruction ID: a684579c0dd2b340e0a12a5a37d03c689cfc3f3d803fdc9763df0f23cabeb7f7
Opcode Fuzzy Hash: 9bc3b0c22a99c9d9eff0e964a6668da6a5293d3ec7c5b5305d712701bc36a914
Instruction Fuzzy Hash: EFE14C62A1CBC585EA61AF15EC007ABA3A0FBD9780F804236DACE46B95DF3CD145CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726ABABA0 Relevance: 16.5, APIs: 1, Strings: 10, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32 ref: 00007FF726ABABB4

Strings

Wrote crash dump file ", xrefs: 00007FF726ABB3A2
=, xrefs: 00007FF726ABAE95
DumpType, xrefs: 00007FF726ABAF3E, 00007FF726ABAF84
Could not write crash dump file: , xrefs: 00007FF726ABB55F
p file ", xrefs: 00007FF726ABB3F8
SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps, xrefs: 00007FF726ABAE86
Exception Code: 0x%08X, xrefs: 00007FF726ABAD52
=, xrefs: 00007FF726ABAEB9
.%%%%%%.dmp, xrefs: 00007FF726ABB148
CustomDumpFlags, xrefs: 00007FF726ABB1EA, 00007FF726ABB25E

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: .%%%%%%.dmp$=$=$Could not write crash dump file: $CustomDumpFlags$DumpType$Exception Code: 0x%08X$SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps$Wrote crash dump file "$p file "
API String ID: 32694325-3937492824
Opcode ID: 52a00c60c8e276db3e2a911259c251c1aa7f17fb5fa7cd2569d02b0f7624b746
Instruction ID: 4be25918fd47df617fe9c0761e79a9f9b9e181774326b1308481005a9feca761
Opcode Fuzzy Hash: 52a00c60c8e276db3e2a911259c251c1aa7f17fb5fa7cd2569d02b0f7624b746
Instruction Fuzzy Hash: 11D0A921C0CA8E84FF02B320ACD07B6D6A0CB39300FE00033D10F082A2DE1D65D48F62

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726AC2030 Relevance: 14.3, APIs: 4, Strings: 4, Instructions: 327fileCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF726AC211A
GetCurrentProcess.KERNEL32 ref: 00007FF726AC212A
DuplicateHandle.KERNEL32 ref: 00007FF726AC2152
CreateFileW.KERNEL32 ref: 00007FF726AC23A2

Strings

output, xrefs: 00007FF726AC23C6
NUL, xrefs: 00007FF726AC22BB
ile for , xrefs: 00007FF726AC24B1
input, xrefs: 00007FF726AC23CD

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: CurrentProcess$CreateDuplicateFileHandle
String ID: NUL$ile for $input$output
API String ID: 627569853-3189213456
Opcode ID: c064e05e91c5e35c62888da31757dfe013a9d564793eeb3e802817bdab640d52
Instruction ID: b343689eb07991b72e3c39513701c8382b56369e56c9fa8009b97970d48e7b57
Opcode Fuzzy Hash: c064e05e91c5e35c62888da31757dfe013a9d564793eeb3e802817bdab640d52
Instruction Fuzzy Hash: 02F19372608AC181EB20EB15EC447AFA761FB85BA4F804636DAAD07BD5DF7CD184CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269D7740 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 199COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF7269D7826
GetLastError.KERNEL32 ref: 00007FF7269D791D
_Init_thread_header.LIBCMT ref: 00007FF7269D7A92

Strings

//?/, xrefs: 00007FF7269D77BD
\\?\, xrefs: 00007FF7269D795E
\\?\, xrefs: 00007FF7269D788E
UNC\, xrefs: 00007FF7269D79B8

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: CurrentDirectoryErrorInit_thread_headerLast
String ID: //?/$UNC\$\\?\$\\?\
API String ID: 3955425628-3199060882
Opcode ID: ae59c6ec1b98319f96cc2b0b4db4ad16b31cfa1499534cc9d767164fe07ac8ef
Instruction ID: ee257def082af57697fe6ffdc00ae2209973479eb96d95a620c833b197823438
Opcode Fuzzy Hash: ae59c6ec1b98319f96cc2b0b4db4ad16b31cfa1499534cc9d767164fe07ac8ef
Instruction Fuzzy Hash: 24917322A0CA8281EA60BB11EC583BBE761EB85794F804537DBCE07A95CF7DD585CF10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726ABCAF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 66COMMON

Download Yara Rule

APIs

_Init_thread_header.LIBCMT ref: 00007FF726ABCB63
_Init_thread_header.LIBCMT ref: 00007FF726ABCBE5

Part of subcall function 00007FF726CAC188: EnterCriticalSection.KERNEL32(?,?,?,00007FF7269B900E), ref: 00007FF726CAC198

Strings

stats, xrefs: 00007FF726ABCBAB
Display statistics as json data, xrefs: 00007FF726ABCBF7
stats-json, xrefs: 00007FF726ABCC31
>, xrefs: 00007FF726ABCB7D
Enable statistics output from program (available with Asserts), xrefs: 00007FF726ABCB71

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: Init_thread_header$CriticalEnterSection
String ID: >$Display statistics as json data$Enable statistics output from program (available with Asserts)$stats$stats-json
API String ID: 640747144-2065831512
Opcode ID: df629f1e5dcb8515119b94026f9390af8feeed83411a3016fadc307583017d19
Instruction ID: ab9c55839e419eae9d4337721b2da296a2e75834c500c2b4ea26815dbb7deeaf
Opcode Fuzzy Hash: df629f1e5dcb8515119b94026f9390af8feeed83411a3016fadc307583017d19
Instruction Fuzzy Hash: 6141E531919A4AD5EA41EB14EC906ABB3B0FB94350FD00133E64E426A5DF3CE989CF21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269D50C0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 189COMMON

Download Yara Rule

Strings

\\.\, xrefs: 00007FF7269D51AF

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID: \\.\
API String ID: 0-2900601889
Opcode ID: c2caaacee5c02b0cf18657034be1123e210c6481ab94a277a1d38b1f294ab22a
Instruction ID: 6df66d5763b3e84b6e182b450ca0728378500c315c82225d6beae69869671899
Opcode Fuzzy Hash: c2caaacee5c02b0cf18657034be1123e210c6481ab94a277a1d38b1f294ab22a
Instruction Fuzzy Hash: D3919132A08BC685EB60AB15EC583BBB364FB85754F90423ADADD43695DF7CE085CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269D5960 Relevance: 9.2, APIs: 6, Instructions: 247COMMON

Download Yara Rule

APIs

_Init_thread_header.LIBCMT ref: 00007FF7269D5DE5

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: Init_thread_header
String ID:
API String ID: 3738618077-0
Opcode ID: 7640adcdbde831af2c48903be685c90c9770137b8e460e216112116f9ea7a61f
Instruction ID: f52f61f193f33946bc5f76d8cc3a253721f91140b5649a215cf159d1975f2e51
Opcode Fuzzy Hash: 7640adcdbde831af2c48903be685c90c9770137b8e460e216112116f9ea7a61f
Instruction Fuzzy Hash: D7D14931A0C64685EA21FB24EC842BBA360FB94794FD04137DB8D476A5DE3CE984CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726AB67F0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 78COMMON

Download Yara Rule

APIs

_Init_thread_header.LIBCMT ref: 00007FF726AB6851

Strings

Comma separated list of debug counter skip and count, xrefs: 00007FF726AB68B9
print-debug-counter, xrefs: 00007FF726AB6962
Print out debug counter info after all counters accumulated, xrefs: 00007FF726AB693C
;, xrefs: 00007FF726AB6948

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: Init_thread_header
String ID: ;$Comma separated list of debug counter skip and count$Print out debug counter info after all counters accumulated$print-debug-counter
API String ID: 3738618077-2671949431
Opcode ID: 7eafd3ac2c10f579ea0d60ae920bd44b0ee471b0f619cca9b15a1a950036cfe4
Instruction ID: b161b85bf9ea9c4e0fe7c555ba580a269a0b07d177167be6ac2c9f96eeb4f899
Opcode Fuzzy Hash: 7eafd3ac2c10f579ea0d60ae920bd44b0ee471b0f619cca9b15a1a950036cfe4
Instruction Fuzzy Hash: A0413B32918B8685EA00EB14FC403ABB7B4FB98344F900237E68C466A4DF7DE556CF21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726AB6510 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57libraryloaderCOMMON

Download Yara Rule

APIs

_Init_thread_header.LIBCMT ref: 00007FF726AB65A3
GetModuleHandleW.KERNEL32 ref: 00007FF726AB65B8
GetProcAddress.KERNEL32 ref: 00007FF726AB65C8

Strings

RtlGetVersion, xrefs: 00007FF726AB65BE
ntdll.dll, xrefs: 00007FF726AB65B1

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: AddressHandleInit_thread_headerModuleProc
String ID: RtlGetVersion$ntdll.dll
API String ID: 220378049-1489217083
Opcode ID: 01395aa5fb9e00bde2f525c47c134d6d5ad053b0a12298080d0673a6a29a3254
Instruction ID: 6a87f21eb384720790254f3742ed6b8396b2efa14c791b2f56a741d24813b3f0
Opcode Fuzzy Hash: 01395aa5fb9e00bde2f525c47c134d6d5ad053b0a12298080d0673a6a29a3254
Instruction Fuzzy Hash: 2421B272E0890B81FF20B724EC514B7A261EF98710FE45337C62E462E5CE2CB4918E35

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726AB6380 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

_Init_thread_header.LIBCMT ref: 00007FF726AB63E3
GetModuleHandleW.KERNEL32(?,?,?,?,00007FF7269D8F8F,?,?,?,?,?,?,?,-00000018,00007FF7269D8E71), ref: 00007FF726AB63F8
GetProcAddress.KERNEL32(?,?,?,?,00007FF7269D8F8F,?,?,?,?,?,?,?,-00000018,00007FF7269D8E71), ref: 00007FF726AB6408

Strings

RtlGetVersion, xrefs: 00007FF726AB63FE
ntdll.dll, xrefs: 00007FF726AB63F1

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: AddressHandleInit_thread_headerModuleProc
String ID: RtlGetVersion$ntdll.dll
API String ID: 220378049-1489217083
Opcode ID: fa031930c8ed301832df1a66374401442054c2566c38c63588a875a8775506ec
Instruction ID: b26794ca8f77cbc09a36773d874b71eedb85b87bd9cd56e1526d4b239d401c93
Opcode Fuzzy Hash: fa031930c8ed301832df1a66374401442054c2566c38c63588a875a8775506ec
Instruction Fuzzy Hash: BD111D32A0864A86FF15FB15EC905B6B361EB98750FD08137CA0D472A0DE3CE445CF21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269D9BB0 Relevance: 7.6, APIs: 5, Instructions: 131fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7269D7740: GetCurrentDirectoryW.KERNEL32 ref: 00007FF7269D7826

CreateFileW.KERNEL32 ref: 00007FF7269D9C73
GetLastError.KERNEL32 ref: 00007FF7269D9CBA
_Init_thread_header.LIBCMT ref: 00007FF7269D9DAE
_Init_thread_header.LIBCMT ref: 00007FF7269D9DE4
_Init_thread_header.LIBCMT ref: 00007FF7269D9E1A

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: Init_thread_header$CreateCurrentDirectoryErrorFileLast
String ID:
API String ID: 2661925990-0
Opcode ID: 291ef8997e0c22b153d526582dd0f7c5c5c901e15e429f9d3233f3c7c812bb74
Instruction ID: 917339e3add75d9edb8e5852457d6afc86baa5662f3cc3879781d6731716dcc1
Opcode Fuzzy Hash: 291ef8997e0c22b153d526582dd0f7c5c5c901e15e429f9d3233f3c7c812bb74
Instruction Fuzzy Hash: F1613031A08A8689EA61FB14EC543BBB360FB94354FD04637DA8D426A5DF3CE485CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269D85E0 Relevance: 7.6, APIs: 5, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7269D7740: GetCurrentDirectoryW.KERNEL32 ref: 00007FF7269D7826

GetFileAttributesW.KERNEL32 ref: 00007FF7269D863C
GetLastError.KERNEL32 ref: 00007FF7269D865B
_Init_thread_header.LIBCMT ref: 00007FF7269D876F
_Init_thread_header.LIBCMT ref: 00007FF7269D87A5
_Init_thread_header.LIBCMT ref: 00007FF7269D87DB

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: Init_thread_header$AttributesCurrentDirectoryErrorFileLast
String ID:
API String ID: 442476566-0
Opcode ID: 4a91a104c7b358ce53a2d6eb1eac132a19192ef84c3f13e480e5761ff1aaaa21
Instruction ID: c583ecaf279c214f854483e11203d1c8f4ba6785150a5e2d364b03200c5f724e
Opcode Fuzzy Hash: 4a91a104c7b358ce53a2d6eb1eac132a19192ef84c3f13e480e5761ff1aaaa21
Instruction Fuzzy Hash: FB513631A18A0695FA21BB14ED943BBB360FB44B54FD04537D68D422A1DF3CE985CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269D7E20 Relevance: 7.6, APIs: 5, Instructions: 105fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7269D7740: GetCurrentDirectoryW.KERNEL32 ref: 00007FF7269D7826

CreateFileW.KERNEL32 ref: 00007FF7269D7EC4
GetLastError.KERNEL32 ref: 00007FF7269D7ED3
CloseHandle.KERNEL32 ref: 00007FF7269D7F5D
_Init_thread_header.LIBCMT ref: 00007FF7269D7FB7
_Init_thread_header.LIBCMT ref: 00007FF7269D7FE9

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: Init_thread_header$CloseCreateCurrentDirectoryErrorFileHandleLast
String ID:
API String ID: 3825668548-0
Opcode ID: 12c523a931c8552ce2892a815677203797a91d2e1a19c8a61bf4324c36964938
Instruction ID: 3373f99d7198c29283ba883608764e1a54beb8585147d8a9edbef0a092831f09
Opcode Fuzzy Hash: 12c523a931c8552ce2892a815677203797a91d2e1a19c8a61bf4324c36964938
Instruction Fuzzy Hash: AF514E31A08A4681EA21BB15EC5437BA361FB847A0FC04637DA9D077E4CF3DE885CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269D9A20 Relevance: 7.6, APIs: 5, Instructions: 95timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32 ref: 00007FF7269D9B0B
SystemTimeToFileTime.KERNEL32 ref: 00007FF7269D9B19
SetFileTime.KERNEL32 ref: 00007FF7269D9B38
GetLastError.KERNEL32 ref: 00007FF7269D9B67
CloseHandle.KERNEL32 ref: 00007FF7269D9B72

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: Time$FileSystem$CloseErrorHandleLast
String ID:
API String ID: 2155180559-0
Opcode ID: 36058778d295e7f024c3eca28ef4beff74af5ce699b0092d9583bc6ad1a634aa
Instruction ID: e7c4c71555cdea690851b778b54f58a62fe2dafbcebfd38048dc9ca7b693228a
Opcode Fuzzy Hash: 36058778d295e7f024c3eca28ef4beff74af5ce699b0092d9583bc6ad1a634aa
Instruction Fuzzy Hash: 44419B22A0CBC645EB24EB15FC553BBA351EB84794F94403ADBCE43A99CF6CE445CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269A69F0 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

_Init_thread_header.LIBCMT ref: 00007FF7269A6A67

Part of subcall function 00007FF726CAC188: EnterCriticalSection.KERNEL32(?,?,?,00007FF7269B900E), ref: 00007FF726CAC198

Part of subcall function 00007FF726CAC1F0: EnterCriticalSection.KERNEL32(?,?,?,00007FF726AB2053,?,?,?,00007FF7269C17B9), ref: 00007FF726CAC200
Part of subcall function 00007FF726CAC1F0: LeaveCriticalSection.KERNEL32(?,?,?,00007FF726AB2053,?,?,?,00007FF7269C17B9), ref: 00007FF726CAC240

Strings

!, xrefs: 00007FF7269A6F76
Path to profiled binary is empty!, xrefs: 00007FF7269A6F67

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: CriticalSection$Enter$Init_thread_headerLeave
String ID: !$Path to profiled binary is empty!
API String ID: 1766094999-1469474377
Opcode ID: dd056dfc9918a3398d3b7786b4f478c0956d198cd734c4222e1eef418ad5e205
Instruction ID: 54c97e7428d1e9a09f58d094329f76bc9ada45c9e4b5695d2d9924d0c5d481fb
Opcode Fuzzy Hash: dd056dfc9918a3398d3b7786b4f478c0956d198cd734c4222e1eef418ad5e205
Instruction Fuzzy Hash: 07E17F72A08A8681EB21EF14EC513FAA3A0FB94744F90853ADACD07795DF7DE584CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269DAD60 Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

APIs

_Init_thread_header.LIBCMT ref: 00007FF7269DADAA

Part of subcall function 00007FF726CAC188: EnterCriticalSection.KERNEL32(?,?,?,00007FF7269B900E), ref: 00007FF726CAC198

_Init_thread_header.LIBCMT ref: 00007FF7269DAE7C
_Init_thread_header.LIBCMT ref: 00007FF7269DAF41
_Init_thread_header.LIBCMT ref: 00007FF7269DAF7C

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: Init_thread_header$CriticalEnterSection
String ID:
API String ID: 640747144-0
Opcode ID: d4e032091d8839bf8b4d9966ee54002209330d60828db4cde761e3397479414b
Instruction ID: 891fc5a48624528ed7467078ad9ed95f33cc49c20c50fc394a470abc5070f05f
Opcode Fuzzy Hash: d4e032091d8839bf8b4d9966ee54002209330d60828db4cde761e3397479414b
Instruction Fuzzy Hash: BC515BB1A4964A85EB11BB18ED841B7A3A0EF44791FC0423BDA4D432A0DE3CF891CF21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726A99B60 Relevance: 6.1, APIs: 4, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2283aa5cf33fb716afb908f5cbb69020ea3ffae443ed4747b9c96cd8f9f48a79
Instruction ID: bd2010a8f53f17c936ec61fcae96eec8dd38dbd9fa0b74ccd014e32cd0f4a302
Opcode Fuzzy Hash: 2283aa5cf33fb716afb908f5cbb69020ea3ffae443ed4747b9c96cd8f9f48a79
Instruction Fuzzy Hash: 6B515031A0960696FA11EB19DC946BAA371FF55755FE44933CA0E432A0DF3CFA42CE21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269DAA30 Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7269D3AA7), ref: 00007FF7269DAA76
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7269D3AA7), ref: 00007FF7269DAAEF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7269D3AA7), ref: 00007FF7269DAB42
_Init_thread_header.LIBCMT ref: 00007FF7269DAB83

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorInit_thread_headerLast
String ID:
API String ID: 2959056455-0
Opcode ID: 211a1e1c3cf25273f420cdaca2cc9cf79598356025b05eee94ed52e2d6f510df
Instruction ID: 5ce24b20a880a35e56eaa57182fd12d92192dd9e56da7a79547c1590dc7fb7e0
Opcode Fuzzy Hash: 211a1e1c3cf25273f420cdaca2cc9cf79598356025b05eee94ed52e2d6f510df
Instruction Fuzzy Hash: 83419521A08B4695EA10FF16ED4467AA361FB94790F84863BDF4D03791DF3CE5A1CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269DA8B0 Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7269DA8EF
MultiByteToWideChar.KERNEL32 ref: 00007FF7269DA964
GetLastError.KERNEL32 ref: 00007FF7269DA9B9
_Init_thread_header.LIBCMT ref: 00007FF7269DA9F9

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorInit_thread_headerLast
String ID:
API String ID: 2959056455-0
Opcode ID: 6a007e9e3ccb236e7f93b031392c2f5255d08e62e39c625a742e1a85e37dba9a
Instruction ID: bbcde4f3a7112b768381160edc7749ca7e2c536ecdd2669ae8ecf143b2257d14
Opcode Fuzzy Hash: 6a007e9e3ccb236e7f93b031392c2f5255d08e62e39c625a742e1a85e37dba9a
Instruction Fuzzy Hash: 05419371A08A4591EA10FB56EC4467AA3A0FB44B90FC1453BCB8D43790DF3DE5A1CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269D84C0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00007FF7269D84EA
GetLastError.KERNEL32 ref: 00007FF7269D8588
_Init_thread_header.LIBCMT ref: 00007FF7269D85AD

Part of subcall function 00007FF726CAC188: EnterCriticalSection.KERNEL32(?,?,?,00007FF7269B900E), ref: 00007FF726CAC198

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: CriticalEnterErrorFinalHandleInit_thread_headerLastNamePathSection
String ID:
API String ID: 953378473-0
Opcode ID: 7be586784710530923c52922c0b6db321241bc058ef2e3fc7d5d7e99453bf397
Instruction ID: c05f05d03d332e31d71b0cfa87a65de50fe7d4e1b9735771fcbe5f6e95cf3738
Opcode Fuzzy Hash: 7be586784710530923c52922c0b6db321241bc058ef2e3fc7d5d7e99453bf397
Instruction Fuzzy Hash: 01316721A09A4691FA10FB56EE4467AA361FB44B90FD4847BCB5E83791DF3CF490CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7269D8E90 Relevance: 6.1, APIs: 4, Instructions: 70fileCOMMON

Download Yara Rule

APIs

UnmapViewOfFile.KERNEL32(?,?,?,?,?,?,?,-00000018,00007FF7269D8E71), ref: 00007FF7269D8EBD
FlushFileBuffers.KERNEL32(?,?,?,?,?,?,?,-00000018,00007FF7269D8E71), ref: 00007FF7269D8EFC
CloseHandle.KERNEL32(?,?,?,?,?,?,?,-00000018,00007FF7269D8E71), ref: 00007FF7269D8F06
_Init_thread_header.LIBCMT ref: 00007FF7269D8F64

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: File$BuffersCloseFlushHandleInit_thread_headerUnmapView
String ID:
API String ID: 3367882763-0
Opcode ID: 12c819d90866a52623a809c0c8f58d4ed6309c6e3dbfe7b910f4f32135169886
Instruction ID: 2f4758c3d4f1ad0fee3047565347eb57ee852561db8004566f1f6c0c7243db56
Opcode Fuzzy Hash: 12c819d90866a52623a809c0c8f58d4ed6309c6e3dbfe7b910f4f32135169886
Instruction Fuzzy Hash: C5314021A19A4685FE11BB29EE4917AA362EF50B81FD04137DA8D022A1CF3CF441CE21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF726B425E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 129COMMON

Download Yara Rule

APIs

_Init_thread_header.LIBCMT ref: 00007FF726B427C1

Strings

RVA 0x%x not found, xrefs: 00007FF726B42704
RVA 0x%x for %s not found, xrefs: 00007FF726B426D9

Memory Dump Source

Source File: 00000000.00000002.1676859084.00007FF726931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF726930000, based on PE: true

Associated: 00000000.00000002.1676845783.00007FF726930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677088897.00007FF726CAF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677157368.00007FF726D75000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677175722.00007FF726D76000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677194444.00007FF726D7E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677216629.00007FF726D93000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677236629.00007FF726DB1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1677251869.00007FF726DBD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff726930000_Mol2sxTjLw.jbxd

Similarity

API ID: Init_thread_header
String ID: RVA 0x%x for %s not found$RVA 0x%x not found
API String ID: 3738618077-2855063148
Opcode ID: 1409565409cf9d48d6118784d2128a6f9aeec7be1d91609a0495a751286c9747
Instruction ID: a8ee8c73c34b61ad0e4d363c21ee252c54fce3cd87e8c0ce55852fbf5f81fbb1
Opcode Fuzzy Hash: 1409565409cf9d48d6118784d2128a6f9aeec7be1d91609a0495a751286c9747
Instruction Fuzzy Hash: 45515F32A08A4685EA11AF15EC906AEB7A0FB84794FA44533DA4D03765DF3CE495DF10

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Mol2sxTjLw.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: Mol2sxTjLw.exePID: 3484, Parent PID: 2580

General

Chronological Activities

Disassembly

Analysis Process: Mol2sxTjLw.exePID: 3484, Parent PID: 2580COMMON

Execution Graph

Graph

Executed Functions

Function 00007FF726935430 Relevance: 28.7, APIs: 1, Strings: 15, Instructions: 659memoryCOMMON

Windows Analysis Report
Mol2sxTjLw.exe

Function 00007FF726935430 Relevance: 28.7, APIs: 1, Strings: 15, Instructions: 659
memoryCOMMON

Function 00007FF726A32AC0 Relevance: 59.1, Strings: 47, Instructions: 364
COMMON

Function 00007FF726AFDEF0 Relevance: 56.5, Strings: 45, Instructions: 288
COMMON

Function 00007FF726A32480 Relevance: 51.6, Strings: 41, Instructions: 394
COMMON

Function 00007FF726ABA0F0 Relevance: 43.8, APIs: 14, Strings: 11, Instructions: 94
libraryloaderCOMMON

Function 00007FF7269DB2A0 Relevance: 26.7, APIs: 13, Strings: 2, Instructions: 418
COMMON

Function 00007FF726ABFDF0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 185
synchronizationtimeCOMMON

Function 00007FF726AB5120 Relevance: 23.4, APIs: 12, Strings: 1, Instructions: 610
COMMON

Function 00007FF72697D870 Relevance: 15.5, Strings: 12, Instructions: 525
COMMON