Edit tour

Windows Analysis Report
hv7H7u7IvS.exe

Overview

General Information

Sample name:	hv7H7u7IvS.exe renamed because original name is a hash value
Original sample name:	50f45a0537eac244e3afa4f07684095d.exe
Analysis ID:	1432351
MD5:	50f45a0537eac244e3afa4f07684095d
SHA1:	3f1f70aff06ecaa65188072405edbf4778868deb
SHA256:	0b3f57e62dacdf7f1dddddbea20daced70e88ef547e795fbadfa124be5a422c2
Tags:	64exe
Infos:

Detection

Score:	5
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains sections with non-standard names

Program does not show much activity (idle)

Classification

Analysis Advice

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample reads itself and does not show any behavior, likely it performs some host environment checks which are compared to an embedded key

Process Tree

System is w10x64

hv7H7u7IvS.exe (PID: 1004 cmdline: "C:\Users\user\Desktop\hv7H7u7IvS.exe" MD5: 50F45A0537EAC244E3AFA4F07684095D)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: hv7H7u7IvS.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD6842C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF66DD6842C
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD58AF0 FindFirstFileExW,FindClose,	0_2_00007FF66DD58AF0
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD724C4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF66DD724C4
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD6842C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF66DD6842C

Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD7789C	0_2_00007FF66DD7789C
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD62680	0_2_00007FF66DD62680
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD61E60	0_2_00007FF66DD61E60
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD6E5FC	0_2_00007FF66DD6E5FC
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD7A5D8	0_2_00007FF66DD7A5D8
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD5A55D	0_2_00007FF66DD5A55D
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD6842C	0_2_00007FF66DD6842C
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD6F110	0_2_00007FF66DD6F110
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD640C4	0_2_00007FF66DD640C4
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD590C0	0_2_00007FF66DD590C0
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD62884	0_2_00007FF66DD62884
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD62064	0_2_00007FF66DD62064
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD74860	0_2_00007FF66DD74860
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD71518	0_2_00007FF66DD71518
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD63330	0_2_00007FF66DD63330
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD68278	0_2_00007FF66DD68278
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD6EA90	0_2_00007FF66DD6EA90
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD62270	0_2_00007FF66DD62270
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD6AA10	0_2_00007FF66DD6AA10
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD76950	0_2_00007FF66DD76950
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD57950	0_2_00007FF66DD57950
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD71518	0_2_00007FF66DD71518
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD59D2B	0_2_00007FF66DD59D2B
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD74CFC	0_2_00007FF66DD74CFC
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD66510	0_2_00007FF66DD66510
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD724C4	0_2_00007FF66DD724C4
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD63CC0	0_2_00007FF66DD63CC0
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD68CB0	0_2_00007FF66DD68CB0
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD62474	0_2_00007FF66DD62474
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD6842C	0_2_00007FF66DD6842C
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD76BCC	0_2_00007FF66DD76BCC
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD59B8B	0_2_00007FF66DD59B8B
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD77350	0_2_00007FF66DD77350

Source: C:\Users\user\Desktop\hv7H7u7IvS.exe

Code function: String function: 00007FF66DD52B10 appears 47 times

Source: classification engine

Classification label: clean5.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\hv7H7u7IvS.exe

Code function: 0_2_00007FF66DD58560 GetLastError,FormatMessageW,WideCharToMultiByte,

0_2_00007FF66DD58560

Source: hv7H7u7IvS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\hv7H7u7IvS.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\hv7H7u7IvS.exe

File read: C:\Users\user\Desktop\hv7H7u7IvS.exe

Jump to behavior

Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Section loaded: wintypes.dll	Jump to behavior

Source: hv7H7u7IvS.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: hv7H7u7IvS.exe

Static file information: File size 30408704 > 1048576

Source: hv7H7u7IvS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: hv7H7u7IvS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: hv7H7u7IvS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: hv7H7u7IvS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: hv7H7u7IvS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: hv7H7u7IvS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: hv7H7u7IvS.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: hv7H7u7IvS.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: hv7H7u7IvS.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: hv7H7u7IvS.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: hv7H7u7IvS.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: hv7H7u7IvS.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: hv7H7u7IvS.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: hv7H7u7IvS.exe

Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\hv7H7u7IvS.exe

Code function: 0_2_00007FF66DD56EF0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF66DD56EF0

Source: C:\Users\user\Desktop\hv7H7u7IvS.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-17647

Source: C:\Users\user\Desktop\hv7H7u7IvS.exe

API coverage: 6.1 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD6842C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF66DD6842C
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD58AF0 FindFirstFileExW,FindClose,	0_2_00007FF66DD58AF0
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD724C4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF66DD724C4
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD6842C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF66DD6842C

Source: C:\Users\user\Desktop\hv7H7u7IvS.exe

Code function: 0_2_00007FF66DD5C6AC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF66DD5C6AC

Source: C:\Users\user\Desktop\hv7H7u7IvS.exe

Code function: 0_2_00007FF66DD740D0 GetProcessHeap,

0_2_00007FF66DD740D0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD5C6AC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF66DD5C6AC
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD5BE20 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF66DD5BE20
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD5C88C SetUnhandledExceptionFilter,	0_2_00007FF66DD5C88C
Source: C:\Users\user\Desktop\hv7H7u7IvS.exe	Code function: 0_2_00007FF66DD6B1B8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF66DD6B1B8

Source: C:\Users\user\Desktop\hv7H7u7IvS.exe

Code function: 0_2_00007FF66DD7A420 cpuid

0_2_00007FF66DD7A420

Source: C:\Users\user\Desktop\hv7H7u7IvS.exe

Code function: 0_2_00007FF66DD5C590 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF66DD5C590

Source: C:\Users\user\Desktop\hv7H7u7IvS.exe

Code function: 0_2_00007FF66DD76950 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF66DD76950

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 DLL Side-Loading	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
hv7H7u7IvS.exe	3%	ReversingLabs

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1432351
Start date and time:	2024-04-26 22:23:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	hv7H7u7IvS.exe renamed because original name is a hash value
Original Sample Name:	50f45a0537eac244e3afa4f07684095d.exe
Detection:	CLEAN
Classification:	clean5.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 17 Number of non-executed functions: 86
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: hv7H7u7IvS.exe

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.992953719781898
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	hv7H7u7IvS.exe
File size:	30'408'704 bytes
MD5:	50f45a0537eac244e3afa4f07684095d
SHA1:	3f1f70aff06ecaa65188072405edbf4778868deb
SHA256:	0b3f57e62dacdf7f1dddddbea20daced70e88ef547e795fbadfa124be5a422c2
SHA512:	5c57ec3e57b6c599d130c1a5d9f50f9dbab5f965b2f15e113041fee66cc7c7ff098a120126f4284d9923d9e6ce11ca5c51e1610a70975c0dc42ad06a62efd975
SSDEEP:	786432:OQlUgl0SP/bLFlkNvdt6xEVFVNMi3Lem/jt4jRJM:OQ+gFP/V4f6Gj53ikjt4jR2
TLSH:	466733B89F45ACC8E1AAB1366240CB0FDCA6B40E3325959763E009781F9F3D71BED951
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................................-.....................,.............................................................Rich...........

File Icon


Icon Hash:	4a464cd47461e179

Static PE Info

General

Entrypoint:	0x14000c330
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x65F0A981 [Tue Mar 12 19:14:09 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	1af6c885af093afc55142c2f1761dbe8

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F8274F74DBCh
dec eax
add esp, 28h
jmp 00007F8274F749DFh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007F8274F75334h
test eax, eax
je 00007F8274F74B83h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F8274F74B67h
dec eax
cmp ecx, eax
je 00007F8274F74B76h
xor eax, eax
dec eax
cmpxchg dword ptr [000351BCh], ecx
jne 00007F8274F74B50h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F8274F74B59h
int3
int3
int3
dec eax
sub esp, 28h
test ecx, ecx
jne 00007F8274F74B69h
mov byte ptr [000351A5h], 00000001h
call 00007F8274F75141h
call 00007F8274F75748h
test al, al
jne 00007F8274F74B66h
xor al, al
jmp 00007F8274F74B76h
call 00007F8274F836AFh
test al, al
jne 00007F8274F74B6Bh
xor ecx, ecx
call 00007F8274F75758h
jmp 00007F8274F74B4Ch
mov al, 01h
dec eax
add esp, 28h
ret
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [0003516Ch], 00000000h
mov ebx, ecx
jne 00007F8274F74BC9h
cmp ecx, 01h
jnbe 00007F8274F74BCCh
call 00007F8274F752AAh
test eax, eax
je 00007F8274F74B8Ah
test ebx, ebx
jne 00007F8274F74B86h
dec eax
lea ecx, dword ptr [00035156h]
call 00007F8274F834A2h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3e094	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x47000	0xf41c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x43000	0x2304	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x57000	0x758	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3b440	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3b300	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2c000	0x420	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2adb0	0x2ae00	75d19a4940b1c41e95d0f65f35d07455	False	0.5456735149416909	data	6.502519008894634	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2c000	0x12ebc	0x13000	5288755939ecd1e1e720f719013984c7	False	0.5153423108552632	data	5.816302686675576	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3f000	0x33b8	0xe00	c77d6acf176d4b487ea671c3fd3a6945	False	0.13392857142857142	firmware 32a2 vdf2d (revision 2569732096) \377\377\377\377 , version 256.0.512, 0 bytes or less, at 0xcd5d20d2 1725235199 bytes , at 0 0 bytes , at 0xffffffff 16777216 bytes	1.828047079050098	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x43000	0x2304	0x2400	f9c9a5a34be2cb8fd1246f51c7b22c72	False	0.4797092013888889	data	5.38202672986895	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x46000	0x1f4	0x200	4ec0234c233e8c5ae54cd80f9630ff86	False	0.525390625	data	3.698330622853966	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x47000	0xf41c	0xf600	455788c285fcfdcb4008bc77e762818a	False	0.803099593495935	data	7.5549760623589695	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x57000	0x758	0x800	f1d633c1708caf707b59b5e59d6f78b3	False	0.54443359375	data	5.24651730799357	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x47208	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.585820895522388
RT_ICON	0x480b0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.7360108303249098
RT_ICON	0x48958	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.755057803468208
RT_ICON	0x48ec0	0x952c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9975384937676757
RT_ICON	0x523ec	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.3887966804979253
RT_ICON	0x54994	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.49530956848030017
RT_ICON	0x55a3c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.7207446808510638
RT_GROUP_ICON	0x55ea4	0x68	data	0.7019230769230769
RT_MANIFEST	0x55f0c	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	IsValidCodePage, GetStringTypeW, GetFileAttributesExW, HeapReAlloc, FlushFileBuffers, GetCurrentDirectoryW, GetACP, GetOEMCP, GetModuleHandleW, MulDiv, GetLastError, SetDllDirectoryW, GetModuleFileNameW, CreateSymbolicLinkW, GetProcAddress, GetCommandLineW, GetEnvironmentVariableW, GetCPInfo, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, SetConsoleCtrlHandler, FindClose, FindFirstFileExW, CloseHandle, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, WriteConsoleW, SetEndOfFile, SetEnvironmentVariableW, RtlUnwindEx, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Target ID:	0
Start time:	22:23:57
Start date:	26/04/2024
Path:	C:\Users\user\Desktop\hv7H7u7IvS.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\hv7H7u7IvS.exe"
Imagebase:	0x7ff66dd50000
File size:	30'408'704 bytes
MD5 hash:	50F45A0537EAC244E3AFA4F07684095D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	37

Executed Functions

Function 00007FF66DD7789C Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF66DD775D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD77611
Part of subcall function 00007FF66DD775D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD7768F
Part of subcall function 00007FF66DD775D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD776E0

CreateFileW.KERNELBASE ref: 00007FF66DD779A2
CreateFileW.KERNEL32 ref: 00007FF66DD779F2
GetLastError.KERNEL32 ref: 00007FF66DD77A22
GetFileType.KERNELBASE ref: 00007FF66DD77A37
GetLastError.KERNEL32 ref: 00007FF66DD77A41
CloseHandle.KERNEL32 ref: 00007FF66DD77A74
CloseHandle.KERNEL32 ref: 00007FF66DD77BD7
CreateFileW.KERNEL32 ref: 00007FF66DD77C0C
GetLastError.KERNEL32 ref: 00007FF66DD77C1B

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: ebe04baee35d04197a335186ba8f0519e297a15ab634c4b8ae388dbdf22bacec
Instruction ID: 417eccdff977bcbe709dac73c51264ee56b5c9513ece38d9b2c65a70e5c2ba88
Opcode Fuzzy Hash: ebe04baee35d04197a335186ba8f0519e297a15ab634c4b8ae388dbdf22bacec
Instruction Fuzzy Hash: 5DC1AF32B24A42E5EB10EF69C4906AC3771EB49B98F050735DA1E9B3D5EF38E555C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD51A90 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF66DD582B0: _fread_nolock.LIBCMT ref: 00007FF66DD5835A

_fread_nolock.LIBCMT ref: 00007FF66DD51B44

Part of subcall function 00007FF66DD52870: MessageBoxW.USER32 ref: 00007FF66DD5297B

Strings

fread, xrefs: 00007FF66DD51B56, 00007FF66DD51C00
fseek, xrefs: 00007FF66DD51B23
malloc, xrefs: 00007FF66DD51BCD
MEI, xrefs: 00007FF66DD51AD2
Failed to seek to cookie position!, xrefs: 00007FF66DD51B1C
Error on file., xrefs: 00007FF66DD51C26
Could not read full TOC!, xrefs: 00007FF66DD51BF9
Failed to read cookie!, xrefs: 00007FF66DD51B4F
Could not allocate buffer for TOC!, xrefs: 00007FF66DD51BC6

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: _fread_nolock$Message
String ID: Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 677216364-1384898525
Opcode ID: 6dcb471c20a695c8c3338c61758bdfdb2c89e06d090f1080b8e13a62910c7b18
Instruction ID: 35d73796af3b5ff5818258b2cf99f45c3a8796f2336833b4c5e1ef8204504585
Opcode Fuzzy Hash: 6dcb471c20a695c8c3338c61758bdfdb2c89e06d090f1080b8e13a62910c7b18
Instruction Fuzzy Hash: 30514A71A09642C6EB24EF29E5501BC77B0EF48B88F558636DA0DCB795EE3CE444CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD51000 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 269
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF66DD53EB0: GetModuleFileNameW.KERNEL32(?,00007FF66DD539CA), ref: 00007FF66DD53EE1

SetDllDirectoryW.KERNEL32 ref: 00007FF66DD53BD5

Part of subcall function 00007FF66DD57B60: GetEnvironmentVariableW.KERNEL32(00007FF66DD539FF), ref: 00007FF66DD57B9A
Part of subcall function 00007FF66DD57B60: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF66DD57BB7

Strings

Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF66DD53B53
Cannot side-load external archive %s (code %d)!, xrefs: 00007FF66DD53B1F
Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF66DD53AA6
_MEIPASS2, xrefs: 00007FF66DD539EB, 00007FF66DD53A54, 00007FF66DD53D07, 00007FF66DD53D13
_PYI_ONEDIR_MODE, xrefs: 00007FF66DD53A14, 00007FF66DD53A3F
MEI, xrefs: 00007FF66DD53ADA
Failed to convert DLL search path!, xrefs: 00007FF66DD53BC5

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-1544818733
Opcode ID: 96931881d18b0330ea34091d7b5263f0145edfa0e674df194285457188caea9b
Instruction ID: 309229d29f3f797e6a2880781eeb06bf98aa79e842017d64844620932eecb149
Opcode Fuzzy Hash: 96931881d18b0330ea34091d7b5263f0145edfa0e674df194285457188caea9b
Instruction Fuzzy Hash: 03B14731A1C682D1EE25BB25D8512BD62B1FF94784F840336EA5DCF69AFE2CF5058740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD6C5FC Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD6CA29

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c279c688e5b0889b49cc882017481efc371aace171ab011e23a17b81497fd1df
Instruction ID: a12baf0b6329f7fb7ab591ec8f8d5262a97079a576c06fc9bcd16604038de666
Opcode Fuzzy Hash: c279c688e5b0889b49cc882017481efc371aace171ab011e23a17b81497fd1df
Instruction Fuzzy Hash: 2DC1B422A086C6D5EB60AB5A94442BD3B75EF80B80F554331EA4D8F796EF7DE84583C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD52B10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF66DD58BD0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF66DD52A9B), ref: 00007FF66DD58C0A

MessageBoxW.USER32 ref: 00007FF66DD52BE5
MessageBoxA.USER32 ref: 00007FF66DD52C01

Strings

Fatal error detected, xrefs: 00007FF66DD52BBB, 00007FF66DD52BF3

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Fatal error detected
API String ID: 1878133881-4025702859
Opcode ID: b6f7d9423fd809a91d1653bcdf9902987ab7b8a697f00e322c081d77e498ae58
Instruction ID: 4ef842833c8982f296a1506ab4a7b8714b479f74130dca5ed65d37dfb6278bd6
Opcode Fuzzy Hash: b6f7d9423fd809a91d1653bcdf9902987ab7b8a697f00e322c081d77e498ae58
Instruction Fuzzy Hash: 9B217972628685D1EB30EB14F4516EA7374FF84788F805235E68D8BA99EF3CE215C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD5C1BC Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF66DD5C38C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF66DD5C3A0

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF66DD5C1E0
__scrt_release_startup_lock.LIBCMT ref: 00007FF66DD5C24E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF66DD5C2A1

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: 6f7f5303e9b22c034abd0ab4f6e45a615f00bbc4bee0f7f82c8393816be5d00e
Instruction ID: 08c906dded9488b375945e7c79f253fd8cb7594d4cabfc1955f0200bbebd9839
Opcode Fuzzy Hash: 6f7f5303e9b22c034abd0ab4f6e45a615f00bbc4bee0f7f82c8393816be5d00e
Instruction Fuzzy Hash: 0B312830A0C643C6FA24BBA994627B923B1DF51784F485635D94ECF2E3FE2DB4048340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD6A5A0 Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF66DD6A59C), ref: 00007FF66DD6A5B1
TerminateProcess.KERNEL32(?,?,?,00007FF66DD6A59C), ref: 00007FF66DD6A5BC
ExitProcess.KERNEL32 ref: 00007FF66DD6A5CB

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 4ba61a3cc0556e7c92b6fc1e72a638e9c9ea62dc27ce852986ab15971a897a88
Instruction ID: b70c9fcff17a8875374ae9f6fb84f803a87e1cc8326fa7d8552b472355d04979
Opcode Fuzzy Hash: 4ba61a3cc0556e7c92b6fc1e72a638e9c9ea62dc27ce852986ab15971a897a88
Instruction Fuzzy Hash: 48D09E20B08692D6EA147B76585947C23715F49741F10267CD85F9E393FD3CB84D4380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD6085C Relevance: 3.2, APIs: 2, Instructions: 177
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD608A0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD60997

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8ce18104659cefce8bbb9575f08fa5332ecac4dfb73f1cb09f1d3f805200cb2f
Instruction ID: fb09ba4922a2294e032bd273817128c238f0bc1d670eb497a4054d1ef4d67741
Opcode Fuzzy Hash: 8ce18104659cefce8bbb9575f08fa5332ecac4dfb73f1cb09f1d3f805200cb2f
Instruction Fuzzy Hash: 4751B661B096C1C5F624BA27940067E76A1BF44BE4F184735EDAD8F7C9EE3CE4418780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD6B6FC Relevance: 3.1, APIs: 2, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF66DD6B579,?,?,00000000,00007FF66DD6B62E), ref: 00007FF66DD6B76A
GetLastError.KERNEL32(?,?,?,00007FF66DD6B579,?,?,00000000,00007FF66DD6B62E), ref: 00007FF66DD6B774

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: e3b73f063bb60367d817196ec2a4f8f6eb52bee7e7896c4ceb0739ce7562b917
Instruction ID: 20999f028cfc73408f65fd396e111de1bb1c31bb23adebd7fbd7b427c91bdfb8
Opcode Fuzzy Hash: e3b73f063bb60367d817196ec2a4f8f6eb52bee7e7896c4ceb0739ce7562b917
Instruction Fuzzy Hash: 06219611B187C2C1FE50B766959027D32A25F447A0F094335EA2DCF3D6FE6CE4948380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD6CCD4 Relevance: 3.0, APIs: 2, Instructions: 46
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF66DD6CE6D), ref: 00007FF66DD6CD20
GetLastError.KERNEL32(?,?,?,?,?,00007FF66DD6CE6D), ref: 00007FF66DD6CD2A

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 62a26f8d1512d31d847f2a475d98554d5a752059faf1bb854899a2cf804e20f8
Instruction ID: 1cd425afb5491abf89596a2a46b6933ae2894e51f93cf6528e1c679f1f6665aa
Opcode Fuzzy Hash: 62a26f8d1512d31d847f2a475d98554d5a752059faf1bb854899a2cf804e20f8
Instruction Fuzzy Hash: E6118261708A81C1DA10AB2AE44416D7B71AB85BF4F544331EA7D8B7D9EE7CD4508780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD6CA4C Relevance: 1.6, APIs: 1, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD6CA74

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9bd69e230f0d3b0e5758ab1338c67e81032152045ba6d69f05b41d5745cc01d1
Instruction ID: afaeafa8cb484209ab3eb74311b1eb5ccb34434d6b1fcc03213a94dd7a5bcf7b
Opcode Fuzzy Hash: 9bd69e230f0d3b0e5758ab1338c67e81032152045ba6d69f05b41d5745cc01d1
Instruction Fuzzy Hash: 95417F32A08681C7EE34EA2EA54117D77B0EB56B95F141331E68ECA6D1EF2CF4428791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD582B0 Relevance: 1.6, APIs: 1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fread_nolock.LIBCMT ref: 00007FF66DD5835A

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: dd25f11f42851f3553b9b6eda5e148bc6a7380405693cde1455446072bdc424b
Instruction ID: 984c40c1c549b52944d4dabb4311d8b8c360e6fb4055c9c655bdb19472a626fa
Opcode Fuzzy Hash: dd25f11f42851f3553b9b6eda5e148bc6a7380405693cde1455446072bdc424b
Instruction Fuzzy Hash: 4A218D31B18292C6FA50BA13A9047BAA661FF45BD4F885530EE4D8F786EE3CE0458740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD6C4DC Relevance: 1.6, APIs: 1, Instructions: 79
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD6C562

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 4f0cf036759396bee00a5ffdbac8b9ba3dd48d89bd34ec8e772c9ccb7d351480
Instruction ID: 519521f2661fe36f4fc74b3e6ebb9aa0d33baf2b7f22e2e90e6fcd58b3c99fa8
Opcode Fuzzy Hash: 4f0cf036759396bee00a5ffdbac8b9ba3dd48d89bd34ec8e772c9ccb7d351480
Instruction Fuzzy Hash: 4F315C71A18682C6EA25BB5A884137C3A74AF84B94F414335EA5D8F3D2FE7CF4818791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD6A4D1 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF66DD6A4FF

Part of subcall function 00007FF66DD6A5F8: GetModuleHandleExW.KERNEL32 ref: 00007FF66DD6A61D
Part of subcall function 00007FF66DD6A5F8: GetProcAddress.KERNEL32 ref: 00007FF66DD6A633
Part of subcall function 00007FF66DD6A5F8: FreeLibrary.KERNEL32 ref: 00007FF66DD6A65A

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 1e818ce3d7a60ac953b6edb356e5c611bf03bd3223dab8e8a1ec707a6cadd3f1
Instruction ID: 908e3b21572fbd5bee7c5937bd7fdf71f20d0236ac6f4f595b109224a7aa48c2
Opcode Fuzzy Hash: 1e818ce3d7a60ac953b6edb356e5c611bf03bd3223dab8e8a1ec707a6cadd3f1
Instruction Fuzzy Hash: AA217C72A04792CAEB24EF65C440AAC33B0EB04718F441736D79C8AAC5FF38D584CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD66A88 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD669ED

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c06f943cf2cfad6cae40bb945918742757c954c3eb67e691afc5a150f41a7f23
Instruction ID: f60a80555d486304560c4425fabef9fbcdb6cd612dc5517ac6ca364c23c0c0f1
Opcode Fuzzy Hash: c06f943cf2cfad6cae40bb945918742757c954c3eb67e691afc5a150f41a7f23
Instruction Fuzzy Hash: 17114D21A1C6C2C1EA60BF52940127DB3B4AF85B84F154672FA8C8F68AEF3DE54087C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD7728C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD772AF

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a2fd61d2380c2417d5794f115bbf4a656e75441d4a409d8b240f29f696bd49a
Instruction ID: 0898289e7de12c33cfb50720aeead139ce27069719f6b6eb6d1ca07f7796dcac
Opcode Fuzzy Hash: 5a2fd61d2380c2417d5794f115bbf4a656e75441d4a409d8b240f29f696bd49a
Instruction Fuzzy Hash: 9C219532E18A81F6DB61AF19D44077977B0EB84B54F244735EA6D8B6DAEF3DE4008B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD60ADC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD60B30

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f9b91d952c5f5bbb27c286856a89106101f2e0992174c8f8af0f54b7d3c9b46c
Instruction ID: d0e79cdd0c367dd7c7d2a6e59db4e8021ab9c8830e57cf8f3a8392564d8b8d03
Opcode Fuzzy Hash: f9b91d952c5f5bbb27c286856a89106101f2e0992174c8f8af0f54b7d3c9b46c
Instruction Fuzzy Hash: 68017021A0878180EA04AB57590007DB6B5AB85FE4F188731EE6C9BBDAEE3CE4418340

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF66DD56EF0 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 263libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF66DD56F07
GetProcAddress.KERNEL32 ref: 00007FF66DD56F46
GetProcAddress.KERNEL32 ref: 00007FF66DD56F6B
GetProcAddress.KERNEL32 ref: 00007FF66DD56F90
GetProcAddress.KERNEL32 ref: 00007FF66DD56FB8
GetProcAddress.KERNEL32 ref: 00007FF66DD56FE0
GetProcAddress.KERNEL32 ref: 00007FF66DD57008
GetProcAddress.KERNEL32 ref: 00007FF66DD57030
GetProcAddress.KERNEL32 ref: 00007FF66DD57058

Strings

Failed to get address for Tcl_GetVar2, xrefs: 00007FF66DD571AA
Failed to get address for Tcl_CreateThread, xrefs: 00007FF66DD57042
Tcl_SetVar2, xrefs: 00007FF66DD571B6
Tcl_CreateObjCommand, xrefs: 00007FF66DD571DE
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF66DD56FA2
Tcl_FindExecutable, xrefs: 00007FF66DD56F61
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF66DD56F58
Failed to get address for Tcl_EvalFile, xrefs: 00007FF66DD572EA
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF66DD5706A
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF66DD5729A
Tcl_NewByteArrayObj, xrefs: 00007FF66DD57256
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF66DD56FF2
Tcl_GetString, xrefs: 00007FF66DD57206
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF66DD56F7D
Tcl_ConditionWait, xrefs: 00007FF66DD57116
Tcl_GetObjResult, xrefs: 00007FF66DD572A6
Tcl_EvalFile, xrefs: 00007FF66DD572CE
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF66DD5710A
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF66DD57272
Tcl_Free, xrefs: 00007FF66DD5736E
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF66DD571FA
Tcl_ConditionNotify, xrefs: 00007FF66DD570EE
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF66DD5715A
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF66DD5701A
Tcl_DeleteInterp, xrefs: 00007FF66DD56FFE
Tcl_FinalizeThread, xrefs: 00007FF66DD56FD6
Failed to get address for Tk_Init, xrefs: 00007FF66DD573B2
Tcl_ThreadQueueEvent, xrefs: 00007FF66DD5713E
Tcl_GetVar2, xrefs: 00007FF66DD5718E
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF66DD57182
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF66DD570BA
Tcl_Finalize, xrefs: 00007FF66DD56FAE
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF66DD573DA
Tcl_SetVar2Ex, xrefs: 00007FF66DD5727E
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF66DD5724A
Failed to get address for Tcl_GetString, xrefs: 00007FF66DD57222
Tcl_MutexLock, xrefs: 00007FF66DD57076
Tcl_DoOneEvent, xrefs: 00007FF66DD56F86
Failed to get address for Tcl_EvalEx, xrefs: 00007FF66DD57312
Tcl_CreateInterp, xrefs: 00007FF66DD56F3C
Tcl_Init, xrefs: 00007FF66DD56F00
Failed to get address for Tcl_MutexLock, xrefs: 00007FF66DD57092
Tcl_CreateThread, xrefs: 00007FF66DD57026
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF66DD5733A
Failed to get address for Tcl_Alloc, xrefs: 00007FF66DD57362
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF66DD570E2
Tk_Init, xrefs: 00007FF66DD57396
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF66DD57132
Tcl_EvalObjv, xrefs: 00007FF66DD5731E
Tcl_EvalEx, xrefs: 00007FF66DD572F6
Tcl_ThreadAlert, xrefs: 00007FF66DD57166
Tk_GetNumMainWindows, xrefs: 00007FF66DD573BE
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF66DD572C2
Tcl_ConditionFinalize, xrefs: 00007FF66DD570C6
Tcl_MutexUnlock, xrefs: 00007FF66DD5709E
GetProcAddress, xrefs: 00007FF66DD56F20
Tcl_Alloc, xrefs: 00007FF66DD57346
Tcl_GetCurrentThread, xrefs: 00007FF66DD5704E
Tcl_NewStringObj, xrefs: 00007FF66DD5722E
Failed to get address for Tcl_SetVar2, xrefs: 00007FF66DD571D2
Failed to get address for Tcl_Init, xrefs: 00007FF66DD56F19
Failed to get address for Tcl_Free, xrefs: 00007FF66DD5738A
Failed to get address for Tcl_Finalize, xrefs: 00007FF66DD56FCA

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-2208601799
Opcode ID: d06a92813886bac4db22892db141582495630975dbcfbb846e36d04df9038670
Instruction ID: df1385bed10533ec1502250a4dd2a69df66956bba9eaf149fc1efa7e1ede3cff
Opcode Fuzzy Hash: d06a92813886bac4db22892db141582495630975dbcfbb846e36d04df9038670
Instruction Fuzzy Hash: F2E17165E4DB03F0FA65AB18EC501B863B5AF09794BA46775C80ECE6A4FF7CB5488340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD74CFC Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF66DD74D4A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD753B6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD7552C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD757EA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD75A0A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD75C47
memcpy_s.LIBCPMT ref: 00007FF66DD75D22
memcpy_s.LIBCPMT ref: 00007FF66DD75DCD
memcpy_s.LIBCPMT ref: 00007FF66DD75E9C

Strings

1#INF, xrefs: 00007FF66DD74E73
1#SNAN, xrefs: 00007FF66DD74E5A
1#QNAN, xrefs: 00007FF66DD74E63
1#IND, xrefs: 00007FF66DD74E37

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: ee6ddb9c22397a02ef7f89c4ae9451cd5ee51806b236cf38c383584f5dc4b0f7
Instruction ID: 6d7355039455cf1f713075e28824309924139d6b890b9c22e6a474a8f3eeb27f
Opcode Fuzzy Hash: ee6ddb9c22397a02ef7f89c4ae9451cd5ee51806b236cf38c383584f5dc4b0f7
Instruction Fuzzy Hash: 76B2B072E18292DBE7659E64D440BFD37B1FB54388F505275DA0E9BA88EF38F9008B41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD58560 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF66DD52A3E,?,?,?,?,?,?,?,?,?,?,?,00007FF66DD5101D), ref: 00007FF66DD58587
FormatMessageW.KERNEL32 ref: 00007FF66DD585B6
WideCharToMultiByte.KERNEL32 ref: 00007FF66DD5860C

Part of subcall function 00007FF66DD529C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF66DD588E2,?,?,?,?,?,?,?,?,?,?,?,00007FF66DD5101D), ref: 00007FF66DD529F4
Part of subcall function 00007FF66DD529C0: MessageBoxW.USER32 ref: 00007FF66DD52AD0

Strings

PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF66DD58629
WideCharToMultiByte, xrefs: 00007FF66DD5861D
FormatMessageW, xrefs: 00007FF66DD585C7
Failed to encode wchar_t as UTF-8., xrefs: 00007FF66DD58616
No error messages generated., xrefs: 00007FF66DD585C0
PyInstaller: FormatMessageW failed., xrefs: 00007FF66DD585D3

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: ErrorLastMessage$ByteCharFormatMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2920928814-2573406579
Opcode ID: 341253ed490ea0d4c0f2cc2c63e3841e2b0994626e2ed60ed720fa43fab6ebbb
Instruction ID: bdad204379dca7b3eb588a518e48bd9b236e80898e1f47dca20a1f91673afc38
Opcode Fuzzy Hash: 341253ed490ea0d4c0f2cc2c63e3841e2b0994626e2ed60ed720fa43fab6ebbb
Instruction Fuzzy Hash: 30213E71A18A43D6F760AB15E8542AA63B5FF88388F840235E64DCB6A5FF3CE545CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD57950 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 141COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000000,?,00000000,00000000,?,00007FF66DD5153F), ref: 00007FF66DD579E7

Part of subcall function 00007FF66DD57B60: GetEnvironmentVariableW.KERNEL32(00007FF66DD539FF), ref: 00007FF66DD57B9A
Part of subcall function 00007FF66DD57B60: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF66DD57BB7

Part of subcall function 00007FF66DD683CC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD683E5

SetEnvironmentVariableW.KERNEL32 ref: 00007FF66DD57AA1

Part of subcall function 00007FF66DD52B10: MessageBoxW.USER32 ref: 00007FF66DD52BE5

Strings

_MEI%d, xrefs: 00007FF66DD579F5
TMP, xrefs: 00007FF66DD579B0
LOADER: Failed to set the TMP environment variable., xrefs: 00007FF66DD579CA
TMP, xrefs: 00007FF66DD5798A, 00007FF66DD57A49, 00007FF66DD57AD7

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 3752271684-1116378104
Opcode ID: b3ba5fb110bb78c08d96a576f6c74f520d24942c7ac6f285bbb95a8c69523cbf
Instruction ID: 93976315af1a0a025ef41444508f7992f8a496d2e9460ce8bb3bc66a38655034
Opcode Fuzzy Hash: b3ba5fb110bb78c08d96a576f6c74f520d24942c7ac6f285bbb95a8c69523cbf
Instruction Fuzzy Hash: 88514A21F09653E1FE14BA26A8152BE62619F85BC0F549635ED0ECF797FE2CF4418780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD5A55D Relevance: 12.0, Strings: 9, Instructions: 745COMMON

Download Yara Rule

Strings

invalid code -- missing end-of-block, xrefs: 00007FF66DD5A976
too many length or distance symbols, xrefs: 00007FF66DD5A6F6
invalid distance code, xrefs: 00007FF66DD5AE64
invalid distance too far back, xrefs: 00007FF66DD5AF20
invalid literal/lengths set, xrefs: 00007FF66DD5A9E3
invalid literal/length code, xrefs: 00007FF66DD5AC92
invalid bit length repeat, xrefs: 00007FF66DD5A949
invalid distances set, xrefs: 00007FF66DD5AA50
invalid code lengths set, xrefs: 00007FF66DD5A6DD

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID:
String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
API String ID: 0-2665694366
Opcode ID: 212d86a86c8cb6d9fc903fcdabd382662a83ce4cb1445b9d6573bc2018cf14a4
Instruction ID: 7e15962447238efe2562ab4589014baeb2bdce33792d1a2c92b4ab07ce1c6378
Opcode Fuzzy Hash: 212d86a86c8cb6d9fc903fcdabd382662a83ce4cb1445b9d6573bc2018cf14a4
Instruction Fuzzy Hash: 1452D272A146B68BE7A49F14D458F7E3BB9FB44340F415239E64A8B780EF38E844CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD5C6AC Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF66DD5C6C8
RtlCaptureContext.KERNEL32 ref: 00007FF66DD5C6F5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF66DD5C70F
RtlVirtualUnwind.KERNEL32 ref: 00007FF66DD5C750
IsDebuggerPresent.KERNEL32 ref: 00007FF66DD5C7A4
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF66DD5C7C1
UnhandledExceptionFilter.KERNEL32 ref: 00007FF66DD5C7CC

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: f0495aeca64e737fa0ff218dd5454e1fd46196f668a698fc407bc1dcdf963f54
Instruction ID: ee45241a5c69fda9f0f32c363da9164278d0804bb328169f02e5f7fcbc03e735
Opcode Fuzzy Hash: f0495aeca64e737fa0ff218dd5454e1fd46196f668a698fc407bc1dcdf963f54
Instruction Fuzzy Hash: 1A312F72609B81DAEB60AF64E8407ED7374FB84744F44413ADA4E8BB95EF38D648C714

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD76950 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF66DD76995

Part of subcall function 00007FF66DD762E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD762FC

Part of subcall function 00007FF66DD6B4EC: HeapFree.KERNEL32(?,?,?,00007FF66DD73972,?,?,?,00007FF66DD739AF,?,?,00000000,00007FF66DD73E75,?,?,00000000,00007FF66DD73DA7), ref: 00007FF66DD6B502
Part of subcall function 00007FF66DD6B4EC: GetLastError.KERNEL32(?,?,?,00007FF66DD73972,?,?,?,00007FF66DD739AF,?,?,00000000,00007FF66DD73E75,?,?,00000000,00007FF66DD73DA7), ref: 00007FF66DD6B50C

Part of subcall function 00007FF66DD6B4A4: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF66DD6B483,?,?,?,?,?,00007FF66DD636AC), ref: 00007FF66DD6B4AD
Part of subcall function 00007FF66DD6B4A4: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF66DD6B483,?,?,?,?,?,00007FF66DD636AC), ref: 00007FF66DD6B4D2

_get_daylight.LIBCMT ref: 00007FF66DD76984

Part of subcall function 00007FF66DD76348: _invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD7635C

_get_daylight.LIBCMT ref: 00007FF66DD76BFA
_get_daylight.LIBCMT ref: 00007FF66DD76C0B
_get_daylight.LIBCMT ref: 00007FF66DD76C1C
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF66DD76E5C), ref: 00007FF66DD76C43

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: 68b999f229cb279b771c9b6526825656b60bb96bc74b06700145a25f32af5fee
Instruction ID: 2fbf1bdc6e00496ccc14d81b2489497bf4053d8fc0beaac34466dc4fbc8571f1
Opcode Fuzzy Hash: 68b999f229cb279b771c9b6526825656b60bb96bc74b06700145a25f32af5fee
Instruction Fuzzy Hash: 4AD1A022A08252E6E7A0BF26D8515BD7771EF44784F858235EA4D8FA96FF3CF4418780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD6B1B8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF66DD6B231
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF66DD6B249
RtlVirtualUnwind.KERNEL32 ref: 00007FF66DD6B284
IsDebuggerPresent.KERNEL32 ref: 00007FF66DD6B2BD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF66DD6B2C7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF66DD6B2D2

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: fd667905384e7d9d9673078d4bc89f495a5f33449598c9bf886212c96aaa5de2
Instruction ID: 4bb27533f1e69f046096a890513fa727abf4ee649e1dd348da236fc3f63d5d6d
Opcode Fuzzy Hash: fd667905384e7d9d9673078d4bc89f495a5f33449598c9bf886212c96aaa5de2
Instruction Fuzzy Hash: 86316F32608B81D6EB60DF69E8406AE73B4FB88754F540236EA9D87B95EF3CD145CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD724C4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD72510
FindFirstFileExW.KERNEL32 ref: 00007FF66DD7261A

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 39d91788d0b19d495b26843577507a1cf0f08a93b845adaf621480a5b236d061
Instruction ID: e8705781d685a4bb5253dead8a40b64a4eb9b2ca8b36caa8eb4c13b7729425e1
Opcode Fuzzy Hash: 39d91788d0b19d495b26843577507a1cf0f08a93b845adaf621480a5b236d061
Instruction Fuzzy Hash: 4AB1B222B186D2D1EA71AB2699101BD6B74FB44BE8F445272EA4D8FBC5FE3CF4418300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD76BCC Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF66DD76BFA

Part of subcall function 00007FF66DD76348: _invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD7635C

_get_daylight.LIBCMT ref: 00007FF66DD76C0B

Part of subcall function 00007FF66DD762E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD762FC

_get_daylight.LIBCMT ref: 00007FF66DD76C1C

Part of subcall function 00007FF66DD76318: _invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD7632C

Part of subcall function 00007FF66DD6B4EC: HeapFree.KERNEL32(?,?,?,00007FF66DD73972,?,?,?,00007FF66DD739AF,?,?,00000000,00007FF66DD73E75,?,?,00000000,00007FF66DD73DA7), ref: 00007FF66DD6B502
Part of subcall function 00007FF66DD6B4EC: GetLastError.KERNEL32(?,?,?,00007FF66DD73972,?,?,?,00007FF66DD739AF,?,?,00000000,00007FF66DD73E75,?,?,00000000,00007FF66DD73DA7), ref: 00007FF66DD6B50C

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF66DD76E5C), ref: 00007FF66DD76C43

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 4da564cbe2ed5f93640d02b0843b0d4a4af145672d7b9370a807429b4dc33e70
Instruction ID: 386615d9e0a80abf90a472fcbc1ec3a74e0fccecc4b68d77e90dd9429fe548ee
Opcode Fuzzy Hash: 4da564cbe2ed5f93640d02b0843b0d4a4af145672d7b9370a807429b4dc33e70
Instruction Fuzzy Hash: DA512B22A18642D6E760FF62D8915AD6B70BB48784F854275EA4DCBA96FF3CF4408780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD5C590 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF66DD5C5BC
GetCurrentThreadId.KERNEL32 ref: 00007FF66DD5C5CA
GetCurrentProcessId.KERNEL32 ref: 00007FF66DD5C5D6
QueryPerformanceCounter.KERNEL32 ref: 00007FF66DD5C5E6

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: c9256d3c29dec7defdbd069e132950cc3752c5933af8d37e6b370c711f310d19
Instruction ID: e67a01947307f3f1ceed2138c4de3ba1875f003613286f4816df3c2fccbb99e7
Opcode Fuzzy Hash: c9256d3c29dec7defdbd069e132950cc3752c5933af8d37e6b370c711f310d19
Instruction Fuzzy Hash: 01111822B54B01DAEB009BA4E8547A833B4FB19758F441E31DA6D8A7A4EF78E1948340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD74860 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF66DD748C6
memcpy_s.LIBCPMT ref: 00007FF66DD748F1

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 4a6dbd71ae6092cd6c706e31d85cfead9b73525af4dc3add50745cf5494c3af6
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: 80C1F572B18686D7E7259F1AA04466AB7A1F788784F458239DB4A8B744EF3DF801CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD59D2B Relevance: 4.1, Strings: 3, Instructions: 397COMMON

Download Yara Rule

Strings

unknown header flags set, xrefs: 00007FF66DD59D75
header crc mismatch, xrefs: 00007FF66DD5A1D1
, xrefs: 00007FF66DD59E0B

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID:
String ID: $header crc mismatch$unknown header flags set
API String ID: 0-1127688429
Opcode ID: 326cf6427d5bf0e9376a5910f25170e202e1497fb5a723acb88e47d2bece8f14
Instruction ID: 15a3b2d94ca46d32b9f1d9db3fba7142cbb68c2b3125b746969150f0111218ff
Opcode Fuzzy Hash: 326cf6427d5bf0e9376a5910f25170e202e1497fb5a723acb88e47d2bece8f14
Instruction Fuzzy Hash: 0AF19272A183D5CBE7A5AB18C488F3E7AB9EF44744F055639DA498B390EF38E540CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD7A5D8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF66DD7A827
RaiseException.KERNEL32 ref: 00007FF66DD7A838

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 48b97647827edafc3b78799631f3641f64fd5a0bbb932a3008f366d071470ff1
Instruction ID: 660dcd4fbcb410bb57b74391f8eda193f716fb5bef59b832f6177ee88b348ab4
Opcode Fuzzy Hash: 48b97647827edafc3b78799631f3641f64fd5a0bbb932a3008f366d071470ff1
Instruction Fuzzy Hash: 80B14977A00B89CAEB15CF29C8467683BB0F744B48F159A72DA5D8B7A4DF39E452C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD58AF0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF66DD58B21
FindClose.KERNEL32 ref: 00007FF66DD58B30

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: b4e9d4f2f4e135cd5a826bc565e92bc8980f88c43f5a21f71a862fe531212b02
Instruction ID: 287781b3a3e4277eab4af194de3667d1d4d4b8fe868fd375041f01740dcb244b
Opcode Fuzzy Hash: b4e9d4f2f4e135cd5a826bc565e92bc8980f88c43f5a21f71a862fe531212b02
Instruction Fuzzy Hash: 1CF04472A18685CAFB60AF64E4497667361FB44724F044735DA6D4A6D4FF3CE1188B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD640C4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF66DD64232
, xrefs: 00007FF66DD64474

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 844ebbe57181a3840fd0e5f6d674fc9b0496702e201a79bd656eeeac4e9c6a5b
Instruction ID: 471aff4472c10a73dd185d44b62e6aaf0aa0d1c18b73fb6855cd49a841d4af29
Opcode Fuzzy Hash: 844ebbe57181a3840fd0e5f6d674fc9b0496702e201a79bd656eeeac4e9c6a5b
Instruction Fuzzy Hash: FFE19432A0C686C5EB68AE26816053D33B4FF5DF48F245335DA4E8B694EF2DE851C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD59B8B Relevance: 2.7, Strings: 2, Instructions: 218COMMON

Download Yara Rule

Strings

incorrect header check, xrefs: 00007FF66DD59D12
invalid window size, xrefs: 00007FF66DD59CF9

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID:
String ID: incorrect header check$invalid window size
API String ID: 0-900081337
Opcode ID: eff0553be1f10ec537251e961509bf2a8d4d677e3d27bfe4c15f043eb5d22666
Instruction ID: 9e8c800fdbcec196ef3af41674d268e3bffb41e4ad5ff1dd41d8fcc28ad77c93
Opcode Fuzzy Hash: eff0553be1f10ec537251e961509bf2a8d4d677e3d27bfe4c15f043eb5d22666
Instruction Fuzzy Hash: 6A916672A182D5C7E7A5AF14D498F3E3ABDFB45354F115239DA5A8A6C0EF38E540CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD6EA90 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF66DD6EC1A
e+000, xrefs: 00007FF66DD6EB9D

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 9f37f6886a50983af1edbeb5304d9c5a1724e2c4f55c2eaeb36ad1928fa03086
Instruction ID: ad41ca31bf3637f5a7006d4ad8efb96223d6e3dfccb6dc561ae233a882336159
Opcode Fuzzy Hash: 9f37f6886a50983af1edbeb5304d9c5a1724e2c4f55c2eaeb36ad1928fa03086
Instruction Fuzzy Hash: 06513422B186C586E7249E3A9C0176DBBA1F744B94F48D331CAA8CFAC5EE3DE4458740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD71518 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 3a6f23c9973ea05008b0ab19088ab645339660b6d16710ffb7d1eefd6a3e1d73
Instruction ID: 8c8cbaabdf2e6b7336f1af35b7cff1f21ae87cf73d1667b460be9a85ad29697d
Opcode Fuzzy Hash: 3a6f23c9973ea05008b0ab19088ab645339660b6d16710ffb7d1eefd6a3e1d73
Instruction Fuzzy Hash: 83026E21A1D692E0FA65BF22942127926B8AF41B90F595775ED6DCF3D2FE3DF4028300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD6E5FC Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF66DD6E93E

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 7476b0d7411414aadaa87b929f11621b17e9f2f3721f3962e4b0dff9c83324f6
Instruction ID: b84c36c6cc7486cbe17a9aa35d4bed913b208c537494e4a17056b2f88ae782cb
Opcode Fuzzy Hash: 7476b0d7411414aadaa87b929f11621b17e9f2f3721f3962e4b0dff9c83324f6
Instruction Fuzzy Hash: 7BA14662A087D5C6EB21DB2AA8007AD7BA0AB507C4F04C232DE9DCB795EE3DE505C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD68CB0 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF66DD68CCF

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: 1f787d85f28bda76f51a36d7e0584dddc950fc50dd77ffebb8b3d4204956afe2
Instruction ID: 41603aecd232b841c42b9478a9f8f1b0e81ae692362351078bb8e8a7c6f9c32e
Opcode Fuzzy Hash: 1f787d85f28bda76f51a36d7e0584dddc950fc50dd77ffebb8b3d4204956afe2
Instruction Fuzzy Hash: A151AC11B08682D1FA68BA67990117E76B5AF56B88F484335DE0ECF7D2FE3CE4424380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD740D0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF66DD740D4

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 9cb1cd12b35fa318c4a8e0929622bdae7cba3dd6c324a68b4e8dcf83c52a71e5
Instruction ID: 3f8a878a5e6b582c8e9ee1b20f95078dea7cc311a92d2f563f94e8e50151b30b
Opcode Fuzzy Hash: 9cb1cd12b35fa318c4a8e0929622bdae7cba3dd6c324a68b4e8dcf83c52a71e5
Instruction Fuzzy Hash: 62B09220E07A42C6EA083B15AC8221422B47F48B10FD44278C50C8D320EE2C21B54701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD63CC0 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14b18484ab84efb2998c80e56806d0f7f7a775c3760978dbb041d68280269385
Instruction ID: 2460c886c11de6d0de18d6291fb719f1b855a5d8f3a348d552d23d4c7bd98f5e
Opcode Fuzzy Hash: 14b18484ab84efb2998c80e56806d0f7f7a775c3760978dbb041d68280269385
Instruction Fuzzy Hash: 98D1B322A0C6C2C6EB68EE6BC15027D37B0AF45B48F185335CE0D8B695EF3AD855C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD590C0 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5e7c7d6f5738ce9ae6dae89df256b28c6339b9d8c2370fd2cf9ecf49eca8280
Instruction ID: ae5130855c90af775bf8b9046fb9102e2a076c61bfaef375623b017d7634bb89
Opcode Fuzzy Hash: e5e7c7d6f5738ce9ae6dae89df256b28c6339b9d8c2370fd2cf9ecf49eca8280
Instruction Fuzzy Hash: 15C1A5722241E18BD2C9EB39E46947AB7E1FB88349FC4413AEB8747B85CA3CE115D710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD63330 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c9ed06f36b3d533f088c72f27e683e59507fd20484e083b1e58df30cf10ceb8
Instruction ID: 3d5b4d844168e002b60da82afe34651576389d771b6d12f01e163c8032630152
Opcode Fuzzy Hash: 7c9ed06f36b3d533f088c72f27e683e59507fd20484e083b1e58df30cf10ceb8
Instruction Fuzzy Hash: BEB13A72A087C5C5E7659F2AC05423D7BB4E74AB48F284235CB4E8B395EF3AE441C790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD6F110 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e5c34987f7a9ca6c6679c1ebbd58ec90466e7178802fc144f73f7d44e403847
Instruction ID: 76568f68169167ef24c42acdbc6a5a6fa67f7fef63af9a95dd49f9a067028cf8
Opcode Fuzzy Hash: 0e5c34987f7a9ca6c6679c1ebbd58ec90466e7178802fc144f73f7d44e403847
Instruction Fuzzy Hash: B581D472A08BC186E774DF2A944076E7AA1FB897D4F544335DA9D8BB89EF3CD4008B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD77350 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 4bcb7fea4aa58ec1e83bb0a718aef7bf1dc42f5110259d120146a0bda132328e
Instruction ID: ac0c1adade64074371447b0dc9d9e8b3e1f9f5da8db0f6116c734e68e3207ff1
Opcode Fuzzy Hash: 4bcb7fea4aa58ec1e83bb0a718aef7bf1dc42f5110259d120146a0bda132328e
Instruction Fuzzy Hash: 8D61F622F1C292F6FB64AA29844033D6AA5EF40364F150BB9DB5DCE6D1FE6DF8418740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD62884 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c25247ae15e209603ec1042d904b34171e82564d0ea1a98edeaeffe93ffac02
Instruction ID: a63446933fd5d45d4ed58a4c552ac67f57a8a0d3251bb72c9bccc403a9264a46
Opcode Fuzzy Hash: 3c25247ae15e209603ec1042d904b34171e82564d0ea1a98edeaeffe93ffac02
Instruction Fuzzy Hash: 43517876A18695C1E7349B2AC04423C3BB0EB95B5CF244231DE8D9B798DF3AE843C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD62064 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51394bb55acd0354c6b54540f03649d9a1ed653df3d59b65c3bbefa0f3d6b76a
Instruction ID: fd309f24cf9c24200721ca65f9a0746ed7155196c27e7a6a4124fdbe64b0cfbb
Opcode Fuzzy Hash: 51394bb55acd0354c6b54540f03649d9a1ed653df3d59b65c3bbefa0f3d6b76a
Instruction Fuzzy Hash: 23514476A18692C5E7349B2AC44472C3BB1EB55B6CF244231CE4D9B794DF3AE843C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD62474 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa1e8384b8f9ed93a652e40ff1fad70abf09339abefc5cb7d3385a95e3869c9a
Instruction ID: b06109df41ec4ebb7a6ea509f9f2fad2d3ce6076183bbc597a2388cbbac2108b
Opcode Fuzzy Hash: fa1e8384b8f9ed93a652e40ff1fad70abf09339abefc5cb7d3385a95e3869c9a
Instruction Fuzzy Hash: 18518436A18691C2E7349B2AC05422C3BB0EB55F5CF244231CE4D9BB94EF3AE842C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD62680 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8494ecf62f03c1d3943c1d589e4c29644468de266d09ee5189585ab02985f6c2
Instruction ID: ebf4324c8ccb21ef2ca9032c48d402e725b85a59841b92b0f6999eb821119466
Opcode Fuzzy Hash: 8494ecf62f03c1d3943c1d589e4c29644468de266d09ee5189585ab02985f6c2
Instruction Fuzzy Hash: BC517336A186D1C6E7349B2AC45467C3BB1EB54B5CF244231CE4C9B7A4EF3AE842C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD61E60 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbef8b130d79a7ad9bd62ede7a83548c92a3f011a0e32d449ba268992e3839f7
Instruction ID: 2325d3b22c477bcc618f044a26189e81e3d311070ebea4b0fe1ec1401a0d0062
Opcode Fuzzy Hash: cbef8b130d79a7ad9bd62ede7a83548c92a3f011a0e32d449ba268992e3839f7
Instruction Fuzzy Hash: 88517036A18A92C6E7349B2AC04433C77B1EB54B58F244231DE4D9B795EF3AE847C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD62270 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4595b9fb9fef9db7488d00d8b5cf28c2737f3b7c2e6c847ec82cdef55389f28
Instruction ID: 47564823ea32a766613b95b4d82475fca2a69b784713dbd7f8f25954c6600267
Opcode Fuzzy Hash: d4595b9fb9fef9db7488d00d8b5cf28c2737f3b7c2e6c847ec82cdef55389f28
Instruction Fuzzy Hash: 78516576A18691C5E7349B2AC04062C3BB0EB59F5CF644235CE4D9F799EF3AE852C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD66510 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: e92a37c76df52a12f6378b9684cbdac2f8c5e9d7f197015dc62e9944f439dec8
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: B541E862C097CAC4ED95995A05007BC36A19F62BA0D1813F4EE9A9F3CBFD0D799683C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD6AA10 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 7d3e4d8fa8e82e1d65e056e10a1cd71db2df39a2122d24cd2b56d782eb366f8f
Instruction ID: 558db2492831b107f076397dcf46abf724848f473feec574d3388f4da2aa47f4
Opcode Fuzzy Hash: 7d3e4d8fa8e82e1d65e056e10a1cd71db2df39a2122d24cd2b56d782eb366f8f
Instruction Fuzzy Hash: AD41E022714A9486EF04DF6AD91466973A2FB48FC4F09A132EE4DDBB58EE3CD4428300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD68278 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a995e5fc84bafd528f225b35c170f98e6cc3b92f214e8a834a3db34d2346d02
Instruction ID: 31299288163b0f15d0e27fbed2e17107755ffec2ea41d71415cbe77eb85948f0
Opcode Fuzzy Hash: 9a995e5fc84bafd528f225b35c170f98e6cc3b92f214e8a834a3db34d2346d02
Instruction Fuzzy Hash: 76315432B18B81C1E664EF26644013D76A5AB85B90F144338EA8DDBBD6EF3CE4128744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD7A420 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aa2e9ba6296ea42dd861dc7f4a70719f263379b300c18e22927abb196144ca8
Instruction ID: 2af40ae80af5d3c9f6f04b3aed4f5569270546e253f6da61b0b782828ad4334b
Opcode Fuzzy Hash: 4aa2e9ba6296ea42dd861dc7f4a70719f263379b300c18e22927abb196144ca8
Instruction Fuzzy Hash: B6F06871B18255CADBA89F6DE4126297BE0F708384F80853DD58DCFB04DA3D90508F04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD5C88C Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba86f607178f2dc3ef803bbc4180c5da227c40ec501de79dfe2d660df2792ade
Instruction ID: 75ff808408a1c986701d781c0d2af3f1580de92bb0fe62a1ee3fc11442b83f83
Opcode Fuzzy Hash: ba86f607178f2dc3ef803bbc4180c5da227c40ec501de79dfe2d660df2792ade
Instruction Fuzzy Hash: 26A0023194CC42E8F644BB0CEC500302770FB50312B8002B5D40EC94A0BF3CB540C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD551E0 Relevance: 233.1, APIs: 44, Strings: 89, Instructions: 363libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF66DD5344E), ref: 00007FF66DD551F0
GetProcAddress.KERNEL32(?,?,00000000,00007FF66DD5344E), ref: 00007FF66DD5522A
GetProcAddress.KERNEL32(?,?,00000000,00007FF66DD5344E), ref: 00007FF66DD5524F
GetProcAddress.KERNEL32(?,?,00000000,00007FF66DD5344E), ref: 00007FF66DD55274
GetProcAddress.KERNEL32(?,?,00000000,00007FF66DD5344E), ref: 00007FF66DD5529C
GetProcAddress.KERNEL32(?,?,00000000,00007FF66DD5344E), ref: 00007FF66DD552C4
GetProcAddress.KERNEL32(?,?,00000000,00007FF66DD5344E), ref: 00007FF66DD552EC
GetProcAddress.KERNEL32(?,?,00000000,00007FF66DD5344E), ref: 00007FF66DD55314
GetProcAddress.KERNEL32(?,?,00000000,00007FF66DD5344E), ref: 00007FF66DD5533C
GetProcAddress.KERNEL32(?,?,00000000,00007FF66DD5344E), ref: 00007FF66DD55364

Strings

Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF66DD5584E
PyEval_EvalCode, xrefs: 00007FF66DD554EA
PyMarshal_ReadObjectFromString, xrefs: 00007FF66DD555B2
Failed to get address for Py_DecRef, xrefs: 00007FF66DD55202
Failed to get address for PyUnicode_Decode, xrefs: 00007FF66DD557FE
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF66DD55736
Failed to get address for PyConfig_SetWideStringList, xrefs: 00007FF66DD553EE
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF66DD556F2
Py_DecodeLocale, xrefs: 00007FF66DD55220
Failed to get address for Py_DecodeLocale, xrefs: 00007FF66DD5523C
PyRun_SimpleStringFlags, xrefs: 00007FF66DD5571A
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF66DD55556
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF66DD555CE
Py_Finalize, xrefs: 00007FF66DD5526A
PyObject_GetAttrString, xrefs: 00007FF66DD5567A
Failed to get address for PyModule_GetDict, xrefs: 00007FF66DD5561E
PyUnicode_Join, xrefs: 00007FF66DD55882
PyUnicode_Decode, xrefs: 00007FF66DD557E2
PyErr_Occurred, xrefs: 00007FF66DD55472
PyModule_GetDict, xrefs: 00007FF66DD55602
PyConfig_SetWideStringList, xrefs: 00007FF66DD553D2
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF66DD55826
Failed to get address for PyErr_Print, xrefs: 00007FF66DD554B6
Failed to get address for PyMem_RawFree, xrefs: 00007FF66DD555F6
PyMem_RawFree, xrefs: 00007FF66DD555DA
PyErr_Clear, xrefs: 00007FF66DD553FA
Failed to get address for PyList_Append, xrefs: 00007FF66DD555A6
Py_DecRef, xrefs: 00007FF66DD551E6
Failed to get address for PyObject_Str, xrefs: 00007FF66DD556E6
PyUnicode_Replace, xrefs: 00007FF66DD558AA
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF66DD557D6
Py_ExitStatusException, xrefs: 00007FF66DD55245
Failed to get address for Py_IsInitialized, xrefs: 00007FF66DD552D6
Failed to get address for PyStatus_Exception, xrefs: 00007FF66DD5575E
Failed to get address for PyImport_ImportModule, xrefs: 00007FF66DD5557E
Failed to get address for PyConfig_SetBytesString, xrefs: 00007FF66DD5539E
PySys_SetObject, xrefs: 00007FF66DD55792
Failed to get address for PyConfig_InitIsolatedConfig, xrefs: 00007FF66DD5534E
Failed to get address for PySys_SetObject, xrefs: 00007FF66DD557AE
PyErr_Print, xrefs: 00007FF66DD5549A
PyErr_NormalizeException, xrefs: 00007FF66DD5544A
Failed to get address for PyUnicode_Replace, xrefs: 00007FF66DD558C6
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF66DD55466
PyConfig_SetString, xrefs: 00007FF66DD553AA
PyList_Append, xrefs: 00007FF66DD5558A
Py_IsInitialized, xrefs: 00007FF66DD552BA
Failed to get address for Py_Finalize, xrefs: 00007FF66DD55286
Failed to get address for PyPreConfig_InitIsolatedConfig, xrefs: 00007FF66DD5570E
PyUnicode_DecodeFSDefault, xrefs: 00007FF66DD5580A
Py_PreInitialize, xrefs: 00007FF66DD552E2
Failed to get address for PyConfig_Clear, xrefs: 00007FF66DD55326
Failed to get address for PyErr_Restore, xrefs: 00007FF66DD554DE
Failed to get address for Py_PreInitialize, xrefs: 00007FF66DD552FE
PyUnicode_FromFormat, xrefs: 00007FF66DD55832
Failed to get address for PyErr_Occurred, xrefs: 00007FF66DD5548E
Failed to get address for PyEval_EvalCode, xrefs: 00007FF66DD55506
PyConfig_SetBytesString, xrefs: 00007FF66DD55382
Failed to get address for PySys_GetObject, xrefs: 00007FF66DD55786
Failed to get address for PyImport_AddModule, xrefs: 00007FF66DD5552E
PyConfig_Clear, xrefs: 00007FF66DD5530A
PyObject_SetAttrString, xrefs: 00007FF66DD556A2
Failed to get address for PyUnicode_FromString, xrefs: 00007FF66DD55876
Failed to get address for PyErr_Fetch, xrefs: 00007FF66DD5543E
PyConfig_InitIsolatedConfig, xrefs: 00007FF66DD55332
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF66DD556BE
PyImport_ImportModule, xrefs: 00007FF66DD55562
Failed to get address for Py_InitializeFromConfig, xrefs: 00007FF66DD552AE
PyObject_CallFunctionObjArgs, xrefs: 00007FF66DD55652
Failed to get address for PyConfig_Read, xrefs: 00007FF66DD55376
PyStatus_Exception, xrefs: 00007FF66DD55742
PyObject_Str, xrefs: 00007FF66DD556CA
PyUnicode_FromString, xrefs: 00007FF66DD5585A
PyObject_CallFunction, xrefs: 00007FF66DD5562A
PyConfig_Read, xrefs: 00007FF66DD5535A
PyErr_Restore, xrefs: 00007FF66DD554C2
Failed to get address for PyErr_Clear, xrefs: 00007FF66DD55416
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF66DD55696
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF66DD5566E
PyUnicode_AsUTF8, xrefs: 00007FF66DD557BA
GetProcAddress, xrefs: 00007FF66DD55209
Py_InitializeFromConfig, xrefs: 00007FF66DD55292
PyImport_AddModule, xrefs: 00007FF66DD55512
Failed to get address for Py_ExitStatusException, xrefs: 00007FF66DD55261
Failed to get address for PyUnicode_Join, xrefs: 00007FF66DD5589E
Failed to get address for PyObject_CallFunction, xrefs: 00007FF66DD55646
PySys_GetObject, xrefs: 00007FF66DD5576A
Failed to get address for PyConfig_SetString, xrefs: 00007FF66DD553C6
PyImport_ExecCodeModule, xrefs: 00007FF66DD5553A
PyErr_Fetch, xrefs: 00007FF66DD55422

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyConfig_Clear$Failed to get address for PyConfig_InitIsolatedConfig$Failed to get address for PyConfig_Read$Failed to get address for PyConfig_SetBytesString$Failed to get address for PyConfig_SetString$Failed to get address for PyConfig_SetWideStringList$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyPreConfig_InitIsolatedConfig$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PyStatus_Exception$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetObject$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_ExitStatusException$Failed to get address for Py_Finalize$Failed to get address for Py_InitializeFromConfig$Failed to get address for Py_IsInitialized$Failed to get address for Py_PreInitialize$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 190572456-4266016200
Opcode ID: 0f541286951d05cfde1ee621bc5578c8d1597a0a29c56f9860b2b78389049273
Instruction ID: 79d0cbfe4ed082245aabc9b886c08c19cdf4e7f7d8d3ce076dfa6710859379cc
Opcode Fuzzy Hash: 0f541286951d05cfde1ee621bc5578c8d1597a0a29c56f9860b2b78389049273
Instruction Fuzzy Hash: 1E126165A4EB03E0FA56FF18A8505B423B1AF88751B946775C81ECE2A4FF7CB548C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD51700 Relevance: 24.6, APIs: 1, Strings: 13, Instructions: 148COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF66DD517C9
fread, xrefs: 00007FF66DD518EC
malloc, xrefs: 00007FF66DD5185D
fopen, xrefs: 00007FF66DD51787
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF66DD51856
Failed to extract %s: failed to open target file!, xrefs: 00007FF66DD51780
Failed to create symbolic link %s!, xrefs: 00007FF66DD51743
pyi_arch_extract2fs was called before temporary directory was initialized!, xrefs: 00007FF66DD51716
fseek, xrefs: 00007FF66DD517FD
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF66DD518D5
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF66DD517F6
fwrite, xrefs: 00007FF66DD518DC
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF66DD518E5

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: Message
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc$pyi_arch_extract2fs was called before temporary directory was initialized!
API String ID: 2030045667-3833288071
Opcode ID: 5bf43b9ab711587773a46785ec42c3c65c14bbb310814db4e1e82add9540f615
Instruction ID: 907dbf2788b5f80fc0fae3951705da826dcb928694bfcab1bd11d3523dd6c062
Opcode Fuzzy Hash: 5bf43b9ab711587773a46785ec42c3c65c14bbb310814db4e1e82add9540f615
Instruction Fuzzy Hash: 69515871B08642D6EA20BF1AE4406B977B1EF45BD4F444631DE1D8FA96FF2CE5498700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD512A0 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF66DD52B10: MessageBoxW.USER32 ref: 00007FF66DD52BE5

_fread_nolock.LIBCMT ref: 00007FF66DD51489

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF66DD512EE
\, xrefs: 00007FF66DD513E5
fseek, xrefs: 00007FF66DD51322
fread, xrefs: 00007FF66DD514B6
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF66DD5131B
malloc, xrefs: 00007FF66DD51367
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF66DD51360
%s%c%s, xrefs: 00007FF66DD513DE
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF66DD514AF

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: Message_fread_nolock
String ID: %s%c%s$Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$\$fread$fseek$malloc
API String ID: 3065259568-2316137593
Opcode ID: e6fbfd7a88a3acd3220cec0b2b42a85d2d63ccd497967aa48f586f71ada1ce5b
Instruction ID: 2db01d8ab90c1bd093b1c89bb9069f5f1793b16df5f2a7c9134298d5f5c15f70
Opcode Fuzzy Hash: e6fbfd7a88a3acd3220cec0b2b42a85d2d63ccd497967aa48f586f71ada1ce5b
Instruction Fuzzy Hash: DA519D31A08683D6EA20BB16A8516FA73B4EF447C4F405231EE5DCBA9AFE7CE4458740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD523D0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF66DD523FB
SelectObject.GDI32 ref: 00007FF66DD52442
DrawTextW.USER32 ref: 00007FF66DD52465
SelectObject.GDI32 ref: 00007FF66DD5247B
ReleaseDC.USER32 ref: 00007FF66DD5248B
MoveWindow.USER32 ref: 00007FF66DD524DB
MoveWindow.USER32 ref: 00007FF66DD5251B
MoveWindow.USER32 ref: 00007FF66DD5256E
MoveWindow.USER32 ref: 00007FF66DD525B6

Strings

P%, xrefs: 00007FF66DD5244F

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 4ec0923ad57b9e26d950b98539eabaaac0ee0779749769c2f3ee915382542b09
Instruction ID: 8c0d3d486f279937aaba37f6d8620b0118103d2eb0b5c427be03820cabfcb89a
Opcode Fuzzy Hash: 4ec0923ad57b9e26d950b98539eabaaac0ee0779749769c2f3ee915382542b09
Instruction Fuzzy Hash: 4151C8366147A1C6D634AF26E4181BAB7B1F798B65F004235EBCE87694EF3CE085DB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD66D84 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD66DC7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD671B4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD67450

Strings

:, xrefs: 00007FF66DD66F80
-, xrefs: 00007FF66DD66E5D
f, xrefs: 00007FF66DD66EE9
p, xrefs: 00007FF66DD66EF1
p, xrefs: 00007FF66DD66E79

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: f37731288347d64e2d3011cd538038f3f04169e152bcb0d828a74818e0b48390
Instruction ID: dd344fe71652fbc40eb34917e76b277d2d2982ce1a7d15b9f6641a81d2dd65dd
Opcode Fuzzy Hash: f37731288347d64e2d3011cd538038f3f04169e152bcb0d828a74818e0b48390
Instruction Fuzzy Hash: 7E129221E0C1CBE6FB207A16D15467D7675FB80754F944236EA998EAC8FF3CE4908B90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD616E8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD61728
_invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD61AF0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD61D8F

Strings

f, xrefs: 00007FF66DD61975
p, xrefs: 00007FF66DD61832
f, xrefs: 00007FF66DD617C0
f, xrefs: 00007FF66DD6182A
p, xrefs: 00007FF66DD617CD

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 7160b50ef5c5d9843a5fd5f0d5cd643ebb1f382f7049b3f2f81a6a7c29ab944c
Instruction ID: 8a9ae97ef948b97182bb058cec2a86297d3a11656412870591804cec906b75fb
Opcode Fuzzy Hash: 7160b50ef5c5d9843a5fd5f0d5cd643ebb1f382f7049b3f2f81a6a7c29ab944c
Instruction Fuzzy Hash: 53129222E0C1C3C6FB60BB56D0546BD76B1FB91754F884632E6998A6C4EF3CE4858B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD51590 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 99COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF66DD515C3
fseek, xrefs: 00007FF66DD51600
fread, xrefs: 00007FF66DD516B9
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF66DD515F9
malloc, xrefs: 00007FF66DD51630
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF66DD51629
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF66DD516B2

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 49147764f31c004b29695ab1ecca4140ab6d42c7e57b4c61b66495af9e1e673c
Instruction ID: 351c06621e8d7ff8f5b39d1746e0d1992f45754492cdb1cd8931174778f5902f
Opcode Fuzzy Hash: 49147764f31c004b29695ab1ecca4140ab6d42c7e57b4c61b66495af9e1e673c
Instruction Fuzzy Hash: 46315B31B48683D6EA24BF16A4405BA73B0EB447D4F884632DE4E8FA55FE7CF5468700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD58080 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90processsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF66DD58BD0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF66DD52A9B), ref: 00007FF66DD58C0A

SetConsoleCtrlHandler.KERNEL32(00000000,00007FF66DD53D37), ref: 00007FF66DD580CF
GetStartupInfoW.KERNEL32 ref: 00007FF66DD580EE

Part of subcall function 00007FF66DD6AFF4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD6B008

Part of subcall function 00007FF66DD68C10: _invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD68C77

GetCommandLineW.KERNEL32 ref: 00007FF66DD5818E
CreateProcessW.KERNEL32 ref: 00007FF66DD581D0
WaitForSingleObject.KERNEL32 ref: 00007FF66DD581E4
GetExitCodeProcess.KERNEL32 ref: 00007FF66DD581F4

Strings

Error creating child process!, xrefs: 00007FF66DD58200
CreateProcessW, xrefs: 00007FF66DD58207

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 2895956056-3524285272
Opcode ID: 3741643826c5352320942fbf43c5de1d0e179915c125a0ccfc2097356f541c1c
Instruction ID: 4da5908cf2117436da508eefc349207a7e779e0a06fa9c28b24403eed8c072c8
Opcode Fuzzy Hash: 3741643826c5352320942fbf43c5de1d0e179915c125a0ccfc2097356f541c1c
Instruction Fuzzy Hash: AF414431A08BC2D5DA20AB25E4452AEB3B4FF94364F500735E6AD8BBD5EF7CD0448B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD5F120 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 312COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF66DD5F17C

Part of subcall function 00007FF66DD600DC: __GetUnwindTryBlock.LIBCMT ref: 00007FF66DD6011F
Part of subcall function 00007FF66DD600DC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF66DD60144

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF66DD5F254
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF66DD5F4A3
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF66DD5F5AF

Strings

csm, xrefs: 00007FF66DD5F277
csm, xrefs: 00007FF66DD5F196
csm, xrefs: 00007FF66DD5F1FD

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 5c4a38c8f57a926daa469fe7fda771022afe3b7785d2be7659b7c9bcf00e9d14
Instruction ID: 186dcd92f3865d5759014ef1a66241d11e3d9d6c2f624de8c08d33315ff19ee2
Opcode Fuzzy Hash: 5c4a38c8f57a926daa469fe7fda771022afe3b7785d2be7659b7c9bcf00e9d14
Instruction Fuzzy Hash: A5D15B72A08742CAEB60AF75D4402AD77B4FB55798F100235EA8D9FB96EF38E491C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD51050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 154COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF66DD510F1
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF66DD51249
malloc, xrefs: 00007FF66DD510F8, 00007FF66DD51126
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF66DD510B4
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF66DD5111F
1.3.1, xrefs: 00007FF66DD5107E

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: Message
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-2813020118
Opcode ID: 78c83a4bffb7f7d0efbc50818c1eaec615024630e109283ba17c9c5b37e430ab
Instruction ID: bcee640faa93b2cc0436ff93d783528ffb0ec4b5c7f0209795bf755361379778
Opcode Fuzzy Hash: 78c83a4bffb7f7d0efbc50818c1eaec615024630e109283ba17c9c5b37e430ab
Instruction Fuzzy Hash: 8F51A932A09682C5EA20BF56E4417BA72A1FB84798F444235EE4ECB796FE3CE545C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD6F7B0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF66DD6FB4A,?,?,-00000018,00007FF66DD6B8F7,?,?,?,00007FF66DD6B7EE,?,?,?,00007FF66DD66A32), ref: 00007FF66DD6F92C
GetProcAddress.KERNEL32(?,?,?,00007FF66DD6FB4A,?,?,-00000018,00007FF66DD6B8F7,?,?,?,00007FF66DD6B7EE,?,?,?,00007FF66DD66A32), ref: 00007FF66DD6F938

Strings

ext-ms-, xrefs: 00007FF66DD6F889
api-ms-, xrefs: 00007FF66DD6F876

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 50fc87d62c39ae03e22a26114dde782de41cd8fd571e56f0271d50297936ec9a
Instruction ID: e77bd1c5f62365aee8fe014f10f4f520ad4e6c08b6f06afb8759b38675930b9b
Opcode Fuzzy Hash: 50fc87d62c39ae03e22a26114dde782de41cd8fd571e56f0271d50297936ec9a
Instruction Fuzzy Hash: C341AD62B59A42D5FA16EB27A8006B923A5BF49BD0F494335DD0DCF784FE3CE4458380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD587A0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF66DD5101D), ref: 00007FF66DD58837
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF66DD5101D), ref: 00007FF66DD5888E

Strings

win32_utils_to_utf8, xrefs: 00007FF66DD588C6
Out of memory., xrefs: 00007FF66DD588BF
WideCharToMultiByte, xrefs: 00007FF66DD588D6
Failed to encode wchar_t as UTF-8., xrefs: 00007FF66DD588B6
Failed to get UTF-8 buffer size., xrefs: 00007FF66DD588CF

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: 3cbf7e68bc59ef73436adbb022304ace8745ffa10feb47800d683f6d14593b66
Instruction ID: a044232374c15c2e1a42250c2c62b85adc377328cd6696a88a0ab187502cfd38
Opcode Fuzzy Hash: 3cbf7e68bc59ef73436adbb022304ace8745ffa10feb47800d683f6d14593b66
Instruction Fuzzy Hash: 4F414C32A18B82C2E660EF15B84017ABAB1FB84794F544235DA8DCBB95FF3CE455CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD58CE0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00007FF66DD539CA), ref: 00007FF66DD58D21

Part of subcall function 00007FF66DD529C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF66DD588E2,?,?,?,?,?,?,?,?,?,?,?,00007FF66DD5101D), ref: 00007FF66DD529F4
Part of subcall function 00007FF66DD529C0: MessageBoxW.USER32 ref: 00007FF66DD52AD0

WideCharToMultiByte.KERNEL32(?,00007FF66DD539CA), ref: 00007FF66DD58D95

Strings

win32_utils_to_utf8, xrefs: 00007FF66DD58D62
Out of memory., xrefs: 00007FF66DD58D5B
WideCharToMultiByte, xrefs: 00007FF66DD58D35, 00007FF66DD58DA6
Failed to encode wchar_t as UTF-8., xrefs: 00007FF66DD58D9F
Failed to get UTF-8 buffer size., xrefs: 00007FF66DD58D2E

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 3723044601-27947307
Opcode ID: cdc817edca651c55abaac523045c67828908e02529da1e8e0e30dd665938bc79
Instruction ID: d6588e972d5a5f7a6f74919e27c193234b15260141a3e2f5e192ad9553bb7c2c
Opcode Fuzzy Hash: cdc817edca651c55abaac523045c67828908e02529da1e8e0e30dd665938bc79
Instruction Fuzzy Hash: 21217C35A18B83D9EA10EF26A8401A977B1EB94B94F544336CA4ECB795FF3CE5058700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD575A0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 136COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF66DD57716

Part of subcall function 00007FF66DD60830: _invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD60844

Part of subcall function 00007FF66DD60804: _invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD60818

Strings

ERROR: file already exists but should not: %s, xrefs: 00007FF66DD5767C
\, xrefs: 00007FF66DD575EC
WARNING: file already exists but should not: %s, xrefs: 00007FF66DD57698
%s%c%s, xrefs: 00007FF66DD575E5
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF66DD57632

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_fread_nolock
String ID: %s%c%s$ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s$\
API String ID: 3231891352-3501660386
Opcode ID: 51b22534cb803c03e450a57b029b0a775e20f1c8180d52c71903a8c39a76eea3
Instruction ID: 9446787a3f7ebd16575e2355c93eddda9b40074919e5f2d233bdf1614d19e399
Opcode Fuzzy Hash: 51b22534cb803c03e450a57b029b0a775e20f1c8180d52c71903a8c39a76eea3
Instruction Fuzzy Hash: 2A516D35E1D683E5FA61BB26A9102B962B1DF84BC0F548331E90DCF6D6FE6CE5058780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD5E1B8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF66DD5E46A,?,?,?,00007FF66DD5D39C,?,?,?,00007FF66DD5CF91), ref: 00007FF66DD5E23D
GetLastError.KERNEL32(?,?,?,00007FF66DD5E46A,?,?,?,00007FF66DD5D39C,?,?,?,00007FF66DD5CF91), ref: 00007FF66DD5E24B
LoadLibraryExW.KERNEL32(?,?,?,00007FF66DD5E46A,?,?,?,00007FF66DD5D39C,?,?,?,00007FF66DD5CF91), ref: 00007FF66DD5E275
FreeLibrary.KERNEL32(?,?,?,00007FF66DD5E46A,?,?,?,00007FF66DD5D39C,?,?,?,00007FF66DD5CF91), ref: 00007FF66DD5E2E3
GetProcAddress.KERNEL32(?,?,?,00007FF66DD5E46A,?,?,?,00007FF66DD5D39C,?,?,?,00007FF66DD5CF91), ref: 00007FF66DD5E2EF

Strings

api-ms-, xrefs: 00007FF66DD5E25D

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 525887afc6986384a1777d0c8198f2eafd939100db725deedb62a7a51ad00a5e
Instruction ID: 164ad54d866f397b8400f1fecc5c3e11817c647353b52930fd3d1d15ca2a1304
Opcode Fuzzy Hash: 525887afc6986384a1777d0c8198f2eafd939100db725deedb62a7a51ad00a5e
Instruction Fuzzy Hash: 0F315E31B1AA42E5EE51BB46A8009B923A4FF48BA4F594735DD5DCE798FE3CE4848300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD57420 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF66DD58BD0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF66DD52A9B), ref: 00007FF66DD58C0A

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF66DD579A1,00000000,?,00000000,00000000,?,00007FF66DD5153F), ref: 00007FF66DD5747F

Part of subcall function 00007FF66DD52B10: MessageBoxW.USER32 ref: 00007FF66DD52BE5

Strings

LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF66DD57493
LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF66DD574DA
LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF66DD57456

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 1662231829-3498232454
Opcode ID: 22c74f2aeb27d9e2e1b9200df4b4c47419f48150c37f7df49e9ad082d6edf2be
Instruction ID: 176fbaa1b2497666a7da5ebb87201aa8cad5b09301fa272f255b80534e31d5b2
Opcode Fuzzy Hash: 22c74f2aeb27d9e2e1b9200df4b4c47419f48150c37f7df49e9ad082d6edf2be
Instruction Fuzzy Hash: 97316021F19682E0FA20BB2599153BE62B1EF987C4F944635DA4ECA7D6FE2CF1058740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD58BD0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF66DD52A9B), ref: 00007FF66DD58C0A

Part of subcall function 00007FF66DD529C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF66DD588E2,?,?,?,?,?,?,?,?,?,?,?,00007FF66DD5101D), ref: 00007FF66DD529F4
Part of subcall function 00007FF66DD529C0: MessageBoxW.USER32 ref: 00007FF66DD52AD0

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF66DD52A9B), ref: 00007FF66DD58C90

Strings

MultiByteToWideChar, xrefs: 00007FF66DD58C1E, 00007FF66DD58CA1
win32_utils_from_utf8, xrefs: 00007FF66DD58C59
Out of memory., xrefs: 00007FF66DD58C52
Failed to decode wchar_t from UTF-8, xrefs: 00007FF66DD58C9A
Failed to get wchar_t buffer size., xrefs: 00007FF66DD58C17

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 3723044601-876015163
Opcode ID: 8b746091e8d54f9d951026cc617a7aeabec9110d911e03e0d2f253015d9281f0
Instruction ID: 10e9b020ec29ba880be01053819071b5b2d27695f39169f90469eac4566e507c
Opcode Fuzzy Hash: 8b746091e8d54f9d951026cc617a7aeabec9110d911e03e0d2f253015d9281f0
Instruction Fuzzy Hash: 6F217322B18A42D1EB50EB29F800069A771FB857C8F584635DF4CDBB69FF2CE5518700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD58650 Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF66DD58670
OpenProcessToken.ADVAPI32 ref: 00007FF66DD58681
GetTokenInformation.ADVAPI32 ref: 00007FF66DD586A6
GetLastError.KERNEL32 ref: 00007FF66DD586B0
GetTokenInformation.ADVAPI32 ref: 00007FF66DD586F0
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF66DD5870C
CloseHandle.KERNEL32 ref: 00007FF66DD58724

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 09af4e1d1a68aac14f11794f91bb1aca58113b247625a6be8eeac8dd3651ce95
Instruction ID: e4637202bc7b05e29d37095f2533cb51957845c4ab01ac2879cf027b4783eee2
Opcode Fuzzy Hash: 09af4e1d1a68aac14f11794f91bb1aca58113b247625a6be8eeac8dd3651ce95
Instruction Fuzzy Hash: AA214431A08643C6EB10AB59E44427AA3B0FF857A5F500335DA6D8BBE5FF7CE4458B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD6BCF0 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF66DD6BCFF
FlsGetValue.KERNEL32 ref: 00007FF66DD6BD14
FlsSetValue.KERNEL32 ref: 00007FF66DD6BD35
FlsSetValue.KERNEL32 ref: 00007FF66DD6BD62
FlsSetValue.KERNEL32 ref: 00007FF66DD6BD73
FlsSetValue.KERNEL32 ref: 00007FF66DD6BD84
SetLastError.KERNEL32 ref: 00007FF66DD6BD9F

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 0ee19574a0982cf08fa92601851437d03fc808c1e3de2497ccb5992d3d317d40
Instruction ID: a3f8d60a032666482cdd7752d629d5282e1ef4aae57c932266b34110c115dc4b
Opcode Fuzzy Hash: 0ee19574a0982cf08fa92601851437d03fc808c1e3de2497ccb5992d3d317d40
Instruction Fuzzy Hash: 41210720E0C682C2FA697736965527D72B29F447A0F154734E92ECE6D6FE3CB4018B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD78B9C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF66DD78BCD
GetLastError.KERNEL32 ref: 00007FF66DD78BD9
CloseHandle.KERNEL32 ref: 00007FF66DD78BF1
CreateFileW.KERNEL32 ref: 00007FF66DD78C1C
WriteConsoleW.KERNEL32 ref: 00007FF66DD78C3B

Strings

CONOUT$, xrefs: 00007FF66DD78BFD

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: c684c657c71cc66e393495913d92b804321d58ad0ed46cdbde63fde403b390ba
Instruction ID: 7232e7061b3943503a77810d757fd09627251cd9b755ecf95c8cde310bdf11ed
Opcode Fuzzy Hash: c684c657c71cc66e393495913d92b804321d58ad0ed46cdbde63fde403b390ba
Instruction Fuzzy Hash: F9118E21A18A41DAE350AB56E88432977B0FB88BE4F040334EE5DCB794EF3CE5448740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD58970 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF66DD58650: GetCurrentProcess.KERNEL32 ref: 00007FF66DD58670
Part of subcall function 00007FF66DD58650: OpenProcessToken.ADVAPI32 ref: 00007FF66DD58681
Part of subcall function 00007FF66DD58650: GetTokenInformation.ADVAPI32 ref: 00007FF66DD586A6
Part of subcall function 00007FF66DD58650: GetLastError.KERNEL32 ref: 00007FF66DD586B0
Part of subcall function 00007FF66DD58650: GetTokenInformation.ADVAPI32 ref: 00007FF66DD586F0
Part of subcall function 00007FF66DD58650: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF66DD5870C
Part of subcall function 00007FF66DD58650: CloseHandle.KERNEL32 ref: 00007FF66DD58724

LocalFree.KERNEL32(00000000,00007FF66DD53B4E), ref: 00007FF66DD589FC
LocalFree.KERNEL32 ref: 00007FF66DD58A05

Strings

D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF66DD589D2
D:(A;;FA;;;%s), xrefs: 00007FF66DD589E7
Security descriptor string length exceeds PATH_MAX!, xrefs: 00007FF66DD58A13
S-1-3-4, xrefs: 00007FF66DD589B1

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PATH_MAX!
API String ID: 6828938-1817031585
Opcode ID: e69f9d860e0369a2c3572a61a1d791fb4b8f0ac012e48f997b8c265c1e7a2feb
Instruction ID: 4bea5bbd06bd295cff3fe4d4dbdf3a203b25bd4e8f7e2954353553ae36c19755
Opcode Fuzzy Hash: e69f9d860e0369a2c3572a61a1d791fb4b8f0ac012e48f997b8c265c1e7a2feb
Instruction Fuzzy Hash: 41213A31A28787D1FA50BB60E8056F96371EF44780F840732E94EDB696FE3CE5048740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD6BE68 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF66DD65AAD,?,?,?,?,00007FF66DD6F79F,?,?,00000000,00007FF66DD6BF86,?,?,?), ref: 00007FF66DD6BE77
FlsSetValue.KERNEL32(?,?,?,00007FF66DD65AAD,?,?,?,?,00007FF66DD6F79F,?,?,00000000,00007FF66DD6BF86,?,?,?), ref: 00007FF66DD6BEAD
FlsSetValue.KERNEL32(?,?,?,00007FF66DD65AAD,?,?,?,?,00007FF66DD6F79F,?,?,00000000,00007FF66DD6BF86,?,?,?), ref: 00007FF66DD6BEDA
FlsSetValue.KERNEL32(?,?,?,00007FF66DD65AAD,?,?,?,?,00007FF66DD6F79F,?,?,00000000,00007FF66DD6BF86,?,?,?), ref: 00007FF66DD6BEEB
FlsSetValue.KERNEL32(?,?,?,00007FF66DD65AAD,?,?,?,?,00007FF66DD6F79F,?,?,00000000,00007FF66DD6BF86,?,?,?), ref: 00007FF66DD6BEFC
SetLastError.KERNEL32(?,?,?,00007FF66DD65AAD,?,?,?,?,00007FF66DD6F79F,?,?,00000000,00007FF66DD6BF86,?,?,?), ref: 00007FF66DD6BF17

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 81df9579e83e1cd669c12650860727807aeb5bcb80b4cbbf71287ed99d1ace91
Instruction ID: 3c08038d18ee9b8aa99c309148f3637933935ef9cd36ef0b3fdf1dfc081a5016
Opcode Fuzzy Hash: 81df9579e83e1cd669c12650860727807aeb5bcb80b4cbbf71287ed99d1ace91
Instruction Fuzzy Hash: 0B113820A0C682C2FA64B776969113D72769F447A0F150734FA2ECE6D6FE3CB4418781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD525E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00007FF66DD527CF), ref: 00007FF66DD52618
DialogBoxIndirectParamW.USER32 ref: 00007FF66DD526DC
DeleteObject.GDI32 ref: 00007FF66DD5270F
DestroyIcon.USER32 ref: 00007FF66DD52721

Strings

Unhandled exception in script, xrefs: 00007FF66DD52648

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 66c833e6ed6def9769710971e31309989410471a98400d4f2f52bf1597ed673f
Instruction ID: af56224645c411c0dd330198e96cf18964ec841e6def874ea86801086ea3d966
Opcode Fuzzy Hash: 66c833e6ed6def9769710971e31309989410471a98400d4f2f52bf1597ed673f
Instruction Fuzzy Hash: 3C311E72A09A82D9EB20EF65E8556FD6370FF88788F440235EA4D8BA55EF3CD1458740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD529C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00007FF66DD588E2,?,?,?,?,?,?,?,?,?,?,?,00007FF66DD5101D), ref: 00007FF66DD529F4

Part of subcall function 00007FF66DD58560: GetLastError.KERNEL32(00000000,00007FF66DD52A3E,?,?,?,?,?,?,?,?,?,?,?,00007FF66DD5101D), ref: 00007FF66DD58587
Part of subcall function 00007FF66DD58560: FormatMessageW.KERNEL32 ref: 00007FF66DD585B6

Part of subcall function 00007FF66DD58BD0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF66DD52A9B), ref: 00007FF66DD58C0A

MessageBoxW.USER32 ref: 00007FF66DD52AD0
MessageBoxA.USER32 ref: 00007FF66DD52AEC

Strings

%s%s: %s, xrefs: 00007FF66DD52A4B
Fatal error detected, xrefs: 00007FF66DD52AA6, 00007FF66DD52ADE

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: Message$ErrorLast$ByteCharFormatMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 2806210788-2410924014
Opcode ID: a22562a3e5708768cb0d15f904b55a8b62d2097d7bb286fe6f48fe5cd4d63a9f
Instruction ID: 734471be9aad7953d49beeb7abb3ca2a552e5fd2e360b8e258d0caee30c161d9
Opcode Fuzzy Hash: a22562a3e5708768cb0d15f904b55a8b62d2097d7bb286fe6f48fe5cd4d63a9f
Instruction Fuzzy Hash: 37316872628A85D1E730FB14E4516EA7374FF84784F804236E68D9BA99EF3CE645CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD6A5F8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF66DD6A61D
GetProcAddress.KERNEL32 ref: 00007FF66DD6A633
FreeLibrary.KERNEL32 ref: 00007FF66DD6A65A

Strings

CorExitProcess, xrefs: 00007FF66DD6A62C
mscoree.dll, xrefs: 00007FF66DD6A614

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 8b09857164704210b2e0253d11d0b3fe713c31e540e9fb1e205907d45fa6ef0f
Instruction ID: c4f13562a7779757fbc2ccfe26ec512f53030c004f952888555a3babafcf54a4
Opcode Fuzzy Hash: 8b09857164704210b2e0253d11d0b3fe713c31e540e9fb1e205907d45fa6ef0f
Instruction Fuzzy Hash: A9F09661B09B46D5FB10AB68E4447796330EF89765F541335CAAECE2E4EF2CE049C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD7A220 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF66DD7A248
_set_statfp.LIBCMT ref: 00007FF66DD7A263
_set_statfp.LIBCMT ref: 00007FF66DD7A27F
_set_statfp.LIBCMT ref: 00007FF66DD7A2BB

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
Instruction ID: 2e8583723b421e8b60d23c5e7b2459f19d23d022fb6edd8264848c1808bac06f
Opcode Fuzzy Hash: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
Instruction Fuzzy Hash: 4A11C122E9CA03F1FA5431A5E446F7921606F98370E6537B5F96ECE3D6AE2DF8408301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD6BF30 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF66DD6B147,?,?,00000000,00007FF66DD6B3E2,?,?,?,?,?,00007FF66DD636AC), ref: 00007FF66DD6BF4F
FlsSetValue.KERNEL32(?,?,?,00007FF66DD6B147,?,?,00000000,00007FF66DD6B3E2,?,?,?,?,?,00007FF66DD636AC), ref: 00007FF66DD6BF6E
FlsSetValue.KERNEL32(?,?,?,00007FF66DD6B147,?,?,00000000,00007FF66DD6B3E2,?,?,?,?,?,00007FF66DD636AC), ref: 00007FF66DD6BF96
FlsSetValue.KERNEL32(?,?,?,00007FF66DD6B147,?,?,00000000,00007FF66DD6B3E2,?,?,?,?,?,00007FF66DD636AC), ref: 00007FF66DD6BFA7
FlsSetValue.KERNEL32(?,?,?,00007FF66DD6B147,?,?,00000000,00007FF66DD6B3E2,?,?,?,?,?,00007FF66DD636AC), ref: 00007FF66DD6BFB8

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 4e03a785267527999042f713a3935151f7ece8db95abf54a9fb70bd1f5489e34
Instruction ID: 01d0f0c8fa00a14b21b34267567cb0c2ae99aa550d7eef71de5faf1dde8d2446
Opcode Fuzzy Hash: 4e03a785267527999042f713a3935151f7ece8db95abf54a9fb70bd1f5489e34
Instruction Fuzzy Hash: F6112920E08682C1FA98B736959117D32B69F843A0F155734F92DCE6E6FE3DB4068780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD6BDC4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF66DD6BDD5
FlsSetValue.KERNEL32 ref: 00007FF66DD6BDF4
FlsSetValue.KERNEL32 ref: 00007FF66DD6BE1C
FlsSetValue.KERNEL32 ref: 00007FF66DD6BE2D
FlsSetValue.KERNEL32 ref: 00007FF66DD6BE3E

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 212ab8644362d2b5fddc8e950eddb9ed53924d62a1b5ee0e8481b764f8be921c
Instruction ID: 4ae3685b0a669ce6268380a2c17d8a5706f88ddedc78fe03faabd2fb2dc046fb
Opcode Fuzzy Hash: 212ab8644362d2b5fddc8e950eddb9ed53924d62a1b5ee0e8481b764f8be921c
Instruction Fuzzy Hash: 9D11E310E08686C1F969B276546117D32728F45360E151734EA3ECE2D3FE3CB4118391

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD66A94 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD66AD0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD66BFA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD66CB0

Strings

verbose, xrefs: 00007FF66DD66AA4

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: ad3fface7d4b2ce3aa9510f497705372120eac90acd968bb25d3a192cbea6c12
Instruction ID: a030dd9512017a03dc958e1cd050ec4ccaf75ea140c40ba993d7e53508b06746
Opcode Fuzzy Hash: ad3fface7d4b2ce3aa9510f497705372120eac90acd968bb25d3a192cbea6c12
Instruction Fuzzy Hash: 8C91AE32A08AC6C1E721AE26D85037D7BB4EB40B58F454276DA5DCB3D5EE3DE84587C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD70B88 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD70E67

Part of subcall function 00007FF66DD76FA4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD76FC1

Strings

UTF-8, xrefs: 00007FF66DD70DE6
ccs, xrefs: 00007FF66DD70DA2
UTF-16LEUNICODE, xrefs: 00007FF66DD70E05

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: d575cc9c9c6fff3bb6b887c91fcc14de71c27d2c4b886d2e4095e12dd43ef316
Instruction ID: bebd61ad1c56d437dcf31969e3493046b73a641ab30aa0309e127ca5b224181c
Opcode Fuzzy Hash: d575cc9c9c6fff3bb6b887c91fcc14de71c27d2c4b886d2e4095e12dd43ef316
Instruction Fuzzy Hash: C581B032E08202E5F7A56F27855127836B0AB11BC8F5582B1EA0DDFAD5FE2EF9418701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD5CD70 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF66DD5CD9B
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF66DD5CE32
RtlUnwindEx.KERNEL32 ref: 00007FF66DD5CE8C

Strings

csm, xrefs: 00007FF66DD5CE19

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 4e145a519d1e56cfcb6aecf34f39f1bb90b218c54cd5e4365c61506f758ddca0
Instruction ID: 25f9510c4ee33b76924f045c9f2cc701247ad87da05d4893ef109ff958fbb9fd
Opcode Fuzzy Hash: 4e145a519d1e56cfcb6aecf34f39f1bb90b218c54cd5e4365c61506f758ddca0
Instruction Fuzzy Hash: 1F51B636B1A601CADB14EB19D444A7C37B5EB44B98F514231EA5D8B784FF7CE895C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD5F5F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF66DD5F64F
_CallSETranslator.LIBVCRUNTIME ref: 00007FF66DD5F69B

Strings

MOC, xrefs: 00007FF66DD5F663
RCC, xrefs: 00007FF66DD5F66B

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 42e7225603c31ac0345d399652e63b89c05e0963da81407f23d94035f534052b
Instruction ID: 7a567f768ecc028a22bd323e6c78f8838bc8205bc2545a4cd2a324579929e276
Opcode Fuzzy Hash: 42e7225603c31ac0345d399652e63b89c05e0963da81407f23d94035f534052b
Instruction Fuzzy Hash: 33618172908BC5C1D760AB25E4407AABBA0FB95794F044335EB9C9BB95EF3CD191CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD5F9A0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF66DD5F9C8
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF66DD5FAB0

Strings

csm, xrefs: 00007FF66DD5FB02
csm, xrefs: 00007FF66DD5F9EA

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 723dedddd72afc6468d282760165df683ca6c1680e5e3aacb3d58d0999c557cb
Instruction ID: 46683b76510cbce4896ce6c20ec03beb0176004b8d7ba339d6a4cf2f3942f776
Opcode Fuzzy Hash: 723dedddd72afc6468d282760165df683ca6c1680e5e3aacb3d58d0999c557cb
Instruction Fuzzy Hash: B0514C32908282CAEB74AF26955426977B0FB95B98F144235DB8DCFB95EF3CF4508701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD52870 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF66DD58BD0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF66DD52A9B), ref: 00007FF66DD58C0A

MessageBoxW.USER32 ref: 00007FF66DD5297B
MessageBoxA.USER32 ref: 00007FF66DD52997

Strings

%s%s: %s, xrefs: 00007FF66DD528F6
Fatal error detected, xrefs: 00007FF66DD52951, 00007FF66DD52989

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 1878133881-2410924014
Opcode ID: 88149bfc2a28579845b544d32f14f9b1101eddfde92b8430b51e14ba55e9a319
Instruction ID: 815564f4c5c748bbce33b85e76034b22983fa68508608367c80db974aab8a116
Opcode Fuzzy Hash: 88149bfc2a28579845b544d32f14f9b1101eddfde92b8430b51e14ba55e9a319
Instruction Fuzzy Hash: C4313472628682D1E730FB15E4516EA7374FF84784F804236E68D8BA99EF3CE645CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD53EB0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF66DD539CA), ref: 00007FF66DD53EE1

Part of subcall function 00007FF66DD529C0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF66DD588E2,?,?,?,?,?,?,?,?,?,?,?,00007FF66DD5101D), ref: 00007FF66DD529F4
Part of subcall function 00007FF66DD529C0: MessageBoxW.USER32 ref: 00007FF66DD52AD0

Strings

Failed to get executable path., xrefs: 00007FF66DD53EEB
Failed to convert executable path to UTF-8., xrefs: 00007FF66DD53F1A
GetModuleFileNameW, xrefs: 00007FF66DD53EF2

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: ErrorFileLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2581892565-1977442011
Opcode ID: 83b392c3a1d8c6461ef05c73b114d4a321837aa147d3d053d1040a026c8207d7
Instruction ID: fc5e6a4b8073304f97dd56c2f71cf8d7f62cd9d398d08f193fbfea5871933048
Opcode Fuzzy Hash: 83b392c3a1d8c6461ef05c73b114d4a321837aa147d3d053d1040a026c8207d7
Instruction Fuzzy Hash: 0C014F71B1D642E5FA61B724E8163B522B1FF58784F801636E84ECE296FE2CF1498710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD6D140 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF66DD6D1BF
WriteFile.KERNEL32 ref: 00007FF66DD6D487
WriteFile.KERNEL32 ref: 00007FF66DD6D4CD
GetLastError.KERNEL32 ref: 00007FF66DD6D583

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: d9e9b6a0e803154a8816c19f60390c13506db3debf7fa671d8e2b76ca9c696ed
Instruction ID: aae72d4b17d66e2b89ed7ded727b29dbbc55608c8917ab79420f8ce2816d17fe
Opcode Fuzzy Hash: d9e9b6a0e803154a8816c19f60390c13506db3debf7fa671d8e2b76ca9c696ed
Instruction Fuzzy Hash: EBD1D172B08A81D9E711DF6AE4402AC3775EB85798F644235CE5DDBB99EE38E406C380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD6DB00 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF66DD6DAEB), ref: 00007FF66DD6DC1C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF66DD6DAEB), ref: 00007FF66DD6DCA7

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 22d3a6457501795b59bf01a2dac9296c2ae100d567842b84d6240295c9042c5f
Instruction ID: 0533bb0428ec684f3d64687555b7e5ab74e61800af4c38e000bf090585a64727
Opcode Fuzzy Hash: 22d3a6457501795b59bf01a2dac9296c2ae100d567842b84d6240295c9042c5f
Instruction Fuzzy Hash: A691C872F08695D5F750BF6AA8402BD3BB4BB84B98F244235DE0E9B685EF78E441C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD702CC Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF66DD703BC
_get_daylight.LIBCMT ref: 00007FF66DD703CD
_get_daylight.LIBCMT ref: 00007FF66DD703DE
_isindst.LIBCMT ref: 00007FF66DD704A9

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: d633cea6ef98d02e7ff3f8296ba5b244dd0af1af742495bf1b1bafc2113ebc24
Instruction ID: 27c6318c920f7a51737d07226aed4b1a451dc5572e99e7644a77e4923ec81245
Opcode Fuzzy Hash: d633cea6ef98d02e7ff3f8296ba5b244dd0af1af742495bf1b1bafc2113ebc24
Instruction Fuzzy Hash: B351E672F04211DAEB24EF65D9956BC2775AB4039CF100335DE1E9AAE5EF3DB4428700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD65E34 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF66DD65E67
GetFileInformationByHandle.KERNEL32 ref: 00007FF66DD65EC9
GetLastError.KERNEL32 ref: 00007FF66DD65F5A
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,?,00007FF66DD65D6C), ref: 00007FF66DD65FA6

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: c83329a2bd18a21367976a5c4af3d00e11dcc87eb128c326a6acb0b8d0e7847d
Instruction ID: 17030bb926630c7e078752a0732041664d5ef0bee61d9912bf0f8f082bd48545
Opcode Fuzzy Hash: c83329a2bd18a21367976a5c4af3d00e11dcc87eb128c326a6acb0b8d0e7847d
Instruction Fuzzy Hash: E2516222E18681CAFB10EF72D4503BD37B1AF58B58F144635EE4D9BA86EF38D4858790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD65CE0 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD65D0D
CreateFileW.KERNEL32 ref: 00007FF66DD65D4C
CloseHandle.KERNEL32 ref: 00007FF66DD65D81

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: eaa23331f25f2e51c26c40c7f22f67132b8e6c9fb57ddc49ae46cd87a565a1ae
Instruction ID: 2ee0725905621b75e0b0d5825230241b655fc4082cf5e529f4e0a4a673250fb3
Opcode Fuzzy Hash: eaa23331f25f2e51c26c40c7f22f67132b8e6c9fb57ddc49ae46cd87a565a1ae
Instruction Fuzzy Hash: CA418F62D187C2C3E754AB62954437D7370FB947A4F109334EA9C8BAD6EF6CA5E08780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD52310 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF66DD52344
SetWindowLongPtrW.USER32 ref: 00007FF66DD52366
GetWindowLongPtrW.USER32 ref: 00007FF66DD52390
InvalidateRect.USER32 ref: 00007FF66DD523B0

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: b05b5568a63e2e2d0baaa3588e58b47743bee96d0fa3dc0d735729d29a60f88b
Instruction ID: 1367b53921a736f1f1d40a9ad9b84714f13163d3473d27716f6b80b2a2a3610f
Opcode Fuzzy Hash: b05b5568a63e2e2d0baaa3588e58b47743bee96d0fa3dc0d735729d29a60f88b
Instruction Fuzzy Hash: 2D11A931A08142C2F764AB69E5442B916B1EB85B84F444235DA498EB99ED2CE4C94700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD7686C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF66DD723B0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD723E3

_get_daylight.LIBCMT ref: 00007FF66DD76984
_get_daylight.LIBCMT ref: 00007FF66DD76995

Strings

?, xrefs: 00007FF66DD76915

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 0930287eedd1917940a0480c2dd6402272712f8c6384c3a7c216d5b4ae975781
Instruction ID: da45a7ac54ef35153de8771cef874380783f13e0760c6bd4be5b92093b2ee8d4
Opcode Fuzzy Hash: 0930287eedd1917940a0480c2dd6402272712f8c6384c3a7c216d5b4ae975781
Instruction Fuzzy Hash: E0410B22A08282E2F7A4AB26D44177E6670EF80BA4F144375EE5C8EAD5FF3CE441C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD69B84 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD69BB6

Part of subcall function 00007FF66DD6B4EC: HeapFree.KERNEL32(?,?,?,00007FF66DD73972,?,?,?,00007FF66DD739AF,?,?,00000000,00007FF66DD73E75,?,?,00000000,00007FF66DD73DA7), ref: 00007FF66DD6B502
Part of subcall function 00007FF66DD6B4EC: GetLastError.KERNEL32(?,?,?,00007FF66DD73972,?,?,?,00007FF66DD739AF,?,?,00000000,00007FF66DD73E75,?,?,00000000,00007FF66DD73DA7), ref: 00007FF66DD6B50C

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF66DD5C125), ref: 00007FF66DD69BD4

Strings

C:\Users\user\Desktop\hv7H7u7IvS.exe, xrefs: 00007FF66DD69BC2

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\hv7H7u7IvS.exe
API String ID: 3580290477-2896458556
Opcode ID: f41bca3c60c2b35ddc9f50a7c6ece592f9eb92d123b0ffd90266884ce268fb58
Instruction ID: 7e6379b7b020fc58445e743269e462a057621a808be4d6f391a634c4afb30146
Opcode Fuzzy Hash: f41bca3c60c2b35ddc9f50a7c6ece592f9eb92d123b0ffd90266884ce268fb58
Instruction Fuzzy Hash: DE411031A08A92C5EB14FF2698901BD76B8EF447D4F555235E94D8B785EF39E4818380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD6D7D8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF66DD6D8EF
GetLastError.KERNEL32 ref: 00007FF66DD6D911

Strings

U, xrefs: 00007FF66DD6D89B

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 1c4d8f885a23e91b6f023f5bba01b3d5456b675b65fc2396528dfcf9b2bee20e
Instruction ID: fbe3ae1dc73f1bbeba85970159800aa802aced6d2238f5dabc4266a6539245eb
Opcode Fuzzy Hash: 1c4d8f885a23e91b6f023f5bba01b3d5456b675b65fc2396528dfcf9b2bee20e
Instruction Fuzzy Hash: C441B122A18A85D5DB60AF26E8443AD7771FB98794F944231EE4DCB788EF3CD541C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD6FEF8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF66DD6FF38
GetCurrentDirectoryW.KERNEL32 ref: 00007FF66DD6FF8A

Strings

:, xrefs: 00007FF66DD6FF4E

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: 5e105f0e2b368d3f9dedb3a7fc5cc25de905b31730642d2b5143ffde5ed086ab
Instruction ID: db880b03a01f6aa9db84d83da6fe518ef7c478c7543345afa841f9f3d7796b95
Opcode Fuzzy Hash: 5e105f0e2b368d3f9dedb3a7fc5cc25de905b31730642d2b5143ffde5ed086ab
Instruction Fuzzy Hash: 5A217323A08A81C5EB20AB36D44426D73B2FB84B44F558235D68DCB6C5EF7CE5498791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD52C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF66DD58BD0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF66DD52A9B), ref: 00007FF66DD58C0A

MessageBoxW.USER32 ref: 00007FF66DD52D05
MessageBoxA.USER32 ref: 00007FF66DD52D21

Strings

Error detected, xrefs: 00007FF66DD52CDB, 00007FF66DD52D13

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error detected
API String ID: 1878133881-3513342764
Opcode ID: 04587b85e8c5a5f01c124244adb340557da1a3c376205467b785ddfdae2ba4e1
Instruction ID: a0d3fe2ee94bfd8922454df7b24520ca08e3cf5af1da88423b61b260d5a00117
Opcode Fuzzy Hash: 04587b85e8c5a5f01c124244adb340557da1a3c376205467b785ddfdae2ba4e1
Instruction Fuzzy Hash: D7217972628685D1E730EB14F4516EA7374FF84788F805236E68D8B995EF3CD215CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD60468 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF66DD604B8
RaiseException.KERNEL32 ref: 00007FF66DD604F9

Strings

csm, xrefs: 00007FF66DD604E6

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: c8cc4bb08b20690d02c8bce5cff6a9b5d4d552f887a177c474232a7ea1470dcf
Instruction ID: b98786a79bc40b2739e44fe663001997871245cecace9a4a4147b8d36f50a984
Opcode Fuzzy Hash: c8cc4bb08b20690d02c8bce5cff6a9b5d4d552f887a177c474232a7ea1470dcf
Instruction Fuzzy Hash: DD112E32618B8182EB619F26F54026D77E4FB88B94F584230DACD4B759EF3CE5518740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF66DD709FC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF66DD70A2C
GetDriveTypeW.KERNEL32 ref: 00007FF66DD70A6C

Strings

:, xrefs: 00007FF66DD70A55

Memory Dump Source

Source File: 00000000.00000002.1684853065.00007FF66DD51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66DD50000, based on PE: true

Associated: 00000000.00000002.1684836664.00007FF66DD50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684887564.00007FF66DD7C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD8F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684913351.00007FF66DD91000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1684948511.00007FF66DD93000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff66dd50000_hv7H7u7IvS.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 0bb087a2c4c4f6707d1aaf47450714c5cfb5908953c580e39f9c8bdb8a3b6409
Instruction ID: 899d1a53979fa37bd02029a1e6aae63318d69cc6f671729e7558668c32cac0ae
Opcode Fuzzy Hash: 0bb087a2c4c4f6707d1aaf47450714c5cfb5908953c580e39f9c8bdb8a3b6409
Instruction Fuzzy Hash: C9015A62D18646D6EB30BB61946127E63B4EF44748F841235E94DCA6C2FE2DE544CB14

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report hv7H7u7IvS.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: hv7H7u7IvS.exePID: 1004, Parent PID: 2580

General

Chronological Activities

Disassembly

Analysis Process: hv7H7u7IvS.exePID: 1004, Parent PID: 2580COMMON

Execution Graph

Graph

Executed Functions

Function 00007FF66DD7789C Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON

Control-flow Graph

Function 00007FF66DD51A90 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 135COMMON

Control-flow Graph

Function 00007FF66DD51000 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 269COMMON

Windows Analysis Report
hv7H7u7IvS.exe

Function 00007FF66DD7789C Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Function 00007FF66DD51A90 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 135
COMMON

Function 00007FF66DD51000 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 269
COMMON

Function 00007FF66DD6C5FC Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Function 00007FF66DD52B10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57
windowCOMMON

Function 00007FF66DD5C1BC Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Function 00007FF66DD6A5A0 Relevance: 4.5, APIs: 3, Instructions: 14
COMMON

Function 00007FF66DD6085C Relevance: 3.2, APIs: 2, Instructions: 177
COMMONLIBRARYCODE

Function 00007FF66DD6B6FC Relevance: 3.1, APIs: 2, Instructions: 59
COMMON

Function 00007FF66DD6CCD4 Relevance: 3.0, APIs: 2, Instructions: 46
COMMONLIBRARYCODE

Function 00007FF66DD6CA4C Relevance: 1.6, APIs: 1, Instructions: 112
COMMONLIBRARYCODE

Function 00007FF66DD582B0 Relevance: 1.6, APIs: 1, Instructions: 85
COMMON

Function 00007FF66DD6C4DC Relevance: 1.6, APIs: 1, Instructions: 79
COMMONLIBRARYCODE

Function 00007FF66DD6A4D1 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Function 00007FF66DD66A88 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON