Edit tour

Windows Analysis Report
cmd.exe

Overview

General Information

Sample name:	cmd.exe
Analysis ID:	1385352
MD5:	cb6cd09f6a25744a8fa6e4b3e4d260c5
SHA1:	e9be2f86e3a3bff02d1953aeccf0ed22284596d4
SHA256:	265b69033cea7a9f8214a34cd9b17912909af46c7a47395dd7bb893a24507e59
Infos:

Detection

Score:	7
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Binary contains a suspicious time stamp

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to launch a process as a different user

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found large amount of non-executed APIs

PE file contains sections with non-standard names

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Classification

Process Tree

System is w10x64

cmd.exe (PID: 5252 cmdline: C:\Users\user\Desktop\cmd.exe MD5: CB6CD09F6A25744A8FA6E4B3E4D260C5)

conhost.exe (PID: 2004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Code function: 0_2_00007FF6D9FD5240: memset,GetFileSecurityW,GetSecurityDescriptorOwner,??_V@YAXPEAX@Z,memset,CreateFileW,DeviceIoControl,memmove,CloseHandle,??_V@YAXPEAX@Z,memset,FindClose,??_V@YAXPEAX@Z,??_V@YAXPEAX@Z,

0_2_00007FF6D9FD5240

Source: C:\Users\user\Desktop\cmd.exe

Code function: 0_2_00007FF6D9FE4224 InitializeProcThreadAttributeList,UpdateProcThreadAttribute,memset,memset,GetStartupInfoW,wcsrchr,lstrcmpW,CreateProcessW,CloseHandle,CreateProcessAsUserW,_local_unwind,GetLastError,_local_unwind,_local_unwind,CloseHandle,DeleteProcThreadAttributeList,GetLastError,GetLastError,DeleteProcThreadAttributeList,

0_2_00007FF6D9FE4224

Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FE37D8	0_2_00007FF6D9FE37D8
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FD3410	0_2_00007FF6D9FD3410
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FE5554	0_2_00007FF6D9FE5554
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FDAA54	0_2_00007FF6D9FDAA54
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FF7F00	0_2_00007FF6D9FF7F00
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FD9B50	0_2_00007FF6D9FD9B50
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FD5B70	0_2_00007FF6D9FD5B70
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FD3F90	0_2_00007FF6D9FD3F90
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FFAFBC	0_2_00007FF6D9FFAFBC
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FD6BE0	0_2_00007FF6D9FD6BE0
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FE7854	0_2_00007FF6D9FE7854
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FFAC4C	0_2_00007FF6D9FFAC4C
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FD2C48	0_2_00007FF6D9FD2C48
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FD1884	0_2_00007FF6D9FD1884
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FE18D4	0_2_00007FF6D9FE18D4
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FDB0D8	0_2_00007FF6D9FDB0D8
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FD8510	0_2_00007FF6D9FD8510
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FD7D30	0_2_00007FF6D9FD7D30
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6DA001538	0_2_00007FF6DA001538
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FD81D4	0_2_00007FF6D9FD81D4
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FFD9D0	0_2_00007FF6D9FFD9D0
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FD8DF8	0_2_00007FF6D9FD8DF8
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FDCE10	0_2_00007FF6D9FDCE10
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FE4224	0_2_00007FF6D9FE4224
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FD2220	0_2_00007FF6D9FD2220
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FFAA30	0_2_00007FF6D9FFAA30
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FD4A30	0_2_00007FF6D9FD4A30
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FD5240	0_2_00007FF6D9FD5240
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FD7650	0_2_00007FF6D9FD7650
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FDD250	0_2_00007FF6D9FDD250
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FD9E50	0_2_00007FF6D9FD9E50
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FE0A6C	0_2_00007FF6D9FE0A6C
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FDE680	0_2_00007FF6D9FDE680
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FFEE88	0_2_00007FF6D9FFEE88
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FD6EE4	0_2_00007FF6D9FD6EE4
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FD372C	0_2_00007FF6D9FD372C

Source: cmd.exe

Binary or memory string: OriginalFilename vs cmd.exe

Source: C:\Users\user\Desktop\cmd.exe	Section loaded: winbrand.dll			Jump to behavior
Source: C:\Users\user\Desktop\cmd.exe	Section loaded: wldp.dll			Jump to behavior

Source: classification engine

Classification label: clean7.winEXE@2/0@0/0

Source: C:\Users\user\Desktop\cmd.exe

Code function: 0_2_00007FF6D9FD32B0 _get_osfhandle,GetConsoleScreenBufferInfo,WriteConsoleW,wcschr,FormatMessageW,GetConsoleScreenBufferInfo,WriteConsoleW,GetStdHandle,FlushConsoleInputBuffer,GetConsoleMode,SetConsoleMode,_getch,SetConsoleMode,GetConsoleScreenBufferInfo,FillConsoleOutputCharacterW,SetConsoleCursorPosition,GetLastError,GetLastError,

0_2_00007FF6D9FD32B0

Source: C:\Users\user\Desktop\cmd.exe

Code function: 0_2_00007FF6D9FFFB54 memset,GetDiskFreeSpaceExW,??_V@YAXPEAX@Z,

0_2_00007FF6D9FFFB54

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2004:120:WilError_03

Source: cmd.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\cmd.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\cmd.exe C:\Users\user\Desktop\cmd.exe
Source: C:\Users\user\Desktop\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: cmd.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: cmd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: cmd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: cmd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: cmd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: cmd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: cmd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: cmd.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: cmd.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: cmd.pdbUGP source: cmd.exe
Source:	Binary string: cmd.pdb source: cmd.exe

Source: cmd.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: cmd.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: cmd.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: cmd.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: cmd.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: cmd.exe

Static PE information: 0xD7EE190D [Wed Oct 18 11:03:41 2084 UTC]

Source: cmd.exe

Static PE information: section name: .didat

Source: C:\Users\user\Desktop\cmd.exe

API coverage: 9.2 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FE2978 FindFirstFileW,FindClose,memmove,_wcsnicmp,_wcsicmp,memmove,	0_2_00007FF6D9FE2978
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FF7B4C FindFirstFileW,FindNextFileW,FindClose,	0_2_00007FF6D9FF7B4C
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FD1560 memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPEAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,	0_2_00007FF6D9FD1560
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FD35B8 GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPEAX@Z,FindNextFileW,SetLastError,??_V@YAXPEAX@Z,GetLastError,FindClose,	0_2_00007FF6D9FD35B8
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FE823C FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,FindNextFileW,GetProcessHeap,HeapReAlloc,FindClose,GetLastError,FindClose,	0_2_00007FF6D9FE823C

Source: C:\Users\user\Desktop\cmd.exe

Code function: 0_2_00007FF6D9FE8B00 DelayLoadFailureHook,LdrResolveDelayLoadedAPI,

0_2_00007FF6D9FE8B00

Source: C:\Users\user\Desktop\cmd.exe

Code function: 0_2_00007FF6D9FF63FC GetCurrentThreadId,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF6D9FF63FC

Source: C:\Users\user\Desktop\cmd.exe

Code function: 0_2_00007FF6D9FDDF60 GetProcessHeap,RtlFreeHeap,_setjmp,longjmp,VirtualFree,

0_2_00007FF6D9FDDF60

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FE8FA4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00007FF6D9FE8FA4
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FE93B0 SetUnhandledExceptionFilter,		0_2_00007FF6D9FE93B0

Source: C:\Users\user\Desktop\cmd.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale,	0_2_00007FF6D9FE51EC
Source: C:\Users\user\Desktop\cmd.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW,	0_2_00007FF6D9FE3140
Source: C:\Users\user\Desktop\cmd.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetDateFormatW,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,realloc,	0_2_00007FF6D9FD6EE4

Source: C:\Users\user\Desktop\cmd.exe

Code function: 0_2_00007FF6D9FE3140 GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW,

0_2_00007FF6D9FE3140

Source: C:\Users\user\Desktop\cmd.exe

Code function: 0_2_00007FF6D9FD586C GetVersion,

0_2_00007FF6D9FD586C

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	Windows Management Instrumentation	1 Valid Accounts	1 Valid Accounts	1 Valid Accounts	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Access Token Manipulation	1 Access Token Manipulation	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Process Injection	1 Process Injection	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Timestomp	NTDS	14 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
cmd.exe	0%	ReversingLabs
cmd.exe	0%	Virustotal		Browse

Joe Sandbox version:	39.0.0 Ruby
Analysis ID:	1385352
Start date and time:	2024-02-02 05:06:57 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	cmd.exe
Detection:	CLEAN
Classification:	clean7.winEXE@2/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 38 Number of non-executed functions: 148
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.135596419282984
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	cmd.exe
File size:	289'792 bytes
MD5:	cb6cd09f6a25744a8fa6e4b3e4d260c5
SHA1:	e9be2f86e3a3bff02d1953aeccf0ed22284596d4
SHA256:	265b69033cea7a9f8214a34cd9b17912909af46c7a47395dd7bb893a24507e59
SHA512:	d978934298ef3c2b6da441afa146364f1a9f0d7e4a10a5aa8541a17c5b13202d95d47cc9e77140cea9eb059793caa9161200fdd86533dfaa2246c92e27c6bbdb
SSDEEP:	6144:s4WA1B9BxDfQWKORSqY4zOcmpdlc3gLotdlSm:P1BhkWvSqY4zvmjOwck
TLSH:	3A54291D23991CE5D927923D9903C226C6727C346321A6EF22D0CD7B6F63AE97A34F05
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........OH...&...&...&..V....&..E%...&..E"...&...'../&..E'...&..E#...&..E+...&..E....&..E$...&.Rich..&.................PE..d..........

File Icon


Icon Hash:	a43a7ac70101a5a0

Static PE Info

General

Entrypoint:	0x140018f50
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0xD7EE190D [Wed Oct 18 11:03:41 2084 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	272245e2988e1e430500b852c4fb5e18

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FAF2102C550h
dec eax
add esp, 28h
jmp 00007FAF2102BD43h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
nop word ptr [eax+eax+00000000h]
dec eax
cmp ecx, dword ptr [00024171h]
jne 00007FAF2102BF32h
dec eax
rol ecx, 10h
test cx, FFFFh
jne 00007FAF2102BF23h
ret
dec eax
ror ecx, 10h
jmp 00007FAF2102BF67h
int3
int3
int3
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [0001A633h]
dec eax
mov ecx, ebx
call dword ptr [0001A612h]
call dword ptr [0001A944h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [0001A920h]
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 00000088h
dec eax
lea ecx, dword ptr [000242CDh]
call dword ptr [0001ADC7h]
dec eax
mov eax, dword ptr [000243B8h]
dec eax
mov dword ptr [esp+48h], eax
inc ebp
xor eax, eax
dec eax
lea edx, dword ptr [esp+50h]
dec eax
mov ecx, dword ptr [esp+48h]
call dword ptr [0001ADA0h]

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3a028	0x2f8	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5d000	0x84f8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x59000	0x2334	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x66000	0x30c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x35a60	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x32c10	0x118	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x334d0	0x9a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x39d20	0x80	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x30ef9	0x31000	25a5d44020db4754910ab6e396c9a718	False	0.5605070153061225	data	6.309578650753951	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x32000	0xa53c	0xa600	23613b8ef679b342307b8738c949053f	False	0.3739646084337349	data	4.9231968161506465	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3d000	0x1bc50	0x200	1cf8515124a1a34c1675f83df3970743	False	0.38671875	data	3.17983043542025	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x59000	0x2334	0x2400	2b671e140419d52024fd880b0050fd61	False	0.5021701388888888	data	5.489299855036303	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat	0x5c000	0x90	0x200	8963233f6e4d70f6f240ab50ce9621cf	False	0.119140625	data	1.0346602658536108	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5d000	0x84f8	0x8600	beff4d2ce9292f4b64971d20b49d7d2b	False	0.28270755597014924	data	4.359907321995828	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x66000	0x30c	0x400	1bdbe7e1ecefe0f26fe1ab14787f890c	False	0.546875	data	4.67734346646031	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
MUI	0x65420	0xd8	data	English	United States	0.5185185185185185
RT_ICON	0x5d778	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.21097560975609755
RT_ICON	0x5dde0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.2647849462365591
RT_ICON	0x5e0c8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.3783783783783784
RT_ICON	0x5e1f0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.11567164179104478
RT_ICON	0x5f098	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.18592057761732853
RT_ICON	0x5f940	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.08236994219653179
RT_ICON	0x5fea8	0x169e	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.968048359240069
RT_ICON	0x61548	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.06130705394190871
RT_ICON	0x63af0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.1177298311444653
RT_ICON	0x64b98	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.09308510638297872
RT_GROUP_ICON	0x65000	0x92	data	English	United States	0.636986301369863
RT_VERSION	0x65098	0x388	data	English	United States	0.4657079646017699
RT_MANIFEST	0x5d350	0x428	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.43609022556390975

Imports

DLL	Import
msvcrt.dll	_setmode, exit, iswxdigit, time, srand, _wtol, fflush, wcsstr, iswalpha, wcstoul, _errno, printf, rand, fprintf, wcsncmp, _pipe, _commode, _lock, wcsrchr, realloc, towlower, _initterm, __setusermatherr, setlocale, _wcsupr, iswdigit, _ultoa, _cexit, _unlock, _exit, __dllonexit, _wcsicmp, iswspace, wcschr, fgets, ??_V@YAXPEAX@Z, _pclose, ferror, _onexit, __CxxFrameHandler3, _open_osfhandle, _close, feof, _dup, _wpopen, _wcsnicmp, ?terminate@@YAXXZ, memset, wcstol, _get_osfhandle, _dup2, _getch, towupper, memcmp, _setjmp, wcsspn, _fmode, qsort, __set_app_type, _tell, _wcslwr, longjmp, _local_unwind, _purecall, __C_specific_handler, ??3@YAXPEAX@Z, memcpy_s, free, calloc, __getmainargs, _XcptFilter, _amsg_exit, ??1type_info@@UEAA@XZ, memmove, memcpy, _CxxThrowException, _vsnwprintf, swscanf, __iob_func, malloc, _callnewh, ??0exception@@QEAA@AEBQEBD@Z, ??0exception@@QEAA@AEBQEBDH@Z, ??0exception@@QEAA@AEBV0@@Z, ??1exception@@UEAA@XZ, ?what@exception@@UEBAPEBDXZ, wcscmp
ntdll.dll	RtlLookupFunctionEntry, RtlCaptureContext, NtOpenProcessToken, NtQueryInformationToken, NtClose, NtOpenThreadToken, RtlFreeHeap, NtFsControlFile, RtlDosPathNameToNtPathName_U, RtlVirtualUnwind, RtlFreeUnicodeString, RtlReleaseRelativeName, NtOpenFile, RtlDosPathNameToRelativeNtPathName_U_WithStatus, NtSetInformationFile, NtQueryVolumeInformationFile, NtSetInformationProcess, NtQueryInformationProcess, RtlNtStatusToDosError, NtCancelSynchronousIoFile, RtlCreateUnicodeStringFromAsciiz, RtlFindLeastSignificantBit
api-ms-win-core-kernel32-legacy-l1-1-0.dll	CopyFileW, GetConsoleWindow
api-ms-win-core-libraryloader-l1-2-0.dll	GetModuleHandleW, GetModuleFileNameA, LoadLibraryExW, GetProcAddress, GetModuleFileNameW, GetModuleHandleExW
api-ms-win-core-synch-l1-1-0.dll	CreateSemaphoreExW, InitializeCriticalSection, WaitForSingleObject, ReleaseSemaphore, TryAcquireSRWLockExclusive, WaitForSingleObjectEx, ReleaseMutex, ReleaseSRWLockShared, AcquireSRWLockShared, LeaveCriticalSection, CreateMutexExW, EnterCriticalSection, ReleaseSRWLockExclusive, OpenSemaphoreW
api-ms-win-core-heap-l1-1-0.dll	HeapFree, HeapAlloc, GetProcessHeap, HeapSetInformation, HeapReAlloc, HeapSize
api-ms-win-core-errorhandling-l1-1-0.dll	SetLastError, UnhandledExceptionFilter, GetLastError, SetErrorMode, SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0.dll	InitializeProcThreadAttributeList, GetCurrentThreadId, UpdateProcThreadAttribute, DeleteProcThreadAttributeList, GetStartupInfoW, CreateProcessAsUserW, OpenThread, CreateProcessW, ResumeThread, TerminateProcess, GetExitCodeProcess, GetCurrentProcess, GetCurrentProcessId
api-ms-win-core-localization-l1-2-0.dll	GetThreadLocale, SetThreadLocale, FormatMessageW, GetLocaleInfoW, GetCPInfo, GetACP, GetUserDefaultLCID
api-ms-win-core-debug-l1-1-0.dll	OutputDebugStringW, DebugBreak, IsDebuggerPresent
api-ms-win-core-handle-l1-1-0.dll	DuplicateHandle, CloseHandle
api-ms-win-core-memory-l1-1-0.dll	VirtualAlloc, VirtualQuery, VirtualFree, ReadProcessMemory
api-ms-win-core-console-l1-1-0.dll	ReadConsoleW, SetConsoleCtrlHandler, SetConsoleMode, WriteConsoleW, GetConsoleMode, GetConsoleOutputCP
api-ms-win-core-file-l1-1-0.dll	CreateFileW, FlushFileBuffers, GetFileAttributesExW, GetDriveTypeW, FindClose, FindNextFileW, CreateDirectoryW, GetVolumeInformationW, SetFileAttributesW, SetEndOfFile, SetFilePointerEx, WriteFile, DeleteFileW, SetFileTime, GetVolumePathNameW, SetFilePointer, ReadFile, GetFileAttributesW, GetFileType, RemoveDirectoryW, FindFirstFileExW, CompareFileTime, GetFullPathNameW, GetDiskFreeSpaceExW, FileTimeToLocalFileTime, GetFileSize, FindFirstFileW
api-ms-win-core-string-l1-1-0.dll	WideCharToMultiByte, MultiByteToWideChar
api-ms-win-core-processenvironment-l1-1-0.dll	GetCommandLineW, GetEnvironmentStringsW, ExpandEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, SearchPathW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetEnvironmentVariableW, SetEnvironmentStringsW, GetStdHandle
api-ms-win-core-console-l2-1-0.dll	SetConsoleCursorPosition, GetConsoleScreenBufferInfo, ScrollConsoleScreenBufferW, FillConsoleOutputAttribute, FillConsoleOutputCharacterW, FlushConsoleInputBuffer, SetConsoleTextAttribute
api-ms-win-security-base-l1-1-0.dll	GetFileSecurityW, RevertToSelf, GetSecurityDescriptorOwner
api-ms-win-core-sysinfo-l1-1-0.dll	GetSystemTime, SetLocalTime, GetSystemTimeAsFileTime, GetTickCount, GetWindowsDirectoryW, GetLocalTime, GetVersion
api-ms-win-core-timezone-l1-1-0.dll	SystemTimeToFileTime, FileTimeToSystemTime
api-ms-win-core-datetime-l1-1-0.dll	GetDateFormatW, GetTimeFormatW
api-ms-win-core-systemtopology-l1-1-0.dll	GetNumaNodeProcessorMaskEx, GetNumaHighestNodeNumber
api-ms-win-core-console-l2-2-0.dll	SetConsoleTitleW, GetConsoleTitleW
api-ms-win-core-processenvironment-l1-2-0.dll	NeedCurrentDirectoryForExePathW
api-ms-win-core-registry-l1-1-0.dll	RegCloseKey, RegSetValueExW, RegOpenKeyExW, RegCreateKeyExW, RegEnumKeyExW, RegDeleteKeyExW, RegDeleteValueW, RegQueryValueExW
api-ms-win-core-file-l2-1-0.dll	MoveFileExW, CreateSymbolicLinkW, CreateHardLinkW, MoveFileWithProgressW, GetFileInformationByHandleEx
api-ms-win-core-heap-l2-1-0.dll	GlobalAlloc, GlobalFree, LocalFree
api-ms-win-core-io-l1-1-0.dll	DeviceIoControl
api-ms-win-core-winrt-l1-1-0.dll	RoInitialize, RoUninitialize
api-ms-win-core-processtopology-l1-1-0.dll	GetThreadGroupAffinity
api-ms-win-core-synch-l1-2-0.dll	Sleep
api-ms-win-core-profile-l1-1-0.dll	QueryPerformanceCounter
api-ms-win-core-string-obsolete-l1-1-0.dll	lstrcmpW, lstrcmpiW
api-ms-win-core-processtopology-obsolete-l1-1-0.dll	SetProcessAffinityMask
api-ms-win-core-apiquery-l1-1-0.dll	ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1.dll	ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0.dll	DelayLoadFailureHook

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	05:07:45
Start date:	02/02/2024
Path:	C:\Users\user\Desktop\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\cmd.exe
Imagebase:	0x7ff6d9fd0000
File size:	289'792 bytes
MD5 hash:	CB6CD09F6A25744A8FA6E4B3E4D260C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	05:07:45
Start date:	02/02/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	33.5%
Total number of Nodes:	890
Total number of Limit Nodes:	19

Executed Functions

Function 00007FF6D9FF7F00 Relevance: 61.6, APIs: 28, Strings: 7, Instructions: 341
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6D9FF7F44
_get_osfhandle.MSVCRT ref: 00007FF6D9FF7F5C
GetConsoleScreenBufferInfo.KERNELBASE(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6D9FF7F9E
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6D9FF7FFF
ReadConsoleW.KERNELBASE(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6D9FF8020
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6D9FF8036
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6D9FF8061
RtlFreeHeap.NTDLL(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6D9FF8075
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6D9FF80D6
RtlFreeHeap.NTDLL(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6D9FF80EA
_wcsnicmp.MSVCRT ref: 00007FF6D9FF8177
_wcsnicmp.MSVCRT ref: 00007FF6D9FF819A
_wcsnicmp.MSVCRT ref: 00007FF6D9FF81BD
_wcsnicmp.MSVCRT ref: 00007FF6D9FF81DC
_wcsnicmp.MSVCRT ref: 00007FF6D9FF81FB
_wcsnicmp.MSVCRT ref: 00007FF6D9FF821A
_wcsnicmp.MSVCRT ref: 00007FF6D9FF8239
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6D9FF8291
SetConsoleCursorPosition.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6D9FF82D7
FillConsoleOutputCharacterW.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6D9FF82FB
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6D9FF831A
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6D9FF8364
RtlFreeHeap.NTDLL(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6D9FF8378
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6D9FF839A
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6D9FF83AE
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6D9FF83E6
ReadConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6D9FF8403
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000,00000002,00002328,00000001,0000000A), ref: 00007FF6D9FF8418

Strings

rd , xrefs: 00007FF6D9FF8193
md , xrefs: 00007FF6D9FF81B6
pushd , xrefs: 00007FF6D9FF8232
chdir , xrefs: 00007FF6D9FF81D5
mkdir , xrefs: 00007FF6D9FF8213
rmdir , xrefs: 00007FF6D9FF81F4
cd , xrefs: 00007FF6D9FF8170

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Heap$Console_wcsnicmp$LockProcessShared$Free$AcquireBufferInfoReadReleaseScreen$AllocCharacterCursorFillHandleOutputPositionWrite_get_osfhandle
String ID: cd $chdir $md $mkdir $pushd $rd $rmdir
API String ID: 3637805771-3100821235
Opcode ID: 8d8142b9be1a5613caafbab5f3326282510bdfa90e9b839c504153badec4a604
Instruction ID: 670b645e408237c70558cdbab8a5c62852fd06ba1cc24d251279d5bfb1498718
Opcode Fuzzy Hash: 8d8142b9be1a5613caafbab5f3326282510bdfa90e9b839c504153badec4a604
Instruction Fuzzy Hash: 89E1B632A086538AE7208F66E8441BD7BA5FB49B99F448672DD1FD3791DF3CA428C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FDAA54 Relevance: 51.3, APIs: 24, Strings: 5, Instructions: 536
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6D9FDCD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6D9FDB9A1,?,?,?,?,00007FF6D9FDD81A), ref: 00007FF6D9FDCDA6
Part of subcall function 00007FF6D9FDCD90: RtlAllocateHeap.NTDLL(?,?,?,00007FF6D9FDB9A1,?,?,?,?,00007FF6D9FDD81A), ref: 00007FF6D9FDCDBD

wcschr.MSVCRT ref: 00007FF6D9FDAAB6
towlower.MSVCRT ref: 00007FF6D9FDAAD5
memset.MSVCRT ref: 00007FF6D9FDAC27
wcschr.MSVCRT ref: 00007FF6D9FDAC3C
wcschr.MSVCRT ref: 00007FF6D9FDAC60
wcsrchr.MSVCRT ref: 00007FF6D9FDAC9B
wcschr.MSVCRT ref: 00007FF6D9FDAD82
wcschr.MSVCRT ref: 00007FF6D9FDAD9D
wcschr.MSVCRT ref: 00007FF6D9FDADB8
wcschr.MSVCRT ref: 00007FF6D9FDADD3
wcschr.MSVCRT ref: 00007FF6D9FDADEE
wcschr.MSVCRT ref: 00007FF6D9FDAE09
iswspace.MSVCRT ref: 00007FF6D9FDAE30

Strings

:, xrefs: 00007FF6D9FEBC86
:, xrefs: 00007FF6D9FEBCFE
OFF, xrefs: 00007FF6D9FEBC32, 00007FF6D9FEBC92, 00007FF6D9FEBD0A
:, xrefs: 00007FF6D9FEBC26
:ON, xrefs: 00007FF6D9FEBD37

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: wcschr$Heap$AllocateProcessiswspacememsettowlowerwcsrchr
String ID: :$:$:$:ON$OFF
API String ID: 4076514806-467788257
Opcode ID: 2c3668651f4979ca9faab3cebc12e13a9f78b58cac88e34d12c38504de92a7c5
Instruction ID: a6f8eda46d149adf935c0a5b5b2009be34bf17407c21bb22e82a2902d70c114c
Opcode Fuzzy Hash: 2c3668651f4979ca9faab3cebc12e13a9f78b58cac88e34d12c38504de92a7c5
Instruction Fuzzy Hash: 2222E322E0C64386FB649F2699542BD7691EF89B89F488077CA0EC7795DF3CE460C344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE51EC Relevance: 45.9, APIs: 15, Strings: 11, Instructions: 384
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6D9FE5508: GetUserDefaultLangID.KERNELBASE(?,?,?,?,00007FF6D9FD6F97), ref: 00007FF6D9FE550C

GetLocaleInfoW.KERNELBASE ref: 00007FF6D9FE5237
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6D9FE5260
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6D9FE52AB
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6D9FE52F7
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6D9FE5335
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6D9FE5360
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6D9FE5388
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6D9FE53B0
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6D9FE53D8
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6D9FE5400
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6D9FE5428
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6D9FE5450
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6D9FE5478
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6D9FE54A0
setlocale.MSVCRT ref: 00007FF6D9FE54BD

Strings

dd/MM/yy, xrefs: 00007FF6D9FEEFA3
.OCP, xrefs: 00007FF6D9FE54B4
MM/dd/yy, xrefs: 00007FF6D9FE52D0
Mon, xrefs: 00007FF6D9FEEFF2
Wed, xrefs: 00007FF6D9FEF078
Tue, xrefs: 00007FF6D9FEF035
Sun, xrefs: 00007FF6D9FEF184
Thu, xrefs: 00007FF6D9FEF0BB
yy/MM/dd, xrefs: 00007FF6D9FEEF8D
Sat, xrefs: 00007FF6D9FEF141
Fri, xrefs: 00007FF6D9FEF0FE

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: InfoLocale$DefaultLangUsersetlocale
String ID: .OCP$Fri$MM/dd/yy$Mon$Sat$Sun$Thu$Tue$Wed$dd/MM/yy$yy/MM/dd
API String ID: 2492766124-2236139042
Opcode ID: 2a4578c534326ca189a6d67b8d7d5f73ffb3ac0fc7df7dd3f0f26b29881ec2ab
Instruction ID: 369cadbb061277245308cd1200011b1c99fe68374efd7ffb69f29343cb88f128
Opcode Fuzzy Hash: 2a4578c534326ca189a6d67b8d7d5f73ffb3ac0fc7df7dd3f0f26b29881ec2ab
Instruction Fuzzy Hash: B1F15926B0874386EF218F11E9502BD66A5BF49B84F94813BCA0DC77A5EF3CE925C314

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE5554 Relevance: 45.8, APIs: 18, Strings: 8, Instructions: 295
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.ADVAPI32(?,00000000,?,00000001,?,00007FF6D9FE4E35), ref: 00007FF6D9FE55DA
RegQueryValueExW.ADVAPI32 ref: 00007FF6D9FE5623
RegQueryValueExW.ADVAPI32 ref: 00007FF6D9FE5667
RegQueryValueExW.ADVAPI32 ref: 00007FF6D9FE56BE
RegQueryValueExW.ADVAPI32 ref: 00007FF6D9FE5702
RegQueryValueExW.ADVAPI32 ref: 00007FF6D9FE5759
RegQueryValueExW.ADVAPI32 ref: 00007FF6D9FE57CF
RegQueryValueExW.ADVAPI32 ref: 00007FF6D9FE5862
RegCloseKey.ADVAPI32 ref: 00007FF6D9FE587B
time.MSVCRT ref: 00007FF6D9FE5896
srand.MSVCRT ref: 00007FF6D9FE58A5

Strings

PathCompletionChar, xrefs: 00007FF6D9FE57C8
EnableExtensions, xrefs: 00007FF6D9FE5660
DisableUNCCheck, xrefs: 00007FF6D9FE5614
Software\Microsoft\Command Processor, xrefs: 00007FF6D9FE55D3
CompletionChar, xrefs: 00007FF6D9FE5752
DefaultColor, xrefs: 00007FF6D9FE56FB
AutoRun, xrefs: 00007FF6D9FE585B
DelayedExpansion, xrefs: 00007FF6D9FE56B7

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: QueryValue$CloseOpensrandtime
String ID: AutoRun$CompletionChar$DefaultColor$DelayedExpansion$DisableUNCCheck$EnableExtensions$PathCompletionChar$Software\Microsoft\Command Processor
API String ID: 145004033-3846321370
Opcode ID: 7805ef0751f17a64bc231b327674b43fa69c0befe7df2b1e52c817e25d9d9668
Instruction ID: 2bb4ce7fa9d54fd7645c74e3195a5a5ddbd4c20d450c5995a9f4a5010777884e
Opcode Fuzzy Hash: 7805ef0751f17a64bc231b327674b43fa69c0befe7df2b1e52c817e25d9d9668
Instruction Fuzzy Hash: B5E16D3262DA82C6EB608F51E4505BEB7A4FB89748F805137EA8EC3A54DF7CD564CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE37D8 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 269
registrythreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6D9FE380B
OpenThread.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6D9FE3821
HeapSetInformation.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FE3845
RegOpenKeyExW.ADVAPI32 ref: 00007FF6D9FE3875
GetConsoleOutputCP.KERNELBASE ref: 00007FF6D9FE38BF
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6D9FE38DD
memset.MSVCRT ref: 00007FF6D9FE3909
_setjmp.MSVCRT ref: 00007FF6D9FE3952
GetConsoleOutputCP.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF6D9FE398B
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6D9FE39A2
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6D9FEEA1F
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6D9FEEA2F

Part of subcall function 00007FF6D9FE5920: VirtualQuery.API-MS-WIN-CORE-MEMORY-L1-1-0(?,?,?,?,?,?,00000000,00000000,00000000,00007FF6D9FEB71F), ref: 00007FF6D9FE5997
Part of subcall function 00007FF6D9FE5920: VirtualQuery.API-MS-WIN-CORE-MEMORY-L1-1-0(?,?,?,?,?,?,00000000,00000000,00000000,00007FF6D9FEB71F), ref: 00007FF6D9FE59C5

GetThreadLocale.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6D9FEEA41

Strings

Software\Policies\Microsoft\Windows\System, xrefs: 00007FF6D9FE3867
DisableCMD, xrefs: 00007FF6D9FEEA18

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: QueryThread$ConsoleInfoOpenOutputVirtual$CloseCurrentHeapInformationLocaleValue_setjmpmemset
String ID: DisableCMD$Software\Policies\Microsoft\Windows\System
API String ID: 2624720099-1920437939
Opcode ID: f7d7d08620b0a20aad27d36e676bcdea795ae43db43436ca2b5da1582b61596f
Instruction ID: 9df26939838319e12afdfd380ca7149d6104a0f8e743bce7ce6c7a6fca048237
Opcode Fuzzy Hash: f7d7d08620b0a20aad27d36e676bcdea795ae43db43436ca2b5da1582b61596f
Instruction Fuzzy Hash: 75C1BA31E0C6438AF724AF65A8541BD7AA1FF49758F14817BEA0EC77A2DF3CA4648700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD32B0 Relevance: 27.2, APIs: 18, Instructions: 243
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6D9FE3578: _get_osfhandle.MSVCRT ref: 00007FF6D9FE3584
Part of subcall function 00007FF6D9FE3578: GetFileType.KERNELBASE(?,?,00000014,00007FF6D9FD32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6D9FE359C
Part of subcall function 00007FF6D9FE3578: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF6D9FD32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6D9FE35C3
Part of subcall function 00007FF6D9FE3578: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6D9FD32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6D9FE35D9
Part of subcall function 00007FF6D9FE3578: GetConsoleMode.KERNELBASE(?,?,00000014,00007FF6D9FD32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6D9FE35ED
Part of subcall function 00007FF6D9FE3578: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6D9FD32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6D9FE3602

_get_osfhandle.MSVCRT ref: 00007FF6D9FD32F3
GetConsoleScreenBufferInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00000000,00000014,?,?,0000002F,00007FF6D9FD32A4), ref: 00007FF6D9FD3309
WriteConsoleW.KERNELBASE ref: 00007FF6D9FD3384
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FF11DF

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Console$LockShared_get_osfhandle$AcquireBufferErrorFileHandleInfoLastModeReleaseScreenTypeWrite
String ID:
API String ID: 611521582-0
Opcode ID: 48034758720484ce4b30563db4a16b18c5906bae599308cacbd019090a686e8f
Instruction ID: 2f57ad4c3ec7affdb3a5159abc55dcf0b97e4eb8b4923836f061b57101dc7bde
Opcode Fuzzy Hash: 48034758720484ce4b30563db4a16b18c5906bae599308cacbd019090a686e8f
Instruction Fuzzy Hash: 76A18D22F086138AFB248F61A8442BD7AA5FF89B59F449136CE0EC7795DF7CA459C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD3410 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 160
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FormatMessageW.KERNELBASE ref: 00007FF6D9FD3477
wcschr.MSVCRT ref: 00007FF6D9FD34A0
FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6D9FD34DF
_ultoa.MSVCRT ref: 00007FF6D9FF12DA
GetACP.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6D9FF12E6
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF6D9FF131E

Strings

, xrefs: 00007FF6D9FF12FB
Application, xrefs: 00007FF6D9FF1341
System, xrefs: 00007FF6D9FF133A

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: FormatMessage$ByteCharMultiWide_ultoawcschr
String ID: $Application$System
API String ID: 3538039442-1881496484
Opcode ID: daa3c9530b8b938baf5fb889163c7e181f5423a1c9033fa4c42bef87fdf31ece
Instruction ID: 87c33eef0beee1b2c7bd416e0fa1ca9680875b617d2a920fa100cdde161389b3
Opcode Fuzzy Hash: daa3c9530b8b938baf5fb889163c7e181f5423a1c9033fa4c42bef87fdf31ece
Instruction Fuzzy Hash: 8051AB32A0CB4287EB218F16B4406BEBAA5FB89B48F459136DE4E83755DF3CD469C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE2978 Relevance: 9.1, APIs: 6, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 449607d8b30cf2fcca0a8811105e09d4af6f68671a5f8fd8d6b2897c28d3601c
Instruction ID: fe2347db9f98d27bdbf1a7418f8e994f683c2e7eff6a43dd4d57c58744f95322
Opcode Fuzzy Hash: 449607d8b30cf2fcca0a8811105e09d4af6f68671a5f8fd8d6b2897c28d3601c
Instruction Fuzzy Hash: 88511962B0868286EB309F15A9442BEA690FB54BE4F545232DE6EC77D1EF3CE465C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FDDF60 Relevance: 7.6, APIs: 5, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,00000000,00007FF6D9FDCEAA), ref: 00007FF6D9FDDFB8
RtlFreeHeap.NTDLL ref: 00007FF6D9FDDFCC
_setjmp.MSVCRT ref: 00007FF6D9FDE03E

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Heap$FreeProcess_setjmp
String ID:
API String ID: 777023205-0
Opcode ID: 4d7b9ccfac645ebfd825f434598c61173767747c4fc72b71514dec63949a2a90
Instruction ID: ec084f497356a46115710d2c695b2629a1da20d93d688f8f7ab4217a52865837
Opcode Fuzzy Hash: 4d7b9ccfac645ebfd825f434598c61173767747c4fc72b71514dec63949a2a90
Instruction Fuzzy Hash: F051273191DA438AE6108F15A8801BDB7A4BF88B58F548577D94ECB7A2EF3CB460C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE88C0 Relevance: 4.6, APIs: 3, Instructions: 68nativethreadCOMMON

Download Yara Rule

APIs

NtOpenThreadToken.NTDLL ref: 00007FF6D9FE88E7
NtOpenProcessToken.NTDLL ref: 00007FF6D9FE8907
NtClose.NTDLL ref: 00007FF6D9FE896C

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: OpenToken$CloseProcessThread
String ID:
API String ID: 2991381754-0
Opcode ID: b852a0208421dc62c7203a720914108dbe041e691bb4631683058e09142ae365
Instruction ID: 03dc6d094d4687aad753ac91f18482647c6aef856121e3e5e9849f5a1da03177
Opcode Fuzzy Hash: b852a0208421dc62c7203a720914108dbe041e691bb4631683058e09142ae365
Instruction Fuzzy Hash: B921A132B086838BE7109F94E4402BDB7A0EB85BA5F504537DB69C3694DF7CE868CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD586C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetVersion.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,?,?,?,?,?,00000000,00007FF6D9FFC59E), ref: 00007FF6D9FD5879

Part of subcall function 00007FF6D9FD58D4: RegOpenKeyExW.ADVAPI32 ref: 00007FF6D9FD5903
Part of subcall function 00007FF6D9FD58D4: RegQueryValueExW.ADVAPI32 ref: 00007FF6D9FD5943
Part of subcall function 00007FF6D9FD58D4: RegCloseKey.ADVAPI32 ref: 00007FF6D9FD5956

Strings

%d.%d.%05d.%d, xrefs: 00007FF6D9FD58B2

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: CloseOpenQueryValueVersion
String ID: %d.%d.%05d.%d
API String ID: 2996790148-3457777122
Opcode ID: 4d5ad80169b63ecb9418821cd297058139bf77423c780748cae3bcfdcd848c3f
Instruction ID: e0227af8a805996197b73482fa86a9469f9fdd71e5481bb41f1f1f36351559e5
Opcode Fuzzy Hash: 4d5ad80169b63ecb9418821cd297058139bf77423c780748cae3bcfdcd848c3f
Instruction Fuzzy Hash: DEF0A062A0C3828BD3209F56B44006EBAA1FB88780F508139DA4A47B5ACF7CD528CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE89E4 Relevance: 3.0, APIs: 2, Instructions: 43nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationToken.NTDLL ref: 00007FF6D9FE8A20
NtQueryInformationToken.NTDLL ref: 00007FF6D9FF52BE

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: InformationQueryToken
String ID:
API String ID: 4239771691-0
Opcode ID: 87357954a8523b25dda20131eda18b71b38099689d5f90fd4ce6128a3877601f
Instruction ID: 3f8bb3c099ba215ae97e1e98ee4d154a4450eae02ffab6991372b58df0214c3a
Opcode Fuzzy Hash: 87357954a8523b25dda20131eda18b71b38099689d5f90fd4ce6128a3877601f
Instruction Fuzzy Hash: 3C115E72A18781DBEB118F01E4003ADBBA4FB85BA5F008532DB4883694DF7DE598CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE898C Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationToken.NTDLL ref: 00007FF6D9FE89B6

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: InformationQueryToken
String ID:
API String ID: 4239771691-0
Opcode ID: d8659c39f39a3ec2fcbfc3da82b894078fa87797e5da65106923171eedb6fa24
Instruction ID: af101f1ecc86eda3e9bca062b3ade2935f4ac3bfdda86a644324ac868857b8a9
Opcode Fuzzy Hash: d8659c39f39a3ec2fcbfc3da82b894078fa87797e5da65106923171eedb6fa24
Instruction Fuzzy Hash: BAF030B3B04B81CBD7018F65E58449CB778F744B88B55857ACB2843704DB75D9A4CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE8B00 Relevance: 1.5, APIs: 1, Instructions: 12libraryCOMMON

Download Yara Rule

APIs

LdrResolveDelayLoadedAPI.NTDLL ref: 00007FF6D9FE8B2B

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: DelayLoadedResolve
String ID:
API String ID: 841769287-0
Opcode ID: 1dcf29d44bb20ea269609b542accdec4eb1f07110d6fe7f193b9314fbb93284e
Instruction ID: 8302c53088c062faaaeca8bfa440fcdda0197246bb8946253b43b659d22c0806
Opcode Fuzzy Hash: 1dcf29d44bb20ea269609b542accdec4eb1f07110d6fe7f193b9314fbb93284e
Instruction Fuzzy Hash: 07E0EC70D08A42D6D6209F01E8440AC7BA5FB49749F805173D94CC3335CF3CE169CB09

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE4D5C Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 268
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6D9FE4D9A

Part of subcall function 00007FF6D9FE58E4: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00007FF6D9FFC6DB), ref: 00007FF6D9FE58EF

SetConsoleCtrlHandler.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6D9FE4DBB
_get_osfhandle.MSVCRT ref: 00007FF6D9FE4DCA
GetConsoleMode.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6D9FE4DE0
_get_osfhandle.MSVCRT ref: 00007FF6D9FE4DEE
GetConsoleMode.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6D9FE4E04

Part of subcall function 00007FF6D9FE0580: _get_osfhandle.MSVCRT ref: 00007FF6D9FE0589
Part of subcall function 00007FF6D9FE0580: SetConsoleMode.KERNELBASE ref: 00007FF6D9FE059E
Part of subcall function 00007FF6D9FE0580: _get_osfhandle.MSVCRT ref: 00007FF6D9FE05AF
Part of subcall function 00007FF6D9FE0580: GetConsoleMode.KERNELBASE ref: 00007FF6D9FE05C5
Part of subcall function 00007FF6D9FE0580: _get_osfhandle.MSVCRT ref: 00007FF6D9FE05EF
Part of subcall function 00007FF6D9FE0580: GetConsoleMode.KERNELBASE ref: 00007FF6D9FE0605
Part of subcall function 00007FF6D9FE0580: _get_osfhandle.MSVCRT ref: 00007FF6D9FE0632
Part of subcall function 00007FF6D9FE0580: SetConsoleMode.KERNELBASE ref: 00007FF6D9FE0647

Part of subcall function 00007FF6D9FE4A14: GetEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000000,00007FF6D9FE49F1), ref: 00007FF6D9FE4A28
Part of subcall function 00007FF6D9FE4A14: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6D9FE49F1), ref: 00007FF6D9FE4A66
Part of subcall function 00007FF6D9FE4A14: RtlAllocateHeap.NTDLL(?,?,00000000,00007FF6D9FE49F1), ref: 00007FF6D9FE4A7D
Part of subcall function 00007FF6D9FE4A14: memmove.MSVCRT(?,?,00000000,00007FF6D9FE49F1), ref: 00007FF6D9FE4A9A
Part of subcall function 00007FF6D9FE4A14: FreeEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000000,00007FF6D9FE49F1), ref: 00007FF6D9FE4AA2

Part of subcall function 00007FF6D9FE4AD0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6D9FD8798), ref: 00007FF6D9FE4AD6
Part of subcall function 00007FF6D9FE4AD0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6D9FD8798), ref: 00007FF6D9FE4AEF

Part of subcall function 00007FF6D9FE5554: RegOpenKeyExW.ADVAPI32(?,00000000,?,00000001,?,00007FF6D9FE4E35), ref: 00007FF6D9FE55DA
Part of subcall function 00007FF6D9FE5554: RegQueryValueExW.ADVAPI32 ref: 00007FF6D9FE5623
Part of subcall function 00007FF6D9FE5554: RegQueryValueExW.ADVAPI32 ref: 00007FF6D9FE5667
Part of subcall function 00007FF6D9FE5554: RegQueryValueExW.ADVAPI32 ref: 00007FF6D9FE56BE
Part of subcall function 00007FF6D9FE5554: RegQueryValueExW.ADVAPI32 ref: 00007FF6D9FE5702

GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6D9FE4E35
GetCommandLineW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6D9FE4E81
GetWindowsDirectoryW.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6D9FE4F69
GetConsoleOutputCP.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6D9FE4F95
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6D9FE4FB0
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6D9FE4FC1
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6D9FE4FD8
GetConsoleTitleW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6D9FE4FF8
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6D9FE5037
GetConsoleScreenBufferInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6D9FE504B
GlobalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6D9FE50DF
GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6D9FE50F2
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6D9FE510F
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6D9FE5130
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6D9FE514A
free.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF6D9FE5175

Part of subcall function 00007FF6D9FE3578: _get_osfhandle.MSVCRT ref: 00007FF6D9FE3584
Part of subcall function 00007FF6D9FE3578: GetFileType.KERNELBASE(?,?,00000014,00007FF6D9FD32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6D9FE359C
Part of subcall function 00007FF6D9FE3578: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF6D9FD32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6D9FE35C3
Part of subcall function 00007FF6D9FE3578: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6D9FD32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6D9FE35D9
Part of subcall function 00007FF6D9FE3578: GetConsoleMode.KERNELBASE(?,?,00000014,00007FF6D9FD32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6D9FE35ED
Part of subcall function 00007FF6D9FE3578: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6D9FD32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6D9FE3602

Strings

CopyFileExW, xrefs: 00007FF6D9FE5108
IsDebuggerPresent, xrefs: 00007FF6D9FE5122
SetConsoleInputExeNameW, xrefs: 00007FF6D9FE5143
KERNEL32.DLL, xrefs: 00007FF6D9FE50EB

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Console$Mode_get_osfhandle$Heap$QueryValue$AddressHandleProcProcess$AllocCommandCriticalEnvironmentFreeInfoLineLockSectionSharedStrings$AcquireAllocateBufferCtrlDirectoryEnterFileGlobalHandlerInitializeModuleOpenOutputReleaseScreenTitleTypeWindowsfreememmove
String ID: CopyFileExW$IsDebuggerPresent$KERNEL32.DLL$SetConsoleInputExeNameW
API String ID: 3614140610-3021193919
Opcode ID: 172b698400a4144ef5224189bd2f7d65852c6c10f3c357a529f948fe7e5f60a5
Instruction ID: b8eacc52f2c8ee91c8627daac3f883abec7e3abb415eb4e20bcfe8ca5c361871
Opcode Fuzzy Hash: 172b698400a4144ef5224189bd2f7d65852c6c10f3c357a529f948fe7e5f60a5
Instruction Fuzzy Hash: 76C1AE21A0CB4396EA14AF51E8541BD77A4FF8AB99F448177DA0EC77A2DF3CE4658300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FDF8C0 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 380
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,00000000,?,00007FF6D9FDF52A,00000000,00000000,?,00000000,?,00007FF6D9FDE626,?,?,00000000,00007FF6D9FE1F69), ref: 00007FF6D9FDF8DE
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF6D9FE1F69,?,?,?,?,?,?,?,00007FF6D9FD286E,00000000,00000000,00000000,00000000), ref: 00007FF6D9FDF8FB
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF6D9FE1F69,?,?,?,?,?,?,?,00007FF6D9FD286E,00000000,00000000,00000000,00000000), ref: 00007FF6D9FDF951
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF6D9FE1F69,?,?,?,?,?,?,?,00007FF6D9FD286E,00000000,00000000,00000000,00000000), ref: 00007FF6D9FDF96B
wcschr.MSVCRT ref: 00007FF6D9FDFA8E
_get_osfhandle.MSVCRT ref: 00007FF6D9FDFB14
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00000000,00007FF6D9FE1F69,?,?,?,?,?,?,?,00007FF6D9FD286E,00000000,00000000,00000000,00000000), ref: 00007FF6D9FDFB2D
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FF6D9FE1F69,?,?,?,?,?,?,?,00007FF6D9FD286E,00000000,00000000,00000000,00000000), ref: 00007FF6D9FDFBEA
_get_osfhandle.MSVCRT ref: 00007FF6D9FDF996

Part of subcall function 00007FF6D9FE0010: SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,0000237B,00000000,00000002,0000000A,00000001,00007FF6D9FF849D,?,?,?,00007FF6D9FFF0C7), ref: 00007FF6D9FE0045
Part of subcall function 00007FF6D9FE0010: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF6D9FFF0C7,?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF6D9FFE964), ref: 00007FF6D9FE0071
Part of subcall function 00007FF6D9FE0010: ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FE0092
Part of subcall function 00007FF6D9FE0010: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6D9FE00A7
Part of subcall function 00007FF6D9FE0010: MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF6D9FE0181

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF6D9FE1F69,?,?,?,?,?,?,?,00007FF6D9FD286E,00000000,00000000,00000000,00000000), ref: 00007FF6D9FED401
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF6D9FE1F69,?,?,?,?,?,?,?,00007FF6D9FD286E,00000000,00000000,00000000,00000000), ref: 00007FF6D9FED41B
longjmp.MSVCRT(?,?,00000000,00007FF6D9FE1F69,?,?,?,?,?,?,?,00007FF6D9FD286E,00000000,00000000,00000000,00000000), ref: 00007FF6D9FED435
longjmp.MSVCRT(?,?,00000000,00007FF6D9FE1F69,?,?,?,?,?,?,?,00007FF6D9FD286E,00000000,00000000,00000000,00000000), ref: 00007FF6D9FED480

Strings

=,;, xrefs: 00007FF6D9FDF8C8

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: CriticalSection$EnterFileLeave$LockPointerShared_get_osfhandlelongjmp$AcquireByteCharErrorLastMultiReadReleaseWidewcschr
String ID: =,;
API String ID: 3964947564-1539845467
Opcode ID: 98315cab970932119a6691ce4b7dab6fc313552480302974d3843cb62566fdd6
Instruction ID: f713d15e1bdb617a681d33891e7c0c6cb456349bcc6ad4a23d73b6eb413ef5e7
Opcode Fuzzy Hash: 98315cab970932119a6691ce4b7dab6fc313552480302974d3843cb62566fdd6
Instruction Fuzzy Hash: 13026921A1D6038AEB289F21E8405BD76A5FF89B58F544277D91EC77E6EF3CA424C301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE3C24 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 289
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6D9FDCA40: memset.MSVCRT ref: 00007FF6D9FDCAB3

GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6D9FE3D0C
towupper.MSVCRT ref: 00007FF6D9FE3D2F
iswalpha.MSVCRT ref: 00007FF6D9FE3D4F
towupper.MSVCRT ref: 00007FF6D9FE3D75
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FE3DBF
GetFileAttributesW.KERNELBASE ref: 00007FF6D9FE3E7E
GetFileAttributesW.KERNELBASE ref: 00007FF6D9FE3EE9
SetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6D9FE3F32
_local_unwind.MSVCRT ref: 00007FF6D9FE4062
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FE4067
_local_unwind.MSVCRT ref: 00007FF6D9FE4098
_local_unwind.MSVCRT ref: 00007FF6D9FE40B3
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FE40B8
_local_unwind.MSVCRT ref: 00007FF6D9FE40DE
_local_unwind.MSVCRT ref: 00007FF6D9FE40F9
_local_unwind.MSVCRT ref: 00007FF6D9FE4114

Strings

:, xrefs: 00007FF6D9FE3D89

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: _local_unwind$AttributesCurrentDirectoryErrorFileLasttowupper$FullNamePathiswalphamemset
String ID: :
API String ID: 1809961153-336475711
Opcode ID: 9a6838553337d10caea9482eb8d4b87fb6c3f53a5735761c353ac2a4c5941523
Instruction ID: 4bb73565df87c06928c04c001ed287bc03cae997ca7b2a028260fb3ac51a79cd
Opcode Fuzzy Hash: 9a6838553337d10caea9482eb8d4b87fb6c3f53a5735761c353ac2a4c5941523
Instruction Fuzzy Hash: A0D13A26A1CB8682EA64DF15E4442BEB7A1FB84750F444137EA4EC37A5EF7CE554CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FDEF40 Relevance: 33.7, APIs: 16, Strings: 3, Instructions: 465COMMON

Download Yara Rule

APIs

iswspace.MSVCRT ref: 00007FF6D9FDF000
wcschr.MSVCRT ref: 00007FF6D9FDF031
iswdigit.MSVCRT ref: 00007FF6D9FDF0D6

Strings

=,;, xrefs: 00007FF6D9FDEF9D, 00007FF6D9FDF1CE, 00007FF6D9FDF342, 00007FF6D9FDF61A
()|&=,;", xrefs: 00007FF6D9FDF3EC, 00007FF6D9FDF6D0
Ungetting: '%s', xrefs: 00007FF6D9FED0E1

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: iswdigitiswspacewcschr
String ID: ()|&=,;"$=,;$Ungetting: '%s'
API String ID: 1595556998-2755026540
Opcode ID: e96c15cb8f8de66f5ffc9bf5ec9d0c6fd0ab5971a01c0a57f8745c566a0df927
Instruction ID: 4e9136818544c9cc831c1565bb9a4f7ecbef8966fa0941ade080ede089e51cdc
Opcode Fuzzy Hash: e96c15cb8f8de66f5ffc9bf5ec9d0c6fd0ab5971a01c0a57f8745c566a0df927
Instruction Fuzzy Hash: 9E22BC69E2C65382FA604F12E84467E36A0BF85799F948173D98DC73E1EF3CA4718701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE2394 Relevance: 26.5, APIs: 7, Strings: 8, Instructions: 213
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF6D9FE23F1

Part of subcall function 00007FF6D9FDCA40: memset.MSVCRT ref: 00007FF6D9FDCAB3

GetModuleFileNameW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF6D9FE2438

Part of subcall function 00007FF6D9FE081C: GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6D9FE084E

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FE24DD
wcschr.MSVCRT ref: 00007FF6D9FEE12A
_wcsupr.MSVCRT ref: 00007FF6D9FEE146

Strings

.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC, xrefs: 00007FF6D9FEE0F4
PATHEXT, xrefs: 00007FF6D9FE2459, 00007FF6D9FEE0FB
COMSPEC, xrefs: 00007FF6D9FE2483, 00007FF6D9FEE28B
\CMD.EXE, xrefs: 00007FF6D9FEE22A
$P$G, xrefs: 00007FF6D9FE2516
PROMPT, xrefs: 00007FF6D9FE246E, 00007FF6D9FE251D
PATH, xrefs: 00007FF6D9FE2444, 00007FF6D9FEE0E2
KEYS, xrefs: 00007FF6D9FE2498

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: memset$EnvironmentFileModuleNameVariable_wcsuprwcschr
String ID: $P$G$.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC$COMSPEC$KEYS$PATH$PATHEXT$PROMPT$\CMD.EXE
API String ID: 2622545777-4197029667
Opcode ID: 8eeef2ed06c537bd9747ced6f978eb122ffaf98112ffaa52732f2f0061db8594
Instruction ID: 9d5e0feadc9fcb9f269b036e7d85432c27880a7e3657db90bab36913d05e9a31
Opcode Fuzzy Hash: 8eeef2ed06c537bd9747ced6f978eb122ffaf98112ffaa52732f2f0061db8594
Instruction Fuzzy Hash: A8914B62B09A8786EE259F11E8502BD63A5FF48B88F544177C94EC7696EF3CE624C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE0580 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_osfhandle.MSVCRT ref: 00007FF6D9FE0589
SetConsoleMode.KERNELBASE ref: 00007FF6D9FE059E
_get_osfhandle.MSVCRT ref: 00007FF6D9FE05AF
GetConsoleMode.KERNELBASE ref: 00007FF6D9FE05C5
_get_osfhandle.MSVCRT ref: 00007FF6D9FE05EF
GetConsoleMode.KERNELBASE ref: 00007FF6D9FE0605
_get_osfhandle.MSVCRT ref: 00007FF6D9FE0632
SetConsoleMode.KERNELBASE ref: 00007FF6D9FE0647
_get_osfhandle.MSVCRT ref: 00007FF6D9FE0684
SetConsoleMode.KERNELBASE ref: 00007FF6D9FE0699
_get_osfhandle.MSVCRT ref: 00007FF6D9FED891
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF6D9FED8A6

Strings

CMD.EXE, xrefs: 00007FF6D9FE065F

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: ConsoleMode_get_osfhandle
String ID: CMD.EXE
API String ID: 1606018815-3025314500
Opcode ID: 3e686ae0276ad7ff8a78bb3c5d2715100bc0f58041da1ae85f5dc5c67167e71d
Instruction ID: 7b9e9069a15d64892781e5032e6d1cdd7ae21fac08d426e2050aae044cd7c3f5
Opcode Fuzzy Hash: 3e686ae0276ad7ff8a78bb3c5d2715100bc0f58041da1ae85f5dc5c67167e71d
Instruction Fuzzy Hash: D641ED31A0D7038BE7194F15E9541BC7BA0FB8A759F4891BAC91EC33A2DF3CA4258705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FFBFEC Relevance: 16.2, APIs: 3, Strings: 6, Instructions: 444
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6D9FE58E4: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00007FF6D9FFC6DB), ref: 00007FF6D9FE58EF

Part of subcall function 00007FF6D9FE081C: GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6D9FE084E

towupper.MSVCRT ref: 00007FF6D9FFC1C9
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FFC31C
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF6D9FFC5CB

Strings

\, xrefs: 00007FF6D9FFC30F
%s>, xrefs: 00007FF6D9FFC684
x, xrefs: 00007FF6D9FFC36B
PROMPT, xrefs: 00007FF6D9FFC079
%s , xrefs: 00007FF6D9FFC3D6
Unknown, xrefs: 00007FF6D9FFC3AB

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: CriticalDriveEnterEnvironmentFreeLocalSectionTypeVariabletowupper
String ID: %s $%s>$PROMPT$Unknown$\$x
API String ID: 2242554020-3610052186
Opcode ID: 5e630d37b7b09928d23bc05a013b986a7d5ce2529fc585b79f6df014d867e99c
Instruction ID: 8e299dcccb5f86871a41d1b20a4c3f0e24c95ecfbbbf15f250103a1185d99b83
Opcode Fuzzy Hash: 5e630d37b7b09928d23bc05a013b986a7d5ce2529fc585b79f6df014d867e99c
Instruction Fuzzy Hash: 9512D421A0C66381EA24AF15A4441BE63A1FF44BA8F544337DAAEC37E1DF3CE529D704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE86F0 Relevance: 10.7, APIs: 7, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6D9FE88C0: NtOpenThreadToken.NTDLL ref: 00007FF6D9FE88E7
Part of subcall function 00007FF6D9FE88C0: NtOpenProcessToken.NTDLL ref: 00007FF6D9FE8907
Part of subcall function 00007FF6D9FE88C0: NtClose.NTDLL ref: 00007FF6D9FE896C

SetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0 ref: 00007FF6D9FE87D7
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF6D9FE8807
RtlNtStatusToDosError.NTDLL ref: 00007FF6D9FF517E
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FF518C
GetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0 ref: 00007FF6D9FF51FD
wcsstr.MSVCRT ref: 00007FF6D9FF5219
wcsstr.MSVCRT ref: 00007FF6D9FF5236

Part of subcall function 00007FF6D9FE885C: FormatMessageW.KERNELBASE ref: 00007FF6D9FE88A2

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: ConsoleErrorOpenTitleTokenwcsstr$CloseFormatFreeLastLocalMessageProcessStatusThread
String ID:
API String ID: 1313749407-0
Opcode ID: 4d31b305405a3d765fe0144db543a2852d122a425ff484c85fdfa966466d6282
Instruction ID: 8da4ddf9ee0b3a65f1ad65e1663ac39e6ea6d88b8920273d98a8fd9637df2312
Opcode Fuzzy Hash: 4d31b305405a3d765fe0144db543a2852d122a425ff484c85fdfa966466d6282
Instruction Fuzzy Hash: 2051D722B0D68246FA20AF12981427D6695FF49B94F485636DE3EC77D1EF3CE860C204

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE8D80 Relevance: 9.1, APIs: 6, Instructions: 95sleepCOMMON

Download Yara Rule

APIs

Sleep.API-MS-WIN-CORE-SYNCH-L1-2-0 ref: 00007FF6D9FE8DC4
_amsg_exit.MSVCRT ref: 00007FF6D9FE8DE0
_initterm.MSVCRT ref: 00007FF6D9FE8E64
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6D9FE8E91
exit.MSVCRT ref: 00007FF6D9FE8EDE
_cexit.MSVCRT ref: 00007FF6D9FE8EED

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: CurrentImageNonwritableSleep_amsg_exit_cexit_inittermexit
String ID:
API String ID: 4291973834-0
Opcode ID: 1c7d4f9672c25dc89753b58092f3baa3c71a1f277e4bfd9c8df4ae4aed7312e4
Instruction ID: 1fb3696df4c3ee3ad88fc4cb308e0ee50d100d835e97058436e6c997158c6a5a
Opcode Fuzzy Hash: 1c7d4f9672c25dc89753b58092f3baa3c71a1f277e4bfd9c8df4ae4aed7312e4
Instruction Fuzzy Hash: DF411A32E0C64386F761AF52E95027D32A4BF54348F040977E91DC76A2DF7CE8A48794

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE34A0 Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D9FE3578: _get_osfhandle.MSVCRT ref: 00007FF6D9FE3584
Part of subcall function 00007FF6D9FE3578: GetFileType.KERNELBASE(?,?,00000014,00007FF6D9FD32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6D9FE359C
Part of subcall function 00007FF6D9FE3578: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF6D9FD32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6D9FE35C3
Part of subcall function 00007FF6D9FE3578: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6D9FD32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6D9FE35D9
Part of subcall function 00007FF6D9FE3578: GetConsoleMode.KERNELBASE(?,?,00000014,00007FF6D9FD32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6D9FE35ED
Part of subcall function 00007FF6D9FE3578: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6D9FD32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6D9FE3602

AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00000000,00007FF6D9FE3491,?,?,?,00007FF6D9FF4420), ref: 00007FF6D9FE3514
_get_osfhandle.MSVCRT ref: 00007FF6D9FE3522
WriteConsoleW.KERNELBASE(?,?,?,?,00000000,00007FF6D9FE3491,?,?,?,00007FF6D9FF4420), ref: 00007FF6D9FE3541
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00000000,00007FF6D9FE3491,?,?,?,00007FF6D9FF4420), ref: 00007FF6D9FE355E

Part of subcall function 00007FF6D9FE36EC: _get_osfhandle.MSVCRT ref: 00007FF6D9FE3715
Part of subcall function 00007FF6D9FE36EC: WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF6D9FE3770
Part of subcall function 00007FF6D9FE36EC: WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FE3791

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: LockShared$_get_osfhandle$AcquireConsoleFileReleaseWrite$ByteCharHandleModeMultiTypeWide
String ID:
API String ID: 4057327938-0
Opcode ID: 807fa989d39d4849e06e2f4786b28539bca90d0803ce6995c92bbc2c66011cd3
Instruction ID: 32fb8b99b6ece9975b42bc823bc9d31730bdebfedde97c2aac8454253733b056
Opcode Fuzzy Hash: 807fa989d39d4849e06e2f4786b28539bca90d0803ce6995c92bbc2c66011cd3
Instruction Fuzzy Hash: BE317E21F0CA4387E7659F26A80407DBAA4FF89745F58417BDE4EC3396DE7CE9288600

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE01B8 Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF6D9FE01C4
GetFileType.KERNELBASE(?,?,?,00007FF6D9FEE904,?,?,?,?,00000000,00007FF6D9FE3491,?,?,?,00007FF6D9FF4420), ref: 00007FF6D9FE01D6
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,00007FF6D9FEE904,?,?,?,?,00000000,00007FF6D9FE3491,?,?,?,00007FF6D9FF4420), ref: 00007FF6D9FE0212
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF6D9FEE904,?,?,?,?,00000000,00007FF6D9FE3491,?,?,?,00007FF6D9FF4420), ref: 00007FF6D9FE0228
GetConsoleMode.KERNELBASE(?,?,?,00007FF6D9FEE904,?,?,?,?,00000000,00007FF6D9FE3491,?,?,?,00007FF6D9FF4420), ref: 00007FF6D9FE023C
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF6D9FEE904,?,?,?,?,00000000,00007FF6D9FE3491,?,?,?,00007FF6D9FF4420), ref: 00007FF6D9FE0251

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: LockShared$AcquireConsoleFileHandleModeReleaseType_get_osfhandle
String ID:
API String ID: 513048808-0
Opcode ID: ef555d96517b4a4d7bc0a02b43aa9942dfc75bbee8affbf3c621068c46bc1ac3
Instruction ID: d01caa38b00747e519f76fa7e32006b6609970af0056a09e1be6731ddd9e4a32
Opcode Fuzzy Hash: ef555d96517b4a4d7bc0a02b43aa9942dfc75bbee8affbf3c621068c46bc1ac3
Instruction Fuzzy Hash: CC216A2190C78387E7604F64A58827C7AA0FF4A759F584277DA1EC76A2CF7CE4688700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE3578 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF6D9FE3584
GetFileType.KERNELBASE(?,?,00000014,00007FF6D9FD32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6D9FE359C
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF6D9FD32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6D9FE35C3
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6D9FD32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6D9FE35D9
GetConsoleMode.KERNELBASE(?,?,00000014,00007FF6D9FD32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6D9FE35ED
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6D9FD32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6D9FE3602

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: LockShared$AcquireConsoleFileHandleModeReleaseType_get_osfhandle
String ID:
API String ID: 513048808-0
Opcode ID: 4be1f5ec09c5108d2c7826c3a7209228348aa1fd039264005e97f60c6ac8ced8
Instruction ID: 5ebb11e051d1fccef833b918bdab59c7ca862e4fec833b319c6c92c4f6046c20
Opcode Fuzzy Hash: 4be1f5ec09c5108d2c7826c3a7209228348aa1fd039264005e97f60c6ac8ced8
Instruction Fuzzy Hash: 0A115E21A0CB4386EA244F35A54847CAAA4FB4A769F555377DA2EC33D1CE7CD4688701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD58D4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF6D9FD5903
RegQueryValueExW.ADVAPI32 ref: 00007FF6D9FD5943
RegCloseKey.ADVAPI32 ref: 00007FF6D9FD5956

Strings

Software\Microsoft\Windows NT\CurrentVersion, xrefs: 00007FF6D9FD58F5
UBR, xrefs: 00007FF6D9FD593C

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Software\Microsoft\Windows NT\CurrentVersion$UBR
API String ID: 3677997916-3870813718
Opcode ID: 11f10b6277c18dac5d1f9458213eb359f51f159b19c3fb95c1c998554f45dc91
Instruction ID: 53821106f9533bbbd87ba8799d81a59f4c7b4e402ccbdfb3741a19df5c8d8cc8
Opcode Fuzzy Hash: 11f10b6277c18dac5d1f9458213eb359f51f159b19c3fb95c1c998554f45dc91
Instruction Fuzzy Hash: 52114C3261CB42C7EB208F50E44026EB7A4FB897A5F404232DA8D43768DF7DC058CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE4A14 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000000,00007FF6D9FE49F1), ref: 00007FF6D9FE4A28
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6D9FE49F1), ref: 00007FF6D9FE4A66
RtlAllocateHeap.NTDLL(?,?,00000000,00007FF6D9FE49F1), ref: 00007FF6D9FE4A7D
memmove.MSVCRT(?,?,00000000,00007FF6D9FE49F1), ref: 00007FF6D9FE4A9A
FreeEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000000,00007FF6D9FE49F1), ref: 00007FF6D9FE4AA2

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: EnvironmentHeapStrings$AllocateFreeProcessmemmove
String ID:
API String ID: 647542462-0
Opcode ID: 1c74cb7d747f94bb3f8ccfe64acdf6d421a13f5ebefc0e59dd75b6ffc5c77824
Instruction ID: e58a27c873bc21873bff2cf724434d18195f7c86ea177184621638ba73ef82c0
Opcode Fuzzy Hash: 1c74cb7d747f94bb3f8ccfe64acdf6d421a13f5ebefc0e59dd75b6ffc5c77824
Instruction Fuzzy Hash: F511A026A18B4282DE209F02B44403DBBA0FB89FA4B59907ADE4E83755DF3DE4518744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FFB89C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

RtlCreateUnicodeStringFromAsciiz.NTDLL ref: 00007FF6D9FFB934
GlobalAlloc.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6D9FE5085), ref: 00007FF6D9FFB9A5
GlobalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF6D9FE5085), ref: 00007FF6D9FFB9F7

Strings

%WINDOWS_COPYRIGHT%, xrefs: 00007FF6D9FFB912

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Global$AllocAsciizCreateFreeFromStringUnicode
String ID: %WINDOWS_COPYRIGHT%
API String ID: 1103618819-1745581171
Opcode ID: 315f33a102ad39634f979ce1a7930e6d82fe0816c96778e1b84bf6ee5a19bbf5
Instruction ID: 55043ebf77af286c04c938a464a43990f765f3a29de55fcab62b96f4dca8a66a
Opcode Fuzzy Hash: 315f33a102ad39634f979ce1a7930e6d82fe0816c96778e1b84bf6ee5a19bbf5
Instruction Fuzzy Hash: BB41A062A08B8286EB208F15D45027D77A1FB49BD9F859276DF8D83395EF3CE4A5C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE4AD0 Relevance: 6.0, APIs: 4, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6D9FD8798), ref: 00007FF6D9FE4AD6
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6D9FD8798), ref: 00007FF6D9FE4AEF

Part of subcall function 00007FF6D9FE4A14: GetEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000000,00007FF6D9FE49F1), ref: 00007FF6D9FE4A28
Part of subcall function 00007FF6D9FE4A14: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6D9FE49F1), ref: 00007FF6D9FE4A66
Part of subcall function 00007FF6D9FE4A14: RtlAllocateHeap.NTDLL(?,?,00000000,00007FF6D9FE49F1), ref: 00007FF6D9FE4A7D
Part of subcall function 00007FF6D9FE4A14: memmove.MSVCRT(?,?,00000000,00007FF6D9FE49F1), ref: 00007FF6D9FE4A9A
Part of subcall function 00007FF6D9FE4A14: FreeEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000000,00007FF6D9FE49F1), ref: 00007FF6D9FE4AA2

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6D9FD8798), ref: 00007FF6D9FEEE64
RtlFreeHeap.NTDLL(?,?,?,00007FF6D9FD8798), ref: 00007FF6D9FEEE78

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Heap$Process$EnvironmentFreeStrings$AllocAllocatememmove
String ID:
API String ID: 3874763886-0
Opcode ID: 7a3e83c85971b04ca882a9ee2456586daf5b43258bcc07a67dde7322b822874c
Instruction ID: f3f3c82ac1af80d4295fcd5e0654e30f3440a8da682e3415615545b3430954a3
Opcode Fuzzy Hash: 7a3e83c85971b04ca882a9ee2456586daf5b43258bcc07a67dde7322b822874c
Instruction Fuzzy Hash: 29F06D60E09B4386EF259F66A44417CADD1FF8EB45B498079CD0EC3351EE3CA5248711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FDCA40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6D9FDCAB3
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FEC706

Strings

onecore\base\cmd\maxpathawarestring.cpp, xrefs: 00007FF6D9FEC6E5

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: memset
String ID: onecore\base\cmd\maxpathawarestring.cpp
API String ID: 2221118986-3416068913
Opcode ID: 9d986779ded9d6f5d75f9ad373981b98952a2f194155cc8bde4d49c126c00a83
Instruction ID: 6349543dfe4247d4a7f4adc644b79a6e3ee58c7243a86d5f77120adc511f7a21
Opcode Fuzzy Hash: 9d986779ded9d6f5d75f9ad373981b98952a2f194155cc8bde4d49c126c00a83
Instruction Fuzzy Hash: 3D11A521A0874685FB54DF66E5542BD22929F85BE8F184333EE6DCB7D6DE2CD4A08304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FDE600 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

GeToken: (%x) '%s', xrefs: 00007FF6D9FECCF2

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID:
String ID: GeToken: (%x) '%s'
API String ID: 0-1994581435
Opcode ID: f9391344a69862f8414903480630b12e8e70c9aa2b3bdcd8f42a8ad775e2db21
Instruction ID: 52e6560010d2d1bb25e72215f1497fe3ef8f719adbb8770d41932056e880574b
Opcode Fuzzy Hash: f9391344a69862f8414903480630b12e8e70c9aa2b3bdcd8f42a8ad775e2db21
Instruction Fuzzy Hash: 56012920E1D5078AF7149F28D8942BC26A1AF9532CF5446B7D42ECB7E2DE6C74A58701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE9A6C Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007FF6D9FE9A86
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6D9FE9A97

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Concurrency::cancel_current_taskmalloc
String ID:
API String ID: 1412018758-0
Opcode ID: 738c8df77e10b4e497db5d3a2d7ddec6b27d778605f8f6b2fdfcc597a874d2dd
Instruction ID: 791a6f97fd201e24864a6289f7daa7a01a5998d6b67cc647770f3d6a861bc0a6
Opcode Fuzzy Hash: 738c8df77e10b4e497db5d3a2d7ddec6b27d778605f8f6b2fdfcc597a874d2dd
Instruction Fuzzy Hash: 35E0E541F5A60B95FE2A2F6278461BC13545F69B51E582432DE1DCB392EE2DE0F58320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FDCD90 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6D9FDB9A1,?,?,?,?,00007FF6D9FDD81A), ref: 00007FF6D9FDCDA6
RtlAllocateHeap.NTDLL(?,?,?,00007FF6D9FDB9A1,?,?,?,?,00007FF6D9FDD81A), ref: 00007FF6D9FDCDBD

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 9a820599708a522690afe6bbce0270cb8cb077445389604e7191a5141531bc8d
Instruction ID: 444d96b406c41621470f8115809145640fbf0779beb7a6776df46cc2a4c03e88
Opcode Fuzzy Hash: 9a820599708a522690afe6bbce0270cb8cb077445389604e7191a5141531bc8d
Instruction Fuzzy Hash: 95F0A972A1C74282EB148F06F8800BCBBA5FB89B44B589136DA0EC7355DF3CE4A1C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FFF318 Relevance: 3.0, APIs: 2, Instructions: 14COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF6D9FFF31C
GetFileType.KERNELBASE(?,?,?,?,00007FF6D9FEE91F,?,?,?,?,00000000,00007FF6D9FE3491,?,?,?,00007FF6D9FF4420), ref: 00007FF6D9FFF32B

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: FileType_get_osfhandle
String ID:
API String ID: 2312334805-0
Opcode ID: 223848f62e28b87063ec73ebbe696b5da64dbff73e64d749b635a9d8a6dc9d85
Instruction ID: 1d4159d93cfca7d5a403b8c7a431b198893c8bec7f5f13827e44582af58846b9
Opcode Fuzzy Hash: 223848f62e28b87063ec73ebbe696b5da64dbff73e64d749b635a9d8a6dc9d85
Instruction Fuzzy Hash: ECD05E35E0A602C7CB08AF61685407C6AA0FB8D705B8180B9D60BC7311DE3C50548700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE885C Relevance: 1.5, APIs: 1, Instructions: 23windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNELBASE ref: 00007FF6D9FE88A2

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 7d14eb8d6440d8a6ff149373b33d2c264773d91702229be83f18df8b013b3c5b
Instruction ID: a38e81bcd80c131654e2c129e3ac67e300d4d67dc688854b5f14916b9e44fe19
Opcode Fuzzy Hash: 7d14eb8d6440d8a6ff149373b33d2c264773d91702229be83f18df8b013b3c5b
Instruction Fuzzy Hash: F3F0AF72B18B4096D7108B10E488BAD3BA9F359794FA24179D7AC46710DF3ACA64CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE5508 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNELBASE(?,?,?,?,00007FF6D9FD6F97), ref: 00007FF6D9FE550C

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: DefaultLangUser
String ID:
API String ID: 768647712-0
Opcode ID: 5d8fc4fa8e665926eb49570ec356dc21582dec5ebc006b351cd7b5a4e2c943bd
Instruction ID: 983289947f8d56865ca97bd96f977321a83aeab61dee4a906fe0df4d2d026905
Opcode Fuzzy Hash: 5d8fc4fa8e665926eb49570ec356dc21582dec5ebc006b351cd7b5a4e2c943bd
Instruction Fuzzy Hash: 7DE0C2A2D183538AF9982E8260413BC2953CB68786FC44033C60EC32C5CD2D28615209

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE2E44 Relevance: 1.3, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6D9FE2E8B

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 5e7fccc8773aef34ba68b35cce16b71deba0983de483b5e6488b3a2eb2d94e71
Instruction ID: c5ec890d588a0071bd51e6d626591ba7f08758a271a3159d162236b1efab53c2
Opcode Fuzzy Hash: 5e7fccc8773aef34ba68b35cce16b71deba0983de483b5e6488b3a2eb2d94e71
Instruction Fuzzy Hash: C7F05E21B0979640EA548B57B94016D62959B88BE0B488336EA7DC7BD9EE3CD4628700

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF6D9FD5B70 Relevance: 158.5, APIs: 70, Strings: 20, Instructions: 1037memorythreadprocessCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6D9FD5C20
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6D9FD5C39
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6D9FD5C4E
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6D9FD5C63
memset.MSVCRT ref: 00007FF6D9FD5CAC

Part of subcall function 00007FF6D9FDCA40: memset.MSVCRT ref: 00007FF6D9FDCAB3

wcschr.MSVCRT ref: 00007FF6D9FD5E17
memset.MSVCRT ref: 00007FF6D9FD5F23
GetStartupInfoW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6D9FD5F33
InitializeProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6D9FD5F68
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FD5F7C
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FD5F91
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FD5FA9
InitializeProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6D9FD5FD1
UpdateProcThreadAttribute.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6D9FD6012
CreateProcessW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6D9FD6088
DeleteProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?), ref: 00007FF6D9FD60A0
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FD60AC
RtlFreeHeap.NTDLL ref: 00007FF6D9FD60C2
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FD60DA
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6D9FD611F
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6D9FD6140
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD615C
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD6173
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD6187
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD619B
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD61AF
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD61C3
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD61D7

Part of subcall function 00007FF6D9FE09F4: iswspace.MSVCRT ref: 00007FF6D9FE0A11
Part of subcall function 00007FF6D9FE09F4: wcschr.MSVCRT ref: 00007FF6D9FE0A2B

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD61FD
_wcsicmp.MSVCRT ref: 00007FF6D9FD6265
_wcsicmp.MSVCRT ref: 00007FF6D9FD6283
_wcsicmp.MSVCRT ref: 00007FF6D9FD62A3
_wcsicmp.MSVCRT ref: 00007FF6D9FD62C3
_wcsicmp.MSVCRT ref: 00007FF6D9FD62E1
towupper.MSVCRT ref: 00007FF6D9FD62FA
_wcsicmp.MSVCRT ref: 00007FF6D9FD631A
towupper.MSVCRT ref: 00007FF6D9FD6333
towupper.MSVCRT ref: 00007FF6D9FD634C
_wcsicmp.MSVCRT ref: 00007FF6D9FD636C
_wcsicmp.MSVCRT ref: 00007FF6D9FD638C

Part of subcall function 00007FF6D9FD6530: iswspace.MSVCRT ref: 00007FF6D9FD6572

_wcsnicmp.MSVCRT ref: 00007FF6D9FD6451
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FF3DB0
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FF3DC2
RtlFreeHeap.NTDLL ref: 00007FF6D9FF3DD8
_wcsicmp.MSVCRT ref: 00007FF6D9FF3E5F
SetConsoleCtrlHandler.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF6D9FF3EEB
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FF3F0C
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FF3F23
DeleteProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6D9FF3F3A
UpdateProcThreadAttribute.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6D9FF3F71
SetConsoleCtrlHandler.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF6D9FF3F8A

Strings

ABOVENORMAL, xrefs: 00007FF6D9FD6279
/K %s, xrefs: 00007FF6D9FF3E1D
NEWWINDOW, xrefs: 00007FF6D9FD62D7
/K , xrefs: 00007FF6D9FF3E55
BELOWNORMAL, xrefs: 00007FF6D9FD6299
COMSPEC, xrefs: 00007FF6D9FF3DF1
MIN, xrefs: 00007FF6D9FD6382
SHARED, xrefs: 00007FF6D9FF3C3F
.LNK, xrefs: 00007FF6D9FD6446
NORMAL, xrefs: 00007FF6D9FF3BCB
LOW, xrefs: 00007FF6D9FD6362
AFFINITY, xrefs: 00007FF6D9FD625B
, xrefs: 00007FF6D9FF3BE7
NODE, xrefs: 00007FF6D9FF3B17
SEPARATE, xrefs: 00007FF6D9FF3C18
WAIT, xrefs: 00007FF6D9FF3C66
MAX, xrefs: 00007FF6D9FF3AEB
"%s", xrefs: 00007FF6D9FF3D96
HIGH, xrefs: 00007FF6D9FD6310
REALTIME, xrefs: 00007FF6D9FF3BF1

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: _wcsicmp$AttributeHeapProcThread$ErrorHandleLast$ListProcessmemset$towupper$CloseConsoleCtrlDeleteFreeHandlerInitializeUpdateiswspacewcschr$AllocCreateInfoStartup_wcsnicmp
String ID: $ /K $ /K %s$"%s"$.LNK$ABOVENORMAL$AFFINITY$BELOWNORMAL$COMSPEC$HIGH$LOW$MAX$MIN$NEWWINDOW$NODE$NORMAL$REALTIME$SEPARATE$SHARED$WAIT
API String ID: 1388555566-2647954630
Opcode ID: 0c7347f3e22ddfba5c98678606a1d58325ad8667ce46c200bbbc2c40ae858416
Instruction ID: 61dbf5e2dbcfc6bac8dcc9fc8dccb287aeefabe52b6fe0ab1043a2aad5c30b73
Opcode Fuzzy Hash: 0c7347f3e22ddfba5c98678606a1d58325ad8667ce46c200bbbc2c40ae858416
Instruction Fuzzy Hash: 3DA28231A0C78286EB249F26A8542BD7BA1FF89B88F448176DA4EC7795DF7CE454C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FDE680 Relevance: 79.4, APIs: 39, Strings: 6, Instructions: 696COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D9FE09F4: iswspace.MSVCRT ref: 00007FF6D9FE0A11
Part of subcall function 00007FF6D9FE09F4: wcschr.MSVCRT ref: 00007FF6D9FE0A2B

wcschr.MSVCRT ref: 00007FF6D9FDE71D
wcschr.MSVCRT ref: 00007FF6D9FDE738
_get_osfhandle.MSVCRT ref: 00007FF6D9FDE784
GetFileSize.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FDE795
_wcsnicmp.MSVCRT ref: 00007FF6D9FDE7D5

Strings

:EOF, xrefs: 00007FF6D9FDE7CB
+: , xrefs: 00007FF6D9FDE731, 00007FF6D9FDEC33
&<|>, xrefs: 00007FF6D9FDEC51
=,;, xrefs: 00007FF6D9FDE713, 00007FF6D9FDE840, 00007FF6D9FDEBC0, 00007FF6D9FDEC0F
:, xrefs: 00007FF6D9FDEB36
^, xrefs: 00007FF6D9FDEC69

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: wcschr$FileSize_get_osfhandle_wcsnicmpiswspace
String ID: &<|>$+: $:$:EOF$=,;$^
API String ID: 511550188-726566285
Opcode ID: ecc936a8b2123d416c6907596ec693eb851faf97a5d6d1e260225ff274185885
Instruction ID: 2a92a497c0632ec23c71932f4406ce60d7afd797d469a6b0ec2cf6e66e0b047c
Opcode Fuzzy Hash: ecc936a8b2123d416c6907596ec693eb851faf97a5d6d1e260225ff274185885
Instruction Fuzzy Hash: 2152A032E0C69386EB259F25A4042BD7AA1FB85B48F448177EA4EC3795DF3CE965C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD9E50 Relevance: 67.3, APIs: 32, Strings: 6, Instructions: 811COMMON

Download Yara Rule

APIs

_wcsnicmp.MSVCRT ref: 00007FF6D9FD9F25
_wcsnicmp.MSVCRT ref: 00007FF6D9FD9F4A
_wcsnicmp.MSVCRT ref: 00007FF6D9FD9F6F
_wcsnicmp.MSVCRT ref: 00007FF6D9FD9F94
_wcsnicmp.MSVCRT ref: 00007FF6D9FD9FB9
_wcsnicmp.MSVCRT ref: 00007FF6D9FD9FDE
wcstol.MSVCRT ref: 00007FF6D9FDA02F
wcschr.MSVCRT ref: 00007FF6D9FDA2B1
wcschr.MSVCRT ref: 00007FF6D9FDA324
wcschr.MSVCRT ref: 00007FF6D9FDA367

Strings

eol=, xrefs: 00007FF6D9FD9F62
tokens=, xrefs: 00007FF6D9FD9FD7
useback, xrefs: 00007FF6D9FD9F3D
delims=, xrefs: 00007FF6D9FD9F87
usebackq, xrefs: 00007FF6D9FD9F1B
skip=, xrefs: 00007FF6D9FD9FAC

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: _wcsnicmp$wcschr$wcstol
String ID: delims=$eol=$skip=$tokens=$useback$usebackq
API String ID: 1738779099-3004636944
Opcode ID: 9efc5e680396b75076e63303b627040fc2277f7c0f3a1c65f5e9be39770acc7c
Instruction ID: 3b8a18c0266190ffc97b4d31c88df6d85823d2d22a144ab902bf89ad4eec4c6c
Opcode Fuzzy Hash: 9efc5e680396b75076e63303b627040fc2277f7c0f3a1c65f5e9be39770acc7c
Instruction Fuzzy Hash: 95726932F086528AEB209F65D4446BD37A1FB85B88F458136DE0ED7794EE3CE865C348

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD3F90 Relevance: 60.8, APIs: 32, Strings: 2, Instructions: 1302fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6D9FD4048
memset.MSVCRT ref: 00007FF6D9FD406E
memset.MSVCRT ref: 00007FF6D9FD4094
memset.MSVCRT ref: 00007FF6D9FD40BA

Part of subcall function 00007FF6D9FDCA40: memset.MSVCRT ref: 00007FF6D9FDCAB3

GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FD4492
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FD45E0
SetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FD4608
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD46DB
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD46FA
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD4719
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD4738

Part of subcall function 00007FF6D9FD5194: VirtualAlloc.API-MS-WIN-CORE-MEMORY-L1-1-0 ref: 00007FF6D9FD51C4

Part of subcall function 00007FF6D9FE1EA0: wcschr.MSVCRT ref: 00007FF6D9FE1EB3

Part of subcall function 00007FF6D9FE823C: FindFirstFileExW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FE8280
Part of subcall function 00007FF6D9FE823C: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FE829D

CopyFileW.API-MS-WIN-CORE-KERNEL32-LEGACY-L1-1-0 ref: 00007FF6D9FF1DD5
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FF1DE7

Strings

%s , xrefs: 00007FF6D9FF1982
%s, xrefs: 00007FF6D9FD4254

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Filememset$Attributes$ErrorLast$AllocCopyFindFirstVirtualwcschr
String ID: %s$%s
API String ID: 3623545644-3518022669
Opcode ID: 2c59002f44014bed6d62d7d9bfab8569cdd3669a3fab2aacb014ef1240c6e24b
Instruction ID: f2f447223e1bd851d0d1a6cfea7cc25176445f433791e113944eb390ccb09961
Opcode Fuzzy Hash: 2c59002f44014bed6d62d7d9bfab8569cdd3669a3fab2aacb014ef1240c6e24b
Instruction Fuzzy Hash: 17D28E32A086838AEB649F25D8902BD77A1FB85758F14413ADA4EC7BD5DF3CE564CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD2C48 Relevance: 60.1, APIs: 32, Strings: 2, Instructions: 633COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6D9FD2CB6
memset.MSVCRT ref: 00007FF6D9FD2CDA

Part of subcall function 00007FF6D9FDCA40: memset.MSVCRT ref: 00007FF6D9FDCAB3

wcsrchr.MSVCRT ref: 00007FF6D9FD2E1F
memset.MSVCRT ref: 00007FF6D9FD2ED4
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FD2F36
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FD2FA5
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD302C
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD3112
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD3131
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FF0E96
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FF0EBD
_wcsicmp.MSVCRT ref: 00007FF6D9FF0F75
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF6D9FF1065
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF6D9FF1094
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6D9FF10AD
FlushConsoleInputBuffer.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF6D9FF10BC
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF6D9FF10CF
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF6D9FF10E0
_getch.MSVCRT ref: 00007FF6D9FF10EC
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF6D9FF1100
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF6D9FF1113
FillConsoleOutputCharacterW.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF6D9FF115D
SetConsoleCursorPosition.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF6D9FF116F

Part of subcall function 00007FF6D9FE3BAC: wcschr.MSVCRT ref: 00007FF6D9FE3BE6

Strings

%9d, xrefs: 00007FF6D9FD30B7, 00007FF6D9FF0D21
%s, xrefs: 00007FF6D9FD3222, 00007FF6D9FF0EE9

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Console$memset$BufferMode$FullInfoNamePathScreen$CharacterCursorErrorFillFlushHandleInputLastOutputPositionWrite_getch_wcsicmpwcschrwcsrchr
String ID: %9d$%s
API String ID: 4286035211-3662383364
Opcode ID: a3bee1deb293f716227e62ac9c5a3310629ad2ba5b6ef547e6115011021ce3f8
Instruction ID: f5ba059b58f868d659320a3ceda0cb5548acbbfa6d4486d898c73dd159b30757
Opcode Fuzzy Hash: a3bee1deb293f716227e62ac9c5a3310629ad2ba5b6ef547e6115011021ce3f8
Instruction Fuzzy Hash: 6B52A132B08B828AEB259F25D8502FD77A4FB89799F444136DA0E87B95DF3CE558C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE0A6C Relevance: 53.1, APIs: 23, Strings: 7, Instructions: 605COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D9FE1EA0: wcschr.MSVCRT ref: 00007FF6D9FE1EB3

_wcsnicmp.MSVCRT ref: 00007FF6D9FE0AFE
memset.MSVCRT ref: 00007FF6D9FE0B37
wcschr.MSVCRT ref: 00007FF6D9FE0B91
wcsrchr.MSVCRT ref: 00007FF6D9FE0C14
wcsrchr.MSVCRT ref: 00007FF6D9FE0D79
NeedCurrentDirectoryForExePathW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-2-0 ref: 00007FF6D9FE0D9A
wcsrchr.MSVCRT ref: 00007FF6D9FE0FBB
wcschr.MSVCRT ref: 00007FF6D9FE0FD8
wcschr.MSVCRT ref: 00007FF6D9FE0FF3
_wcsicmp.MSVCRT ref: 00007FF6D9FE1091
_wcsicmp.MSVCRT ref: 00007FF6D9FE10B1
wcsrchr.MSVCRT ref: 00007FF6D9FE1102
_wcsicmp.MSVCRT ref: 00007FF6D9FE1124
_wcsicmp.MSVCRT ref: 00007FF6D9FE1142
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FE1169

Strings

cmd , xrefs: 00007FF6D9FE0AF4
.BAT, xrefs: 00007FF6D9FE1087, 00007FF6D9FE1138
.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC, xrefs: 00007FF6D9FEDA38
PATHEXT, xrefs: 00007FF6D9FE0E6E
COMSPEC, xrefs: 00007FF6D9FED927
PATH, xrefs: 00007FF6D9FE11D3
.CMD, xrefs: 00007FF6D9FE10A7, 00007FF6D9FE111A

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: _wcsicmpwcschrwcsrchr$CurrentDirectoryNeedPath_wcsnicmpmemset
String ID: .BAT$.CMD$.COM;.EXE;.BAT;.CMD;.VBS;.JS;.WS;.MSC$COMSPEC$PATH$PATHEXT$cmd
API String ID: 3305344409-4288247545
Opcode ID: 534ec16e987550a66f3e1d5b34a1157b4fd9a17b2c719d80120aaa9796f83e6c
Instruction ID: ee8bd92dcc807ec5d4846e452b23c4b4c086668c7962e05136de74e3bbf52922
Opcode Fuzzy Hash: 534ec16e987550a66f3e1d5b34a1157b4fd9a17b2c719d80120aaa9796f83e6c
Instruction Fuzzy Hash: E342B021B0D78385EB609F2298502BE67A1FF85B98F484236D91ECB7D6DF3CE5658300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE4224 Relevance: 45.8, APIs: 19, Strings: 7, Instructions: 328threadprocessstringCOMMON

Download Yara Rule

APIs

InitializeProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6D9FE4297
UpdateProcThreadAttribute.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6D9FE42D7
memset.MSVCRT ref: 00007FF6D9FE42FD
memset.MSVCRT ref: 00007FF6D9FE4368
GetStartupInfoW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6D9FE4380

Part of subcall function 00007FF6D9FE3A90: wcsrchr.MSVCRT ref: 00007FF6D9FE3ADF
Part of subcall function 00007FF6D9FE3A90: _wcsnicmp.MSVCRT ref: 00007FF6D9FE3B38

wcsrchr.MSVCRT ref: 00007FF6D9FE43E6
lstrcmpW.API-MS-WIN-CORE-STRING-OBSOLETE-L1-1-0 ref: 00007FF6D9FE4401
CreateProcessW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6D9FE447F
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6D9FE44AA
CreateProcessAsUserW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6D9FE45EE
_local_unwind.MSVCRT ref: 00007FF6D9FE4644
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6D9FE47E1
DeleteProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6D9FE4802
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FEECD4
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FEECF0
DeleteProcThreadAttributeList.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6D9FEED12

Strings

COPYCMD, xrefs: 00007FF6D9FE439C, 00007FF6D9FE44B9
\XCOPY.EXE, xrefs: 00007FF6D9FE43F7
%08X, xrefs: 00007FF6D9FE452C
h, xrefs: 00007FF6D9FE436D
=ExitCodeAscii, xrefs: 00007FF6D9FE456B
%01C, xrefs: 00007FF6D9FE47B1
=ExitCode, xrefs: 00007FF6D9FE454C

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: AttributeProcThread$List$CloseCreateDeleteErrorHandleLastProcessmemsetwcsrchr$InfoInitializeStartupUpdateUser_local_unwind_wcsnicmplstrcmp
String ID: %01C$%08X$=ExitCode$=ExitCodeAscii$COPYCMD$\XCOPY.EXE$h
API String ID: 388421343-2905461000
Opcode ID: 91aa278bae488f07ca69690407c5ac2f944185e63ade342298008147df7553ae
Instruction ID: b9520049ef4fc2115942c1bcb7f5eaf1a4d1d13a4cb6ca2b713a57e33e33a7c3
Opcode Fuzzy Hash: 91aa278bae488f07ca69690407c5ac2f944185e63ade342298008147df7553ae
Instruction Fuzzy Hash: 67F12932A1CB8286EA609F11E4847BEB7A5FB89784F50417BDA4DC7695DF3CE464CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE18D4 Relevance: 42.6, APIs: 23, Strings: 1, Instructions: 644COMMON

Download Yara Rule

APIs

wcsrchr.MSVCRT ref: 00007FF6D9FE1949
towlower.MSVCRT ref: 00007FF6D9FE19F6
wcsrchr.MSVCRT ref: 00007FF6D9FE1A0C
wcsrchr.MSVCRT ref: 00007FF6D9FE1A3F
wcsrchr.MSVCRT ref: 00007FF6D9FE1A5A
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FE1ADD

Strings

fdpnxsatz, xrefs: 00007FF6D9FE1A05

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: wcsrchr$towlower
String ID: fdpnxsatz
API String ID: 3267374428-1106894203
Opcode ID: a2e01bddbcf446966ff69a9cc6a8659e7d71e7754141e89b10d21dc1499ca482
Instruction ID: 07b66bb7b9457de2190ed10e031a0cd747dceeb898c212861a628673d79e6dd3
Opcode Fuzzy Hash: a2e01bddbcf446966ff69a9cc6a8659e7d71e7754141e89b10d21dc1499ca482
Instruction Fuzzy Hash: 1C42B122B09B8286EB648F2699542BD67A1FF45B94F548137DE4EC7BD4DF3CE8618300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD7650 Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 461fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6D9FD76E5

Part of subcall function 00007FF6D9FDCA40: memset.MSVCRT ref: 00007FF6D9FDCAB3

_get_osfhandle.MSVCRT ref: 00007FF6D9FD7745
GetFileSize.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FD7759
_get_osfhandle.MSVCRT ref: 00007FF6D9FD776C
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FD7783
_get_osfhandle.MSVCRT ref: 00007FF6D9FD77A3
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FD77C9
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD7808
wcsrchr.MSVCRT ref: 00007FF6D9FF49BE
_wcsnicmp.MSVCRT ref: 00007FF6D9FF4A02
SearchPathW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6D9FF4A81

Part of subcall function 00007FF6D9FE01B8: _get_osfhandle.MSVCRT ref: 00007FF6D9FE01C4
Part of subcall function 00007FF6D9FE01B8: GetFileType.KERNELBASE(?,?,?,00007FF6D9FEE904,?,?,?,?,00000000,00007FF6D9FE3491,?,?,?,00007FF6D9FF4420), ref: 00007FF6D9FE01D6

Strings

DPATH, xrefs: 00007FF6D9FF499A

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: File_get_osfhandle$memset$PathPointerReadSearchSizeType_wcsnicmpwcsrchr
String ID: DPATH
API String ID: 95024817-2010427443
Opcode ID: d8f382e6e12ddc57194bca8be96919110f8aaf6239d95eeedcf695d463a234ea
Instruction ID: 825715267702fe5c8bc7e063d037dab459f791236a7a886420e6086b33dcee12
Opcode Fuzzy Hash: d8f382e6e12ddc57194bca8be96919110f8aaf6239d95eeedcf695d463a234ea
Instruction Fuzzy Hash: A012C632A0C68386E7649F11A4441BDB7A1FB89B58F44523BEA5ED7795DF3CE414CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD5240 Relevance: 33.8, APIs: 14, Strings: 5, Instructions: 503COMMON

Download Yara Rule

Strings

:, xrefs: 00007FF6D9FF3261
[.], xrefs: 00007FF6D9FF3128
[..], xrefs: 00007FF6D9FF2FB5
..., xrefs: 00007FF6D9FF2C8C
[...], xrefs: 00007FF6D9FF3013

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID:
String ID: [...]$ [..]$ [.]$...$:
API String ID: 0-1980097535
Opcode ID: 251dffbd20cb83d3debd935fcd4546828530d34106f281e7cd8b68f040cf8ba4
Instruction ID: ffe6bf796090c2cdf1ccc60c5162f6ad2dd0adc1f203fd42af26d7dd42a12aaa
Opcode Fuzzy Hash: 251dffbd20cb83d3debd935fcd4546828530d34106f281e7cd8b68f040cf8ba4
Instruction Fuzzy Hash: 33329B72A0878386EB60DF61E8402FD73A5EB85788F418136DA4D8779ADF7CE569C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD6EE4 Relevance: 30.1, APIs: 13, Strings: 4, Instructions: 342timeCOMMON

Download Yara Rule

APIs

GetSystemTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF6D9FD6F34
SystemTimeToFileTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0 ref: 00007FF6D9FD6F49
FileTimeToLocalFileTime.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FD6F5F
FileTimeToSystemTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0 ref: 00007FF6D9FD6F74
realloc.MSVCRT ref: 00007FF6D9FF4327

Part of subcall function 00007FF6D9FE5508: GetUserDefaultLangID.KERNELBASE(?,?,?,?,00007FF6D9FD6F97), ref: 00007FF6D9FE550C

GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6D9FD6FA8
memmove.MSVCRT ref: 00007FF6D9FD702F
GetDateFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0 ref: 00007FF6D9FD7064

Strings

%s , xrefs: 00007FF6D9FF43ED
%02d%s%02d%s%02d, xrefs: 00007FF6D9FF4355
%s %s , xrefs: 00007FF6D9FF4400
$P$G, xrefs: 00007FF6D9FD6EEB

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Time$File$System$DateDefaultFormatInfoLangLocalLocaleUsermemmoverealloc
String ID: $P$G$%02d%s%02d%s%02d$%s $%s %s
API String ID: 4111365348-3792846528
Opcode ID: 4bbca4a7fa58dce35846e693fe757bf5253ce874f3a130b4f9e0a181b9804d7b
Instruction ID: ebacbc757251793b3ed742bced77c487af042dd985c7423bb049c7fd8189ed25
Opcode Fuzzy Hash: 4bbca4a7fa58dce35846e693fe757bf5253ce874f3a130b4f9e0a181b9804d7b
Instruction Fuzzy Hash: B1E17D62A0C64386EB209F65A8442FD67A1FF8978CF544133DA4ED7696EF3CE529C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FFEE88 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

_wcsupr.MSVCRT ref: 00007FF6D9FFEF33
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF6D9FFE964), ref: 00007FF6D9FFEF98
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF6D9FFE964), ref: 00007FF6D9FFEFA9
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF6D9FFE964), ref: 00007FF6D9FFEFBF
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF6D9FFEFDC
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF6D9FFE964), ref: 00007FF6D9FFEFED
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF6D9FFE964), ref: 00007FF6D9FFF003
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF6D9FFE964), ref: 00007FF6D9FFF022
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF6D9FFE964), ref: 00007FF6D9FFF083
FlushConsoleInputBuffer.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF6D9FFE964), ref: 00007FF6D9FFF092
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF6D9FFE964), ref: 00007FF6D9FFF0A5
towupper.MSVCRT ref: 00007FF6D9FFF0DB
wcschr.MSVCRT ref: 00007FF6D9FFF135
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF6D9FFE964), ref: 00007FF6D9FFF16C
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF6D9FFE964), ref: 00007FF6D9FFF185

Part of subcall function 00007FF6D9FE01B8: _get_osfhandle.MSVCRT ref: 00007FF6D9FE01C4
Part of subcall function 00007FF6D9FE01B8: GetFileType.KERNELBASE(?,?,?,00007FF6D9FEE904,?,?,?,?,00000000,00007FF6D9FE3491,?,?,?,00007FF6D9FF4420), ref: 00007FF6D9FE01D6

Strings

CMD.EXE, xrefs: 00007FF6D9FFF19D
<noalias>, xrefs: 00007FF6D9FFF03C

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Console$Mode$Handle$BufferFileFlushFreeInputLocalType_get_osfhandle_wcsuprtowupperwcschr
String ID: <noalias>$CMD.EXE
API String ID: 1161012917-1690691951
Opcode ID: 515b4b3c9e1c53e86647d6030510c72eb22c7b0d4b1ae78da30837f4729b0ade
Instruction ID: 6d3923d82d8aa11bc78508f61b7f44d1a084c9ae346ead4797b690bdba75bad9
Opcode Fuzzy Hash: 515b4b3c9e1c53e86647d6030510c72eb22c7b0d4b1ae78da30837f4729b0ade
Instruction Fuzzy Hash: 0C919D22F086438AFB159F61E8101BD2AA0AF49B59F488177DE0EC77D6DF3CA469C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD1560 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 338fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6D9FD15BD

Part of subcall function 00007FF6D9FDCA40: memset.MSVCRT ref: 00007FF6D9FDCAB3

FindFirstFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FD1620
FindClose.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FD1638
FindFirstFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FD16C0

Part of subcall function 00007FF6D9FD1560: FindNextFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FD17F0
Part of subcall function 00007FF6D9FD1560: FindClose.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FD180C
Part of subcall function 00007FF6D9FD1560: ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD183E

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FEAC35
SetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FEAC68

Strings

\\?\, xrefs: 00007FF6D9FEAC99

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Find$File$CloseFirstmemset$AttributesErrorLastNext
String ID: \\?\
API String ID: 628682198-4282027825
Opcode ID: 58be10dc0a729e0ede8e45c897456c5a564b599b2587ade0bf5c951e8e4c4558
Instruction ID: 5b2280df3402d88d4da0e0ae16a8e44a65ee5f1870e820e5645fb944473e5639
Opcode Fuzzy Hash: 58be10dc0a729e0ede8e45c897456c5a564b599b2587ade0bf5c951e8e4c4558
Instruction Fuzzy Hash: AAE1AE62B0868296EB659F25D8403FD63A0FB85749F405136EA1EC77E5EF3CE665C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FFAFBC Relevance: 26.0, APIs: 17, Instructions: 537COMMON

Download Yara Rule

APIs

longjmp.MSVCRT(?,?,?,?,00007FF6D9FF182A), ref: 00007FF6D9FFAFD8
_setjmp.MSVCRT ref: 00007FF6D9FFB032

Part of subcall function 00007FF6D9FDD3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FDD46E
Part of subcall function 00007FF6D9FDD3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FDD485
Part of subcall function 00007FF6D9FDD3F0: wcschr.MSVCRT ref: 00007FF6D9FDD4EE
Part of subcall function 00007FF6D9FDD3F0: iswspace.MSVCRT ref: 00007FF6D9FDD54D
Part of subcall function 00007FF6D9FDD3F0: wcschr.MSVCRT ref: 00007FF6D9FDD569
Part of subcall function 00007FF6D9FDD3F0: wcschr.MSVCRT ref: 00007FF6D9FDD58C

memset.MSVCRT ref: 00007FF6D9FFB126
memset.MSVCRT ref: 00007FF6D9FFB14C
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FFB266
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FFB281

Part of subcall function 00007FF6D9FFAFBC: ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FFB717
Part of subcall function 00007FF6D9FFAFBC: ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FFB736
Part of subcall function 00007FF6D9FFAFBC: ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FFB755

Part of subcall function 00007FF6D9FE3A0C: FindClose.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF6D9FFEAC5,?,?,?,00007FF6D9FFE925,?,?,?,?,00007FF6D9FDB9B1), ref: 00007FF6D9FE3A56

Part of subcall function 00007FF6D9FFAFBC: ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FFB7D2
Part of subcall function 00007FF6D9FFAFBC: ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FFB7F1
Part of subcall function 00007FF6D9FFAFBC: ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FFB810

wcschr.MSVCRT ref: 00007FF6D9FFB2AA
memset.MSVCRT ref: 00007FF6D9FFB2E0

Part of subcall function 00007FF6D9FE1EA0: wcschr.MSVCRT ref: 00007FF6D9FE1EB3

wcsrchr.MSVCRT ref: 00007FF6D9FFB4BC
MoveFileWithProgressW.API-MS-WIN-CORE-FILE-L2-1-0 ref: 00007FF6D9FFB692
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FFB6A2

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: wcschr$memset$ErrorFileHeapLast$AllocAttributesCloseFindMoveProcessProgressWith_setjmpiswspacelongjmpwcsrchr
String ID:
API String ID: 16309207-0
Opcode ID: 39281ab943732698daec275114152188bca7bc57d7047d9a14549d778b5747ea
Instruction ID: f77267ef10b3cd1f0f9f3c796a799dbe192205fdf7aa79dceb89c8daedc7b7aa
Opcode Fuzzy Hash: 39281ab943732698daec275114152188bca7bc57d7047d9a14549d778b5747ea
Instruction Fuzzy Hash: 4E22A162B08B8286EB259F25D8542FD63A0FF85B89F404136DA1E8BB95DF3CE165C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FFD9D0 Relevance: 23.3, APIs: 10, Strings: 3, Instructions: 576fileCOMMON

Download Yara Rule

APIs

longjmp.MSVCRT(?,?,00000000,00007FF6D9FF048E), ref: 00007FF6D9FFDA58
memset.MSVCRT ref: 00007FF6D9FFDAD6
memset.MSVCRT ref: 00007FF6D9FFDAFC
memset.MSVCRT ref: 00007FF6D9FFDB22

Part of subcall function 00007FF6D9FE3A0C: FindClose.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF6D9FFEAC5,?,?,?,00007FF6D9FFE925,?,?,?,?,00007FF6D9FDB9B1), ref: 00007FF6D9FE3A56

Part of subcall function 00007FF6D9FD5194: VirtualAlloc.API-MS-WIN-CORE-MEMORY-L1-1-0 ref: 00007FF6D9FD51C4

Part of subcall function 00007FF6D9FE823C: FindFirstFileExW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FE8280
Part of subcall function 00007FF6D9FE823C: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FE829D

Part of subcall function 00007FF6D9FE01B8: _get_osfhandle.MSVCRT ref: 00007FF6D9FE01C4
Part of subcall function 00007FF6D9FE01B8: GetFileType.KERNELBASE(?,?,?,00007FF6D9FEE904,?,?,?,?,00000000,00007FF6D9FE3491,?,?,?,00007FF6D9FF4420), ref: 00007FF6D9FE01D6

Part of subcall function 00007FF6D9FD4FE8: _get_osfhandle.MSVCRT ref: 00007FF6D9FD5012
Part of subcall function 00007FF6D9FD4FE8: ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FD5030

GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FFDDB0

Part of subcall function 00007FF6D9FD59E4: CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FD5A2E
Part of subcall function 00007FF6D9FD59E4: _open_osfhandle.MSVCRT ref: 00007FF6D9FD5A4F

_get_osfhandle.MSVCRT ref: 00007FF6D9FFDDEB
SetEndOfFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FFDDFA
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FFE204
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FFE223
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FFE242

Strings

%9d, xrefs: 00007FF6D9FFD9EF
%s, xrefs: 00007FF6D9FFDC95, 00007FF6D9FFE00C
~, xrefs: 00007FF6D9FFDB34

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: File$_get_osfhandlememset$Find$AllocAttributesCloseCreateErrorFirstLastReadTypeVirtual_open_osfhandlelongjmp
String ID: %9d$%s$~
API String ID: 3651208239-912394897
Opcode ID: 29544b42f9cbdb1dfb34a09445a5538564ede9ca9281ec5b6e2057e935bcb2de
Instruction ID: 9d53aece858a8e2f152e2d2aac34660a2387ac7954c24fd39021531be3a9a26d
Opcode Fuzzy Hash: 29544b42f9cbdb1dfb34a09445a5538564ede9ca9281ec5b6e2057e935bcb2de
Instruction Fuzzy Hash: 4C425D32A087828AEB649F25D8502FD77A1FB85748F500137EA4DC7A99DF3DE565CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FDCE10 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 337COMMON

Download Yara Rule

APIs

_tell.MSVCRT ref: 00007FF6D9FDCEAF
memset.MSVCRT ref: 00007FF6D9FDCF5C
_wcsicmp.MSVCRT ref: 00007FF6D9FDCFAE
GetConsoleOutputCP.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF6D9FDD003
GetCPInfo.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6D9FDD01E
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FDD044
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6D9FEC889
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6D9FEC8A2

Strings

GOTO, xrefs: 00007FF6D9FDD0A3

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: CriticalSection$ConsoleEnterInfoLeaveOutput_tell_wcsicmpmemset
String ID: GOTO
API String ID: 3863671652-1693823284
Opcode ID: dee6fc3255eb917917b1ec0481f3bd1534c34cd92e8af6b215a3ce948fe175a9
Instruction ID: 6c6d36f25d34b895e813d6a3bfac0873dd04974cb8577a264e2eb4a8cca568cf
Opcode Fuzzy Hash: dee6fc3255eb917917b1ec0481f3bd1534c34cd92e8af6b215a3ce948fe175a9
Instruction Fuzzy Hash: 96E1AB21A0D64386FA64AF15A4543BD26A2FF89B48F554237DA1EC77D2DF3CE865C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD372C Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 396COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6D9FD3921

Part of subcall function 00007FF6D9FE09F4: iswspace.MSVCRT ref: 00007FF6D9FE0A11
Part of subcall function 00007FF6D9FE09F4: wcschr.MSVCRT ref: 00007FF6D9FE0A2B

wcsrchr.MSVCRT ref: 00007FF6D9FD37D2
_wcsnicmp.MSVCRT ref: 00007FF6D9FD381A
wcsrchr.MSVCRT ref: 00007FF6D9FD3A0C
wcsrchr.MSVCRT ref: 00007FF6D9FD3A35
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FD3A9D
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FD3ACC
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FD3AE1
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD3B1E

Strings

COPYCMD, xrefs: 00007FF6D9FD37AE
\, xrefs: 00007FF6D9FD3AB9

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: wcsrchr$ErrorLast$AttributesFile_wcsnicmpiswspacememsetwcschr
String ID: COPYCMD$\
API String ID: 3989487059-1802776761
Opcode ID: 3bbf8f215ee2954a5d4fb17bf70d9d8e166cfa696a158a9e0d223ca151e74ab2
Instruction ID: 8b52a0ccc6d16b8a37c11a7ab0e89074ea7186a0a6742a4b81e6ac5be053dc3f
Opcode Fuzzy Hash: 3bbf8f215ee2954a5d4fb17bf70d9d8e166cfa696a158a9e0d223ca151e74ab2
Instruction Fuzzy Hash: C6F1C366B0878686EB649F16D4402BE63A1FF85B8CF048136DA4EC77A5EF7CE565C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE3140 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 229timeCOMMON

Download Yara Rule

APIs

GetSystemTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF6D9FE3189
SystemTimeToFileTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0 ref: 00007FF6D9FE319F
FileTimeToLocalFileTime.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FE31B5
FileTimeToSystemTime.API-MS-WIN-CORE-TIMEZONE-L1-1-0 ref: 00007FF6D9FE31CB
GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6D9FEE619
GetTimeFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0 ref: 00007FF6D9FEE738

Strings

%2d%s%02d%s%02d%s%02d, xrefs: 00007FF6D9FE3236, 00007FF6D9FEE5C9
%02d%s%02d%s, xrefs: 00007FF6D9FEE799
, xrefs: 00007FF6D9FEE718
HH:mm:ss t, xrefs: 00007FF6D9FEE629
$P$G, xrefs: 00007FF6D9FE3147

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Time$File$System$FormatInfoLocalLocale
String ID: $$P$G$%02d%s%02d%s$%2d%s%02d%s%02d%s%02d$HH:mm:ss t
API String ID: 55602301-2040992447
Opcode ID: 457f9467175a3318a12c9a214969f411ccc9455fcec49b62d1d196d219907895
Instruction ID: 47df092c27fce53cda13b81d827f421cf2b2dece89434b8ea280f768644f1318
Opcode Fuzzy Hash: 457f9467175a3318a12c9a214969f411ccc9455fcec49b62d1d196d219907895
Instruction Fuzzy Hash: AAA1AB32A1C64296EB208F11E4442BE77A5FB84798F500137EE5EC76A5EF7CE564C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DA001538 Relevance: 19.7, APIs: 13, Instructions: 169filememorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6DA001408: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6DA00142A
Part of subcall function 00007FF6DA001408: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6DA00144F

Part of subcall function 00007FF6DA001408: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6DA00146C

SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6DA0015A8
CreateDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6DA0015D1
CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6DA00160B
RtlDosPathNameToNtPathName_U.NTDLL ref: 00007FF6DA001635
memset.MSVCRT ref: 00007FF6DA001677
memmove.MSVCRT ref: 00007FF6DA0016AD
memmove.MSVCRT ref: 00007FF6DA0016E6
NtFsControlFile.NTDLL ref: 00007FF6DA00171D
RtlNtStatusToDosError.NTDLL ref: 00007FF6DA00172F
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6DA00173D
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6DA001754
RtlFreeHeap.NTDLL ref: 00007FF6DA00177F
RemoveDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6DA001797

Part of subcall function 00007FF6DA001A40: memset.MSVCRT ref: 00007FF6DA001AA6
Part of subcall function 00007FF6DA001A40: memset.MSVCRT ref: 00007FF6DA001ACC
Part of subcall function 00007FF6DA001A40: GetVolumePathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6DA001B3E
Part of subcall function 00007FF6DA001A40: GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6DA001B67
Part of subcall function 00007FF6DA001A40: GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6DA001BD7
Part of subcall function 00007FF6DA001A40: _wcsicmp.MSVCRT ref: 00007FF6DA001C05

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Path$ErrorName$Lastmemset$CreateDirectoryFileFullVolumememmove$CloseControlDriveFreeHandleHeapInformationName_RemoveStatusType_wcsicmp
String ID:
API String ID: 3935429995-0
Opcode ID: 2ee110a42e0ffdb27aede9fb5eb1a80379d063d7b2cbba6d0c9e22b52d84b57f
Instruction ID: 238f2db9b075562cd5f5bd4e9adb8fdb6d3843993d465aff564189df4ffbabd4
Opcode Fuzzy Hash: 2ee110a42e0ffdb27aede9fb5eb1a80379d063d7b2cbba6d0c9e22b52d84b57f
Instruction Fuzzy Hash: AF61CE26A1CB9386E7109F22A44467EBBA4FF89F58F058176DE4E83796DF3CD4118704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD35B8 Relevance: 18.2, APIs: 12, Instructions: 214COMMON

Download Yara Rule

APIs

GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FD3620

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: bf4ab2995026e5a4594a7787ae0969c26e7308b7f8ed3652c67194726e000269
Instruction ID: 1cc17bb7c46ceeb5a8d9421dbc1ca6d61a998beeda81222a51e1d5324daf0b9f
Opcode Fuzzy Hash: bf4ab2995026e5a4594a7787ae0969c26e7308b7f8ed3652c67194726e000269
Instruction Fuzzy Hash: 04919E32B0969286EB689F25D8502FD76A0FB89B4DF048136DA4E87794EF3CD559C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FDB0D8 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6D9FDB13F

Part of subcall function 00007FF6D9FDCA40: memset.MSVCRT ref: 00007FF6D9FDCAB3

_get_osfhandle.MSVCRT ref: 00007FF6D9FDB22A
_get_osfhandle.MSVCRT ref: 00007FF6D9FDB241

Part of subcall function 00007FF6D9FE1EA0: wcschr.MSVCRT ref: 00007FF6D9FE1EB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FDB2F7

Strings

DPATH, xrefs: 00007FF6D9FEC078

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: _get_osfhandlememset$wcschr
String ID: DPATH
API String ID: 3260997497-2010427443
Opcode ID: 30e79d6667bfef039a896905d814ad25378bb9efaa9bcaf331d36dbb6943df02
Instruction ID: d727f5628f68ddbf2ecaae8dc6578251eab355fec7691eabfd0bf073dcff234f
Opcode Fuzzy Hash: 30e79d6667bfef039a896905d814ad25378bb9efaa9bcaf331d36dbb6943df02
Instruction Fuzzy Hash: DCD1A032A0864286EB25AF65D8401BD63A2FF85BA9F444237DA1EC77D5DF3CE865C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE7FF8 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 87filenativeCOMMON

Download Yara Rule

APIs

RtlDosPathNameToRelativeNtPathName_U_WithStatus.NTDLL ref: 00007FF6D9FE802B
NtOpenFile.NTDLL ref: 00007FF6D9FE8092
RtlReleaseRelativeName.NTDLL ref: 00007FF6D9FE80A4
RtlFreeUnicodeString.NTDLL ref: 00007FF6D9FE80B4

Part of subcall function 00007FF6D9FE8114: NtQueryVolumeInformationFile.NTDLL ref: 00007FF6D9FE8151

CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6D9FE80E2
NtSetInformationFile.NTDLL ref: 00007FF6D9FF0327
DeleteFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FF0342
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FF0356

Strings

@P, xrefs: 00007FF6D9FE805E

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: File$InformationNamePathRelative$CloseDeleteErrorFreeHandleLastName_OpenQueryReleaseStatusStringUnicodeVolumeWith
String ID: @P
API String ID: 1801357106-3670739982
Opcode ID: a098cbb43c680f3415d79602374c39353e633b648bff1f45cd59ed0b1006156a
Instruction ID: 23cbbb833a618d2ef106117e57870b60db946ff465a3d04516e2b80f1f1b7c69
Opcode Fuzzy Hash: a098cbb43c680f3415d79602374c39353e633b648bff1f45cd59ed0b1006156a
Instruction Fuzzy Hash: 46417C32B08A42DBE7209F61D4503ED7BA4FB8974CF848232DA1D93A88DF78D558C744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD2220 Relevance: 15.4, APIs: 10, Instructions: 368COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6D9FD2287
memset.MSVCRT ref: 00007FF6D9FD22AD
memset.MSVCRT ref: 00007FF6D9FD22D3
memset.MSVCRT ref: 00007FF6D9FD22F9

Part of subcall function 00007FF6D9FDCA40: memset.MSVCRT ref: 00007FF6D9FDCAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD23F6
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD2415
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD2434
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD2453

Part of subcall function 00007FF6D9FD2618: GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,00008000,00007FF6D9FD2397), ref: 00007FF6D9FD2666

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: memset$BufferConsoleInfoScreen
String ID:
API String ID: 1034426908-0
Opcode ID: 2d5ade14f79c77d004b43372fe25f46a3d97144d660a0eedcb7f27a731b6732b
Instruction ID: af7684d92fa57c8c5bee614b42eab99f4c005eec601db62b00655e8e2513e334
Opcode Fuzzy Hash: 2d5ade14f79c77d004b43372fe25f46a3d97144d660a0eedcb7f27a731b6732b
Instruction Fuzzy Hash: FFF18C32A087828AEB64DF22D8506ED77A4FF85788F448136DA4E8B795DF3CE564C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE823C Relevance: 15.1, APIs: 10, Instructions: 116COMMON

Download Yara Rule

APIs

FindFirstFileExW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FE8280
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FE829D

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: 11074d3c224ce67514852d4966aba4998422fc44b58f31243b65843f6fe49b86
Instruction ID: a8cd783741c2d5668ff0179758f1380e7d0983fd24edbe9c7158b619065a6f08
Opcode Fuzzy Hash: 11074d3c224ce67514852d4966aba4998422fc44b58f31243b65843f6fe49b86
Instruction Fuzzy Hash: E4513E36A0DB42CAE7119F12E4841BD7BA4FB4AB95F548572CA1DC3391DF3CE4648704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FFAC4C Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 194registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6D9FFAD67
RegCreateKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6D9FFADF0
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6D9FFAE17
RegSetValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6D9FFAE94
RegDeleteValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6D9FFAED1
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6D9FFAEFA

Strings

\Shell\Open\Command, xrefs: 00007FF6D9FFAD12
%s=%s, xrefs: 00007FF6D9FFAEA9

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: CloseValue$CreateDeleteOpen
String ID: %s=%s$\Shell\Open\Command
API String ID: 4081037667-3301834661
Opcode ID: cca4a14b3588188b9bfe3025cf43e35c39970c82599c4534055a3dd81e0db7f2
Instruction ID: 3321148be1438badfd27e5f63bb87c90f69ed5f450276a516ebce97baf617c28
Opcode Fuzzy Hash: cca4a14b3588188b9bfe3025cf43e35c39970c82599c4534055a3dd81e0db7f2
Instruction Fuzzy Hash: 7871D672B0974282EB218F66A4502BDA2A5FFC5798F444132DE4E87B94EF7CE569C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FFAA30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 123registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6D9FFAA85
RegSetValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6D9FFAACF
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6D9FFAAEC
RegDeleteKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FF6D9FF98C0), ref: 00007FF6D9FFAB39
RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FF6D9FF98C0), ref: 00007FF6D9FFAB6F
RegDeleteValueW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FF6D9FF98C0), ref: 00007FF6D9FFABA4
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00007FF6D9FF98C0), ref: 00007FF6D9FFABCB

Strings

%s=%s, xrefs: 00007FF6D9FFAB02

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: CloseDeleteValue$CreateOpen
String ID: %s=%s
API String ID: 1019019434-1087296587
Opcode ID: c4aa14512d763a8ddc045357bcc46d2d458d72264caee2155a35efe21365b1f8
Instruction ID: 9562dc94b677e974d08713e308719016bc9564a0ae7e2942eb66624e75eda97f
Opcode Fuzzy Hash: c4aa14512d763a8ddc045357bcc46d2d458d72264caee2155a35efe21365b1f8
Instruction Fuzzy Hash: 8D51A232B08B8286E7608F25A4447AE7AA5FBCA794F408236CB5DC3795EF3CD465C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD1884 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 380COMMON

Download Yara Rule

APIs

wcsrchr.MSVCRT ref: 00007FF6D9FD194E
_wcsnicmp.MSVCRT ref: 00007FF6D9FD19A1
wcsrchr.MSVCRT ref: 00007FF6D9FD1A1D
_wcsnicmp.MSVCRT ref: 00007FF6D9FD1A75

Strings

COPYCMD, xrefs: 00007FF6D9FD192B, 00007FF6D9FD19F9

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: _wcsnicmpwcsrchr
String ID: COPYCMD
API String ID: 2429825313-3727491224
Opcode ID: 4d82711cc2208d1db92bdbc9a67415b50588ed216ffaf236914d612e0490fdc8
Instruction ID: a2da0af0afda14c5b7756f7752b9acd64b25f117cbf47543d220f76a197b24d7
Opcode Fuzzy Hash: 4d82711cc2208d1db92bdbc9a67415b50588ed216ffaf236914d612e0490fdc8
Instruction Fuzzy Hash: AFF19C32F086528AFB649F61D0402BD36A5EB84B9CF144237DE5EA77D4EE3CA469C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD4A30 Relevance: 10.8, APIs: 7, Instructions: 318COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6D9FD4A87

Part of subcall function 00007FF6D9FDCA40: memset.MSVCRT ref: 00007FF6D9FDCAB3

wcsrchr.MSVCRT ref: 00007FF6D9FD4B19
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FD4B83
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD4BDD

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: memset$FullNamePathwcsrchr
String ID:
API String ID: 4289998964-0
Opcode ID: a80d012484cbdcca0ca620b8a14734abd8c46742d7c15bd51813b886838a5470
Instruction ID: bca4fd48ae26cd90cc44582056a4695a6591cb5b01c6a85b480ab42077b7c3f3
Opcode Fuzzy Hash: a80d012484cbdcca0ca620b8a14734abd8c46742d7c15bd51813b886838a5470
Instruction Fuzzy Hash: ACC1A022B0D75A82EAA49F5695483BD67A0FF95B98F005532CE1E877D0EF3CA4B5C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FFBCF0 Relevance: 10.6, APIs: 7, Instructions: 52filenativeCOMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6D9FFBD2C
fflush.MSVCRT ref: 00007FF6D9FFBD45
TryAcquireSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6D9FFBD62
NtCancelSynchronousIoFile.NTDLL ref: 00007FF6D9FFBD80
ReleaseSRWLockExclusive.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6D9FFBD93
_get_osfhandle.MSVCRT ref: 00007FF6D9FFBDB5
FlushConsoleInputBuffer.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF6D9FFBDC4

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: ExclusiveLock$AcquireBufferCancelConsoleFileFlushInputReleaseSynchronous_get_osfhandlefflushfprintf
String ID:
API String ID: 3476366620-0
Opcode ID: e80667afc0d4efceb6aef25f833a3d837a8fcd408026498b2919174857c48976
Instruction ID: 122b9ab0cfba4a31ff40e52bba766105a6feb735d79959c54349ec7577bec531
Opcode Fuzzy Hash: e80667afc0d4efceb6aef25f833a3d837a8fcd408026498b2919174857c48976
Instruction Fuzzy Hash: EA21122090CA4396FA246F21E4152BC6755FF4AB5EF8452B7CA5EC32E2DF3CA468C705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD3D94 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110nativeCOMMON

Download Yara Rule

APIs

_setjmp.MSVCRT ref: 00007FF6D9FD3DD4

Part of subcall function 00007FF6D9FE417C: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6D9FE41AD

Part of subcall function 00007FF6D9FD1884: wcsrchr.MSVCRT ref: 00007FF6D9FD194E
Part of subcall function 00007FF6D9FD1884: _wcsnicmp.MSVCRT ref: 00007FF6D9FD19A1

NtQueryInformationProcess.NTDLL ref: 00007FF6D9FD3E9C
NtSetInformationProcess.NTDLL ref: 00007FF6D9FD3EC9
NtSetInformationProcess.NTDLL ref: 00007FF6D9FD3F4D

Strings

%9d, xrefs: 00007FF6D9FD3EF9

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: InformationProcess$CurrentDirectoryQuery_setjmp_wcsnicmpwcsrchr
String ID: %9d
API String ID: 1006866328-2241623522
Opcode ID: 49dbeeece98ca2af395b5421f0eabdee3e715f5a42a247bfbbf55fa9d0e8537f
Instruction ID: fc4f7c44447772a0e19306f8b4b7d70b1b7c727c2bfc15e2a306d4f0e0b6d1a3
Opcode Fuzzy Hash: 49dbeeece98ca2af395b5421f0eabdee3e715f5a42a247bfbbf55fa9d0e8537f
Instruction Fuzzy Hash: C0511972A086438AE7109F21E8805BD3BA4FB4476CF804676DA6DD77A6CF7CE564CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD8DF8 Relevance: 7.8, APIs: 5, Instructions: 281COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6D9FD8E6D
memset.MSVCRT ref: 00007FF6D9FD8E93

Part of subcall function 00007FF6D9FDCA40: memset.MSVCRT ref: 00007FF6D9FDCAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD8F9A
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD8FBC

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 7160d99242a1669725aef99eaef69d89578f29fe8c66c0003e2744a279b5bca3
Instruction ID: 3ec529576260d6779b1a5a96d26e6141067aaa1c32ad2c20d7b718e105e1d168
Opcode Fuzzy Hash: 7160d99242a1669725aef99eaef69d89578f29fe8c66c0003e2744a279b5bca3
Instruction Fuzzy Hash: A9C1E022A0978286EB61DF21E890AFD33A4FFD5798F044536DA1D877A5DF3CE5A18300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD9B50 Relevance: 7.8, APIs: 5, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 2e7a924b57887036cda351d50a900b3fc87ff6663746bd4f5c61131fe866968e
Instruction ID: ea0251f8964e286d178e76dd88724dedf93f3fcf5d1b2c9adc03729cce80e354
Opcode Fuzzy Hash: 2e7a924b57887036cda351d50a900b3fc87ff6663746bd4f5c61131fe866968e
Instruction Fuzzy Hash: E5A1BF22A1D65382EB609F66A4916BE76A1FF88B84F404137DE4EC7B91DF3CE461C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FFFB54 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6D9FFFBC1

Part of subcall function 00007FF6D9FDCA40: memset.MSVCRT ref: 00007FF6D9FDCAB3

GetDiskFreeSpaceExW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FFFC58
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FFFD01

Strings

%5lu, xrefs: 00007FF6D9FFFCB0

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: memset$DiskFreeSpace
String ID: %5lu
API String ID: 2448137811-2100233843
Opcode ID: 91b9902f1ee4f2c69dd88f1cc13d7b02493769e4bbf5f2682aca5e24acde37c3
Instruction ID: edc9f8eecfb3b5d531d2fca324abab8e5e73f1b7cf1a254bdab01bb3a7c3a977
Opcode Fuzzy Hash: 91b9902f1ee4f2c69dd88f1cc13d7b02493769e4bbf5f2682aca5e24acde37c3
Instruction Fuzzy Hash: B9416F66708AC286EB61DF61E8446EE7361FB84788F448036EA4D8BB59DF7CD259C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FDD250 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 187COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 00007FF6D9FDD292

Strings

GeToken: (%x) '%s', xrefs: 00007FF6D9FED0C8

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: _wcsicmp
String ID: GeToken: (%x) '%s'
API String ID: 2081463915-1994581435
Opcode ID: 6e4c5c6b6d185140ca64f330d229c4bae651b3bc3ca60c47b554df0f6da724cf
Instruction ID: 0b62b998714b12f459cb80483fe0b885c74c313adbf5af2a0b182e4f5d4786b1
Opcode Fuzzy Hash: 6e4c5c6b6d185140ca64f330d229c4bae651b3bc3ca60c47b554df0f6da724cf
Instruction Fuzzy Hash: 1E718A21E0C74385FB64AF25A8442BD36A0AF91758F94467BD50EC7BE2EF7CB4A18701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD81D4 Relevance: 4.8, APIs: 3, Instructions: 299COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 00007FF6D9FD826E
wcschr.MSVCRT ref: 00007FF6D9FD8289

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: wcschr
String ID:
API String ID: 1497570035-0
Opcode ID: 953991e5515e9720921bfd82a5a30b3c869f8d800aebf2b352ed82d5cf5886c3
Instruction ID: bdf77066e8b96b062c5202ea020969b60e6c78d928af59e2fe0a4ada225d27ad
Opcode Fuzzy Hash: 953991e5515e9720921bfd82a5a30b3c869f8d800aebf2b352ed82d5cf5886c3
Instruction Fuzzy Hash: 52C1E422A0D68386EA54AF16A4502BD67A0FFC5798F084537EA5EC77D6EF3CE4608700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FF7B4C Relevance: 4.8, APIs: 3, Instructions: 269fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FF7CE2
FindNextFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FF7E92
FindClose.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FF7EB0

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 565e35bf3077f6e5330a4c685e4702854ac746395b3091a84d0a46ce28e859e6
Instruction ID: f2fd06483cc5d0069e62538f3fcd03786e6969ea51ef4bef5be0e97732ac5b88
Opcode Fuzzy Hash: 565e35bf3077f6e5330a4c685e4702854ac746395b3091a84d0a46ce28e859e6
Instruction Fuzzy Hash: 56A13561B1839241EE649F6694142BEA291EF45BE8F444337EEAEC77C4EE3CE465C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD6BE0 Relevance: 4.7, APIs: 3, Instructions: 184COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D9FDCD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6D9FDB9A1,?,?,?,?,00007FF6D9FDD81A), ref: 00007FF6D9FDCDA6
Part of subcall function 00007FF6D9FDCD90: RtlAllocateHeap.NTDLL(?,?,?,00007FF6D9FDB9A1,?,?,?,?,00007FF6D9FDD81A), ref: 00007FF6D9FDCDBD

_pipe.MSVCRT ref: 00007FF6D9FD6C1E

Part of subcall function 00007FF6D9FDAFFC: _dup.MSVCRT ref: 00007FF6D9FDB004

Part of subcall function 00007FF6D9FDB038: _dup2.MSVCRT ref: 00007FF6D9FDB04D

_get_osfhandle.MSVCRT ref: 00007FF6D9FD6CD1
DuplicateHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6D9FD6CFB

Part of subcall function 00007FF6D9FDB998: memset.MSVCRT ref: 00007FF6D9FDBA2B
Part of subcall function 00007FF6D9FDB998: wcschr.MSVCRT ref: 00007FF6D9FDBA8A
Part of subcall function 00007FF6D9FDB998: wcschr.MSVCRT ref: 00007FF6D9FDBAAA
Part of subcall function 00007FF6D9FDB998: _wcsicmp.MSVCRT ref: 00007FF6D9FDBB2C

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Heapwcschr$AllocateDuplicateHandleProcess_dup_dup2_get_osfhandle_pipe_wcsicmpmemset
String ID:
API String ID: 1037144754-0
Opcode ID: 5cd10cc880c9efa22f02b238c7b986dae6fee2c2e7af1ecbe2869c05f18fdff7
Instruction ID: e7dc20f6c5d2e33bd0281b056e18d8551adaa181abc40c1a00519117d7803cd6
Opcode Fuzzy Hash: 5cd10cc880c9efa22f02b238c7b986dae6fee2c2e7af1ecbe2869c05f18fdff7
Instruction Fuzzy Hash: F4718C31A0864287E754AF25D8440BC76A2FF89768F14823ADA5DDB3E6DF3CE861C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FF63FC Relevance: 4.7, APIs: 3, Instructions: 179threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6D9FF64FD
IsDebuggerPresent.API-MS-WIN-CORE-DEBUG-L1-1-0 ref: 00007FF6D9FF65F5
OutputDebugStringW.API-MS-WIN-CORE-DEBUG-L1-1-0 ref: 00007FF6D9FF666F

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: CurrentDebugDebuggerOutputPresentStringThread
String ID:
API String ID: 4268342597-0
Opcode ID: dd079414f8549339cb4fded4247a4dbae90aea18fcb15bc8c39707241a1b23ff
Instruction ID: 3f7d65b4a241f8098224024250ef272c863ec2e6babe9310c9a605fba595121c
Opcode Fuzzy Hash: dd079414f8549339cb4fded4247a4dbae90aea18fcb15bc8c39707241a1b23ff
Instruction Fuzzy Hash: BD813922A0CB8681EB659F26A44423D77A4FB49B88F18417BCE4D877A5DF3CE469C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE7854 Relevance: 3.3, APIs: 2, Instructions: 296COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6D9FE790B

Part of subcall function 00007FF6D9FDCA40: memset.MSVCRT ref: 00007FF6D9FDCAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FE7B79

Part of subcall function 00007FF6D9FE823C: FindFirstFileExW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FE8280
Part of subcall function 00007FF6D9FE823C: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FE829D

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: memset$ErrorFileFindFirstLast
String ID:
API String ID: 2831795651-0
Opcode ID: 638df73a00ca543e65087d6208835b8c015977170cf38772a4d9fd7cf800cb00
Instruction ID: 612993a8cfce6be3f6c5fe91a84b652bc38415072fefdb437428262a0120a7ed
Opcode Fuzzy Hash: 638df73a00ca543e65087d6208835b8c015977170cf38772a4d9fd7cf800cb00
Instruction Fuzzy Hash: 47D1C276A0868286EB64DF25E4502BE77A1FB84B98F105136DE8EC7798DF3CE561C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD7D30 Relevance: 3.3, APIs: 2, Instructions: 252COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6D9FD7DA1

Part of subcall function 00007FF6D9FDCA40: memset.MSVCRT ref: 00007FF6D9FDCAB3

Part of subcall function 00007FF6D9FE417C: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6D9FE41AD

Part of subcall function 00007FF6D9FDD3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FDD46E
Part of subcall function 00007FF6D9FDD3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FDD485
Part of subcall function 00007FF6D9FDD3F0: wcschr.MSVCRT ref: 00007FF6D9FDD4EE
Part of subcall function 00007FF6D9FDD3F0: iswspace.MSVCRT ref: 00007FF6D9FDD54D
Part of subcall function 00007FF6D9FDD3F0: wcschr.MSVCRT ref: 00007FF6D9FDD569
Part of subcall function 00007FF6D9FDD3F0: wcschr.MSVCRT ref: 00007FF6D9FDD58C

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD7EB7

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: wcschr$Heapmemset$AllocCurrentDirectoryProcessiswspace
String ID:
API String ID: 168394030-0
Opcode ID: 0e98079df390ebc712ea752efcb5069782c59026a64ae7b96eff119acfe59c53
Instruction ID: 5a6bae3cd46eade2d51230de0c3112bc2752b3db1bac1bb3706a704ae89a33b1
Opcode Fuzzy Hash: 0e98079df390ebc712ea752efcb5069782c59026a64ae7b96eff119acfe59c53
Instruction Fuzzy Hash: D7A1A161B1C68385FB64DF2698502BE23A1BF85788F444136DA5EC7BE5DF3CE8658700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE8114 Relevance: 3.0, APIs: 2, Instructions: 41filenativeCOMMON

Download Yara Rule

APIs

NtQueryVolumeInformationFile.NTDLL ref: 00007FF6D9FE8151
GetFileInformationByHandleEx.API-MS-WIN-CORE-FILE-L2-1-0 ref: 00007FF6D9FF037C

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: FileInformation$HandleQueryVolume
String ID:
API String ID: 2149833895-0
Opcode ID: 625d3b3e026192d6aa05ab746e3d747582aa1c91c48dbe730e9190b973acbc48
Instruction ID: 8f3c46e3f58cf5234f72623df677c71e4898006d8b7bad8f9239bd644fac7511
Opcode Fuzzy Hash: 625d3b3e026192d6aa05ab746e3d747582aa1c91c48dbe730e9190b973acbc48
Instruction Fuzzy Hash: B011513260C6C286E7609F51F4447AEB7A0FB44B48F445532DA9D83A55DFBCD458DB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD8510 Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D9FDD3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FDD46E
Part of subcall function 00007FF6D9FDD3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FDD485
Part of subcall function 00007FF6D9FDD3F0: wcschr.MSVCRT ref: 00007FF6D9FDD4EE
Part of subcall function 00007FF6D9FDD3F0: iswspace.MSVCRT ref: 00007FF6D9FDD54D
Part of subcall function 00007FF6D9FDD3F0: wcschr.MSVCRT ref: 00007FF6D9FDD569
Part of subcall function 00007FF6D9FDD3F0: wcschr.MSVCRT ref: 00007FF6D9FDD58C

towupper.MSVCRT ref: 00007FF6D9FD85D4

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: wcschr$Heap$AllocProcessiswspacetowupper
String ID:
API String ID: 3520273530-0
Opcode ID: 35085f02699a6dda62df14e5b2a3ae78ae89d6808dccd4382872d68b1f214e0d
Instruction ID: b7c4d31f9e074d67d3f8d63d62ff2b466fa4b4a688129546a019375c28b31bd6
Opcode Fuzzy Hash: 35085f02699a6dda62df14e5b2a3ae78ae89d6808dccd4382872d68b1f214e0d
Instruction Fuzzy Hash: 8661BC22A0C24286F7A59F25E50537D36A0FF85768F448537EA1ED73D5DF3CA8A48311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE93B0 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FE93BB

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: eff4557ae00fe4591a940a5480948ed29a826f3915cdbc5be4334919315eb20c
Instruction ID: 7533ae83e10c953f1786cb085b85f09b2cb3280889912df47a488510ae95c1cc
Opcode Fuzzy Hash: eff4557ae00fe4591a940a5480948ed29a826f3915cdbc5be4334919315eb20c
Instruction Fuzzy Hash: B9B01250F2A403D1D609AF32DC8506912A47F5C711FC00473C00EC2170DE1C92FBC700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE02A0 Relevance: 35.3, APIs: 13, Strings: 7, Instructions: 279COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 00007FF6D9FE02C2
_wcsicmp.MSVCRT ref: 00007FF6D9FE02E4
_wcsicmp.MSVCRT ref: 00007FF6D9FE0306
_wcsicmp.MSVCRT ref: 00007FF6D9FE0328
_wcsicmp.MSVCRT ref: 00007FF6D9FE034A
_wcsicmp.MSVCRT ref: 00007FF6D9FE0368
_wcsicmp.MSVCRT ref: 00007FF6D9FE6CF2
_wcsicmp.MSVCRT ref: 00007FF6D9FE6D61
_wcsicmp.MSVCRT ref: 00007FF6D9FE6D7F
_wcsicmp.MSVCRT ref: 00007FF6D9FE6D9D
_wcsicmp.MSVCRT ref: 00007FF6D9FE6DBB
iswspace.MSVCRT ref: 00007FF6D9FE6E01
wcschr.MSVCRT ref: 00007FF6D9FE6E2C

Strings

;, xrefs: 00007FF6D9FE03FD
IF/?, xrefs: 00007FF6D9FE0321
REM/?, xrefs: 00007FF6D9FE0361
FOR, xrefs: 00007FF6D9FE02BB
FOR/?, xrefs: 00007FF6D9FE02DD, 00007FF6D9FE6CE9
=,;, xrefs: 00007FF6D9FE6E1C
REM, xrefs: 00007FF6D9FE0343

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: _wcsicmp$iswspacewcschr
String ID: ;$=,;$FOR$FOR/?$IF/?$REM$REM/?
API String ID: 840959033-3627297882
Opcode ID: 90d0da749b6f36b650c7a119ec94b7cfa78334432448a2a31f5fb3e9199c4a7d
Instruction ID: 194ec4057355aad493aef35bfaf5f4c807b6c5a531e7d194b2b6b18e0da6f111
Opcode Fuzzy Hash: 90d0da749b6f36b650c7a119ec94b7cfa78334432448a2a31f5fb3e9199c4a7d
Instruction Fuzzy Hash: F4D15B21E0C64386FB20AF21E8452BD36A4FF85B48F985077DA4EC72A6DF3CE4258715

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE081C Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 130COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6D9FE084E
_wcsicmp.MSVCRT ref: 00007FF6D9FE088E
_wcsicmp.MSVCRT ref: 00007FF6D9FE08AC
_wcsicmp.MSVCRT ref: 00007FF6D9FE08CA
_wcsicmp.MSVCRT ref: 00007FF6D9FE08E8
_wcsicmp.MSVCRT ref: 00007FF6D9FE0906
_wcsicmp.MSVCRT ref: 00007FF6D9FE0924
_wcsicmp.MSVCRT ref: 00007FF6D9FE093E
_wcsicmp.MSVCRT ref: 00007FF6D9FE095C

Strings

DATE, xrefs: 00007FF6D9FE08FC
CMDEXTVERSION, xrefs: 00007FF6D9FE08C0
RANDOM, xrefs: 00007FF6D9FE0934
CMDCMDLINE, xrefs: 00007FF6D9FE08DE
TIME, xrefs: 00007FF6D9FE091A
ERRORLEVEL, xrefs: 00007FF6D9FE08A2
HIGHESTNUMANODENUMBER, xrefs: 00007FF6D9FE0952
$P$G, xrefs: 00007FF6D9FE0835

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: _wcsicmp$EnvironmentVariable
String ID: $P$G$CMDCMDLINE$CMDEXTVERSION$DATE$ERRORLEVEL$HIGHESTNUMANODENUMBER$RANDOM$TIME
API String ID: 198002717-3447537567
Opcode ID: 86cb16d536f244c24baf619aaa5ba530f3c61f8a6c087709382502a2cbb2fdc2
Instruction ID: 30954083d0a5a06d1e81373195f9564e4a47889057cb75597c4af662173219a0
Opcode Fuzzy Hash: 86cb16d536f244c24baf619aaa5ba530f3c61f8a6c087709382502a2cbb2fdc2
Instruction Fuzzy Hash: 27511E25A0C74386F6205F12A81027DBBA4FF49B89F48A177DA4EC3756DF3CE1648749

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FDD3F0 Relevance: 31.8, APIs: 16, Strings: 2, Instructions: 310memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FDD46E
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FDD485
wcschr.MSVCRT ref: 00007FF6D9FDD4EE
iswspace.MSVCRT ref: 00007FF6D9FDD54D
wcschr.MSVCRT ref: 00007FF6D9FDD569
wcschr.MSVCRT ref: 00007FF6D9FDD58C
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FDD5EE
HeapReAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FDD605
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FDD61F
HeapSize.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FDD633

Strings

", xrefs: 00007FF6D9FDD5AB
=,;, xrefs: 00007FF6D9FDD4D0

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Heap$Processwcschr$Alloc$Sizeiswspace
String ID: "$=,;
API String ID: 3545743878-4143597401
Opcode ID: d71805be19a967498954a19d1c0bc42ca998deadd3f79298ca6fff5ee8fe42de
Instruction ID: fd16281784b4d3ffa7f61485c6ae44fa461103501428766cf3a07f3acca7e63f
Opcode Fuzzy Hash: d71805be19a967498954a19d1c0bc42ca998deadd3f79298ca6fff5ee8fe42de
Instruction Fuzzy Hash: BBC19C62A0D79282EB255F11D0003BD76E1FF89F48F459276DE5E83B94EF3CA465C201

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FF5BF4 Relevance: 26.4, APIs: 2, Strings: 13, Instructions: 153windowthreadCOMMON

Download Yara Rule

APIs

FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6D9FF5CD5
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6D9FF5D54

Strings

%hs(%u)\%hs!%p: , xrefs: 00007FF6D9FF5D01
%hs(%d) tid(%x) %08X %ws, xrefs: 00007FF6D9FF5D6D
ReturnHr, xrefs: 00007FF6D9FF5C97
[%hs(%hs)], xrefs: 00007FF6D9FF5E04
[%hs], xrefs: 00007FF6D9FF5E1D
LogHr, xrefs: 00007FF6D9FF5C8E
CallContext:[%hs] , xrefs: 00007FF6D9FF5DDD
(caller: %p) , xrefs: 00007FF6D9FF5D3F
, xrefs: 00007FF6D9FF5DA7
%hs!%p: , xrefs: 00007FF6D9FF5D1F
Msg:[%ws] , xrefs: 00007FF6D9FF5DC2
Exception, xrefs: 00007FF6D9FF5CA0
FailFast, xrefs: 00007FF6D9FF5C85

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: CurrentFormatMessageThread
String ID: $%hs!%p: $%hs(%d) tid(%x) %08X %ws$%hs(%u)\%hs!%p: $(caller: %p) $CallContext:[%hs] $Exception$FailFast$LogHr$Msg:[%ws] $ReturnHr$[%hs(%hs)]$[%hs]
API String ID: 2411632146-3173542853
Opcode ID: fb2fb1c3bf230b004cc3ce09a0c69924bb125e2a6cca917ccdca682aa570422a
Instruction ID: 3b5072e2030e418310c182287efad40cf5e207d73bd22a043a0003f0cd0eae49
Opcode Fuzzy Hash: fb2fb1c3bf230b004cc3ce09a0c69924bb125e2a6cca917ccdca682aa570422a
Instruction Fuzzy Hash: 2B617861A1DB4281EA24DFA2A4045BD67A4FF48B8CF44413BDE0D97B69DF3CE668C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE26E0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 187fileCOMMON

Download Yara Rule

APIs

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FE277D
_open_osfhandle.MSVCRT ref: 00007FF6D9FE279E

Strings

con, xrefs: 00007FF6D9FE27EF

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: CreateFile_open_osfhandle
String ID: con
API String ID: 2905481843-4257191772
Opcode ID: 6867a702499016eaea53a9a4f878e431644baeefb259e0b43649b3c41a2578e5
Instruction ID: cf16c7acc25877da3c2cbff80538116d82d3c979b89b62572cae0e244fb61470
Opcode Fuzzy Hash: 6867a702499016eaea53a9a4f878e431644baeefb259e0b43649b3c41a2578e5
Instruction Fuzzy Hash: 1371A432A0C6828AE7218F15E4406BDBAA4FB89B65F544236DE6EC37D4DF3CD459CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FF93E8 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D9FE33A8: iswspace.MSVCRT ref: 00007FF6D9FE33C0

wcsrchr.MSVCRT ref: 00007FF6D9FF9465

Part of subcall function 00007FF6D9FE9158: RtlCaptureContext.NTDLL ref: 00007FF6D9FE9163
Part of subcall function 00007FF6D9FE9158: RtlLookupFunctionEntry.NTDLL ref: 00007FF6D9FE9182
Part of subcall function 00007FF6D9FE9158: RtlVirtualUnwind.NTDLL ref: 00007FF6D9FE91CF
Part of subcall function 00007FF6D9FE9158: __raise_securityfailure.LIBCMT ref: 00007FF6D9FE9245

wcschr.MSVCRT ref: 00007FF6D9FF9486
wcsrchr.MSVCRT ref: 00007FF6D9FF94C1
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6D9FF94E5
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF6D9FF94FC
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF6D9FF9519
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6D9FF952A
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF6D9FF9541
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF6D9FF955E
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6D9FF9587
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF6D9FF95E1
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF6D9FF95FD

Strings

, xrefs: 00007FF6D9FF95BA

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: ConsoleMode$Handle$wcsrchr$CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailureiswspacewcschr
String ID:
API String ID: 3829876242-3916222277
Opcode ID: c372b69739eb2f0c12a22be7621393de33855a61faa155eebe16cc32798ef8d9
Instruction ID: 2357e1fad17bd7b61555ca4b4c7cf4136f690f193074bd8d2d24e31c51291f89
Opcode Fuzzy Hash: c372b69739eb2f0c12a22be7621393de33855a61faa155eebe16cc32798ef8d9
Instruction Fuzzy Hash: 5761C436A0864287EA259F12D40427E77A4FFC9B98F498136DE0E87795DF3CE858CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DA001A40 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 148COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6DA001AA6
memset.MSVCRT ref: 00007FF6DA001ACC

Part of subcall function 00007FF6D9FDCA40: memset.MSVCRT ref: 00007FF6D9FDCAB3

GetVolumePathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6DA001B3E
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6DA001B67
GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6DA001BD7
_wcsicmp.MSVCRT ref: 00007FF6DA001C05
_wcsicmp.MSVCRT ref: 00007FF6DA001C34
_wcsicmp.MSVCRT ref: 00007FF6DA001C63
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6DA001C89
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6DA001CA9

Strings

CSVFS, xrefs: 00007FF6DA001C58
NTFS, xrefs: 00007FF6DA001BFA
REFS, xrefs: 00007FF6DA001C29

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: _wcsicmpmemset$Volume$DriveInformationNamePathType
String ID: CSVFS$NTFS$REFS
API String ID: 3510147486-2605508654
Opcode ID: 25656f9dd7156011cddd26e1f63935c756ad3329fe6ff4f37f6319205113c483
Instruction ID: 0c31d9ff629a9b95f861f58390ffa597f0e5f7873d061f6a976f3b116cf6d280
Opcode Fuzzy Hash: 25656f9dd7156011cddd26e1f63935c756ad3329fe6ff4f37f6319205113c483
Instruction Fuzzy Hash: EA616B32708BC28AEB618F22D8447E977A4FB49B88F458076CA0D8B799DF7CD254C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD72B0 Relevance: 21.3, APIs: 1, Strings: 11, Instructions: 283COMMON

Download Yara Rule

APIs

longjmp.MSVCRT(?,00000000,00000000,00007FF6D9FD7279,?,?,?,?,?,00007FF6D9FDBFA9), ref: 00007FF6D9FF4485

Strings

FOR /?, xrefs: 00007FF6D9FF4654
== , xrefs: 00007FF6D9FF4765
EQU , xrefs: 00007FF6D9FF477D
FOR, xrefs: 00007FF6D9FF4535
GTR , xrefs: 00007FF6D9FF47B5
LEQ , xrefs: 00007FF6D9FF47A7
LSS , xrefs: 00007FF6D9FF4799
NEQ , xrefs: 00007FF6D9FF478B
REM /?, xrefs: 00007FF6D9FF4678
GEQ , xrefs: 00007FF6D9FF47C1
IF /?, xrefs: 00007FF6D9FF4664

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: longjmp
String ID: == $EQU $FOR$FOR /?$GEQ $GTR $IF /?$LEQ $LSS $NEQ $REM /?
API String ID: 1832741078-366822981
Opcode ID: 33da1405c176275929384e71d7b709e1d480dac8859b2aca32cf24daa89c1558
Instruction ID: df85b5cfc8ec1461b48c8b006d96b4e2a1222388ecd85bdb895deace925e40f4
Opcode Fuzzy Hash: 33da1405c176275929384e71d7b709e1d480dac8859b2aca32cf24daa89c1558
Instruction Fuzzy Hash: 75C1BE61E0C68381E728DF1691986BC2392AF86B8CF944037DD4DDB792CF2DE56AC300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FDB998 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 275COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D9FDCD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6D9FDB9A1,?,?,?,?,00007FF6D9FDD81A), ref: 00007FF6D9FDCDA6
Part of subcall function 00007FF6D9FDCD90: RtlAllocateHeap.NTDLL(?,?,?,00007FF6D9FDB9A1,?,?,?,?,00007FF6D9FDD81A), ref: 00007FF6D9FDCDBD

memset.MSVCRT ref: 00007FF6D9FDBA2B
wcschr.MSVCRT ref: 00007FF6D9FDBA8A
wcschr.MSVCRT ref: 00007FF6D9FDBAAA

Strings

=,;+/[] ", xrefs: 00007FF6D9FDBA83
-, xrefs: 00007FF6D9FEC3EA
=,;, xrefs: 00007FF6D9FDBC9C
:.\, xrefs: 00007FF6D9FDBAA3

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Heapwcschr$AllocateProcessmemset
String ID: -$:.\$=,;$=,;+/[] "
API String ID: 2060774286-969133440
Opcode ID: e048727378a3460f555082e81c55544313692faeaf2a868744a414ec58a8adda
Instruction ID: 33be51137617a514abec0e3931cf3dac171cfe40fbcd5470036dc4d93656242d
Opcode Fuzzy Hash: e048727378a3460f555082e81c55544313692faeaf2a868744a414ec58a8adda
Instruction Fuzzy Hash: BDB1B122A0DB8285FA709F15948427D63A1FF88BA5F954237DA5EC37E4DF3CE8658300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DA0003AC Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 219COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6DA000411
memset.MSVCRT ref: 00007FF6DA000436
memset.MSVCRT ref: 00007FF6DA000459

Part of subcall function 00007FF6D9FDCA40: memset.MSVCRT ref: 00007FF6D9FDCAB3

GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6DA000590
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6DA0005A0
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6DA0005BB
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6DA0006F3
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6DA000712
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6DA000731

Strings

%04X-%04X, xrefs: 00007FF6DA000698
~, xrefs: 00007FF6DA00046D

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: memset$ErrorLast$InformationVolume
String ID: %04X-%04X$~
API String ID: 2748242238-2468825380
Opcode ID: 781cf90ddf0ffbbdddcc98e6ef54cce46e5ed54377f9fc63b4e3b7b6eb5e65df
Instruction ID: aefe37b432cfd61211d548dc33c4736f1579fd40d377230350cad07d3bedd5eb
Opcode Fuzzy Hash: 781cf90ddf0ffbbdddcc98e6ef54cce46e5ed54377f9fc63b4e3b7b6eb5e65df
Instruction Fuzzy Hash: C1A19E6270CBC28AEB258F21D8502EE77A5FB85789F408076DA4D8BB99DF3CD655C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE662C Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 170COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 00007FF6D9FE6677
iswdigit.MSVCRT ref: 00007FF6D9FE668F
_errno.MSVCRT ref: 00007FF6D9FE66A3
wcstol.MSVCRT ref: 00007FF6D9FE66C4
iswdigit.MSVCRT ref: 00007FF6D9FE66E4
iswalpha.MSVCRT ref: 00007FF6D9FE66FE

Strings

APerformUnaryOperation: '%c', xrefs: 00007FF6D9FEF78E
+-~!, xrefs: 00007FF6D9FE6670

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: iswdigit$_errnoiswalphawcschrwcstol
String ID: +-~!$APerformUnaryOperation: '%c'
API String ID: 2348642995-441775793
Opcode ID: 3043d5b8b3736d8e68c05dd1a897401147fff5d71c47df5c8b899d9aaf2ce369
Instruction ID: 15de014a05f2bfe88c7af2ae1e3d6536108b3d457b581c387ee5140fc1563fbf
Opcode Fuzzy Hash: 3043d5b8b3736d8e68c05dd1a897401147fff5d71c47df5c8b899d9aaf2ce369
Instruction Fuzzy Hash: 16717872E08A4A86E7615F21D41017DB7A0FB89B98F58C033DA9EC7295EF3CA4A4C715

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD9400 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6D9FD9462
memset.MSVCRT ref: 00007FF6D9FD9485
memset.MSVCRT ref: 00007FF6D9FD94AA

Part of subcall function 00007FF6D9FDCA40: memset.MSVCRT ref: 00007FF6D9FDCAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FEB6A9

Part of subcall function 00007FF6D9FE5EE4: memset.MSVCRT ref: 00007FF6D9FE5F5D
Part of subcall function 00007FF6D9FE5EE4: towupper.MSVCRT ref: 00007FF6D9FE5FFE
Part of subcall function 00007FF6D9FE5EE4: ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FE6029

GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FD95D3
_wcsicmp.MSVCRT ref: 00007FF6D9FD9603
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD963D
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD965C
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FEB67A

Strings

~, xrefs: 00007FF6D9FD94BE
FAT, xrefs: 00007FF6D9FD95F8

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: memset$ErrorInformationLastVolume_wcsicmptowupper
String ID: FAT$~
API String ID: 2238823677-1832570214
Opcode ID: 9870e3df3003cca21a2b5bb6f1f08ea82d43fbeeb1162d01b560e5e2cc2d055c
Instruction ID: e69f74a2c3ccf0a7a9292e08b3b7d20e02b8fc3d03b10c8f019f686e9edaebb7
Opcode Fuzzy Hash: 9870e3df3003cca21a2b5bb6f1f08ea82d43fbeeb1162d01b560e5e2cc2d055c
Instruction Fuzzy Hash: EF716932609BC28AEB318F21D8506EE77A4FB85789F448076DA4D8BB59DF3CD255C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FDD840 Relevance: 18.4, APIs: 12, Instructions: 444memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00000010,?,00000000,0000000E,00000025,?,00007FF6D9FDFE2A), ref: 00007FF6D9FDD884
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00000010,?,00000000,0000000E,00000025,?,00007FF6D9FDFE2A), ref: 00007FF6D9FDD89D
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00000010,?,00000000,0000000E,00000025,?,00007FF6D9FDFE2A), ref: 00007FF6D9FDD94D
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,00000010,?,00000000,0000000E,00000025,?,00007FF6D9FDFE2A), ref: 00007FF6D9FDD964
_wcsnicmp.MSVCRT ref: 00007FF6D9FDDB89
wcstol.MSVCRT ref: 00007FF6D9FDDBDF
wcstol.MSVCRT ref: 00007FF6D9FDDC63
memmove.MSVCRT ref: 00007FF6D9FDDD33
memmove.MSVCRT ref: 00007FF6D9FDDE9A
longjmp.MSVCRT(?,?,?,?,?,?,?,?,?,00000010,?,00000000,0000000E,00000025,?,00007FF6D9FDFE2A), ref: 00007FF6D9FDDF1F

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Heap$AllocProcessmemmovewcstol$_wcsnicmplongjmp
String ID:
API String ID: 1051989028-0
Opcode ID: 9d997d91bc460dae83d081792f82bd463826601465a4caebf3eeed494a632e9a
Instruction ID: 4d50c9e9ca6c9b577cb410cb270607fc960b83e5abea3e21271842d9301cf436
Opcode Fuzzy Hash: 9d997d91bc460dae83d081792f82bd463826601465a4caebf3eeed494a632e9a
Instruction Fuzzy Hash: DE029F72A0DB8282EB249F15E44027E77A5FB85B98F558332DA8D87B94DF3CE061C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD86B0 Relevance: 18.1, APIs: 8, Strings: 4, Instructions: 138memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FD8711
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FD8729
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FD8748
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FD875F
_wcsicmp.MSVCRT ref: 00007FF6D9FD8805
_wcsicmp.MSVCRT ref: 00007FF6D9FD881F
_wcsicmp.MSVCRT ref: 00007FF6D9FD8839

Strings

ENABLEEXTENSIONS, xrefs: 00007FF6D9FD87FB
DISABLEDELAYEDEXPANSION, xrefs: 00007FF6D9FEB366
ENABLEDELAYEDEXPANSION, xrefs: 00007FF6D9FD882F
DISABLEEXTENSIONS, xrefs: 00007FF6D9FD8815

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Heap$_wcsicmp$AllocProcess
String ID: DISABLEDELAYEDEXPANSION$DISABLEEXTENSIONS$ENABLEDELAYEDEXPANSION$ENABLEEXTENSIONS
API String ID: 3223794493-3086019870
Opcode ID: 1b9e9a1fb0b62af167df92eeb5291d00af7ef6c8e61fb06bb5c7810779a96032
Instruction ID: d498568c377e4cd3db2ccf4137d777c5e7c519d1b01484b587b65ad8ccea87df
Opcode Fuzzy Hash: 1b9e9a1fb0b62af167df92eeb5291d00af7ef6c8e61fb06bb5c7810779a96032
Instruction Fuzzy Hash: 48517E25A0CB438AEA158F16A8501BD7BA0FF49B98F584576CA5EC73A2DF3CE465C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE2B94 Relevance: 18.1, APIs: 6, Strings: 6, Instructions: 110COMMON

Download Yara Rule

Strings

LEQ, xrefs: 00007FF6D9FE2CB6
LSS, xrefs: 00007FF6D9FE2C9C
GEQ, xrefs: 00007FF6D9FE2D38
EQU, xrefs: 00007FF6D9FE2C6B
NEQ, xrefs: 00007FF6D9FE2C82
GTR, xrefs: 00007FF6D9FE2CD0

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID:
String ID: EQU$GEQ$GTR$LEQ$LSS$NEQ
API String ID: 0-3124875276
Opcode ID: b745fbc9bdecc4fead9b427a37718483e4c547d64fc83d89c1805cbb2eee3cf9
Instruction ID: c7514ba7ba45d55675f5f1e780cdd62c5481377be50f4f2376b5bfad0b96a0f6
Opcode Fuzzy Hash: b745fbc9bdecc4fead9b427a37718483e4c547d64fc83d89c1805cbb2eee3cf9
Instruction Fuzzy Hash: A0517B20E0C64386FB249F25E8042BD37A6EF45B49F408077CA4EC72A6EF7CA4698745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FDFC30 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FDFC38
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FDFC52
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF6D9FE0181
memset.MSVCRT ref: 00007FF6D9FED580
longjmp.MSVCRT ref: 00007FF6D9FED59F
memmove.MSVCRT ref: 00007FF6D9FED5C4
longjmp.MSVCRT ref: 00007FF6D9FED5FC
longjmp.MSVCRT ref: 00007FF6D9FED62B
longjmp.MSVCRT ref: 00007FF6D9FED660

Strings

0123456789, xrefs: 00007FF6D9FDFDEE

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: longjmp$Heap$AllocByteCharMultiProcessWidememmovememset
String ID: 0123456789
API String ID: 1606811317-2793719750
Opcode ID: e40b2a327a299dd0e466262e2513d9586320006c609d662f0b5b9f1fab087ccd
Instruction ID: 92c39027f30268a1da3409f6bbff28c9e5235751ff089bafe52ce83f886b440e
Opcode Fuzzy Hash: e40b2a327a299dd0e466262e2513d9586320006c609d662f0b5b9f1fab087ccd
Instruction Fuzzy Hash: 9FD18C25A1CA4382EA108F25A8406BD77A0FF85798F884277DA5DC77A6EF3CE425C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE6FB4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6D9FE7013

Part of subcall function 00007FF6D9FDCA40: memset.MSVCRT ref: 00007FF6D9FDCAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FE7123

Part of subcall function 00007FF6D9FE1EA0: wcschr.MSVCRT ref: 00007FF6D9FE1EB3

GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FE706E
wcsncmp.MSVCRT ref: 00007FF6D9FE70A5
wcsstr.MSVCRT ref: 00007FF6D9FEF9DB
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FEFA00
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FEFA5F

Part of subcall function 00007FF6D9FE823C: FindFirstFileExW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FE8280
Part of subcall function 00007FF6D9FE823C: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FE829D

Part of subcall function 00007FF6D9FE3A0C: FindClose.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FF6D9FFEAC5,?,?,?,00007FF6D9FFE925,?,?,?,?,00007FF6D9FDB9B1), ref: 00007FF6D9FE3A56

GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FEFA3D

Strings

\\.\, xrefs: 00007FF6D9FE7097

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: File$AttributesFindmemset$CloseDriveErrorFirstFullLastNamePathTypewcschrwcsncmpwcsstr
String ID: \\.\
API String ID: 799470305-2900601889
Opcode ID: 54d19c3779d548040f92f3520906801ddb16aa6d7fde4edd6d52b252c225e034
Instruction ID: d17ec2f06ec9934a233a5f50b479d1ce2ddeae222a2a9d482839bda354ab80fc
Opcode Fuzzy Hash: 54d19c3779d548040f92f3520906801ddb16aa6d7fde4edd6d52b252c225e034
Instruction Fuzzy Hash: 0D51A232B09B8286EB618F21E8002BD77A4FB89B94F498537DA4ECB795DF3CD5558700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD8B20 Relevance: 16.8, APIs: 11, Instructions: 254COMMON

Download Yara Rule

APIs

wcsrchr.MSVCRT ref: 00007FF6D9FD8BAB
_wcsicmp.MSVCRT ref: 00007FF6D9FD8BD4
_wcsicmp.MSVCRT ref: 00007FF6D9FD8BF2
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FD8C16
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FD8C2F
wcschr.MSVCRT ref: 00007FF6D9FD8CB3
wcschr.MSVCRT ref: 00007FF6D9FD8CD7

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: _wcsicmpwcschr$AttributesErrorFileLastwcsrchr
String ID:
API String ID: 1944892715-0
Opcode ID: 3b8946a33086edb33030d5444c24fecad3efc8509d9ed6e2406bfcb5b6270845
Instruction ID: 37c6497138a926551e477e489e2d2ea79bee3ee158425c210ed4bb1ce442b7b7
Opcode Fuzzy Hash: 3b8946a33086edb33030d5444c24fecad3efc8509d9ed6e2406bfcb5b6270845
Instruction Fuzzy Hash: 8BB17C61A09743CAEA659F12A8501BD76A0FF99B85F588937CA4EC73D1EF7CE460C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD5458 Relevance: 16.7, APIs: 11, Instructions: 213fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D9FE3578: _get_osfhandle.MSVCRT ref: 00007FF6D9FE3584
Part of subcall function 00007FF6D9FE3578: GetFileType.KERNELBASE(?,?,00000014,00007FF6D9FD32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6D9FE359C
Part of subcall function 00007FF6D9FE3578: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,00000014,00007FF6D9FD32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6D9FE35C3
Part of subcall function 00007FF6D9FE3578: AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6D9FD32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6D9FE35D9
Part of subcall function 00007FF6D9FE3578: GetConsoleMode.KERNELBASE(?,?,00000014,00007FF6D9FD32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6D9FE35ED
Part of subcall function 00007FF6D9FE3578: ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000014,00007FF6D9FD32E8,?,?,?,?,?,?,?,?,?,?,00000000,00000014), ref: 00007FF6D9FE3602

_get_osfhandle.MSVCRT ref: 00007FF6D9FD54DE
WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0(?,?,00007FF6D9FD1F7D), ref: 00007FF6D9FD552B
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0(?,?,00007FF6D9FD1F7D), ref: 00007FF6D9FD554F
_get_osfhandle.MSVCRT ref: 00007FF6D9FF345F
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00007FF6D9FD1F7D), ref: 00007FF6D9FF347E
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00007FF6D9FD1F7D), ref: 00007FF6D9FF34C3
_get_osfhandle.MSVCRT ref: 00007FF6D9FF34DB
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,?,00007FF6D9FD1F7D), ref: 00007FF6D9FF34FA

Part of subcall function 00007FF6D9FE36EC: _get_osfhandle.MSVCRT ref: 00007FF6D9FE3715
Part of subcall function 00007FF6D9FE36EC: WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF6D9FE3770
Part of subcall function 00007FF6D9FE36EC: WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FE3791

Part of subcall function 00007FF6D9FD566C: wcschr.MSVCRT ref: 00007FF6D9FD5690

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: _get_osfhandle$ConsoleWrite$File$ByteCharLockModeMultiSharedWide$AcquireHandleReleaseTypewcschr
String ID:
API String ID: 1356649289-0
Opcode ID: 979cfed9b7e49896089137fee2950bcbc78046ff4176823b72def202f83e2622
Instruction ID: abaf7b78fd69be36f970ae6bed7c01ffadf4438350ad8e1aecda856efc1d9def
Opcode Fuzzy Hash: 979cfed9b7e49896089137fee2950bcbc78046ff4176823b72def202f83e2622
Instruction Fuzzy Hash: 04919132A086438BEB249F21E40017DB7A5FB89B88F584176DA4E87795DF7CE468CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FDC620 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 312COMMON

Download Yara Rule

APIs

GetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0 ref: 00007FF6D9FDC65E
wcschr.MSVCRT ref: 00007FF6D9FDC792

Strings

:, xrefs: 00007FF6D9FDC9E2
/, xrefs: 00007FF6D9FDCA1B

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: ConsoleTitlewcschr
String ID: /$:
API String ID: 2364928044-4222935259
Opcode ID: d29fa59355cffc5306ca18f9cd167c37574d9aebd702a778799a5a4d83468f83
Instruction ID: ba89529ce11c9320f472e547fe300b7d345774bccfc525c6cbfbc15e59d5ee53
Opcode Fuzzy Hash: d29fa59355cffc5306ca18f9cd167c37574d9aebd702a778799a5a4d83468f83
Instruction Fuzzy Hash: 4EC1BC62E0C64281FB64AF25D4546BD62A2EF91B98F449133DA1EC73E1EF3CE860D301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FF86FC Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 226timeCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF6D9FF883F
GetLocalTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF6D9FF897A
SetLocalTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF6D9FF89AC
SetLocalTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF6D9FF89BD
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FF89D1

Strings

/-., xrefs: 00007FF6D9FF873E
%s, xrefs: 00007FF6D9FF88B9
:, xrefs: 00007FF6D9FF87B7

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: LocalTime$ErrorLast_get_osfhandle
String ID: %s$/-.$:
API String ID: 1644023181-879152773
Opcode ID: 1c267f07557e1e8594cfee3140c6f6e344d5dd92c4012508e119af3b8928d48f
Instruction ID: 936aceaac8b3e7266289be5747492bd89caf00e516fdfa4405b425b9e86612f2
Opcode Fuzzy Hash: 1c267f07557e1e8594cfee3140c6f6e344d5dd92c4012508e119af3b8928d48f
Instruction Fuzzy Hash: F491AD22B4864295EB209F25D4402BE66A0FF85B98F848937DA4FC76D5EE3CE569C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FF627C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 95synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FF6D9FF7251), ref: 00007FF6D9FF628E

Strings

wil, xrefs: 00007FF6D9FF63D2

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: ObjectSingleWait
String ID: wil
API String ID: 24740636-1589926490
Opcode ID: ea3b1f99615cb6da41309659edc9fe07f1318ac417b21432a0effa90e1671882
Instruction ID: 54ff3936760184fa419c6bc0956a345c10cb63784116ac03cd0a0d4d4cee1e17
Opcode Fuzzy Hash: ea3b1f99615cb6da41309659edc9fe07f1318ac417b21432a0effa90e1671882
Instruction Fuzzy Hash: 08414D21A0C54B83F7204F11E40027D66A1EF86799F649172E94AC7B95DF3DE86DC701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FFCDC0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 94windowCOMMON

Download Yara Rule

APIs

FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6D9FFCE20
_ultoa.MSVCRT ref: 00007FF6D9FFCE43
GetACP.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6D9FFCE4F
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF6D9FFCE84
FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FF6D9FFCEDE
LocalFree.API-MS-WIN-CORE-HEAP-L2-1-0 ref: 00007FF6D9FFCF24

Strings

Application, xrefs: 00007FF6D9FFCEAB
, xrefs: 00007FF6D9FFCE64
System, xrefs: 00007FF6D9FFCE90

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: FormatMessage$ByteCharFreeLocalMultiWide_ultoa
String ID: $Application$System
API String ID: 3377411628-1881496484
Opcode ID: 081ad1a78538691813d500f2119477f8c8ef04af017c9f27d6f6f5b033d517ce
Instruction ID: b6aaee8fc698f012c9febb3cc9974833d1131e9832774c167343c75de3d9ffee
Opcode Fuzzy Hash: 081ad1a78538691813d500f2119477f8c8ef04af017c9f27d6f6f5b033d517ce
Instruction Fuzzy Hash: 7B416932B18B429AE7209F61E4403ED7BA5FB89748F445176DA4E83B99EF3CD119C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD14E8 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,?,00007FF6D9FD1829), ref: 00007FF6D9FD1513
RemoveDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,?,?,?,?,00007FF6D9FD1829), ref: 00007FF6D9FD152B
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FEAB0F
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FEAB29
SetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FEAB4E
RemoveDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FEAB65

Strings

\, xrefs: 00007FF6D9FEAAFC
:, xrefs: 00007FF6D9FEAAF0

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: AttributesDirectoryFileRemove$ErrorFullLastNamePath
String ID: :$\
API String ID: 3961617410-1166558509
Opcode ID: 7382dc9ba5dd15d1d826e80cca2a433ebb6210e0cfd6d3e104106e7a41e883e1
Instruction ID: 95b9e474e42a57e4d8edc85067bde8d3bd297c63241268c63d3cc64f01756b90
Opcode Fuzzy Hash: 7382dc9ba5dd15d1d826e80cca2a433ebb6210e0cfd6d3e104106e7a41e883e1
Instruction Fuzzy Hash: 9421A122B1CA83C6E7645F61A44417DBAA1FF89B95F448673DA1FC3790DF3CD4648601

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD7AA0 Relevance: 15.2, APIs: 10, Instructions: 221COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6D9FD7B13
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FD7B5F
CreateDirectoryW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FD7B83
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD7BA9

Part of subcall function 00007FF6D9FE291C: GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FE294A

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: CreateDirectoryDriveFullNamePathTypememset
String ID:
API String ID: 1397130798-0
Opcode ID: 2f866f744eda2d375aa2d8cb453d95d81c4802dc249533727c77acd7fb7658c8
Instruction ID: f00d474968842e1ad0c312b6571ab8cec6e12ac8c64813e3b02c3099b076a8e5
Opcode Fuzzy Hash: 2f866f744eda2d375aa2d8cb453d95d81c4802dc249533727c77acd7fb7658c8
Instruction Fuzzy Hash: F89193A2B09B8286EB758F11D4402BD73A5FF88B85F458136EA8EC7794DF3CE9518700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE258C Relevance: 15.1, APIs: 5, Strings: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D9FE06C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6D9FDB4DB), ref: 00007FF6D9FE06D6
Part of subcall function 00007FF6D9FE06C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6D9FDB4DB), ref: 00007FF6D9FE06F0
Part of subcall function 00007FF6D9FE06C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6D9FDB4DB), ref: 00007FF6D9FE074D
Part of subcall function 00007FF6D9FE06C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6D9FDB4DB), ref: 00007FF6D9FE0762

_wcsicmp.MSVCRT ref: 00007FF6D9FE25CA
_wcsicmp.MSVCRT ref: 00007FF6D9FE25E8
_wcsicmp.MSVCRT ref: 00007FF6D9FE260F
_wcsicmp.MSVCRT ref: 00007FF6D9FE2636
_wcsicmp.MSVCRT ref: 00007FF6D9FE2650

Strings

CMDEXTVERSION, xrefs: 00007FF6D9FE2608
EXIST, xrefs: 00007FF6D9FE25E1
ERRORLEVEL, xrefs: 00007FF6D9FE25C3
NOT, xrefs: 00007FF6D9FE2649
DEFINED, xrefs: 00007FF6D9FE262F

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: _wcsicmp$Heap$AllocProcess
String ID: CMDEXTVERSION$DEFINED$ERRORLEVEL$EXIST$NOT
API String ID: 3407644289-1668778490
Opcode ID: 6b20a7c0308f2f6d4956041ee9f3b19beb2519d0e51fe48ee44493608e18250d
Instruction ID: d325c54206df9dd9a6443f3df8c1d1422f211f7fdef6e54c22ca3274f4f0a885
Opcode Fuzzy Hash: 6b20a7c0308f2f6d4956041ee9f3b19beb2519d0e51fe48ee44493608e18250d
Instruction Fuzzy Hash: 16314F61A1C64386F7256F21E8113BD6694EF84B88F448177DA4EC72E6EF3CE424C715

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DA000C90 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 282COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6DA001398: free.MSVCRT(?,?,00000000,00007FF6D9FF7FE0,?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000), ref: 00007FF6DA0013C2
Part of subcall function 00007FF6DA001398: free.MSVCRT(?,?,00000000,00007FF6D9FF7FE0,?,?,?,?,?,?,?,?,00000000,00000000,0000237B,00000000), ref: 00007FF6DA0013DF

Part of subcall function 00007FF6D9FD2730: towupper.MSVCRT ref: 00007FF6D9FD27C1

Part of subcall function 00007FF6D9FD91C0: memset.MSVCRT ref: 00007FF6D9FD921C
Part of subcall function 00007FF6D9FD91C0: wcsrchr.MSVCRT ref: 00007FF6D9FD92D8
Part of subcall function 00007FF6D9FD91C0: GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FD9362
Part of subcall function 00007FF6D9FD91C0: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FD9373

Part of subcall function 00007FF6D9FD8DF8: memset.MSVCRT ref: 00007FF6D9FD8E6D
Part of subcall function 00007FF6D9FD8DF8: memset.MSVCRT ref: 00007FF6D9FD8E93

Part of subcall function 00007FF6D9FE7854: memset.MSVCRT ref: 00007FF6D9FE790B

qsort.MSVCRT ref: 00007FF6DA000DDF
wcschr.MSVCRT ref: 00007FF6DA000E40
calloc.MSVCRT ref: 00007FF6DA000EA2
calloc.MSVCRT ref: 00007FF6DA000F5A
wcschr.MSVCRT ref: 00007FF6DA000F9E
memmove.MSVCRT ref: 00007FF6DA001001
memmove.MSVCRT ref: 00007FF6DA001021

Strings

&()[]{}^=;!%'+,`~, xrefs: 00007FF6DA000E39, 00007FF6DA000F97

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: memset$callocfreememmovewcschr$AttributesErrorFileLastqsorttowupperwcsrchr
String ID: &()[]{}^=;!%'+,`~
API String ID: 2516562204-381716982
Opcode ID: 46497fca5754c6479966f60d4708fe0825c75a770e24346d8a6fbe1751f9d7e4
Instruction ID: 042f4e85c40e77dabd2af13bf3c81630662aff8f8609af54c469d1ef80bab6d5
Opcode Fuzzy Hash: 46497fca5754c6479966f60d4708fe0825c75a770e24346d8a6fbe1751f9d7e4
Instruction Fuzzy Hash: A9C1B232A1879286E7648F26E84027E77A1FB44B98F445136EE8D83B99DF3CE461D704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE7E80 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 210COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D9FDD3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FDD46E
Part of subcall function 00007FF6D9FDD3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FDD485
Part of subcall function 00007FF6D9FDD3F0: wcschr.MSVCRT ref: 00007FF6D9FDD4EE
Part of subcall function 00007FF6D9FDD3F0: iswspace.MSVCRT ref: 00007FF6D9FDD54D
Part of subcall function 00007FF6D9FDD3F0: wcschr.MSVCRT ref: 00007FF6D9FDD569
Part of subcall function 00007FF6D9FDD3F0: wcschr.MSVCRT ref: 00007FF6D9FDD58C

iswspace.MSVCRT ref: 00007FF6D9FE7EEE

Strings

A, xrefs: 00007FF6D9FF01B6

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: wcschr$Heapiswspace$AllocProcess
String ID: A
API String ID: 3731854180-3554254475
Opcode ID: cbbec4da78b9c0bcd8cfdbfb7eb308b7a7d6a14b45e0d18e4a5b6038242856f5
Instruction ID: fc6ee03b1b29444894a4b2d0f8a7aa92beb754b3984b5723b25019d12dcba709
Opcode Fuzzy Hash: cbbec4da78b9c0bcd8cfdbfb7eb308b7a7d6a14b45e0d18e4a5b6038242856f5
Instruction Fuzzy Hash: 97A18E21A0D68386EB609F11E85027DB7A0FF45798F048176DA8DC77A6EF3CE465DB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FFA39C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 111libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF6D9FFA3EA
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF6D9FFA40C
ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0 ref: 00007FF6D9FFA47B
ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0 ref: 00007FF6D9FFA4D3
ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0 ref: 00007FF6D9FFA508
ReadProcessMemory.API-MS-WIN-CORE-MEMORY-L1-1-0 ref: 00007FF6D9FFA54A

Strings

NTDLL.DLL, xrefs: 00007FF6D9FFA3E1
NtQueryInformationProcess, xrefs: 00007FF6D9FFA402

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: MemoryProcessRead$AddressLibraryLoadProc
String ID: NTDLL.DLL$NtQueryInformationProcess
API String ID: 1580871199-2613899276
Opcode ID: 248bfccf7fce2d74e04c554d0a409a3469e52293056c2e4adbebd786e6cf1904
Instruction ID: 5caa1d64c3254c46c019a3c673878de8f18008f2397641423b8c98b8c6906535
Opcode Fuzzy Hash: 248bfccf7fce2d74e04c554d0a409a3469e52293056c2e4adbebd786e6cf1904
Instruction Fuzzy Hash: B1519476A18B8286EB208F16E84027D77A4FF88F88F445176DA5E83B55EF3CD125C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD7420 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 101fileCOMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 00007FF6D9FD74A1
CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FD74E8
_open_osfhandle.MSVCRT ref: 00007FF6D9FD7509
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6D9FF4931

Strings

con, xrefs: 00007FF6D9FD748A

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: CloseCreateFileHandle_open_osfhandle_wcsicmp
String ID: con
API String ID: 689241570-4257191772
Opcode ID: c7a2234d9573f6b473384a9ead2fa3a6435853c7d94b0c157743cf5a0c0f015b
Instruction ID: a252ae5aed31ad1699e78da38442d2307f012ebd9401c89b7b099121d945ba9b
Opcode Fuzzy Hash: c7a2234d9573f6b473384a9ead2fa3a6435853c7d94b0c157743cf5a0c0f015b
Instruction Fuzzy Hash: FE41C432A0864687E3208F15944437DBAA5FB89BA8F658336DA6D873D0CF3DD859C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FFA58C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 97memoryfileCOMMON

Download Yara Rule

APIs

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FFA5DC

Part of subcall function 00007FF6D9FFA8D4: ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FFA8F1

SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FFA62E
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FFA68B
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FFA6A0
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FFA6DE
RtlFreeHeap.NTDLL ref: 00007FF6D9FFA6F2
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6D9FFA701

Strings

PE, xrefs: 00007FF6D9FFA65C

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Heap$File$Process$AllocCloseCreateFreeHandlePointerRead
String ID: PE
API String ID: 2941894976-4258593460
Opcode ID: 331757eb63d1f0c0e0f6f41cd200ca790172e856099f574e6941fdd4e3218fed
Instruction ID: 73891730465bb20c50727995d61d07130aa5db6e138801ef401fcf7df435f283
Opcode Fuzzy Hash: 331757eb63d1f0c0e0f6f41cd200ca790172e856099f574e6941fdd4e3218fed
Instruction Fuzzy Hash: 3F41697260865287E6209F11E45067DBBA0FBC9B94F444132DE5D83B95FF3CE469CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE0010 Relevance: 13.7, APIs: 9, Instructions: 163fileCOMMON

Download Yara Rule

APIs

SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,0000237B,00000000,00000002,0000000A,00000001,00007FF6D9FF849D,?,?,?,00007FF6D9FFF0C7), ref: 00007FF6D9FE0045
AcquireSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF6D9FFF0C7,?,?,?,?,?,?,00000002,00000000,?,?,0000002F,00007FF6D9FFE964), ref: 00007FF6D9FE0071
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FE0092
ReleaseSRWLockShared.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6D9FE00A7
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FE0148
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF6D9FE0181

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: File$LockPointerShared$AcquireByteCharMultiReadReleaseWide
String ID:
API String ID: 734197835-0
Opcode ID: 6daa823d36a278c72bc8dcf2d42bf9926b6fb5b8f0ec4fad86b12d1df65ba387
Instruction ID: 562e40dbd6cfac8dc468b76e40c413bb66b03832817c14e53d1a0ee426c7997a
Opcode Fuzzy Hash: 6daa823d36a278c72bc8dcf2d42bf9926b6fb5b8f0ec4fad86b12d1df65ba387
Instruction Fuzzy Hash: F9618036A0C69386E7258F25A80437D7AA1FB46B48F488277DD9EC7791DF3CA465C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FF9B0C Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 261registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6D9FF9B77
RegEnumKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6D9FF9CD2
wcsrchr.MSVCRT ref: 00007FF6D9FF9D47
RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6D9FF9E38

Strings

\Shell\Open\Command, xrefs: 00007FF6D9FF9B8F, 00007FF6D9FF9DE6
%s=%s, xrefs: 00007FF6D9FF9C81, 00007FF6D9FF9E85
., xrefs: 00007FF6D9FF9B96

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Enum$Openwcsrchr
String ID: %s=%s$.$\Shell\Open\Command
API String ID: 3402383852-1459555574
Opcode ID: 525d1a7a22f625536f812f4559a32cd03a6fb8b63cc25c933afa18de369c566e
Instruction ID: 7c3815c5750d8043f3d32df01983d9bbb4a88f43d2f4869f0d71fad276caab5a
Opcode Fuzzy Hash: 525d1a7a22f625536f812f4559a32cd03a6fb8b63cc25c933afa18de369c566e
Instruction Fuzzy Hash: 87A1C462A0C74282EE119F55D0502BE63A0FF85B98F944537DA4D87BD5EF7CE9A9C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE7610 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 228COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6D9FE768B
memset.MSVCRT ref: 00007FF6D9FE76B4

Part of subcall function 00007FF6D9FDCA40: memset.MSVCRT ref: 00007FF6D9FDCAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FE77F5
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FE7815

Part of subcall function 00007FF6D9FE8198: wcscmp.MSVCRT ref: 00007FF6D9FE81EA
Part of subcall function 00007FF6D9FE8198: wcscmp.MSVCRT ref: 00007FF6D9FE81FD

Strings

%s, xrefs: 00007FF6D9FEFC14

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: memset$wcscmp
String ID: %s
API String ID: 243296809-3043279178
Opcode ID: 44f0c51c5f4366950aa2e9ddfdc4d68a7a2ef5c9fa26bc065f037a37bf0143dd
Instruction ID: cb5495344b0867b7f3c5c16240073a724c65b8945654c9d7e92584428cfdca27
Opcode Fuzzy Hash: 44f0c51c5f4366950aa2e9ddfdc4d68a7a2ef5c9fa26bc065f037a37bf0143dd
Instruction Fuzzy Hash: A5A15A22B0968696EB75DF21D8403FD23A1FB49748F144136DA9ECB695EF3CE664C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD1F90 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 174COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6D9FD2058

Part of subcall function 00007FF6D9FDCA40: memset.MSVCRT ref: 00007FF6D9FDCAB3

memset.MSVCRT ref: 00007FF6D9FD20C1
GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6D9FD20D2
GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6D9FD2117
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD21DC

Strings

DIRCMD, xrefs: 00007FF6D9FD20C9, 00007FF6D9FD2109

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: memset$EnvironmentVariable
String ID: DIRCMD
API String ID: 1405722092-1465291664
Opcode ID: 07ed24d3f9858967d8773748a1b845eb6e6d892857c645de86590165c90f9600
Instruction ID: 50b46456fb6e0d192367aa1b139f52c98f69bf627af854eb9f42962a1af08b15
Opcode Fuzzy Hash: 07ed24d3f9858967d8773748a1b845eb6e6d892857c645de86590165c90f9600
Instruction Fuzzy Hash: 73816E72A18BC28AEB20DF61E8802ED37A5FB89748F14413ADB8D97B59DF38D155C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD99F0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D9FDCD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6D9FDB9A1,?,?,?,?,00007FF6D9FDD81A), ref: 00007FF6D9FDCDA6
Part of subcall function 00007FF6D9FDCD90: RtlAllocateHeap.NTDLL(?,?,?,00007FF6D9FDB9A1,?,?,?,?,00007FF6D9FDD81A), ref: 00007FF6D9FDCDBD

wcschr.MSVCRT ref: 00007FF6D9FD9A39

Part of subcall function 00007FF6D9FDDF60: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,00000000,00000000,00007FF6D9FDCEAA), ref: 00007FF6D9FDDFB8
Part of subcall function 00007FF6D9FDDF60: RtlFreeHeap.NTDLL ref: 00007FF6D9FDDFCC
Part of subcall function 00007FF6D9FDDF60: _setjmp.MSVCRT ref: 00007FF6D9FDE03E

wcschr.MSVCRT ref: 00007FF6D9FD9AF0
wcschr.MSVCRT ref: 00007FF6D9FD9B0F

Part of subcall function 00007FF6D9FD96E8: memset.MSVCRT ref: 00007FF6D9FD97B2
Part of subcall function 00007FF6D9FD96E8: ??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD9880

_wcsupr.MSVCRT ref: 00007FF6D9FEB844
wcscmp.MSVCRT ref: 00007FF6D9FEB86D

Strings

IF, xrefs: 00007FF6D9FEB850
FOR, xrefs: 00007FF6D9FEB863

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Heap$wcschr$Process$AllocateFree_setjmp_wcsuprmemsetwcscmp
String ID: FOR$ IF
API String ID: 557945885-2924197646
Opcode ID: 9fbc3e5bcf3e94118a1bc0a9f9aa5fee9472dcf9e4a7545975834e3c01b17498
Instruction ID: 736846286bf45f6248873b557adf9d0579de5d4fa9c593a0516a0ed02b6993fd
Opcode Fuzzy Hash: 9fbc3e5bcf3e94118a1bc0a9f9aa5fee9472dcf9e4a7545975834e3c01b17498
Instruction Fuzzy Hash: DC518D21B0E64781FE29AF16945027D2791EF85BA5F484236D91EC77D1DE3CF9628300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FDF173 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 119COMMON

Download Yara Rule

APIs

iswdigit.MSVCRT ref: 00007FF6D9FDF0D6
iswspace.MSVCRT ref: 00007FF6D9FDF1BA
wcschr.MSVCRT ref: 00007FF6D9FDF1E7
iswdigit.MSVCRT ref: 00007FF6D9FDF1FF
iswdigit.MSVCRT ref: 00007FF6D9FDF2BB

Strings

=,;, xrefs: 00007FF6D9FDF1CE
), xrefs: 00007FF6D9FDF18C

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: iswdigit$iswspacewcschr
String ID: )$=,;
API String ID: 1959970872-2167043656
Opcode ID: 4f4e76ffb3d3d3f1682d86852f25dc45ca8acbfdb86516db9a39298bef1f035d
Instruction ID: a88c6f34b163c9985b080134b21f7aa739d7df5b584231ad4253e352114d3a70
Opcode Fuzzy Hash: 4f4e76ffb3d3d3f1682d86852f25dc45ca8acbfdb86516db9a39298bef1f035d
Instruction Fuzzy Hash: DD419B66F2C25386FB648F12E90477D36A0AF91759F849037CA8CC33A0EF3CA4A18705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FFBA40 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

iswalpha.MSVCRT ref: 00007FF6D9FFBABA
towupper.MSVCRT ref: 00007FF6D9FFBAD1
GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FFBB13
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FFBB2F
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FFBB48

Strings

%04X-%04X, xrefs: 00007FF6D9FFBBBB
:, xrefs: 00007FF6D9FFBAAF

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: ErrorLast$InformationVolumeiswalphatowupper
String ID: %04X-%04X$:
API String ID: 930873262-1938371929
Opcode ID: 978e31d94f6f2106114982db72c5995a26a20c8019cabdbd394f6a877edec6b5
Instruction ID: 4a4303612995fcbe0c35fa171825c4539ee599024a21c8f5c20af9ac351a9ad8
Opcode Fuzzy Hash: 978e31d94f6f2106114982db72c5995a26a20c8019cabdbd394f6a877edec6b5
Instruction Fuzzy Hash: 21417031A0CA8382EB209F61E4452BE6360FB85759F404177DA4DC36D6DF7CE568C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE36EC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 93fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF6D9FE3715
WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF6D9FE3770
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FE3791
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FEE96E
WideCharToMultiByte.API-MS-WIN-CORE-STRING-L1-1-0 ref: 00007FF6D9FEE9A7
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FEE9D5

Strings

$P$G, xrefs: 00007FF6D9FE3703

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: FileWrite$ByteCharMultiWide$_get_osfhandle
String ID: $P$G
API String ID: 3249344982-2079915088
Opcode ID: 51d05573790b3cf5d3d64b049944166340f1b2bbc10c5d821001f089b8cff74b
Instruction ID: 33f9d925f02576d872e628617ecb953a61af6a6efde0f0163d80021dc7e7b12e
Opcode Fuzzy Hash: 51d05573790b3cf5d3d64b049944166340f1b2bbc10c5d821001f089b8cff74b
Instruction Fuzzy Hash: 27414F7261CB4286E3108F12A84477EBAE4FB49BD8F448276DA4D87795DF7CD0658B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE6A28 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

iswdigit.MSVCRT ref: 00007FF6D9FE6A73
wcschr.MSVCRT ref: 00007FF6D9FE6A91
wcschr.MSVCRT ref: 00007FF6D9FE6AB0
wcschr.MSVCRT ref: 00007FF6D9FE6AE3
wcschr.MSVCRT ref: 00007FF6D9FE6B01

Strings

+-~!, xrefs: 00007FF6D9FE6AA9, 00007FF6D9FE6ADC
<>+-*/%()|^&=,, xrefs: 00007FF6D9FE6A8A, 00007FF6D9FE6AF7

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: wcschr$iswdigit
String ID: +-~!$<>+-*/%()|^&=,
API String ID: 2770779731-632268628
Opcode ID: 04afb1219d2367be7b294e05ecf67b56e7fd74584ee28e872d0024d55c3108eb
Instruction ID: 5063252431fbd1830017e5ca6a14c05b39f2f2fbeffea0bf69f48c9d94c349ea
Opcode Fuzzy Hash: 04afb1219d2367be7b294e05ecf67b56e7fd74584ee28e872d0024d55c3108eb
Instruction Fuzzy Hash: A5312826A08E5AC5EA649F02E45027D76A0FB89F89B458077DA5EC3395EF3CE424C304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FFD878 Relevance: 12.1, APIs: 8, Instructions: 89fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF6D9FFD899
FlushFileBuffers.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FFD8A8
_get_osfhandle.MSVCRT ref: 00007FF6D9FFD8D7
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FFD8F1
_get_osfhandle.MSVCRT ref: 00007FF6D9FFD8FF
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FFD921
_get_osfhandle.MSVCRT ref: 00007FF6D9FFD969
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FFD983

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: File_get_osfhandle$Pointer$BuffersFlushRead
String ID:
API String ID: 3192234081-0
Opcode ID: 70e582d2ff1694b1eb8906732218cc539a96d111935978aaaa65a21b5ca98f21
Instruction ID: 92a808f2d571ae7cac83d901c08e07a1e37a97c58ed139818a45fd3b03c6f41f
Opcode Fuzzy Hash: 70e582d2ff1694b1eb8906732218cc539a96d111935978aaaa65a21b5ca98f21
Instruction Fuzzy Hash: 9331B631B08642CBE7209F22E40467DBB91FB8AB99F449235DE8A87795CF3CD415CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE1630 Relevance: 10.7, APIs: 7, Instructions: 208memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(00000000,?,?,00000000,?,00007FF6D9FE14D6,?,?,?,00007FF6D9FDAA22,?,?,?,00007FF6D9FD847E), ref: 00007FF6D9FE1673
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,?,00007FF6D9FE14D6,?,?,?,00007FF6D9FDAA22,?,?,?,00007FF6D9FD847E), ref: 00007FF6D9FE168D
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,?,00007FF6D9FE14D6,?,?,?,00007FF6D9FDAA22,?,?,?,00007FF6D9FD847E), ref: 00007FF6D9FE1757
HeapReAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,?,00007FF6D9FE14D6,?,?,?,00007FF6D9FDAA22,?,?,?,00007FF6D9FD847E), ref: 00007FF6D9FE176E
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,?,00007FF6D9FE14D6,?,?,?,00007FF6D9FDAA22,?,?,?,00007FF6D9FD847E), ref: 00007FF6D9FE1788
HeapSize.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,?,00007FF6D9FE14D6,?,?,?,00007FF6D9FDAA22,?,?,?,00007FF6D9FD847E), ref: 00007FF6D9FE179C

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Heap$Process$Alloc$Size
String ID:
API String ID: 3586862581-0
Opcode ID: 3196afb9ea3d41201a8166459e9d0438d87d531f6b60091101265a9fd18966e8
Instruction ID: ca2cf3433f2b0adaa0a06bdc948655d53da585fbad0ba51494a7ee02d45661f7
Opcode Fuzzy Hash: 3196afb9ea3d41201a8166459e9d0438d87d531f6b60091101265a9fd18966e8
Instruction Fuzzy Hash: 53916C65A09B5681EB218F16E4803BD76A0FB48B98F598237DE5DC77A1EF3CE461C304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FFEC14 Relevance: 10.6, APIs: 7, Instructions: 121COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6D9FFEC73

Part of subcall function 00007FF6D9FDCA40: memset.MSVCRT ref: 00007FF6D9FDCAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FFEE0A

Part of subcall function 00007FF6D9FE081C: GetEnvironmentVariableW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6D9FE084E

SetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6D9FFECD5
SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FFECED
SetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6D9FFED9C
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FFEDAC
SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FFEDC8

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Error$CurrentDirectoryModememset$EnvironmentLastVariable
String ID:
API String ID: 920682188-0
Opcode ID: 72aab322a4609a9c908fc99101459a8672872acad55ba8d77b7613640cd03a1d
Instruction ID: 38b3d8dfe5a7c360835a33630ea489b662b86d86501d1cfdb6f71bafe160e68f
Opcode Fuzzy Hash: 72aab322a4609a9c908fc99101459a8672872acad55ba8d77b7613640cd03a1d
Instruction Fuzzy Hash: 02513736609B818AEB25DF21D8542EC77A4FB89B48F048076CA4D87755EF3CD669C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FDF5D7 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

iswspace.MSVCRT ref: 00007FF6D9FDF1BA
wcschr.MSVCRT ref: 00007FF6D9FDF1E7
iswdigit.MSVCRT ref: 00007FF6D9FDF1FF
iswdigit.MSVCRT ref: 00007FF6D9FDF2BB

Strings

=,;, xrefs: 00007FF6D9FDF1CE
), xrefs: 00007FF6D9FDF18C

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: iswdigit$iswspacewcschr
String ID: )$=,;
API String ID: 1959970872-2167043656
Opcode ID: e8a5d63c360e4c13ef561f3ce3dd80187a3c2d8689f5c743dd181e811bfffbc3
Instruction ID: b36fcf560e837b1d138d7c8201e934d5f9ae40f9547050f4cff6ca0e360a8818
Opcode Fuzzy Hash: e8a5d63c360e4c13ef561f3ce3dd80187a3c2d8689f5c743dd181e811bfffbc3
Instruction Fuzzy Hash: CB41A965F2C21386FB644F12E9087BD36A0AF91749F945077C98DC32A0EF3CA4B18A05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FF91B8 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6D9FF91FF
wcsrchr.MSVCRT ref: 00007FF6D9FF9232
_wcsnicmp.MSVCRT ref: 00007FF6D9FF9285

Strings

Null environment, xrefs: 00007FF6D9FF91F1
%s, xrefs: 00007FF6D9FF9298
CMD Internal Error %s, xrefs: 00007FF6D9FF91F8

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: _wcsnicmpfprintfwcsrchr
String ID: CMD Internal Error %s$%s$Null environment
API String ID: 3625580822-2781220306
Opcode ID: 3cdfeede7ea9cb233e656df7c73d074badb7d386eaab989116ed0f8eb977d474
Instruction ID: 44903e2097865305647945168b999252804c69ebc8d1573dbddfcc8dfb1376de
Opcode Fuzzy Hash: 3cdfeede7ea9cb233e656df7c73d074badb7d386eaab989116ed0f8eb977d474
Instruction Fuzzy Hash: C431D021A0C64792EE289F42E5001BE72A4FF45B9CF444136CE2D977E6EE3CE4A9C304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE1FAC Relevance: 9.3, APIs: 6, Instructions: 260COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6D9FE200F
wcsspn.MSVCRT ref: 00007FF6D9FE2226

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: memsetwcsspn
String ID:
API String ID: 3809306610-0
Opcode ID: 57a5787843a69364694d2dc292972d812e039d942152acd4f4fca5a99e460c4a
Instruction ID: 42347800a612a4b73b3e1a8106f55cd209b8b671f2082e082f54b4c2a3780211
Opcode Fuzzy Hash: 57a5787843a69364694d2dc292972d812e039d942152acd4f4fca5a99e460c4a
Instruction Fuzzy Hash: 70B17F72A08B8686EA51CF15E4906BD77A0FB85B84F858033DA4EC7795EF7DE861C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FF8C18 Relevance: 9.1, APIs: 6, Instructions: 145COMMON

Download Yara Rule

APIs

iswdigit.MSVCRT ref: 00007FF6D9FF8C85
iswdigit.MSVCRT ref: 00007FF6D9FF8CA2
wcstol.MSVCRT ref: 00007FF6D9FF8CBF
wcschr.MSVCRT ref: 00007FF6D9FF8CF0
wcschr.MSVCRT ref: 00007FF6D9FF8D16
wcschr.MSVCRT ref: 00007FF6D9FF8D6A

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: wcschr$iswdigit$wcstol
String ID:
API String ID: 3841054028-0
Opcode ID: c8e66ebebd8934775a16318260a5522f8ecbc9a094cbada97be1ab4c749f477c
Instruction ID: 8fe2e31b6377e233b00a512f0c81ad02c6637499511b4253e62037736019bd2d
Opcode Fuzzy Hash: c8e66ebebd8934775a16318260a5522f8ecbc9a094cbada97be1ab4c749f477c
Instruction Fuzzy Hash: 7151C526A0865382EB649F16D4001BD76A1FF69B58F458633DE5EC3AD4EF3CE466C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD5984 Relevance: 9.1, APIs: 6, Instructions: 142COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF6D9FF3687
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,00000000,00008000,?,00000001,00007FF6D9FD260D), ref: 00007FF6D9FF36A6
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,00000000,00008000,?,00000001,00007FF6D9FD260D), ref: 00007FF6D9FF36EB
_get_osfhandle.MSVCRT ref: 00007FF6D9FF3703
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,00000000,00008000,?,00000001,00007FF6D9FD260D), ref: 00007FF6D9FF3722

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Console$Write_get_osfhandle$Mode
String ID:
API String ID: 1066134489-0
Opcode ID: 2a240abe1de52d061e59be031b55d9e6e9a28d534bea7de0be598d79ad0bcc1b
Instruction ID: 197cdbc4f0a83d8cc73beaaaa9dc858606b9caec0f49b10de6e31c94f369eba9
Opcode Fuzzy Hash: 2a240abe1de52d061e59be031b55d9e6e9a28d534bea7de0be598d79ad0bcc1b
Instruction Fuzzy Hash: 7551AF62B0C64387EA245F22A40457EA691FF84BD8F084476DE1EC7795EFBCE468CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD89C0 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6D9FD8A18

Part of subcall function 00007FF6D9FDCA40: memset.MSVCRT ref: 00007FF6D9FDCAB3

GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FD8A62
GetVolumeInformationW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FD8ABA
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD8AE1
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FEB3FC
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FEB424

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: memset$DriveErrorInformationLastTypeVolume
String ID:
API String ID: 850181435-0
Opcode ID: e30f486a492b6204ca4cfe222f6522b4387915627d195f2e6e30a15257811e7a
Instruction ID: 9b9da767a6240c0e211e6dac13439da6e5062ca80634d1bb91618df54a69c468
Opcode Fuzzy Hash: e30f486a492b6204ca4cfe222f6522b4387915627d195f2e6e30a15257811e7a
Instruction Fuzzy Hash: B3416A32608BC1CAE7718F21D8442ED77A4FB89B49F494536DA4D8BB48CF38D695C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FFBE30 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D9FDD3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FDD46E
Part of subcall function 00007FF6D9FDD3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FDD485
Part of subcall function 00007FF6D9FDD3F0: wcschr.MSVCRT ref: 00007FF6D9FDD4EE
Part of subcall function 00007FF6D9FDD3F0: iswspace.MSVCRT ref: 00007FF6D9FDD54D
Part of subcall function 00007FF6D9FDD3F0: wcschr.MSVCRT ref: 00007FF6D9FDD569
Part of subcall function 00007FF6D9FDD3F0: wcschr.MSVCRT ref: 00007FF6D9FDD58C

_wcsicmp.MSVCRT ref: 00007FF6D9FFBE98
_wcsicmp.MSVCRT ref: 00007FF6D9FFBEC5
_wcsicmp.MSVCRT ref: 00007FF6D9FFBEFA

Strings

OFF, xrefs: 00007FF6D9FFBEBB, 00007FF6D9FFBEDB
LIST, xrefs: 00007FF6D9FFBEF0
KEYS, xrefs: 00007FF6D9FFBEE2

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: _wcsicmpwcschr$Heap$AllocProcessiswspace
String ID: KEYS$LIST$OFF
API String ID: 411561164-4129271751
Opcode ID: 7ad00a9c86f77bb16093b9e442d0c3b03c89383a104a9bcf3af4e47923f87761
Instruction ID: 5fd899c20df951e643cd1964ae93e6bf9371dee720170e571b33e69918ab3300
Opcode Fuzzy Hash: 7ad00a9c86f77bb16093b9e442d0c3b03c89383a104a9bcf3af4e47923f87761
Instruction Fuzzy Hash: 4B213D21E0CA0396F7549F26E84117D66A1EF847A9F509273CB1EC72E6EF7CA468C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE9584 Relevance: 9.0, APIs: 6, Instructions: 49timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF6D9FE95B4
GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6D9FE95C2
GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6D9FE95CE
GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF6D9FE95DA
GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0 ref: 00007FF6D9FE95EA
QueryPerformanceCounter.API-MS-WIN-CORE-PROFILE-L1-1-0 ref: 00007FF6D9FE9605

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: b889aecb1d922b30460546f960472bac4e2facbbb0b8017922a5a639f3fd93e9
Instruction ID: 17e0e229e0317fa41d7064245191b9f9e1f0ccdee393b668857bf58d16a06b3e
Opcode Fuzzy Hash: b889aecb1d922b30460546f960472bac4e2facbbb0b8017922a5a639f3fd93e9
Instruction Fuzzy Hash: 08115122608B428BEB10DF61E8452AC33A8FB1975CF440A36EA6D87B55DF7CD1A48344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FF711C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

OpenSemaphoreW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6D9FF71F9
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FF720D
OpenSemaphoreW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6D9FF7300

Part of subcall function 00007FF6D9FF5740: CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?,?,?,00007FF6D9FF75C4,?,?,00000000,00007FF6D9FF6999,?,?,?,?,?,00007FF6D9FE8C39), ref: 00007FF6D9FF5744

Strings

wil, xrefs: 00007FF6D9FF725E, 00007FF6D9FF7338
_p0, xrefs: 00007FF6D9FF71B3

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: OpenSemaphore$CloseErrorHandleLast
String ID: _p0$wil
API String ID: 455305043-1814513734
Opcode ID: 39a27b84dfd8631c9037e55d178cc10ed73d1848b9dee361412bcbd5f2f98ace
Instruction ID: 27190b57c3129f20705f67223275b3d86d538c60cad4d471a450aa39c4665cb2
Opcode Fuzzy Hash: 39a27b84dfd8631c9037e55d178cc10ed73d1848b9dee361412bcbd5f2f98ace
Instruction Fuzzy Hash: 4D61D362B1968285EF25CF6598102BDA3A1FF88B88F544433DA4E87795EF3CE529C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD1DC0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6D9FD1E21

Part of subcall function 00007FF6D9FDCA40: memset.MSVCRT ref: 00007FF6D9FDCAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD1F23

Part of subcall function 00007FF6D9FDD3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FDD46E
Part of subcall function 00007FF6D9FDD3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FDD485
Part of subcall function 00007FF6D9FDD3F0: wcschr.MSVCRT ref: 00007FF6D9FDD4EE
Part of subcall function 00007FF6D9FDD3F0: iswspace.MSVCRT ref: 00007FF6D9FDD54D
Part of subcall function 00007FF6D9FDD3F0: wcschr.MSVCRT ref: 00007FF6D9FDD569
Part of subcall function 00007FF6D9FDD3F0: wcschr.MSVCRT ref: 00007FF6D9FDD58C

iswspace.MSVCRT ref: 00007FF6D9FF05B0

Strings

%s, xrefs: 00007FF6D9FD1EF3

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: wcschr$Heapiswspacememset$AllocProcess
String ID: %s
API String ID: 2401724867-3043279178
Opcode ID: 0e8decf08ffcf42e36446defa7b9fc8eaea003f80f69816cc42936f12a4f8683
Instruction ID: 8886efa80d7b01e74966dffcf63ca8a1ae363a37b408a5466081afced4e348ed
Opcode Fuzzy Hash: 0e8decf08ffcf42e36446defa7b9fc8eaea003f80f69816cc42936f12a4f8683
Instruction Fuzzy Hash: C3517E72B0968286EB218F21D8502BD73A0EB89B98F484176DA5DCB795EF3CE565C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FDE260 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

iswdigit.MSVCRT ref: 00007FF6D9FDE29D
iswdigit.MSVCRT ref: 00007FF6D9FDE310

Strings

GeToken: (%x) '%s', xrefs: 00007FF6D9FECC39

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: iswdigit
String ID: GeToken: (%x) '%s'
API String ID: 3849470556-1994581435
Opcode ID: 6f2266824f556b61efcee7c2a2893d7da7f07ebce486ed85b38b9357e29a252f
Instruction ID: a23a8855d200afe2a46fa9d6065e08542043ba8b1f68b2c28771978e8150bd7c
Opcode Fuzzy Hash: 6f2266824f556b61efcee7c2a2893d7da7f07ebce486ed85b38b9357e29a252f
Instruction Fuzzy Hash: 45516532A0CA4286EB249F56A44427E7BA0FF95B58F408437DA4DC7391EF7DE8A4C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FF992C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 121registryCOMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FF9A10
RegEnumKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6D9FF9994

Part of subcall function 00007FF6D9FFA73C: RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF6D9FF9A82), ref: 00007FF6D9FFA77A
Part of subcall function 00007FF6D9FFA73C: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF6D9FF9A82), ref: 00007FF6D9FFA839
Part of subcall function 00007FF6D9FFA73C: RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF6D9FF9A82), ref: 00007FF6D9FFA850

wcsrchr.MSVCRT ref: 00007FF6D9FF9A62

Strings

%s=%s, xrefs: 00007FF6D9FF99E1, 00007FF6D9FF9AA0
., xrefs: 00007FF6D9FF99AA

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: ErrorLast$CloseEnumOpenwcsrchr
String ID: %s=%s$.
API String ID: 3242694432-4275322459
Opcode ID: 93cd8132ec43aa136fa1977c97fa5e218ef6435ae6b1180140c0b1f530de0a7c
Instruction ID: b61696781aa2e7b9fb67fd01a7daf688c3975e70f8224cb52d1a3818f327971c
Opcode Fuzzy Hash: 93cd8132ec43aa136fa1977c97fa5e218ef6435ae6b1180140c0b1f530de0a7c
Instruction Fuzzy Hash: 4F41A225B0D74386FE219F11A0502BD62A1FF867A8F544236DE5D877D6EE7CE4A9C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FF54B0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 120synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FF6D9FF54E6
CreateMutexExW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6D9FF552E

Part of subcall function 00007FF6D9FF758C: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FF6D9FF6999,?,?,?,?,?,00007FF6D9FE8C39), ref: 00007FF6D9FF75AE
Part of subcall function 00007FF6D9FF758C: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FF6D9FF6999,?,?,?,?,?,00007FF6D9FE8C39), ref: 00007FF6D9FF75C6

Strings

Local\SM0:%d:%d:%hs, xrefs: 00007FF6D9FF54F7
wil, xrefs: 00007FF6D9FF5592, 00007FF6D9FF55B8, 00007FF6D9FF55E2, 00007FF6D9FF5674
x, xrefs: 00007FF6D9FF5501

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: ErrorLast$CreateCurrentMutexProcess
String ID: Local\SM0:%d:%d:%hs$wil$x
API String ID: 779401067-630742106
Opcode ID: 455202d7a479b8eb008443c79237f92c22bbe4b1cb8e523106a0b0b2338ac627
Instruction ID: 91c5473343baedd0b6d627953ddb36c46af7019b94f4d7d7033b805785012496
Opcode Fuzzy Hash: 455202d7a479b8eb008443c79237f92c22bbe4b1cb8e523106a0b0b2338ac627
Instruction Fuzzy Hash: 87516072A1CA8682EB219F51E4407FEA361EF84B8CF544033EA4DCBA55DE7CE519C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE417C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6D9FE41AD
towupper.MSVCRT ref: 00007FF6D9FE41E1

Strings

:, xrefs: 00007FF6D9FE41F2
:, xrefs: 00007FF6D9FEECC3

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: CurrentDirectorytowupper
String ID: :$:
API String ID: 238703822-3780739392
Opcode ID: a6328a6c3dc4b43d0528279963caee78f723bc6a38f6b0cfe87d14265630f542
Instruction ID: 5e3a879f7ff5f04226dd77d0cfcbef3453e0d274955e04751b819d720bd71d0a
Opcode Fuzzy Hash: a6328a6c3dc4b43d0528279963caee78f723bc6a38f6b0cfe87d14265630f542
Instruction Fuzzy Hash: 9711045260C74185EB268F62A80427DB6A0EF49799F459137DD0DC7791DF3CD0518705

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD4C18 Relevance: 7.7, APIs: 5, Instructions: 163COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6D9FD4C78

Part of subcall function 00007FF6D9FDCA40: memset.MSVCRT ref: 00007FF6D9FDCAB3

wcsrchr.MSVCRT ref: 00007FF6D9FD4CB9
wcsrchr.MSVCRT ref: 00007FF6D9FD4CE6
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD4DD7
wcschr.MSVCRT ref: 00007FF6D9FF28DB

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: memsetwcsrchr$wcschr
String ID:
API String ID: 110935159-0
Opcode ID: 7f89d826d325d620df1b2fcc26921faad221c5699a8a27cefdce3e68956840aa
Instruction ID: ee179f787bff181f136049ce8a924e0375a0cbc51c44d366cc40b61f59250205
Opcode Fuzzy Hash: 7f89d826d325d620df1b2fcc26921faad221c5699a8a27cefdce3e68956840aa
Instruction Fuzzy Hash: B9518122B0978285FA319F1198147FD6295BB89BA8F484532CE5E8B7D5DF3CE566C200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE5EE4 Relevance: 7.6, APIs: 5, Instructions: 146COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6D9FE5F5D

Part of subcall function 00007FF6D9FDCA40: memset.MSVCRT ref: 00007FF6D9FDCAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FE6029

Part of subcall function 00007FF6D9FE417C: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6D9FE41AD

towupper.MSVCRT ref: 00007FF6D9FE5FFE

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: memset$CurrentDirectorytowupper
String ID:
API String ID: 1403193329-0
Opcode ID: 42cade6b9a84014cdd55cf9873a1d02384d54167611cbf46e5f63f406bd17b97
Instruction ID: a336c245adbb443a3f99316853b43dd22ae2e995bcd7b8969337129e18864c9c
Opcode Fuzzy Hash: 42cade6b9a84014cdd55cf9873a1d02384d54167611cbf46e5f63f406bd17b97
Instruction Fuzzy Hash: E151C126B0979685EB65DF21D8006BE77A0FF49798F458137CA1DC7698EF3CE9648300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD91C0 Relevance: 7.6, APIs: 5, Instructions: 138COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6D9FD921C

Part of subcall function 00007FF6D9FDCA40: memset.MSVCRT ref: 00007FF6D9FDCAB3

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD93AA

Part of subcall function 00007FF6D9FD8B20: wcsrchr.MSVCRT ref: 00007FF6D9FD8BAB
Part of subcall function 00007FF6D9FD8B20: _wcsicmp.MSVCRT ref: 00007FF6D9FD8BD4
Part of subcall function 00007FF6D9FD8B20: _wcsicmp.MSVCRT ref: 00007FF6D9FD8BF2
Part of subcall function 00007FF6D9FD8B20: GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FD8C16
Part of subcall function 00007FF6D9FD8B20: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FD8C2F
Part of subcall function 00007FF6D9FD8B20: wcschr.MSVCRT ref: 00007FF6D9FD8CB3

Part of subcall function 00007FF6D9FE417C: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6D9FE41AD

Part of subcall function 00007FF6D9FE3060: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,00000000,0000000A,00007FF6D9FD92AC), ref: 00007FF6D9FE30CA
Part of subcall function 00007FF6D9FE3060: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FE30DD
Part of subcall function 00007FF6D9FE3060: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FE30F6
Part of subcall function 00007FF6D9FE3060: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FE3106

wcsrchr.MSVCRT ref: 00007FF6D9FD92D8
GetFileAttributesW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FD9362
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FD9373

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Error$Mode$AttributesFileLast_wcsicmpmemsetwcsrchr$CurrentDirectoryFullNamePathwcschr
String ID:
API String ID: 3966000956-0
Opcode ID: ebfeb5aba0ebfd8d4bf52c22c54dc17d70488fb3d721b256590214c2a6c830f5
Instruction ID: baab95ee3614731f223c6d90366492c2bc9e60863b7587491d8bc8be48b47ad7
Opcode Fuzzy Hash: ebfeb5aba0ebfd8d4bf52c22c54dc17d70488fb3d721b256590214c2a6c830f5
Instruction Fuzzy Hash: 90518C32A0A78286EB619F21D8503BD73A4FF89B98F044136DA4D87B95DF3CE5A1C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD2A30 Relevance: 7.6, APIs: 5, Instructions: 119COMMON

Download Yara Rule

APIs

_setjmp.MSVCRT ref: 00007FF6D9FD2A6A
memset.MSVCRT ref: 00007FF6D9FD2AB4
memset.MSVCRT ref: 00007FF6D9FD2AD8
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD2BED
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD2C0D

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: memset$_setjmp
String ID:
API String ID: 3883041866-0
Opcode ID: ecc4c4b8fdff3fe7128d071ff51470f6781c2868d41e5204ec9995c2413b862b
Instruction ID: c72bb648f2ae633e504617547bd75084714dbfb7d4ea6b67e9fcd77b197963ee
Opcode Fuzzy Hash: ecc4c4b8fdff3fe7128d071ff51470f6781c2868d41e5204ec9995c2413b862b
Instruction Fuzzy Hash: 8F514A32A08B868AEB618F21D8503ED77A4EB89748F444176EA4DCBB49DF3CD655CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FDB49C Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 00007FF6D9FDB4BD

Part of subcall function 00007FF6D9FE06C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6D9FDB4DB), ref: 00007FF6D9FE06D6
Part of subcall function 00007FF6D9FE06C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6D9FDB4DB), ref: 00007FF6D9FE06F0
Part of subcall function 00007FF6D9FE06C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6D9FDB4DB), ref: 00007FF6D9FE074D
Part of subcall function 00007FF6D9FE06C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6D9FDB4DB), ref: 00007FF6D9FE0762

_wcsicmp.MSVCRT ref: 00007FF6D9FDB518
_wcsicmp.MSVCRT ref: 00007FF6D9FDB58B

Strings

IF/?, xrefs: 00007FF6D9FDB4B4
ELSE, xrefs: 00007FF6D9FDB584

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Heap$_wcsicmp$AllocProcess
String ID: ELSE$IF/?
API String ID: 3223794493-1134991328
Opcode ID: 0034adf53437ebe6a267bb6454d80c232a79fbc284ac909260ddb0eac2ce684d
Instruction ID: f9a0a88a3c1c2bb1ffac5d09f4370232ff16967e7d6cd4f10ced25460606d3b6
Opcode Fuzzy Hash: 0034adf53437ebe6a267bb6454d80c232a79fbc284ac909260ddb0eac2ce684d
Instruction Fuzzy Hash: 47415721E0D74386FB65AF25A4113BE26A1AFC4759F98507BD90EC739AEF3DE4248700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FFE3E8 Relevance: 7.6, APIs: 5, Instructions: 105fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF6D9FFE43A
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FFE45A
_get_osfhandle.MSVCRT ref: 00007FF6D9FFE4D9
SetFilePointer.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FFE4F1

Part of subcall function 00007FF6D9FFD9D0: longjmp.MSVCRT(?,?,00000000,00007FF6D9FF048E), ref: 00007FF6D9FFDA58
Part of subcall function 00007FF6D9FFD9D0: memset.MSVCRT ref: 00007FF6D9FFDAD6
Part of subcall function 00007FF6D9FFD9D0: memset.MSVCRT ref: 00007FF6D9FFDAFC
Part of subcall function 00007FF6D9FFD9D0: memset.MSVCRT ref: 00007FF6D9FFDB22

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: memset$File_get_osfhandle$PointerReadlongjmp
String ID:
API String ID: 1532185241-0
Opcode ID: 74ac34f79dc729dfe9fabf90352e3cd61509ac7904d18460f6508b34cf2d1b9f
Instruction ID: dc2a31d4a969d3e422c99fe931681ae6899045eb79c3a6915ce874b1eb74c036
Opcode Fuzzy Hash: 74ac34f79dc729dfe9fabf90352e3cd61509ac7904d18460f6508b34cf2d1b9f
Instruction Fuzzy Hash: 7841F732A087528BE7149F21D44567D7AA1FB88B88F55853BEA0EC7795CF3CE859C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD4FE8 Relevance: 7.6, APIs: 5, Instructions: 102fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF6D9FD5012
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FD5030
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FF2A84
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FF2AD8
DeleteFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FF2B0F

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: ErrorFileLast$DeleteRead_get_osfhandle
String ID:
API String ID: 3588551418-0
Opcode ID: 3c6522b718a1d61b4de818cf2d479c220fced2fb809985683797a1d35ac47786
Instruction ID: f10e4fa8f21df851f2ad44610806bd35b7c709d54a5ac31a8af0f8ea96270663
Opcode Fuzzy Hash: 3c6522b718a1d61b4de818cf2d479c220fced2fb809985683797a1d35ac47786
Instruction Fuzzy Hash: EF419F32A0C643CBE7249F51A4842BDB661EF85B89F14813ADA4EC7796CF7CE8648740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FFE558 Relevance: 7.6, APIs: 5, Instructions: 100COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6D9FFE5AD
memset.MSVCRT ref: 00007FF6D9FFE5D2

Part of subcall function 00007FF6D9FDCA40: memset.MSVCRT ref: 00007FF6D9FDCAB3

_wcsicmp.MSVCRT ref: 00007FF6D9FFE6A0
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FFE6CB
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FFE6EB

Part of subcall function 00007FF6D9FE3060: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,00000000,0000000A,00007FF6D9FD92AC), ref: 00007FF6D9FE30CA
Part of subcall function 00007FF6D9FE3060: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FE30DD
Part of subcall function 00007FF6D9FE3060: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FE30F6
Part of subcall function 00007FF6D9FE3060: SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FE3106

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: ErrorModememset$FullNamePath_wcsicmp
String ID:
API String ID: 2123716050-0
Opcode ID: adb19cba2c66798b02c2a5bbb02a13772110447b40978f30d8852c1ecb13dfff
Instruction ID: 391248221c2ec96eabc55045fb6a7105c3cf8068241ad4da86efccaa47f8f57e
Opcode Fuzzy Hash: adb19cba2c66798b02c2a5bbb02a13772110447b40978f30d8852c1ecb13dfff
Instruction Fuzzy Hash: 57417D32709BC68AEB729F25D8543ED2794EB49B8CF044135DA4D8BA99DF3CD258C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD65F8 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

RoInitialize.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF6D9FD6627
GetConsoleWindow.API-MS-WIN-CORE-KERNEL32-LEGACY-L1-1-0 ref: 00007FF6D9FD6642

Part of subcall function 00007FF6D9FE5A68: _get_osfhandle.MSVCRT ref: 00007FF6D9FE5A89
Part of subcall function 00007FF6D9FE5A68: SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF6D9FE5A9E
Part of subcall function 00007FF6D9FE5A68: _get_osfhandle.MSVCRT ref: 00007FF6D9FE5AAC

memset.MSVCRT ref: 00007FF6D9FD6697
GetConsoleWindow.API-MS-WIN-CORE-KERNEL32-LEGACY-L1-1-0 ref: 00007FF6D9FD66B0
RoUninitialize.API-MS-WIN-CORE-WINRT-L1-1-0 ref: 00007FF6D9FD670C

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Console$Window_get_osfhandle$InitializeModeUninitializememset
String ID:
API String ID: 3114114779-0
Opcode ID: 1d3c40c4db9270235dfbff6205660991289e4dcca270832023e59d6b38883110
Instruction ID: 4a203907f67a0129a1272d3802bf86e29f64f7b3d2e545b928b0e395862289f1
Opcode Fuzzy Hash: 1d3c40c4db9270235dfbff6205660991289e4dcca270832023e59d6b38883110
Instruction Fuzzy Hash: 2B410636A09B46CAEB10CF65E8802AC37A5FB88B48F554136EA0D97B54DF38E426C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FFA73C Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF6D9FF9A82), ref: 00007FF6D9FFA77A
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF6D9FF9A82), ref: 00007FF6D9FFA7AF
RegQueryValueExW.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF6D9FF9A82), ref: 00007FF6D9FFA80E
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF6D9FF9A82), ref: 00007FF6D9FFA839
RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0(?,?,?,?,00000000,00000000,00000000,00007FF6D9FF9A82), ref: 00007FF6D9FFA850

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: QueryValue$CloseErrorLastOpen
String ID:
API String ID: 2240656346-0
Opcode ID: 259df60cb868630656fe61ae38790f52a7232b22d9cc8ec1dbee3975f468035b
Instruction ID: 2a64e71f33daeea9f1b4326aad9a98022e6000a9848d6dbd2cd61c013504d583
Opcode Fuzzy Hash: 259df60cb868630656fe61ae38790f52a7232b22d9cc8ec1dbee3975f468035b
Instruction Fuzzy Hash: A8316D32A18B8286E7608F15E44057EB7A5FFC9794F944136EA8E83764EF3CD865CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FFD0C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D9FE01B8: _get_osfhandle.MSVCRT ref: 00007FF6D9FE01C4
Part of subcall function 00007FF6D9FE01B8: GetFileType.KERNELBASE(?,?,?,00007FF6D9FEE904,?,?,?,?,00000000,00007FF6D9FE3491,?,?,?,00007FF6D9FF4420), ref: 00007FF6D9FE01D6

GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6D9FFD0F9
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF6D9FFD10F
ScrollConsoleScreenBufferW.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF6D9FFD166
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6D9FFD17A
SetConsoleCursorPosition.API-MS-WIN-CORE-CONSOLE-L2-1-0 ref: 00007FF6D9FFD18C

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Console$BufferHandleScreen$CursorFileInfoPositionScrollType_get_osfhandle
String ID:
API String ID: 3008996577-0
Opcode ID: 775351d33c26abc02f1100cdbdeabd86f6200afad19b0e0b5f91a628eacd3d33
Instruction ID: c5a666b51ac85a09aa0d9bd4c5312d66ed8523199674fac2c3002a5198080f64
Opcode Fuzzy Hash: 775351d33c26abc02f1100cdbdeabd86f6200afad19b0e0b5f91a628eacd3d33
Instruction Fuzzy Hash: 99214926B18A428AF7109F71E8000BD77B0FB4DB49B445266EE0D93B99EF3CD054CB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE5CB4 Relevance: 7.5, APIs: 5, Instructions: 36synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FF6D9FFC9EE,?,?,?,00007FF6D9FFEA6C,?,?,?,00007FF6D9FFE925), ref: 00007FF6D9FE5CCB
GetExitCodeProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FF6D9FFC9EE,?,?,?,00007FF6D9FFEA6C,?,?,?,00007FF6D9FFE925), ref: 00007FF6D9FE5CDF
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6D9FE5D03
fprintf.MSVCRT ref: 00007FF6D9FEF4A9
fflush.MSVCRT ref: 00007FF6D9FEF4C2

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: CloseCodeExitHandleObjectProcessSingleWaitfflushfprintf
String ID:
API String ID: 1826527819-0
Opcode ID: 424fc31126f981a1d5e6876f03eadb09916e9ca5210b05511d0996a25080ff4f
Instruction ID: f20d0ef5fef028f63953b386cf27ec62bf69a4312f4f6778a8ced7f3e625524f
Opcode Fuzzy Hash: 424fc31126f981a1d5e6876f03eadb09916e9ca5210b05511d0996a25080ff4f
Instruction Fuzzy Hash: 37016D3190C6838AE614AF26E4451BDBFA1FF8A759F445172E64F833A2DF3C90A4C715

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FF5770 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 169COMMON

Download Yara Rule

APIs

CreateSemaphoreExW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6D9FF5874
CreateSemaphoreExW.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FF6D9FF595E

Strings

wil, xrefs: 00007FF6D9FF58A8, 00007FF6D9FF5993
_p0, xrefs: 00007FF6D9FF5811

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: CreateSemaphore
String ID: _p0$wil
API String ID: 1078844751-1814513734
Opcode ID: f755fc07889d6bdabc5bc906762bcb13605c747dc28133a8421b38486d33263f
Instruction ID: 089cfeebfaf513ff43b558270779dc3343fbfdebcfa5a0e4dcd973f6de3929d0
Opcode Fuzzy Hash: f755fc07889d6bdabc5bc906762bcb13605c747dc28133a8421b38486d33263f
Instruction Fuzzy Hash: 37510662B1D78286EF268F95C4546BD7290EF84B98F944437DA4D8BB81EF3CE429C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DA000774 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6DA0007DA

Part of subcall function 00007FF6D9FDCA40: memset.MSVCRT ref: 00007FF6D9FDCAB3

_wcslwr.MSVCRT ref: 00007FF6DA00085B
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6DA0008A9

Strings

[%s], xrefs: 00007FF6DA00080F

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: memset$_wcslwr
String ID: [%s]
API String ID: 886762496-302437576
Opcode ID: edde6ab5db54e3a5535b346c374fc5c976f6442aa931e6f93dfa572844f0dcb2
Instruction ID: cb5daf87e3d7779ebd7d7b4b9c94f159bbec6cae2bde87077109d7edc63f891f
Opcode Fuzzy Hash: edde6ab5db54e3a5535b346c374fc5c976f6442aa931e6f93dfa572844f0dcb2
Instruction Fuzzy Hash: 8B315932719B8285EB21DF22D8507ED67A0FB89B88F444176DA8D8BB55DF3CD2598700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE32E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D9FE33A8: iswspace.MSVCRT ref: 00007FF6D9FE33C0

iswspace.MSVCRT ref: 00007FF6D9FE331C

Strings

off, xrefs: 00007FF6D9FE3386

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: iswspace
String ID: off
API String ID: 2389812497-733764931
Opcode ID: 088d681940e04da477f785b2bbe99dbe59d8cc7102cbb33f94b164d50eee713f
Instruction ID: 4c422c1200e19a06a84bcebd83101cfc8f65d933701f860f4717bf9b1287e46f
Opcode Fuzzy Hash: 088d681940e04da477f785b2bbe99dbe59d8cc7102cbb33f94b164d50eee713f
Instruction Fuzzy Hash: AE21CD21F0C6538AFB629F16A41967D76A0EF85B80F498037DA0EC7681DFACE9608301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FF9308 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 56COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 00007FF6D9FF9350

Part of subcall function 00007FF6D9FE09F4: iswspace.MSVCRT ref: 00007FF6D9FE0A11
Part of subcall function 00007FF6D9FE09F4: wcschr.MSVCRT ref: 00007FF6D9FE0A2B

Part of subcall function 00007FF6D9FDD3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FDD46E
Part of subcall function 00007FF6D9FDD3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FDD485
Part of subcall function 00007FF6D9FDD3F0: wcschr.MSVCRT ref: 00007FF6D9FDD4EE
Part of subcall function 00007FF6D9FDD3F0: iswspace.MSVCRT ref: 00007FF6D9FDD54D
Part of subcall function 00007FF6D9FDD3F0: wcschr.MSVCRT ref: 00007FF6D9FDD569
Part of subcall function 00007FF6D9FDD3F0: wcschr.MSVCRT ref: 00007FF6D9FDD58C

Strings

%s=%s, xrefs: 00007FF6D9FF93C0
DPATH, xrefs: 00007FF6D9FF9361, 00007FF6D9FF939F
PATH, xrefs: 00007FF6D9FF9371, 00007FF6D9FF93AA

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: wcschr$Heapiswspace$AllocProcess
String ID: %s=%s$DPATH$PATH
API String ID: 3731854180-3148396303
Opcode ID: 34f873565fd016488015724989cbd239f180fad801886fccff01315d739e6408
Instruction ID: cb9c35f0a3f21039ada32ee29c392458c938793dac565a29972a47d006a2a89a
Opcode Fuzzy Hash: 34f873565fd016488015724989cbd239f180fad801886fccff01315d739e6408
Instruction Fuzzy Hash: B8216D22B0D65781EE549F56E44027D27A4EF84B88F88813BD94EC7396DE3DE5A8C344

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE8198 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

wcscmp.MSVCRT ref: 00007FF6D9FE81EA
wcscmp.MSVCRT ref: 00007FF6D9FE81FD

Strings

????????.???, xrefs: 00007FF6D9FE81F3
*.*, xrefs: 00007FF6D9FE81E0

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: wcscmp
String ID: *.*$????????.???
API String ID: 3392835482-3870530610
Opcode ID: 2267b9e2c7923373c3284e1f11a26023b10064941758683347217dc228a16a6c
Instruction ID: 9e76167517a1e7c24cd656666f880a586b15d1932f0c00181802d31459ad221c
Opcode Fuzzy Hash: 2267b9e2c7923373c3284e1f11a26023b10064941758683347217dc228a16a6c
Instruction Fuzzy Hash: 4411A125B28A6281E764AF26B44053E73A1FB84B80F185432DE9DC7B89DE3DE4A19700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FF9114 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF6D9FF9146

Strings

Null environment, xrefs: 00007FF6D9FF9138
%s, xrefs: 00007FF6D9FF9179
CMD Internal Error %s, xrefs: 00007FF6D9FF913F

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: fprintf
String ID: CMD Internal Error %s$%s$Null environment
API String ID: 383729395-2781220306
Opcode ID: a21cc71c92a28a327d8f8da80eebadce277acf6e437ff25654f6a6615f0d9dc9
Instruction ID: 4a9c0557a5a0bf88ae48c4e572252686e229126ee61525efb656bce85ec0c577
Opcode Fuzzy Hash: a21cc71c92a28a327d8f8da80eebadce277acf6e437ff25654f6a6615f0d9dc9
Instruction Fuzzy Hash: 5A119E2290C64292EB659F15E9040BE6361EB44BF8F444333DA7DC32E5EF2CE4A9C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE09F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

iswspace.MSVCRT ref: 00007FF6D9FE0A11
wcschr.MSVCRT ref: 00007FF6D9FE0A2B

Strings

=,;, xrefs: 00007FF6D9FE0A24
$P$G, xrefs: 00007FF6D9FE09FE

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: iswspacewcschr
String ID: $P$G$=,;
API String ID: 287713880-3338425643
Opcode ID: 8fcb7a04138a3b23992a7cdb16ce22985c951060ce84957cc9b0662892501dea
Instruction ID: 6cfe2d8c0cffc21897a89587457be01a6ab5c2282d32ae5ab366b1bc3ac532b4
Opcode Fuzzy Hash: 8fcb7a04138a3b23992a7cdb16ce22985c951060ce84957cc9b0662892501dea
Instruction Fuzzy Hash: 06F04F21A1C65781EA648F02E40017E66A0FF49F55B4E9172DA5EC3294EF2CE460C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE04F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF6D9FE0525
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF6D9FE0554

Strings

SetThreadUILanguage, xrefs: 00007FF6D9FE054D
KERNEL32.DLL, xrefs: 00007FF6D9FE051E

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: KERNEL32.DLL$SetThreadUILanguage
API String ID: 1646373207-2530943252
Opcode ID: 33fd74526e8d725267334377f69302da3f837b9787d184b3d8809460f86dc4c4
Instruction ID: 77f066ad304caf1719f6ae423f9eda9873b537e5d8f711e1c93b78c489829c69
Opcode Fuzzy Hash: 33fd74526e8d725267334377f69302da3f837b9787d184b3d8809460f86dc4c4
Instruction Fuzzy Hash: 77011621E0DB0795EA648F12E89117C26A0EF49738F4803BBD53EC37E1DE3CA4A08309

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FF73C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF6D9FF73DF
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0 ref: 00007FF6D9FF73F5

Strings

RaiseFailFastException, xrefs: 00007FF6D9FF73EE
kernelbase.dll, xrefs: 00007FF6D9FF73D5

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RaiseFailFastException$kernelbase.dll
API String ID: 1646373207-919018592
Opcode ID: 3febe13a05f537dc5e67cec473ac92f04f036d5fc975d7a9241dfcd9d5059c04
Instruction ID: b1f94110006ba3581e607d4a5dd7ec11761bf233e7ae17e35f8de1ef9d3bc532
Opcode Fuzzy Hash: 3febe13a05f537dc5e67cec473ac92f04f036d5fc975d7a9241dfcd9d5059c04
Instruction Fuzzy Hash: 68F03A21A1CB82D2EA218F12F48407DAA64FF89BD4B489176DA4E43B55CF3CD4A5C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD1130 Relevance: 6.2, APIs: 4, Instructions: 156COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6D9FD138B

Part of subcall function 00007FF6D9FDCA40: memset.MSVCRT ref: 00007FF6D9FDCAB3

Part of subcall function 00007FF6D9FD1140: towupper.MSVCRT ref: 00007FF6D9FD11D3

Part of subcall function 00007FF6D9FE417C: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6D9FE41AD

??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FD14A6

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: memset$CurrentDirectorytowupper
String ID:
API String ID: 1403193329-0
Opcode ID: 75660f6856c69554ae932a378ce653c19d9fc1fbde94745acc7eff884b108f9d
Instruction ID: e9f5075b82b5d363117467560ba73f58fc3a7b119724f66ac7d4460135535e5f
Opcode Fuzzy Hash: 75660f6856c69554ae932a378ce653c19d9fc1fbde94745acc7eff884b108f9d
Instruction Fuzzy Hash: FF61AE32B08B828AEB64CF65D8402ED37A4FB86758F544236DE5D87B99DF38E460C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE4878 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

_wcsnicmp.MSVCRT ref: 00007FF6D9FE48DE
_wcsnicmp.MSVCRT ref: 00007FF6D9FE48FF
wcschr.MSVCRT ref: 00007FF6D9FE493E

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: _wcsnicmp$wcschr
String ID:
API String ID: 3270668897-0
Opcode ID: 22e468a1066d2a7b4628bd12889ba0c42cb96d54184fe1910575478c052ba21c
Instruction ID: c84afb28f057b28e2f944ad35814df40f1046ae1e3f11ce0801b5454d25da333
Opcode Fuzzy Hash: 22e468a1066d2a7b4628bd12889ba0c42cb96d54184fe1910575478c052ba21c
Instruction Fuzzy Hash: 96516C12E0C64381EB65AF12E4101BD73A1EF85B84F598137DA5EC72DAEF2CE9A5C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE3060 Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D9FE1EA0: wcschr.MSVCRT ref: 00007FF6D9FE1EB3

SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,00000000,0000000A,00007FF6D9FD92AC), ref: 00007FF6D9FE30CA
SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FE30DD
GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FE30F6
SetErrorMode.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FE3106

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: ErrorMode$FullNamePathwcschr
String ID:
API String ID: 1464828906-0
Opcode ID: 4608740039e49971374e978e9372c54a28b1034dfcf154244c984753711d5cb1
Instruction ID: b94e44e7061b6e8400ef56dbfa2cba3367d9ef405c3b4438a158a15a330f50b4
Opcode Fuzzy Hash: 4608740039e49971374e978e9372c54a28b1034dfcf154244c984753711d5cb1
Instruction Fuzzy Hash: 38313521E0871282E7249F16B44407EB660FB89B94F54823ADE4EC33E1EFBDE8558305

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FFF358 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6D9FFF3B5

Part of subcall function 00007FF6D9FDCA40: memset.MSVCRT ref: 00007FF6D9FDCAB3

GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FFF401
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FFF442
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6D9FFF468

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: memset$DriveFullNamePathType
String ID:
API String ID: 3442494845-0
Opcode ID: c4faa7a40be53a6a0e94dcc52435e0141cda1ae593caa646d4c93336f675662c
Instruction ID: 40923c59b46e00f2d70098740c4523c67175766ea52977389f6392fad10edc0f
Opcode Fuzzy Hash: c4faa7a40be53a6a0e94dcc52435e0141cda1ae593caa646d4c93336f675662c
Instruction Fuzzy Hash: 06316A32619B828AEB60DF21E8407ED77A4FB89B88F444136EA4D87B54CF38D655C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE8F80 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00007FF6D9FE8FF3
RtlLookupFunctionEntry.NTDLL ref: 00007FF6D9FE9012
RtlVirtualUnwind.NTDLL ref: 00007FF6D9FE905F
__raise_securityfailure.LIBCMT ref: 00007FF6D9FE9144

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: f9503a7e6f26e693eab0e8ec34dcabcd79a91a5ad0fdcc229cb5dec8ce22a0f7
Instruction ID: 2df8bd289411d597424f17ef1a528a11c8f5c2ed7b9d6b43688fbe7fe459295e
Opcode Fuzzy Hash: f9503a7e6f26e693eab0e8ec34dcabcd79a91a5ad0fdcc229cb5dec8ce22a0f7
Instruction Fuzzy Hash: 4D41C236A1CB4285EA509F0AF88036973A4FB98758F904077EA8DC37A6DF7CE464C754

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD4F58 Relevance: 6.1, APIs: 4, Instructions: 72filetimeCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF6D9FF29C4
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FF29E9
_get_osfhandle.MSVCRT ref: 00007FF6D9FF2A22
SetFileTime.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FF2A39

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: File_get_osfhandle$TimeWrite
String ID:
API String ID: 4019809305-0
Opcode ID: d6e0d171c53f5369992abdeba5891b91cfcb4b54cba11b48034f7f063fb4038d
Instruction ID: 3fd03f55ce2f064e2d8edc70b02fb70849d931e1fbf9fd71ff73b11d2c16400e
Opcode Fuzzy Hash: d6e0d171c53f5369992abdeba5891b91cfcb4b54cba11b48034f7f063fb4038d
Instruction Fuzzy Hash: 06318421A0C74686E7A14F1594843BC6791FF4AB68F54523AD94DC7BE6CF3CD868D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE8470 Relevance: 6.1, APIs: 4, Instructions: 72stringCOMMON

Download Yara Rule

APIs

wcstol.MSVCRT ref: 00007FF6D9FE848E
wcstol.MSVCRT ref: 00007FF6D9FE84A8
lstrcmpW.API-MS-WIN-CORE-STRING-OBSOLETE-L1-1-0 ref: 00007FF6D9FE853F

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: wcstol$lstrcmp
String ID:
API String ID: 3515581199-0
Opcode ID: 5b9efed5608bd49f2816daba6a3b85e90b3500fb38e55be3423670eddfbfd6ec
Instruction ID: da46ce5846b9652b32d615c0324098869694c613185dad2a57088fc267809434
Opcode Fuzzy Hash: 5b9efed5608bd49f2816daba6a3b85e90b3500fb38e55be3423670eddfbfd6ec
Instruction Fuzzy Hash: 0B21DD32A0C74283E661AF79A49413EABA4FB89790F156436CB5FC3A94CF7CE4648700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FFE810 Relevance: 6.1, APIs: 4, Instructions: 67fileCOMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF6D9FFE836
WriteFile.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FFE855
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FF6D9FFE877
DeleteFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FFE8AE

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: File$DeleteErrorLastWrite_get_osfhandle
String ID:
API String ID: 2448200120-0
Opcode ID: 5318b056ea043fb93afd7df068f18b2bd02fbcfad57a2dcdf0d64c223e63ef0d
Instruction ID: de8b953eb50096511bb6ae60bdd880e10272e3225920844bea2c10f66eaf4fab
Opcode Fuzzy Hash: 5318b056ea043fb93afd7df068f18b2bd02fbcfad57a2dcdf0d64c223e63ef0d
Instruction Fuzzy Hash: 9B214D31A0CB4287E715AF11A44027DB6A1FB85B89F44417AE94EC7795CF3CE475CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DA001914 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF6DA00196F

Part of subcall function 00007FF6D9FDCA40: memset.MSVCRT ref: 00007FF6D9FDCAB3

GetVolumePathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6DA0019B3
GetDriveTypeW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6DA0019D6
??_V@YAXPEAX@Z.MSVCRT ref: 00007FF6DA001A01

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: memset$DriveNamePathTypeVolume
String ID:
API String ID: 1029679093-0
Opcode ID: 98c11749b4d10f39a46d47e0adf4f6b8e1502341a23e0233d90f7bb3d593d270
Instruction ID: 210f17b599854c59c05387b75b2cb9925deab4729fd241a1a364eab643effe54
Opcode Fuzzy Hash: 98c11749b4d10f39a46d47e0adf4f6b8e1502341a23e0233d90f7bb3d593d270
Instruction Fuzzy Hash: A3313A32709B828AEB318F62D8553EC67A4FB89B88F444176CA4D87B49DF3CD655C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE7CF8 Relevance: 6.1, APIs: 4, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FE7D54
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FE7D68

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 42f91e47f3ef5671c9468e2150952d512ccb49b47a4aa8ec2999c576e9d14cb8
Instruction ID: aaac57db1b7ee0c69884da99052f2c58c2564b3b148cc823b9bc53bc10579187
Opcode Fuzzy Hash: 42f91e47f3ef5671c9468e2150952d512ccb49b47a4aa8ec2999c576e9d14cb8
Instruction Fuzzy Hash: 0221C865B0CB4286EA249F52B94007E7BA1FF8ABD4B489231CE5E83796DF3CE0158700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD6A48 Relevance: 6.1, APIs: 4, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D9FE3C24: GetCurrentDirectoryW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FF6D9FE3D0C
Part of subcall function 00007FF6D9FE3C24: towupper.MSVCRT ref: 00007FF6D9FE3D2F
Part of subcall function 00007FF6D9FE3C24: iswalpha.MSVCRT ref: 00007FF6D9FE3D4F
Part of subcall function 00007FF6D9FE3C24: towupper.MSVCRT ref: 00007FF6D9FE3D75
Part of subcall function 00007FF6D9FE3C24: GetFullPathNameW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FE3DBF

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6D9FFEA0F,?,?,?,00007FF6D9FFE925,?,?,?,?,00007FF6D9FDB9B1), ref: 00007FF6D9FD6ABF
RtlFreeHeap.NTDLL(?,?,?,00007FF6D9FFEA0F,?,?,?,00007FF6D9FFE925,?,?,?,?,00007FF6D9FDB9B1), ref: 00007FF6D9FD6AD3

Part of subcall function 00007FF6D9FD6B84: SetEnvironmentStringsW.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,00007FF6D9FD6AE8,?,?,?,00007FF6D9FFEA0F,?,?,?,00007FF6D9FFE925), ref: 00007FF6D9FD6B8B
Part of subcall function 00007FF6D9FD6B84: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,?,00007FF6D9FD6AE8,?,?,?,00007FF6D9FFEA0F,?,?,?,00007FF6D9FFE925), ref: 00007FF6D9FD6B97
Part of subcall function 00007FF6D9FD6B84: RtlFreeHeap.NTDLL(?,?,?,?,00007FF6D9FD6AE8,?,?,?,00007FF6D9FFEA0F,?,?,?,00007FF6D9FFE925), ref: 00007FF6D9FD6BAF

Part of subcall function 00007FF6D9FD6B30: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6D9FD6AF1,?,?,?,00007FF6D9FFEA0F,?,?,?,00007FF6D9FFE925), ref: 00007FF6D9FD6B39
Part of subcall function 00007FF6D9FD6B30: RtlFreeHeap.NTDLL(?,?,?,00007FF6D9FD6AF1,?,?,?,00007FF6D9FFEA0F,?,?,?,00007FF6D9FFE925), ref: 00007FF6D9FD6B4D
Part of subcall function 00007FF6D9FD6B30: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6D9FD6AF1,?,?,?,00007FF6D9FFEA0F,?,?,?,00007FF6D9FFE925), ref: 00007FF6D9FD6B59

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6D9FFEA0F,?,?,?,00007FF6D9FFE925,?,?,?,?,00007FF6D9FDB9B1), ref: 00007FF6D9FD6B03
RtlFreeHeap.NTDLL(?,?,?,00007FF6D9FFEA0F,?,?,?,00007FF6D9FFE925,?,?,?,?,00007FF6D9FDB9B1), ref: 00007FF6D9FD6B17

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Heap$Process$Free$towupper$CurrentDirectoryEnvironmentFullNamePathStringsiswalpha
String ID:
API String ID: 3512109576-0
Opcode ID: 382550a8889551dd1746f9e05062d813c656d27a38cd142319c153c86f485295
Instruction ID: 230acf5531939c248cb63c150c413b3bf7b5fdc196604f8bc2d25e353ac7e704
Opcode Fuzzy Hash: 382550a8889551dd1746f9e05062d813c656d27a38cd142319c153c86f485295
Instruction Fuzzy Hash: 3A216062A0DA8286EB15DF66D4543BC7BA0EF99B48F148077CA4E87352DF2CE469C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FDB6B0 Relevance: 6.1, APIs: 4, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6D9FDAF82), ref: 00007FF6D9FDB6D0
HeapReAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6D9FDAF82), ref: 00007FF6D9FDB6E7
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6D9FDAF82), ref: 00007FF6D9FDB701
HeapSize.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6D9FDAF82), ref: 00007FF6D9FDB715

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Heap$Process$AllocSize
String ID:
API String ID: 2549470565-0
Opcode ID: 8b7937c01b75b6a402f81ee33712f7103c51c9ba0582a0030a62d3f1dae91938
Instruction ID: 00697eb2e13e31f657c1c657d99a3e4d65afa4554d960dd75ee698bd3f43a44a
Opcode Fuzzy Hash: 8b7937c01b75b6a402f81ee33712f7103c51c9ba0582a0030a62d3f1dae91938
Instruction Fuzzy Hash: 8B215E62A09782C7EB258F11E48007CBAA1FF89B95B889472DA1E83754DF3CE861C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FFCFF0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6D9FE507A), ref: 00007FF6D9FFD01C
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6D9FE507A), ref: 00007FF6D9FFD033
FillConsoleOutputAttribute.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6D9FE507A), ref: 00007FF6D9FFD06D
SetConsoleTextAttribute.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00007FF6D9FE507A), ref: 00007FF6D9FFD07F

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Console$Attribute$BufferFillHandleInfoOutputScreenText
String ID:
API String ID: 1033415088-0
Opcode ID: 45059cb2ee047cb232d20320cf03883d9ebc73042b8c9a2b0d276472751f5675
Instruction ID: b8bfd0871786d36a1acdf96d65080e5c095924b10dafca0d9be77c35efce0eae
Opcode Fuzzy Hash: 45059cb2ee047cb232d20320cf03883d9ebc73042b8c9a2b0d276472751f5675
Instruction Fuzzy Hash: DD11603261CA8286DA548F21F05417EB7A0FB8AB99F445236EA8E87B95DF3CD055CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD59E4 Relevance: 6.0, APIs: 4, Instructions: 45fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D9FE1EA0: wcschr.MSVCRT ref: 00007FF6D9FE1EB3

CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FF6D9FD5A2E
_open_osfhandle.MSVCRT ref: 00007FF6D9FD5A4F
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,00000000,00008000,?,00000001,00007FF6D9FD260D), ref: 00007FF6D9FF37AA
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FF6D9FF37D2

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast_open_osfhandlewcschr
String ID:
API String ID: 22757656-0
Opcode ID: 6f2d595de901b4657c2270727e019009ca61754dc2b8e6e3406c67fcea3533dc
Instruction ID: 82b203da2dd388be9652abebce94524121bba523c6f508604b907b7fad9add85
Opcode Fuzzy Hash: 6f2d595de901b4657c2270727e019009ca61754dc2b8e6e3406c67fcea3533dc
Instruction Fuzzy Hash: 49119472A186468BE7104F24E44837D7AA0FB89B78F644375D62E873D5DF3CD4598B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE9158 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00007FF6D9FE9163
RtlLookupFunctionEntry.NTDLL ref: 00007FF6D9FE9182
RtlVirtualUnwind.NTDLL ref: 00007FF6D9FE91CF
__raise_securityfailure.LIBCMT ref: 00007FF6D9FE9245

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: c08ae526ada62f987d461bd82afd9432e1c3bf21ef9f50b7bdd1a09949af37b2
Instruction ID: 1c42d9c759ae5debe5b636550093c5776aa795d4a0bdf4db43c68675cc5f5107
Opcode Fuzzy Hash: c08ae526ada62f987d461bd82afd9432e1c3bf21ef9f50b7bdd1a09949af37b2
Instruction Fuzzy Hash: E021CF3691CB4285E6508F06F88036D73A4FB98758F500077EA8D83766DF7DE4A4C758

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FF5690 Relevance: 6.0, APIs: 4, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000028,00007FF6D9FF5433,?,?,?,00007FF6D9FF69B8,?,?,?,?,?,00007FF6D9FE8C39), ref: 00007FF6D9FF56C5
RtlFreeHeap.NTDLL(?,?,00000028,00007FF6D9FF5433,?,?,?,00007FF6D9FF69B8,?,?,?,?,?,00007FF6D9FE8C39), ref: 00007FF6D9FF56D9
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000028,00007FF6D9FF5433,?,?,?,00007FF6D9FF69B8,?,?,?,?,?,00007FF6D9FE8C39), ref: 00007FF6D9FF56FD
RtlFreeHeap.NTDLL(?,?,00000028,00007FF6D9FF5433,?,?,?,00007FF6D9FF69B8,?,?,?,?,?,00007FF6D9FE8C39), ref: 00007FF6D9FF5711

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 3558426be91c37f0606525c683e3d483ead9a8c3dc25e426f1ffeaf0c5774795
Instruction ID: 7366eb17fb2ae5f611a21e79bbaaff4f178104b9b4ca258a27df5447428c9162
Opcode Fuzzy Hash: 3558426be91c37f0606525c683e3d483ead9a8c3dc25e426f1ffeaf0c5774795
Instruction Fuzzy Hash: 14114872A08B81C6EB118F56E4440ADBBB0FB8DF88B488126DB4E43718DF38E466C744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FFF22C Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

_get_osfhandle.MSVCRT ref: 00007FF6D9FFF235
GetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF6D9FFF249
_get_osfhandle.MSVCRT ref: 00007FF6D9FFF263
SetConsoleMode.API-MS-WIN-CORE-CONSOLE-L1-1-0 ref: 00007FF6D9FFF276

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: ConsoleMode_get_osfhandle
String ID:
API String ID: 1606018815-0
Opcode ID: 422b38324ae02b1855cf7ad64e97296a8d78d568ed733181d0d72e350d9743d9
Instruction ID: 20535a6be9ed9e2fd9b0cf561678771612d7c0a1920c7a1da438a4d5eab9a739
Opcode Fuzzy Hash: 422b38324ae02b1855cf7ad64e97296a8d78d568ed733181d0d72e350d9743d9
Instruction Fuzzy Hash: ABF03031A28A42CBD7155F11E84467DBA60FB8AB06F859275DA0F83395DF3CD018CB05

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FDE420 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D9FE06C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6D9FDB4DB), ref: 00007FF6D9FE06D6
Part of subcall function 00007FF6D9FE06C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6D9FDB4DB), ref: 00007FF6D9FE06F0
Part of subcall function 00007FF6D9FE06C0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6D9FDB4DB), ref: 00007FF6D9FE074D
Part of subcall function 00007FF6D9FE06C0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6D9FDB4DB), ref: 00007FF6D9FE0762

Part of subcall function 00007FF6D9FDEF40: iswspace.MSVCRT ref: 00007FF6D9FDF000
Part of subcall function 00007FF6D9FDEF40: wcschr.MSVCRT ref: 00007FF6D9FDF031
Part of subcall function 00007FF6D9FDEF40: iswdigit.MSVCRT ref: 00007FF6D9FDF0D6

longjmp.MSVCRT ref: 00007FF6D9FECCBC
longjmp.MSVCRT(?,?,00000000,00007FF6D9FE1F69,?,?,?,?,?,?,?,00007FF6D9FD286E,00000000,00000000,00000000,00000000), ref: 00007FF6D9FECCE0

Strings

GeToken: (%x) '%s', xrefs: 00007FF6D9FECC39, 00007FF6D9FECCF2

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Heap$AllocProcesslongjmp$iswdigitiswspacewcschr
String ID: GeToken: (%x) '%s'
API String ID: 3282654869-1994581435
Opcode ID: 0d50fbd59cb290ba3a7f099b8a3a031ee9f038d52b89f1901d18a5cacde82640
Instruction ID: bf9f00bf47899068cd7ed1d4f55b63c0884140655301f3f1db1695ade4ff2736
Opcode Fuzzy Hash: 0d50fbd59cb290ba3a7f099b8a3a031ee9f038d52b89f1901d18a5cacde82640
Instruction Fuzzy Hash: 0961B061A0D74386FB259F25A4542BD23A1EF857A8F544537DA1ECB7E6EE3CF4608300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DA0010D8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D9FDCD90: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,?,00007FF6D9FDB9A1,?,?,?,?,00007FF6D9FDD81A), ref: 00007FF6D9FDCDA6
Part of subcall function 00007FF6D9FDCD90: RtlAllocateHeap.NTDLL(?,?,?,00007FF6D9FDB9A1,?,?,?,?,00007FF6D9FDD81A), ref: 00007FF6D9FDCDBD

wcschr.MSVCRT ref: 00007FF6DA0011DC
memmove.MSVCRT(?,00000000,00000000,00000000,00000001,0000000A,?,00007FF6D9FF827A), ref: 00007FF6DA001277

Strings

&()[]{}^=;!%'+,`~, xrefs: 00007FF6DA0011D5

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Heap$AllocateProcessmemmovewcschr
String ID: &()[]{}^=;!%'+,`~
API String ID: 4220614737-381716982
Opcode ID: bd83934b9501f045900d4cea0c34526f969d72289539c66b600af79ca04ff41e
Instruction ID: 250eb7b7fe804ea56ba065763606aeb7967d202a2c359c169bd0d4fe179e200b
Opcode Fuzzy Hash: bd83934b9501f045900d4cea0c34526f969d72289539c66b600af79ca04ff41e
Instruction Fuzzy Hash: F371B371A0C2438AE7608F16A4806BDB6A4FB9879CF404277DA5DC7BD9DF3CA4618B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6DA0008EC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 00007FF6DA0009BC
wcsncmp.MSVCRT ref: 00007FF6DA0009F5

Strings

0123456789, xrefs: 00007FF6DA0008FE

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: memmovewcsncmp
String ID: 0123456789
API String ID: 3879766669-2793719750
Opcode ID: b6d2eb98a78dae28402b6106fc772dbd77ca9a03dc6c88e297d1125e4b884182
Instruction ID: e800c0a7d6d7c0d3cb0956dd888789acd06fe05e4cf7d4605cacfcb7cab5e1de
Opcode Fuzzy Hash: b6d2eb98a78dae28402b6106fc772dbd77ca9a03dc6c88e297d1125e4b884182
Instruction Fuzzy Hash: 5B41F322F1CB8B81EA258F2698006BE6294FB45B98F449172DE4E87786EF3CD5518384

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FF9784 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6D9FF97D0

Part of subcall function 00007FF6D9FDD3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FDD46E
Part of subcall function 00007FF6D9FDD3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FDD485
Part of subcall function 00007FF6D9FDD3F0: wcschr.MSVCRT ref: 00007FF6D9FDD4EE
Part of subcall function 00007FF6D9FDD3F0: iswspace.MSVCRT ref: 00007FF6D9FDD54D
Part of subcall function 00007FF6D9FDD3F0: wcschr.MSVCRT ref: 00007FF6D9FDD569
Part of subcall function 00007FF6D9FDD3F0: wcschr.MSVCRT ref: 00007FF6D9FDD58C

RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6D9FF98D7

Strings

Software\Classes, xrefs: 00007FF6D9FF97C2

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: wcschr$Heap$AllocCloseOpenProcessiswspace
String ID: Software\Classes
API String ID: 2714550308-1656466771
Opcode ID: d66e77e282f526cdab360848653042cb1799c396fd656979a78128508030fc96
Instruction ID: 0b6dce610d4ae305d9a983682d307d469b6db51662bbc86c6bdac9938048ab2f
Opcode Fuzzy Hash: d66e77e282f526cdab360848653042cb1799c396fd656979a78128508030fc96
Instruction Fuzzy Hash: F541C322B19B5281EA00DF16D44547D63A5FB84BD4F908232DE5E877E1EF39E8BAC340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FFA0B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6D9FFA0FC

Part of subcall function 00007FF6D9FDD3F0: GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FDD46E
Part of subcall function 00007FF6D9FDD3F0: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0 ref: 00007FF6D9FDD485
Part of subcall function 00007FF6D9FDD3F0: wcschr.MSVCRT ref: 00007FF6D9FDD4EE
Part of subcall function 00007FF6D9FDD3F0: iswspace.MSVCRT ref: 00007FF6D9FDD54D
Part of subcall function 00007FF6D9FDD3F0: wcschr.MSVCRT ref: 00007FF6D9FDD569
Part of subcall function 00007FF6D9FDD3F0: wcschr.MSVCRT ref: 00007FF6D9FDD58C

RegCloseKey.API-MS-WIN-CORE-REGISTRY-L1-1-0 ref: 00007FF6D9FFA1FB

Strings

Software\Classes, xrefs: 00007FF6D9FFA0EE

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: wcschr$Heap$AllocCloseOpenProcessiswspace
String ID: Software\Classes
API String ID: 2714550308-1656466771
Opcode ID: 40e265c1ad5cb419bc37e3f74a7831dec97f4f50f637fb390f268ed2376e0e1b
Instruction ID: 53873fc40b11919c91878ce45e0054f7159d2aba0ee7c92e17ae7fe8f066d315
Opcode Fuzzy Hash: 40e265c1ad5cb419bc37e3f74a7831dec97f4f50f637fb390f268ed2376e0e1b
Instruction Fuzzy Hash: CC41B122B19B5281EA00DF16D44543D73A5FB85BD8F518232DE5E837E1EE39E86AC740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FDCAD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0 ref: 00007FF6D9FEC736
SetConsoleTitleW.API-MS-WIN-CORE-CONSOLE-L2-2-0 ref: 00007FF6D9FEC7E0

Strings

- , xrefs: 00007FF6D9FEC7A6

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: ConsoleTitle
String ID: -
API String ID: 3358957663-3695764949
Opcode ID: 6064907e277deedeb5a502c31a0978855624e0bf0fd413fe06aa3058ee5bb337
Instruction ID: cfa77096b20d5dd4470748c9d12aabd2621c80ef2dfa4f5c60be2a74f0edac13
Opcode Fuzzy Hash: 6064907e277deedeb5a502c31a0978855624e0bf0fd413fe06aa3058ee5bb337
Instruction Fuzzy Hash: 30317E21A0C74286EA14AF12A8440BC6AA6FB89B94F594177D91ED7BD6DF3CF461C304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE7280 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsnicmp.MSVCRT ref: 00007FF6D9FE72D2
swscanf.MSVCRT ref: 00007FF6D9FE731F

Strings

:EOF, xrefs: 00007FF6D9FE72E8

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: _wcsnicmpswscanf
String ID: :EOF
API String ID: 1534968528-551370653
Opcode ID: 371c5ed1d04bc6378da742994009ca7237cc8b6e5efafef9a14f685808df8ab2
Instruction ID: 7b9aba09e30461b12abf7fb92c8c2150b1042742d10b100f157b2a4257ef0f66
Opcode Fuzzy Hash: 371c5ed1d04bc6378da742994009ca7237cc8b6e5efafef9a14f685808df8ab2
Instruction Fuzzy Hash: 0E31AD31E1DA438AFB659F16E8402BC72A1EF45B54F484033EA8DC7292EF2CE961C744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FD3BE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_wcsnicmp.MSVCRT ref: 00007FF6D9FD3C85

Strings

/-Y, xrefs: 00007FF6D9FF184D

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: _wcsnicmp
String ID: /-Y
API String ID: 1886669725-4274875248
Opcode ID: 772bd3782c46842c372c8b89a915565f11f80ecece3792b3c4e3ce842e7c51e5
Instruction ID: 69688070732c545206390493ecaac1fe88c78a1355c08943eebfc9d032ecb1df
Opcode Fuzzy Hash: 772bd3782c46842c372c8b89a915565f11f80ecece3792b3c4e3ce842e7c51e5
Instruction Fuzzy Hash: F5216066E0876681EB209F0695402BC76E1BB84FC8F458073DF9997794DF7CE8A2D304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FDB62C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

Strings

3, xrefs: 00007FF6D9FDB64D
3, xrefs: 00007FF6D9FDB685

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID:
String ID: 3$3
API String ID: 0-2538865259
Opcode ID: ddd87971df706f46a8d232553329da211c0b0389ae935901d5995e82db34f2bd
Instruction ID: 8664207e28527204cc730c6243e85ed41ca66af20e733db406645eb8d3429444
Opcode Fuzzy Hash: ddd87971df706f46a8d232553329da211c0b0389ae935901d5995e82db34f2bd
Instruction Fuzzy Hash: 22012971D1E5838AF3158F64D8842BC3660BF8532EF9441B7C41ECA6E2DF2C74B49641

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF6D9FE06C0 Relevance: 5.1, APIs: 4, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6D9FDB4DB), ref: 00007FF6D9FE06D6
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6D9FDB4DB), ref: 00007FF6D9FE06F0
GetProcessHeap.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6D9FDB4DB), ref: 00007FF6D9FE074D
HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FF6D9FDB4DB), ref: 00007FF6D9FE0762

Memory Dump Source

Source File: 00000000.00000002.2888786103.00007FF6D9FD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6D9FD0000, based on PE: true

Associated: 00000000.00000002.2888770348.00007FF6D9FD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888815173.00007FF6DA002000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA00D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888831918.00007FF6DA01F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2888883522.00007FF6DA029000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6d9fd0000_cmd.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 7f6131ec27923fc47eb93a8029ce1e8351ae842096c6c33028bd98535f1c06b5
Instruction ID: cd9899572269d6362b93e2b939b94d8a53cfe541ce561c553a24dcba62019bb2
Opcode Fuzzy Hash: 7f6131ec27923fc47eb93a8029ce1e8351ae842096c6c33028bd98535f1c06b5
Instruction Fuzzy Hash: 1F417B72A0E74286EA258F10E4801BE7BA0FF85B84F988136CA4EC7795DF3CE561C744

Uniqueness

Uniqueness Score: -1.00%

Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FE88C0 NtOpenThreadToken,NtOpenProcessToken,NtClose,	0_2_00007FF6D9FE88C0
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FE898C NtQueryInformationToken,	0_2_00007FF6D9FE898C
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FE89E4 NtQueryInformationToken,NtQueryInformationToken,	0_2_00007FF6D9FE89E4
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FE7FF8 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,CloseHandle,NtSetInformationFile,DeleteFileW,GetLastError,	0_2_00007FF6D9FE7FF8
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FFBCF0 fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer,	0_2_00007FF6D9FFBCF0
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FE8114 NtQueryVolumeInformationFile,GetFileInformationByHandleEx,	0_2_00007FF6D9FE8114
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6DA001538 SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memmove,memmove,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW,	0_2_00007FF6DA001538
Source: C:\Users\user\Desktop\cmd.exe	Code function: 0_2_00007FF6D9FD3D94 _setjmp,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess,	0_2_00007FF6D9FD3D94

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report cmd.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: cmd.exePID: 5252, Parent PID: 2580

General

Chronological Activities

Analysis Process: conhost.exePID: 2004, Parent PID: 5252

General

Chronological Activities

Disassembly

Analysis Process: cmd.exePID: 5252, Parent PID: 2580COMMON

Execution Graph

Graph

Windows Analysis Report
cmd.exe

Function 00007FF6D9FF7F00 Relevance: 61.6, APIs: 28, Strings: 7, Instructions: 341
memoryCOMMON

Function 00007FF6D9FDAA54 Relevance: 51.3, APIs: 24, Strings: 5, Instructions: 536
COMMON

Function 00007FF6D9FE51EC Relevance: 45.9, APIs: 15, Strings: 11, Instructions: 384
COMMON

Function 00007FF6D9FE5554 Relevance: 45.8, APIs: 18, Strings: 8, Instructions: 295
registryCOMMON

Function 00007FF6D9FE37D8 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 269
registrythreadmemoryCOMMON

Function 00007FF6D9FD32B0 Relevance: 27.2, APIs: 18, Instructions: 243
COMMON

Function 00007FF6D9FD3410 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 160
windowCOMMON

Function 00007FF6D9FE2978 Relevance: 9.1, APIs: 6, Instructions: 138
COMMON

Function 00007FF6D9FE4D5C Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 268
memorylibraryloaderCOMMON

Function 00007FF6D9FDF8C0 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 380
COMMON

Function 00007FF6D9FE3C24 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 289
COMMON

Function 00007FF6D9FE2394 Relevance: 26.5, APIs: 7, Strings: 8, Instructions: 213
COMMON

Function 00007FF6D9FE0580 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 82
COMMON

Function 00007FF6D9FFBFEC Relevance: 16.2, APIs: 3, Strings: 6, Instructions: 444
COMMON

Function 00007FF6D9FE86F0 Relevance: 10.7, APIs: 7, Instructions: 154
COMMON