Edit tour

Windows Analysis Report
ie4uinit.exe

Overview

General Information

Sample name:	ie4uinit.exe
Analysis ID:	1395538
MD5:	054f65e18ad84a4f2d51cfe7931664d2
SHA1:	f5cf003d3aa482f687a855ee0f0d65b3773d38e5
SHA256:	60271fc88e8a6af9d96127b57c4f1a8e477c3c0fe580e29ff6b233e9a4ab3adc
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Checks if browser processes are running

Contains functionality to compare user and computer (likely to detect sandboxes)

Binary contains a suspicious time stamp

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains sections with non-standard names

Program does not show much activity (idle)

Tries to load missing DLLs

Uses Microsoft's Enhanced Cryptographic Provider

Uses the system / local time for branch decision (may execute only at specific dates)

Classification

Process Tree

System is w10x64

ie4uinit.exe (PID: 6364 cmdline: C:\Users\user\Desktop\ie4uinit.exe MD5: 054F65E18AD84A4F2D51CFE7931664D2)

cleanup

Joe Sandbox Signatures

• Cryptography
• Compliance
• Spreading
• Networking
• E-Banking Fraud
• System Summary
• Data Obfuscation
• Malware Analysis System Evasion
• Anti Debugging
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B3A604 CryptHashCertificate,memcmp,GetLastError,	0_2_00007FF674B3A604
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B41610 CryptAcquireContextW,GetLastError,GetLastError,GetLastError,	0_2_00007FF674B41610
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B41A34 memcpy_s,CryptCreateHash,CryptHashData,CryptDeriveKey,GetLastError,GetLastError,GetLastError,CryptDestroyHash,GetLastError,GetLastError,GetLastError,	0_2_00007FF674B41A34
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B42178 CryptSetKeyParam,memcpy_s,CryptEncrypt,memcpy_s,CryptEncrypt,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,	0_2_00007FF674B42178
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B39D90 CryptStringToBinaryW,CryptStringToBinaryW,GetLastError,GetLastError,GetLastError,GetLastError,	0_2_00007FF674B39D90
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B41D98 memcpy_s,memcpy_s,CryptGenRandom,memcpy_s,EnterCriticalSection,LeaveCriticalSection,GetLastError,GetLastError,GetLastError,	0_2_00007FF674B41D98
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B34570 CryptAcquireContextW,CryptReleaseContext,	0_2_00007FF674B34570
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B34B30 CryptGenRandom,GetLastError,SysFreeString,	0_2_00007FF674B34B30
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B39AC0 CryptCreateHash,CryptHashData,CryptGetHashParam,GetLastError,CryptDestroyHash,GetLastError,	0_2_00007FF674B39AC0
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B3A2C0 CertOpenStore,CertFindCertificateInStore,CryptImportPublicKeyInfo,GetLastError,GetLastError,CertFreeCertificateContext,CertCloseStore,	0_2_00007FF674B3A2C0
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B41BC0 CryptDestroyKey,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,	0_2_00007FF674B41BC0
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B39BD8 CryptCreateHash,CryptSetHashParam,CryptVerifySignatureW,GetLastError,CryptDestroyKey,GetLastError,CryptDestroyHash,GetLastError,	0_2_00007FF674B39BD8
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B41FDC CryptCreateHash,CryptSetHashParam,CryptHashData,CryptGetHashParam,GetLastError,GetLastError,GetLastError,CryptDestroyHash,GetLastError,GetLastError,GetLastError,	0_2_00007FF674B41FDC
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B37B98 CryptBinaryToStringA,CryptBinaryToStringA,GetLastError,GetLastError,	0_2_00007FF674B37B98
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B41738 CryptGenRandom,memcpy_s,CryptEncrypt,GetLastError,GetLastError,GetLastError,GetLastError,	0_2_00007FF674B41738
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B344F8 CryptReleaseContext,	0_2_00007FF674B344F8
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B37904 strnlen,isalnum,CryptStringToBinaryA,CryptStringToBinaryA,GetLastError,GetLastError,	0_2_00007FF674B37904
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B418AC CryptImportPublicKeyInfo,GetLastError,GetLastError,GetLastError,CertFreeCertificateContext,CryptGetKeyParam,GetLastError,GetLastError,GetLastError,	0_2_00007FF674B418AC

Source: ie4uinit.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: ie4uinit.pdbGCTL source: ie4uinit.exe
Source:	Binary string: ie4uinit.pdb source: ie4uinit.exe

Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B245D0 GetShortPathNameW,GetShortPathNameW,PathFindFileNameW,GetCurrentDirectoryW,SetCurrentDirectoryW,FindFirstFileW,CoCreateInstance,StrCmpIW,StrCmpIW,PathRemoveBlanksW,StrCmpICW,StrCmpICW,ILCreateFromPath,ILCreateFromPath,RegOpenKeyExW,StrCmpIW,RegCloseKey,ILFree,FindNextFileW,FindClose,FindFirstFileExW,lstrcmpW,lstrcmpW,FindNextFileW,FindClose,SetCurrentDirectoryW,	0_2_00007FF674B245D0
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B2BE44 SHGetFolderPathW,SetFileAttributesW,GetLastError,SHGetFolderPathW,wcscat_s,wcscat_s,wcscat_s,FindFirstFileW,wcscat_s,FindNextFileW,FindClose,	0_2_00007FF674B2BE44
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B24E48 SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,SetCurrentDirectoryW,	0_2_00007FF674B24E48
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B2C400 CreateFileW,#149,CloseHandle,GetLastError,wcscpy_s,wcscat_s,FindFirstFileW,wcscat_s,FindNextFileW,FindClose,GetLastError,	0_2_00007FF674B2C400
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B48468 FindFirstFileExW,GetLastError,FindNextFileW,GetLastError,FindClose,	0_2_00007FF674B48468

Source: C:\Users\user\Desktop\ie4uinit.exe

Code function: 0_2_00007FF674B39428 SysAllocString,SysStringLen,HttpSendRequestW,HttpQueryInfoW,InternetReadFile,GetLastError,SysStringByteLen,SysAllocStringByteLen,SysFreeString,GetLastError,SysFreeString,SysAllocString,SysStringByteLen,SysAllocStringByteLen,SysFreeString,

0_2_00007FF674B39428

Source: ie4uinit.exe	String found in binary or memory: http://www.yandex.com/favicon.ico
Source: ie4uinit.exe	String found in binary or memory: https://suggest.yandex.by/suggest-ff.cgi?srv=ie11&part=
Source: ie4uinit.exe	String found in binary or memory: https://suggest.yandex.com.tr/suggest-ff.cgi?srv=ie11&uil=tr&part=
Source: ie4uinit.exe	String found in binary or memory: https://suggest.yandex.kz/suggest-ff.cgi?srv=ie11&part=
Source: ie4uinit.exe	String found in binary or memory: https://suggest.yandex.ua/suggest-ff.cgi?srv=ie11&part=
Source: ie4uinit.exe	String found in binary or memory: https://www.haosou.com/s?src=win10&ie=utf-8&q=
Source: ie4uinit.exe	String found in binary or memory: https://www.sogou.com/tx?hdq=sogou-wsse-6abba5d8ab1f4f32&query=

E-Banking Fraud

Checks if browser processes are running

Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: GetModuleFileNameW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,StrStrIW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,StrCmpICW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp, IEXPLORE.EXE	0_2_00007FF674B49078
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: GetModuleFileNameW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,StrStrIW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,StrCmpICW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp, microsoftedge.exe	0_2_00007FF674B49078
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: GetModuleFileNameW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,StrStrIW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,StrCmpICW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp, microsoftedgecp.exe	0_2_00007FF674B49078
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: GetModuleFileNameW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,StrStrIW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,StrCmpICW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp, microsoftedgebchost.exe	0_2_00007FF674B49078
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: GetModuleFileNameW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,StrStrIW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,StrCmpICW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp, microsoftedgedevtools.exe	0_2_00007FF674B49078
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: GetModuleFileNameW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,StrStrIW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,StrCmpICW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp, microsoftedgesh.exe	0_2_00007FF674B49078

Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B481E4 NtQueryLicenseValue,	0_2_00007FF674B481E4
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B4A53C OpenGlobalizationUserSettingsKey,SHGetValueW,CharNextW,#123,GetUserDefaultLocaleName,NtClose,	0_2_00007FF674B4A53C
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B47EBC LoadLibraryExW,GetProcAddress,NtQueryLicenseValue,FreeLibrary,NtQueryLicenseValue,	0_2_00007FF674B47EBC

Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B4AA0C	0_2_00007FF674B4AA0C
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B2520C	0_2_00007FF674B2520C
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B22E20	0_2_00007FF674B22E20
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B391C4	0_2_00007FF674B391C4
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B461EC	0_2_00007FF674B461EC
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B4BB30	0_2_00007FF674B4BB30
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B32ABC	0_2_00007FF674B32ABC
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B47EBC	0_2_00007FF674B47EBC
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B2BE44	0_2_00007FF674B2BE44
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B38A44	0_2_00007FF674B38A44
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B47248	0_2_00007FF674B47248
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B21E68	0_2_00007FF674B21E68
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B47C00	0_2_00007FF674B47C00
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B2AFD8	0_2_00007FF674B2AFD8
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B25B88	0_2_00007FF674B25B88
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B473A4	0_2_00007FF674B473A4
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B22B70	0_2_00007FF674B22B70
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B234F8	0_2_00007FF674B234F8
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B46918	0_2_00007FF674B46918
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B4BCBC	0_2_00007FF674B4BCBC
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B2607C	0_2_00007FF674B2607C
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B42CB0	0_2_00007FF674B42CB0
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B22438	0_2_00007FF674B22438
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B3F060	0_2_00007FF674B3F060
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B2E470	0_2_00007FF674B2E470

Source: C:\Users\user\Desktop\ie4uinit.exe

Code function: String function: 00007FF674B266E8 appears 44 times

Source: C:\Users\user\Desktop\ie4uinit.exe	Section loaded: ieadvpack.dll	Jump to behavior
Source: C:\Users\user\Desktop\ie4uinit.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\ie4uinit.exe	Section loaded: iedkcs32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ie4uinit.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ie4uinit.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\ie4uinit.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\ie4uinit.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ie4uinit.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ie4uinit.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ie4uinit.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\ie4uinit.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ie4uinit.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ie4uinit.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\ie4uinit.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\ie4uinit.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ie4uinit.exe	Section loaded: mlang.dll	Jump to behavior

Source: classification engine

Classification label: mal48.bank.evad.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\ie4uinit.exe

Code function: 0_2_00007FF674B245D0 GetShortPathNameW,GetShortPathNameW,PathFindFileNameW,GetCurrentDirectoryW,SetCurrentDirectoryW,FindFirstFileW,CoCreateInstance,StrCmpIW,StrCmpIW,PathRemoveBlanksW,StrCmpICW,StrCmpICW,ILCreateFromPath,ILCreateFromPath,RegOpenKeyExW,StrCmpIW,RegCloseKey,ILFree,FindNextFileW,FindClose,FindFirstFileExW,lstrcmpW,lstrcmpW,FindNextFileW,FindClose,SetCurrentDirectoryW,

0_2_00007FF674B245D0

Source: C:\Users\user\Desktop\ie4uinit.exe

Code function: 0_2_00007FF674B23AC0 #654,FindResourceW,LoadResource,LockResource,wcsrchr,SHCreateDirectory,CreateFileW,SizeofResource,WriteFile,CloseHandle,

0_2_00007FF674B23AC0

Source: ie4uinit.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ie4uinit.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ie4uinit.exe	String found in binary or memory: -hide-show-reinstall-apply-UserConfig-IECleanup-UserIconConfig-BaseSettings-ClearIconCache-UpgradeOldHistoryEntries-InitHistoryRoaming-CleanupEmeDataStoresIn HandleDeferredCommand
Source: ie4uinit.exe	String found in binary or memory: 1.3.6.1.4.1.311.13.1IE-AddressMIE-AddressIE-SearchBoxMIE-SearchBoxIE-ContextMenuMIE-ContextMenu{searchTerms{count10{startIndex1{startPage{language*{outputEncodingUTF-8{inputEncoding{referrer:source{ie:maxwidth{ie:sectionheight{ie:rowheightMissingtruefalse%luhttp://go.microsoft.com/fwlink/?LinkId=392206FORM=IESR4AFORM=IESR4NFORM=IESR3AFORM=IESR3NFORM=IENAE1FORM=IENAD1FORM=IENAE2FORM=IENAD2FORM=IEMAE2FORM=IEMAD2FORM=IEMAE1FORM=IEMAD1FORM=IESR02FORM=IESS4AFORM=IESS4NFORM=IESS3AFORM=IESS3NFORM=IENSE1FORM=IENSD1FORM=IENSE2FORM=IENSD2FORM=IEMSE2FORM=IEMSD2FORM=IEMSE1FORM=IEMSD1FORM=IESS02FORM=IESR4SFORM=IESR3SFORM=IENDS1FORM=IENDS2FORM=IEMDS2FORM=IEMDS1FORM=IESS4SFORM=IESS3SFORM=IENSS1FORM=IENSS2FORM=IEMSS2FORM=IEMSS1bing.com&pc=%s

Source: ie4uinit.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: ie4uinit.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: ie4uinit.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: ie4uinit.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: ie4uinit.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: ie4uinit.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: ie4uinit.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: ie4uinit.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: ie4uinit.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: ie4uinit.pdbGCTL source: ie4uinit.exe
Source:	Binary string: ie4uinit.pdb source: ie4uinit.exe

Source: ie4uinit.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: ie4uinit.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: ie4uinit.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: ie4uinit.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: ie4uinit.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: ie4uinit.exe

Static PE information: 0xCBD62B02 [Sun May 15 03:22:42 2078 UTC]

Source: C:\Users\user\Desktop\ie4uinit.exe

Code function: 0_2_00007FF674B2CBE8 LoadLibraryW,GetProcAddress,LocalFree,FreeLibrary,

0_2_00007FF674B2CBE8

Source: ie4uinit.exe

Static PE information: section name: .didat

Malware Analysis System Evasion

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Users\user\Desktop\ie4uinit.exe

Code function: GetModuleFileNameW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,StrStrIW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,StrCmpICW,_wcsicmp,_wcsicmp,_wcsicmp,_wcsicmp,

0_2_00007FF674B49078

Source: C:\Users\user\Desktop\ie4uinit.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_0-12148

Source: C:\Users\user\Desktop\ie4uinit.exe

API coverage: 0.5 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B40A14 GetSystemTimeAsFileTime followed by cmp: cmp ebx, 01h and CTI: je 00007FF674B40A89h	0_2_00007FF674B40A14
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B40A14 GetSystemTimeAsFileTime followed by cmp: cmp ebx, 02h and CTI: je 00007FF674B40A82h	0_2_00007FF674B40A14
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B40A14 GetSystemTimeAsFileTime followed by cmp: cmp eax, 01h and CTI: jnbe 00007FF674B40A92h	0_2_00007FF674B40A14

Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B245D0 GetShortPathNameW,GetShortPathNameW,PathFindFileNameW,GetCurrentDirectoryW,SetCurrentDirectoryW,FindFirstFileW,CoCreateInstance,StrCmpIW,StrCmpIW,PathRemoveBlanksW,StrCmpICW,StrCmpICW,ILCreateFromPath,ILCreateFromPath,RegOpenKeyExW,StrCmpIW,RegCloseKey,ILFree,FindNextFileW,FindClose,FindFirstFileExW,lstrcmpW,lstrcmpW,FindNextFileW,FindClose,SetCurrentDirectoryW,	0_2_00007FF674B245D0
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B2BE44 SHGetFolderPathW,SetFileAttributesW,GetLastError,SHGetFolderPathW,wcscat_s,wcscat_s,wcscat_s,FindFirstFileW,wcscat_s,FindNextFileW,FindClose,	0_2_00007FF674B2BE44
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B24E48 SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,FindClose,SetCurrentDirectoryW,	0_2_00007FF674B24E48
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B2C400 CreateFileW,#149,CloseHandle,GetLastError,wcscpy_s,wcscat_s,FindFirstFileW,wcscat_s,FindNextFileW,FindClose,GetLastError,	0_2_00007FF674B2C400
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B48468 FindFirstFileExW,GetLastError,FindNextFileW,GetLastError,FindClose,	0_2_00007FF674B48468

Source: C:\Users\user\Desktop\ie4uinit.exe

Code function: 0_2_00007FF674B2C9CC GetSystemInfo,#701,IsJITInProgress,GetSystemInfo,IsJITInProgress,#701,IsJITInProgress,IsJITInProgress,IsJITInProgress,EnterCriticalSection,LeaveCriticalSection,

0_2_00007FF674B2C9CC

Source: C:\Users\user\Desktop\ie4uinit.exe

Code function: 0_2_00007FF674B28A24 GetCurrentThreadId,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF674B28A24

Source: C:\Users\user\Desktop\ie4uinit.exe

Code function: 0_2_00007FF674B2CBE8 LoadLibraryW,GetProcAddress,LocalFree,FreeLibrary,

0_2_00007FF674B2CBE8

Source: C:\Users\user\Desktop\ie4uinit.exe

Code function: 0_2_00007FF674B499FC GetProcessHeap,GetTokenInformation,ConvertSidToStringSidW,GetLastError,GetProcessHeap,HeapFree,CloseHandle,

0_2_00007FF674B499FC

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B275FC SetUnhandledExceptionFilter,RaiseException,	0_2_00007FF674B275FC
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B4C2A4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF674B4C2A4
Source: C:\Users\user\Desktop\ie4uinit.exe	Code function: 0_2_00007FF674B4C780 SetUnhandledExceptionFilter,	0_2_00007FF674B4C780

Source: C:\Users\user\Desktop\ie4uinit.exe

Code function: 0_2_00007FF674B40A14 GetSystemTimeAsFileTime,

0_2_00007FF674B40A14

Source: C:\Users\user\Desktop\ie4uinit.exe

Code function: 0_2_00007FF674B23988 memset,GetVersionExA,

0_2_00007FF674B23988

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	1 Process Injection	OS Credential Dumping	11 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	12 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Timestomp	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	4 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ie4uinit.exe	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://suggest.yandex.com.tr/suggest-ff.cgi?srv=ie11&uil=tr&part=	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://suggest.yandex.by/suggest-ff.cgi?srv=ie11&part=	ie4uinit.exe	false		high
https://suggest.yandex.com.tr/suggest-ff.cgi?srv=ie11&uil=tr&part=	ie4uinit.exe	false	Avira URL Cloud: safe	unknown
https://suggest.yandex.kz/suggest-ff.cgi?srv=ie11&part=	ie4uinit.exe	false		high
https://suggest.yandex.ua/suggest-ff.cgi?srv=ie11&part=	ie4uinit.exe	false		high
http://www.yandex.com/favicon.ico	ie4uinit.exe	false		high
https://www.haosou.com/s?src=win10&ie=utf-8&q=	ie4uinit.exe	false		high
https://www.sogou.com/tx?hdq=sogou-wsse-6abba5d8ab1f4f32&query=	ie4uinit.exe	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1395538
Start date and time:	2024-02-20 19:15:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ie4uinit.exe
Detection:	MAL
Classification:	mal48.bank.evad.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 3 Number of non-executed functions: 232
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
VT rate limit hit for: ie4uinit.exe

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.138880353693972
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ie4uinit.exe
File size:	263'168 bytes
MD5:	054f65e18ad84a4f2d51cfe7931664d2
SHA1:	f5cf003d3aa482f687a855ee0f0d65b3773d38e5
SHA256:	60271fc88e8a6af9d96127b57c4f1a8e477c3c0fe580e29ff6b233e9a4ab3adc
SHA512:	b7554657720c70cac1e9db08ef4b60e009f0e5af1179cdaca435e67792a31e4307ef889e552a57aa3edb1a5d0507c678fa13a3f182f966cd8f9d97e9e69d6d33
SSDEEP:	6144:WsCDhVaxhsycCfF1kf2QM88sb+Jmvaj0/W6gEAZAW2a:WsCFVaxFclso+JmX/Pg3
TLSH:	4544091D22F918E8ED76963DC5678215E6B278312711D6DF02A0C27D0F23AE5BE39F12
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......i..t-..'-..'-..'9..&...'9..&0..'9..&(..'9..&...'-..'k..'9..&[..'9.!',..'9..&,..'Rich-..'........PE..d....+............"........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14002c250
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0xCBD62B02 [Sun May 15 03:22:42 2078 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	69bf75b22c2d05c4dec7cf56001d46f3

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FDAB460BC30h
dec eax
add esp, 28h
jmp 00007FDAB460B2B3h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
nop word ptr [eax+eax+00000000h]
dec eax
cmp ecx, dword ptr [00012501h]
jne 00007FDAB460B542h
dec eax
rol ecx, 10h
test cx, FFFFh
jne 00007FDAB460B533h
ret
dec eax
ror ecx, 10h
jmp 00007FDAB460B577h
int3
int3
int3
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [000038BBh]
dec eax
mov ecx, ebx
call dword ptr [000038AAh]
call dword ptr [000037FCh]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [000038A0h]
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 00000088h
dec eax
lea ecx, dword ptr [0001261Dh]
call dword ptr [00003ED7h]
dec eax
mov eax, dword ptr [00012708h]
dec eax
mov dword ptr [esp+48h], eax
inc ebp
xor eax, eax
dec eax
lea edx, dword ptr [esp+50h]
dec eax
mov ecx, dword ptr [esp+48h]
call dword ptr [00003EC0h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3b018	0x1a4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x43000	0x1570	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x40000	0x1df4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x45000	0x50c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x38b20	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2f568	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2f450	0x118	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2f590	0xce8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x3af88	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2c1bd	0x2c200	609f1e28e2bda96962020709930650b8	False	0.5256562057365439	data	6.2527805838416555	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2e000	0xf7be	0xf800	4bfa7cddf1e104ef8d0765389e6b5fe1	False	0.35798891129032256	data	4.71742574509677	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x1550	0xa00	966f1be6bdd4bdd947ddb063a3163934	False	0.19140625	COM executable for DOS	1.815225242572725	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x40000	0x1df4	0x1e00	2362210a782a99ce533b77636efec683	False	0.5287760416666667	PEX Binary Archive	5.466965215054765	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat	0x42000	0x28	0x200	0ed9f6fcd22b50b4b597ddb4fff4e126	False	0.056640625	data	0.35064057787291114	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x43000	0x1570	0x1600	ad655a376d059ee693a6b5524c376f9a	False	0.3380681818181818	data	5.262932416621954	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x45000	0x50c	0x600	7f10fd6eb63d90a9f87ac268a803405b	False	0.5638020833333334	data	4.987792960988635	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
MUI	0x444a0	0xd0	data	English	United States	0.5384615384615384
RT_RCDATA	0x438b0	0xbea	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.27311475409836067
RT_VERSION	0x43520	0x38c	PGP symmetric key encrypted data - Plaintext or unencrypted data	English	United States	0.46916299559471364
RT_MANIFEST	0x43140	0x3db	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.48226950354609927

Imports

DLL	Import
ADVAPI32.dll	RegQueryValueExW, RegEnumValueW, ConvertSidToStringSidW, EventUnregister, RegOpenKeyExW, FreeSid, RegSetValueExW, EventSetInformation, RegCreateKeyExW, EventRegister, RegCloseKey, RegSetValueW, RegOpenKeyW, RegDeleteValueW, RegCreateKeyW, RegEnumKeyExW, RegDeleteKeyW, RegQueryInfoKeyW, ConvertStringSecurityDescriptorToSecurityDescriptorW, CheckTokenMembership, GetTokenInformation, OpenThreadToken, RegSetKeyValueW, CryptSetKeyParam, CryptDeriveKey, CryptGetKeyParam, CryptEncrypt, CryptDestroyKey, CryptVerifySignatureW, CryptSetHashParam, CryptGenRandom, CryptDestroyHash, CryptGetHashParam, CryptHashData, CryptCreateHash, CryptReleaseContext, CryptAcquireContextW, EventWriteEx, RegGetValueW, EventWriteTransfer, GetSecurityDescriptorSacl, GetAce, SetNamedSecurityInfoW, CopySid, GetNamedSecurityInfoW, ConvertStringSidToSidW, IsValidSid, OpenProcessToken, GetKernelObjectSecurity, AddAccessAllowedAceEx, GetLengthSid
KERNEL32.dll	GetCurrentThread, OpenFileMappingW, GetSystemDirectoryW, GetEnvironmentVariableW, SetErrorMode, GetModuleFileNameW, HeapFree, GetExitCodeProcess, GetTempFileNameW, DuplicateHandle, GetTempPathW, CompareStringOrdinal, ExpandEnvironmentStringsW, GetStdHandle, GetLocalTime, CreateThread, SetEvent, FormatMessageW, CreateEventW, WaitForSingleObject, SetFilePointer, DelayLoadFailureHook, ResolveDelayLoadedAPI, CreateFile2, RemoveDirectoryW, AcquireSRWLockShared, CreateThreadpoolTimer, ReleaseSRWLockShared, SetThreadpoolTimer, CloseThreadpoolTimer, WaitForThreadpoolTimerCallbacks, lstrcmpW, GetTickCount, CreateProcessW, SetCurrentDirectoryW, InitializeCriticalSectionEx, QueueUserWorkItem, QueryPerformanceFrequency, FlushViewOfFile, SystemTimeToFileTime, GetSystemTime, MapViewOfFile, CreateFileMappingW, FlushFileBuffers, SetEndOfFile, LCMapStringW, GetFullPathNameW, OpenMutexW, GetFileSizeEx, SetFileTime, UnmapViewOfFile, MultiByteToWideChar, CreateMutexW, LocaleNameToLCID, DeleteCriticalSection, LoadLibraryW, GetSystemInfo, GetUserPreferredUILanguages, InitializeCriticalSection, LeaveCriticalSection, GetProductInfo, EnterCriticalSection, GetFileAttributesW, IsDebuggerPresent, DebugBreak, CreateMutexExW, OpenSemaphoreW, WaitForSingleObjectEx, OutputDebugStringW, ReleaseMutex, GetModuleHandleExW, ReleaseSemaphore, SetLastError, CreateSemaphoreExW, GetModuleFileNameA, WideCharToMultiByte, GetNativeSystemInfo, IsWow64Process, InitOnceExecuteOnce, GetCurrentDirectoryW, FindResourceW, LoadResource, CloseHandle, DeleteFileW, LockResource, GetVersionExA, SetFileAttributesW, GetVersionExW, CreateFileW, FindClose, GetShortPathNameW, WriteFile, GetCurrentProcess, FindNextFileW, SetPriorityClass, FindFirstFileExW, FindFirstFileW, SizeofResource, ReadFile, LoadLibraryExW, VerifyVersionInfoW, FreeLibrary, GetModuleHandleW, GetProcessHeap, VerSetConditionMask, LocalFree, GetProcAddress, HeapAlloc, HeapSetInformation, RaiseException, GetLastError, Sleep, GetStartupInfoW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, WakeAllConditionVariable, SleepConditionVariableSRW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, RaiseFailFastException
USER32.dll	CharNextW, GetMessageW, PostThreadMessageW, PostMessageW, LoadStringW, GetShellWindow, SendMessageTimeoutW
msvcrt.dll	_wtoi, rand_s, isalnum, strnlen, wcsnlen, wcsncpy_s, _vsnwprintf_s, wcscat_s, wcscpy_s, wcsncmp, wcschr, _ultow_s, _wcsicmp, _wcsnicmp, wcsrchr, swscanf_s, sprintf_s, _wfopen_s, fclose, fgetws, _XcptFilter, _amsg_exit, __wgetmainargs, __set_app_type, iswalpha, _time64, memcpy_s, _vsnwprintf, _CxxThrowException, exit, _exit, _cexit, __setusermatherr, _initterm, __C_specific_handler, memcmp, memmove_s, ?terminate@@YAXXZ, ??1type_info@@UEAA@XZ, _onexit, __dllonexit, _unlock, _lock, _commode, _fmode, _wcmdln, memset
SHELL32.dll	CommandLineToArgvW, SHGetKnownFolderPath, SHChangeNotify, SHCreateItemFromParsingName, SHGetSpecialFolderLocation, SHGetFolderPathW, SHCreateDirectoryExW, SHGetSpecialFolderPathW, SHGetDesktopFolder, SHSetLocalizedName
ntdll.dll	RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, NtClose, NtQueryLicenseValue
IEADVPACK.dll	ExecuteCabW
SHLWAPI.dll	SHDeleteValueW, StrCmpIW, SHRegSetUSValueW, StrCmpNIW, SHCopyKeyW, SHRegGetUSValueW, UrlCreateFromPathW, UrlCanonicalizeW, PathIsURLW, PathFileExistsW, SHDeleteKeyW, PathRemoveBlanksW, PathFindFileNameW, PathRemoveExtensionW, SHGetValueW, SHSetValueW, StrTrimW, StrStrW, StrCmpNIA, StrCmpNA, StrCmpNW, UrlEscapeW, UrlUnescapeW, StrCmpW, UrlApplySchemeW, SHRegDeleteUSValueW, PathIsNetworkPathW, SHStrDupW, StrStrIW
iertutil.dll
OLEAUT32.dll	VariantInit, VariantClear, VarBstrCat, SysAllocString, SysStringLen, SysAllocStringLen, VariantCopy, SysAllocStringByteLen, SysStringByteLen, SysFreeString, VarBstrCmp
ole32.dll	CoTaskMemFree, OleInitialize, CoInitializeEx, PropVariantClear, CoTaskMemAlloc, CoCreateInstance, OleUninitialize, CoUninitialize, CoCreateGuid, StringFromGUID2
iedkcs32.dll	BrandIEActiveSetup
KERNELBASE.dll	GetSystemDefaultLocaleName, GetUserDefaultLocaleName, LocalAlloc, OpenGlobalizationUserSettingsKey
CRYPT32.dll	CertGetCertificateContextProperty, CertEnumCertificatesInStore, CryptStringToBinaryA, CryptBinaryToStringA, CertGetIntendedKeyUsage, CertGetEnhancedKeyUsage, CryptStringToBinaryW, CertGetNameStringW, CertOpenStore, CertCreateCertificateContext, CertAddCertificateContextToStore, CertFreeCertificateContext, CertCloseStore, CryptImportPublicKeyInfo, CertGetCertificateChain, CertFindCertificateInStore, CertVerifyCertificateChainPolicy, CertFreeCertificateChain, CryptHashCertificate
urlmon.dll	CreateUri, CreateIUriBuilder
WININET.dll	InternetConnectW, InternetCrackUrlW, InternetCanonicalizeUrlW, InternetReadFile, HttpOpenRequestW, InternetCloseHandle, HttpSendRequestW, HttpQueryInfoW, InternetOpenW
SLC.dll	SLGetWindowsInformationDWORD
NETAPI32.dll	NetApiBufferFree, NetGetJoinInformation
VERSION.dll	GetFileVersionInfoSizeExW, GetFileVersionInfoExW, VerQueryValueW
MLANG.dll

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

• ie4uinit.exe

Click to jump to process

Memory Usage

• ie4uinit.exe

Click to jump to process

Target ID:	0
Start time:	19:16:03
Start date:	20/02/2024
Path:	C:\Users\user\Desktop\ie4uinit.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\ie4uinit.exe
Imagebase:	0x7ff674b20000
File size:	263'168 bytes
MD5 hash:	054F65E18AD84A4F2D51CFE7931664D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	0.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	37.3%
Total number of Nodes:	67
Total number of Limit Nodes:	3

Executed Functions

Function 00007FF674B4BFE0 Relevance: 10.6, APIs: 7, Instructions: 143
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoW.KERNEL32 ref: 00007FF674B4C008
Sleep.KERNEL32 ref: 00007FF674B4C03F
_amsg_exit.MSVCRT ref: 00007FF674B4C05D
_initterm.MSVCRT ref: 00007FF674B4C0E8
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF674B4C115
exit.KERNELBASE ref: 00007FF674B4C1BA
_cexit.MSVCRT ref: 00007FF674B4C1C9

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CurrentImageInfoNonwritableSleepStartup_amsg_exit_cexit_inittermexit
String ID:
API String ID: 642454821-0
Opcode ID: 9da82ac5b85e3a381c90719c6fec9ba80c5a90861ad1e3cd64d1f3421668b425
Instruction ID: e853d827866042293c3a8d6af74cd726e980f7f07512690faea3144738fea3ff
Opcode Fuzzy Hash: 9da82ac5b85e3a381c90719c6fec9ba80c5a90861ad1e3cd64d1f3421668b425
Instruction Fuzzy Hash: 24612827A28642C2FB609F29E4C8279A2A1FB46F84F554036DA4DD3795DF3CED91C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B27BA4 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#650.IERTUTIL ref: 00007FF674B27BCE

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: #650
String ID:
API String ID: 936228084-0
Opcode ID: 7d5f5a053196136d3436f291fa603ed3c42ffaa005fb086b4074728cf57a5870
Instruction ID: d826eb8d6cb1727a6dffb6c15502ea980079beff6e775d0d604f1612f503ac37
Opcode Fuzzy Hash: 7d5f5a053196136d3436f291fa603ed3c42ffaa005fb086b4074728cf57a5870
Instruction Fuzzy Hash: CBF01573614B41C7D7008F56E58815CBAA1F788F94B98C03AC74883724DF34E8A5CA14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B4BF90 Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wgetmainargs.KERNELBASE ref: 00007FF674B4BFC8

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: __wgetmainargs
String ID:
API String ID: 1709950718-0
Opcode ID: 322e22120a4074f5f4e04645174972c6a5e73387fd47f3108d6b69dacbb940b0
Instruction ID: 266904403670cc442a4985347c44d572c238576859c257620e762f64d77fda28
Opcode Fuzzy Hash: 322e22120a4074f5f4e04645174972c6a5e73387fd47f3108d6b69dacbb940b0
Instruction Fuzzy Hash: 35E07576E28787D6EA10DF91E8984A4F7A0FB56B04F840176D44D96330EF3CA9DACB01

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF674B49078 Relevance: 93.0, APIs: 27, Strings: 26, Instructions: 225
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF674B490AE
_wcsicmp.MSVCRT ref: 00007FF674B490D9
_wcsicmp.MSVCRT ref: 00007FF674B490FB

Strings

Te.ProcessHost.exe, xrefs: 00007FF674B491D7
microsoftedgedevtools.exe, xrefs: 00007FF674B49362
FAKEVIRTUALSURFACETESTAPP.EXE, xrefs: 00007FF674B491F5
microsoftedge.exe, xrefs: 00007FF674B49304
TE.EXE, xrefs: 00007FF674B491B9
EXPLORER.EXE, xrefs: 00007FF674B49135
SYSPREP.EXE, xrefs: 00007FF674B49113
browser_broker.exe, xrefs: 00007FF674B493BA
WWAHOST.EXE, xrefs: 00007FF674B49179
microsoftedgecp.exe, xrefs: 00007FF674B49326
pickerhost.exe, xrefs: 00007FF674B4939B
MSFEEDSSYNC.EXE, xrefs: 00007FF674B490F1
MSOOBE.EXE, xrefs: 00007FF674B49213
FirstLogonAnim.exe, xrefs: 00007FF674B4929B
USERACCOUNTBROKER.EXE, xrefs: 00007FF674B49257
NETPLWIZ.EXE, xrefs: 00007FF674B49235
MSHTMPAD.EXE, xrefs: 00007FF674B49279
DCIScanner, xrefs: 00007FF674B492DF
jshost.exe, xrefs: 00007FF674B493D9
microsoftedgebchost.exe, xrefs: 00007FF674B49344
IEUTLAUNCH.EXE, xrefs: 00007FF674B4919B
authhost.exe, xrefs: 00007FF674B493F8
LOADER42.EXE, xrefs: 00007FF674B49157
RESTOREOPTIN.EXE, xrefs: 00007FF674B492BD
microsoftedgesh.exe, xrefs: 00007FF674B49380
IEXPLORE.EXE, xrefs: 00007FF674B490CC

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: _wcsicmp$FileModuleName
String ID: DCIScanner$EXPLORER.EXE$FAKEVIRTUALSURFACETESTAPP.EXE$FirstLogonAnim.exe$IEUTLAUNCH.EXE$IEXPLORE.EXE$LOADER42.EXE$MSFEEDSSYNC.EXE$MSHTMPAD.EXE$MSOOBE.EXE$NETPLWIZ.EXE$RESTOREOPTIN.EXE$SYSPREP.EXE$TE.EXE$Te.ProcessHost.exe$USERACCOUNTBROKER.EXE$WWAHOST.EXE$authhost.exe$browser_broker.exe$jshost.exe$microsoftedge.exe$microsoftedgebchost.exe$microsoftedgecp.exe$microsoftedgedevtools.exe$microsoftedgesh.exe$pickerhost.exe
API String ID: 1034258996-1180723254
Opcode ID: e5e6a1bc840d25c17b83aa237c5cd1d854911dd46cdf97a3bb4bf43cf9c52e73
Instruction ID: 4cd2501f3ea914d55bc4ba6c387009ad84576a3ff49cbc2b0f2d64aef917fc09
Opcode Fuzzy Hash: e5e6a1bc840d25c17b83aa237c5cd1d854911dd46cdf97a3bb4bf43cf9c52e73
Instruction Fuzzy Hash: DBB1B326628742C6EA148B39E8D8679E7A1FF47FC5F859174C90FC2294EF7CE948C601

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B21E68 Relevance: 91.3, APIs: 9, Strings: 43, Instructions: 282
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF674B21574: _vsnwprintf.MSVCRT ref: 00007FF674B215B4

RegOpenKeyExW.ADVAPI32 ref: 00007FF674B22215
memset.MSVCRT ref: 00007FF674B22235
RegQueryValueExW.ADVAPI32 ref: 00007FF674B22267
StrCmpIW.SHLWAPI ref: 00007FF674B2228F
StrCmpICW.SHLWAPI ref: 00007FF674B222B2
memset.MSVCRT ref: 00007FF674B222D6
RegQueryValueExW.ADVAPI32 ref: 00007FF674B22303
StrCmpIW.SHLWAPI ref: 00007FF674B2232E
RegCloseKey.ADVAPI32 ref: 00007FF674B22349

Strings

NSimsun, xrefs: 00007FF674B2214D
software\microsoft\Internet Explorer\International\Scripts, xrefs: 00007FF674B221CB
Mangal, xrefs: 00007FF674B21F18, 00007FF674B2207D
MS PGothic, xrefs: 00007FF674B21FEB
IEFixedFontName, xrefs: 00007FF674B222EA
Euphemia, xrefs: 00007FF674B21EFB
MingLiu, xrefs: 00007FF674B22133
Microsoft Yi Baiti, xrefs: 00007FF674B21F27
DokChampa, xrefs: 00007FF674B21ECC
Gulim, xrefs: 00007FF674B21FE0
GulimChe, xrefs: 00007FF674B22117
Plantagenet Cherokee, xrefs: 00007FF674B21F11
Shruti, xrefs: 00007FF674B21F5A, 00007FF674B220A7
Simplified Arabic Fixed, xrefs: 00007FF674B2206F
Iskoola Pota, xrefs: 00007FF674B21F3D
Simplified Arabic, xrefs: 00007FF674B21F02
Segoe UI Symbol, xrefs: 00007FF674B21EC0
DaunPenh, xrefs: 00007FF674B21F7F
Mongolian Baiti, xrefs: 00007FF674B21FAB
Arial, xrefs: 00007FF674B21EEB
Nyala, xrefs: 00007FF674B21EE4
IEPropFontName, xrefs: 00007FF674B22249
Estrangelo Edessa, xrefs: 00007FF674B21F53
Vrinda, xrefs: 00007FF674B21F2E, 00007FF674B2208B
Simsun, xrefs: 00007FF674B22001
Tunga, xrefs: 00007FF674B21FB2, 00007FF674B220DF
Tahoma, xrefs: 00007FF674B21FD5, 00007FF674B220FB
Times New Roman, xrefs: 00007FF674B21EA5
PMingLiu, xrefs: 00007FF674B21FF6
%s\%u, xrefs: 00007FF674B221D6
Kalinga, xrefs: 00007FF674B21F70, 00007FF674B220B5
Kartika, xrefs: 00007FF674B21FC4, 00007FF674B220ED
Latha, xrefs: 00007FF674B21F86, 00007FF674B220C3
Microsoft Himalaya, xrefs: 00007FF674B21ED8
Miriam Fixed, xrefs: 00007FF674B2203D
MS Gothic, xrefs: 00007FF674B22125
MV Boli, xrefs: 00007FF674B21F95
Raavi, xrefs: 00007FF674B21F44, 00007FF674B22099
David, xrefs: 00007FF674B222A4
Courier New, xrefs: 00007FF674B2200C
Sylfaen, xrefs: 00007FF674B21EB4, 00007FF674B2202F, 00007FF674B22109
Gautami, xrefs: 00007FF674B21F9C, 00007FF674B220D1
Myanmar Text, xrefs: 00007FF674B21F69

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: QueryValuememset$CloseOpen_vsnwprintf
String ID: %s\%u$Arial$Courier New$DaunPenh$David$DokChampa$Estrangelo Edessa$Euphemia$Gautami$Gulim$GulimChe$IEFixedFontName$IEPropFontName$Iskoola Pota$Kalinga$Kartika$Latha$MS Gothic$MS PGothic$MV Boli$Mangal$Microsoft Himalaya$Microsoft Yi Baiti$MingLiu$Miriam Fixed$Mongolian Baiti$Myanmar Text$NSimsun$Nyala$PMingLiu$Plantagenet Cherokee$Raavi$Segoe UI Symbol$Shruti$Simplified Arabic$Simplified Arabic Fixed$Simsun$Sylfaen$Tahoma$Times New Roman$Tunga$Vrinda$software\microsoft\Internet Explorer\International\Scripts
API String ID: 3838326566-3455815564
Opcode ID: bb95d98c0b9ce52d2afee0030d27698f1cacf6dbb2a86d5c0c801d4b92472ba7
Instruction ID: 4bf46f346bb7fc7c1052422a7f218fe20fbd6b0a237bf1e9c693c9260725e779
Opcode Fuzzy Hash: bb95d98c0b9ce52d2afee0030d27698f1cacf6dbb2a86d5c0c801d4b92472ba7
Instruction Fuzzy Hash: 76F1DD37925F82D9E721CF20E8846E9B7A8FB49B48F504236DA4D87B24DF38D695C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B22438 Relevance: 63.3, APIs: 24, Strings: 12, Instructions: 251
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.ADVAPI32 ref: 00007FF674B22499
SHCopyKeyW.SHLWAPI ref: 00007FF674B224BF
RegCloseKey.ADVAPI32 ref: 00007FF674B224D0
GetSystemDirectoryW.KERNEL32 ref: 00007FF674B224EF
LoadLibraryExW.KERNEL32 ref: 00007FF674B22527
GetProcAddress.KERNEL32 ref: 00007FF674B22545
FreeLibrary.KERNEL32 ref: 00007FF674B2255F
#33.IERTUTIL ref: 00007FF674B2256B
SHFlushSFCache.SHELL32 ref: 00007FF674B2257C
_time64.MSVCRT ref: 00007FF674B2258C
SHRegSetUSValueW.SHLWAPI ref: 00007FF674B225C2
memset.MSVCRT ref: 00007FF674B225DA
GetModuleHandleW.KERNEL32 ref: 00007FF674B225E8
GetModuleFileNameW.KERNEL32 ref: 00007FF674B22604
PathFileExistsW.SHLWAPI ref: 00007FF674B22657
ExecuteCabW.IEADVPACK ref: 00007FF674B22690
GetModuleHandleW.KERNEL32 ref: 00007FF674B226A0
ShellMessageBoxW.SHLWAPI ref: 00007FF674B226CE
RegCreateKeyExW.ADVAPI32 ref: 00007FF674B227EB
RegCreateKeyExW.ADVAPI32 ref: 00007FF674B22836
RegQueryValueExW.ADVAPI32 ref: 00007FF674B22874
RegSetValueExW.ADVAPI32 ref: 00007FF674B228A6
RegCloseKey.ADVAPI32 ref: 00007FF674B228B7
RegCloseKey.ADVAPI32 ref: 00007FF674B228C8

Strings

DefaultInstall.Windows7, xrefs: 00007FF674B22680
SOFTWARE\Microsoft\Internet Explorer\New Windows, xrefs: 00007FF674B2246F
ShellFolder, xrefs: 00007FF674B2280E
Attributes, xrefs: 00007FF674B22855, 00007FF674B22890
SOFTWARE\Microsoft\Internet Explorer\Unattend\New Windows, xrefs: 00007FF674B224AE
PerUserInit, xrefs: 00007FF674B2253B
@, xrefs: 00007FF674B226C6
Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}, xrefs: 00007FF674B227C0
ieuinit.inf, xrefs: 00007FF674B22639
Software\Microsoft\Internet Explorer\SQM, xrefs: 00007FF674B225BB
InstallDate, xrefs: 00007FF674B225B4
mydocs.dll, xrefs: 00007FF674B22504

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CloseCreateModuleValue$FileHandleLibrary$AddressCacheCopyDirectoryExecuteExistsFlushFreeLoadMessageNamePathProcQueryShellSystem_time64memset
String ID: @$Attributes$DefaultInstall.Windows7$InstallDate$PerUserInit$SOFTWARE\Microsoft\Internet Explorer\New Windows$SOFTWARE\Microsoft\Internet Explorer\Unattend\New Windows$ShellFolder$Software\Microsoft\Internet Explorer\SQM$Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}$ieuinit.inf$mydocs.dll
API String ID: 1390537773-2640647115
Opcode ID: c2174abbe7ee1ada879519ae8abbd446766d3185761d58f5df5f0d0c5200438a
Instruction ID: d8946eeb9c96d5b6a0a61f3a52f4eec1e9196a6c4fcf6d2b8f75ef2fc5230261
Opcode Fuzzy Hash: c2174abbe7ee1ada879519ae8abbd446766d3185761d58f5df5f0d0c5200438a
Instruction Fuzzy Hash: DFD13537628B82C6EB10CF54E8946B9BBA0FB8AB94F445135DA4D87764DF3CE945CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B245D0 Relevance: 58.1, APIs: 26, Strings: 7, Instructions: 319
fileregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetShortPathNameW.KERNEL32 ref: 00007FF674B24622
GetShortPathNameW.KERNEL32 ref: 00007FF674B24672
PathFindFileNameW.SHLWAPI(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B24687

Part of subcall function 00007FF674B2AB18: LocalFree.KERNEL32 ref: 00007FF674B2AD46

GetCurrentDirectoryW.KERNEL32(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B246B6
SetCurrentDirectoryW.KERNEL32(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B246CD
FindFirstFileW.KERNEL32(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B246ED
CoCreateInstance.OLE32(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B24724
StrCmpIW.SHLWAPI(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B247B4
StrCmpIW.SHLWAPI(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B247E0
PathRemoveBlanksW.SHLWAPI(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B2481E
StrCmpICW.SHLWAPI(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B24842
StrCmpICW.SHLWAPI(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B24860
ILCreateFromPath.SHELL32 ref: 00007FF674B248B0
ILCreateFromPath.SHELL32 ref: 00007FF674B248ED
RegOpenKeyExW.ADVAPI32(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B24937
StrCmpIW.SHLWAPI(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B24986
RegCloseKey.ADVAPI32(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B249A7
ILFree.SHELL32(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B249B8
FindNextFileW.KERNEL32(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B249CC
FindClose.KERNEL32(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B24A07

Part of subcall function 00007FF674B2A334: wcschr.MSVCRT ref: 00007FF674B2A39C

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B24A68
lstrcmpW.KERNEL32(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B24A8C
lstrcmpW.KERNEL32(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B24AA7
FindNextFileW.KERNEL32(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B24B17
FindClose.KERNEL32(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B24B2E
SetCurrentDirectoryW.KERNEL32(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B24B41

Strings

shell:::{871C5380-42A0-1069-A2EA-08002B30309D}, xrefs: 00007FF674B248A9
Software\Clients\StartMenuInternet, xrefs: 00007FF674B24929
shell:::{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}, xrefs: 00007FF674B248E6
IEXPLORE.EXE, xrefs: 00007FF674B2497F
-extoff, xrefs: 00007FF674B24852
-nohome, xrefs: 00007FF674B24834
*.lnk, xrefs: 00007FF674B246E6

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Find$Path$File$CloseCreateCurrentDirectoryName$FirstFreeFromNextShortlstrcmp$BlanksInstanceLocalOpenRemovewcschr
String ID: *.lnk$-extoff$-nohome$IEXPLORE.EXE$Software\Clients\StartMenuInternet$shell:::{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}$shell:::{871C5380-42A0-1069-A2EA-08002B30309D}
API String ID: 1000041407-3405740670
Opcode ID: 12b338869ac055bfbfede1c304d72bf4f993c3a24294629947afc1739973ac51
Instruction ID: f4ab3203856d9a9be6d4940560360db542273299b2e66469c78a6da9641b9430
Opcode Fuzzy Hash: 12b338869ac055bfbfede1c304d72bf4f993c3a24294629947afc1739973ac51
Instruction Fuzzy Hash: 25E10037628A86D6EB50DF25E8881B9B760FB8AF95F405131DA0DC7A94DF3CE949C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B22B70 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 146
sleeplibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF674B266E8: GetLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF674B21A63), ref: 00007FF674B26721
Part of subcall function 00007FF674B266E8: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF674B21A63), ref: 00007FF674B26799
Part of subcall function 00007FF674B266E8: PostThreadMessageW.USER32 ref: 00007FF674B267B9

InitOnceExecuteOnce.KERNEL32 ref: 00007FF674B22BB6
GetTickCount.KERNEL32 ref: 00007FF674B22BEB
GetShellWindow.USER32 ref: 00007FF674B22BF9
GetTickCount.KERNEL32 ref: 00007FF674B22C0A
GetTickCount.KERNEL32 ref: 00007FF674B22C25
Sleep.KERNEL32 ref: 00007FF674B22C38
Sleep.KERNEL32 ref: 00007FF674B22C4B
SHChangeNotify.SHELL32 ref: 00007FF674B22C64
CoInitializeEx.OLE32 ref: 00007FF674B22C8A
SHGetKnownFolderPath.SHELL32 ref: 00007FF674B22CB5
LoadLibraryExW.KERNEL32 ref: 00007FF674B22CF2
GetProcAddress.KERNEL32 ref: 00007FF674B22D10
FreeLibrary.KERNEL32 ref: 00007FF674B22D45
CoTaskMemFree.OLE32 ref: 00007FF674B22D56
CoUninitialize.OLE32 ref: 00007FF674B22D62
Sleep.KERNEL32 ref: 00007FF674B22D7A
GetShellWindow.USER32 ref: 00007FF674B22D86
SHGetFolderPathW.SHELL32 ref: 00007FF674B22DD4

Strings

MigrateCacheForCurrentUser, xrefs: 00007FF674B22D06
MigrateCacheForCurrentUser() returned: 0x%1!08lX!, xrefs: 00007FF674B22D2F
In MigrateWinInetCache, xrefs: 00007FF674B22C70
migration\WininetPlugin.dll, xrefs: 00007FF674B22CCE
In CmdClearIconCache, xrefs: 00007FF674B22B8F

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CountSleepTick$FolderFreeLibraryMessageOncePathShellWindow$AddressChangeExecuteFormatInitInitializeKnownLoadLocalNotifyPostProcTaskThreadTimeUninitialize
String ID: In CmdClearIconCache$In MigrateWinInetCache$MigrateCacheForCurrentUser$MigrateCacheForCurrentUser() returned: 0x%1!08lX!$migration\WininetPlugin.dll
API String ID: 2252748604-3922426855
Opcode ID: c76efddafdf2c0a565b18acd89d85bdb2a0319ff8dafd2594191556a9968fab7
Instruction ID: 5b2094f34e2c3d4ca6d1454a479b10e5a2fe71b55a43ccb923d06a980e6ee032
Opcode Fuzzy Hash: c76efddafdf2c0a565b18acd89d85bdb2a0319ff8dafd2594191556a9968fab7
Instruction Fuzzy Hash: F0612133A28A42C6EB549B64E8D86B9A7A0FF8BF41F405535DA0EC3695DF3CE844C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B234F8 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 209
commemorysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EventRegister.ADVAPI32 ref: 00007FF674B2356D
EventSetInformation.ADVAPI32 ref: 00007FF674B23595
HeapSetInformation.KERNEL32 ref: 00007FF674B235B7
OleInitialize.OLE32 ref: 00007FF674B235C5
SetErrorMode.KERNEL32 ref: 00007FF674B235DE
CommandLineToArgvW.SHELL32 ref: 00007FF674B235F7
memset.MSVCRT ref: 00007FF674B23647
CreateEventW.KERNEL32 ref: 00007FF674B23676
CreateThread.KERNEL32 ref: 00007FF674B236B7
WaitForSingleObject.KERNEL32 ref: 00007FF674B236D9
CloseHandle.KERNEL32 ref: 00007FF674B236EA
StrCmpNIW.SHLWAPI ref: 00007FF674B2374D
LocalFree.KERNEL32 ref: 00007FF674B237F7
GetLastError.KERNEL32 ref: 00007FF674B23805
OleUninitialize.OLE32 ref: 00007FF674B2381F
EventUnregister.ADVAPI32 ref: 00007FF674B23869

Strings

Starting ie4uinit.exe. Command Line:%1!lS!, xrefs: 00007FF674B236F9
ie4uinit%s.log, xrefs: 00007FF674B23656
Executing Command: %1!lS!, xrefs: 00007FF674B23799
Command Result: 0x%1!08lx!, xrefs: 00007FF674B237BA
ie4uInit.exe exiting. Process Result: 0x%1!08lx!======================================================, xrefs: 00007FF674B23835

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Event$CreateErrorInformation$ArgvCloseCommandFreeHandleHeapInitializeLastLineLocalModeObjectRegisterSingleThreadUninitializeUnregisterWaitmemset
String ID: Command Result: 0x%1!08lx!$Executing Command: %1!lS!$Starting ie4uinit.exe. Command Line:%1!lS!$ie4uInit.exe exiting. Process Result: 0x%1!08lx!======================================================$ie4uinit%s.log
API String ID: 3658610800-118140733
Opcode ID: c91161290317f067eff6c316cf6bb48b25ac0183bb98f27e52d42ed7f1f09385
Instruction ID: 9f5531779b89b9732ee8c7fca4b7daecdab41ea270804e646e40ae2b53bdd15b
Opcode Fuzzy Hash: c91161290317f067eff6c316cf6bb48b25ac0183bb98f27e52d42ed7f1f09385
Instruction Fuzzy Hash: 69A14133A28B82C6E710DF65E8885B9B7A0FB8AF80F455135D94E87660DF3CE985C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B25B88 Relevance: 35.2, APIs: 12, Strings: 8, Instructions: 224
filewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF674B266E8: GetLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF674B21A63), ref: 00007FF674B26721
Part of subcall function 00007FF674B266E8: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF674B21A63), ref: 00007FF674B26799
Part of subcall function 00007FF674B266E8: PostThreadMessageW.USER32 ref: 00007FF674B267B9

Part of subcall function 00007FF674B25944: CreateFileW.KERNEL32 ref: 00007FF674B259AE
Part of subcall function 00007FF674B25944: GetLastError.KERNEL32 ref: 00007FF674B259C3
Part of subcall function 00007FF674B25944: GetLastError.KERNEL32 ref: 00007FF674B259D9
Part of subcall function 00007FF674B25944: ReadFile.KERNEL32 ref: 00007FF674B25A2B
Part of subcall function 00007FF674B25944: CloseHandle.KERNEL32 ref: 00007FF674B25A89
Part of subcall function 00007FF674B25944: DeleteFileW.KERNEL32 ref: 00007FF674B25AB7
Part of subcall function 00007FF674B25944: GetLastError.KERNEL32 ref: 00007FF674B25AC7
Part of subcall function 00007FF674B25944: GetLastError.KERNEL32 ref: 00007FF674B25ADD

CoInitializeEx.OLE32 ref: 00007FF674B25BDE

Part of subcall function 00007FF674B27BA4: #650.IERTUTIL ref: 00007FF674B27BCE

InitOnceExecuteOnce.KERNEL32 ref: 00007FF674B25C38
SHGetSpecialFolderPathW.SHELL32 ref: 00007FF674B25CA3
PathFileExistsW.SHLWAPI ref: 00007FF674B25CDC
SetFileAttributesW.KERNEL32 ref: 00007FF674B25CF5
DeleteFileW.KERNEL32 ref: 00007FF674B25D05
SHGetSpecialFolderPathW.SHELL32 ref: 00007FF674B25D36
#654.IERTUTIL ref: 00007FF674B25DA6

Part of subcall function 00007FF674B24F14: SHGetSpecialFolderPathW.SHELL32 ref: 00007FF674B24F48
Part of subcall function 00007FF674B24F14: GetCurrentDirectoryW.KERNEL32 ref: 00007FF674B24F6A
Part of subcall function 00007FF674B24F14: GetModuleHandleW.KERNEL32 ref: 00007FF674B24F8D
Part of subcall function 00007FF674B24F14: LoadStringW.USER32 ref: 00007FF674B24FAB
Part of subcall function 00007FF674B24F14: GetCurrentDirectoryW.KERNEL32 ref: 00007FF674B24FD5
Part of subcall function 00007FF674B24F14: SHGetValueW.SHLWAPI ref: 00007FF674B2502E
Part of subcall function 00007FF674B24F14: GetModuleHandleW.KERNEL32 ref: 00007FF674B25040
Part of subcall function 00007FF674B24F14: LoadStringW.USER32 ref: 00007FF674B2505E
Part of subcall function 00007FF674B24F14: SHGetSpecialFolderPathW.SHELL32 ref: 00007FF674B2507C
Part of subcall function 00007FF674B24F14: GetCurrentDirectoryW.KERNEL32 ref: 00007FF674B250A6

Part of subcall function 00007FF674B25188: SHGetKnownFolderPath.SHELL32(00007FF674B22A2C), ref: 00007FF674B251B3
Part of subcall function 00007FF674B25188: CoTaskMemFree.OLE32 ref: 00007FF674B251DC

Part of subcall function 00007FF674B2520C: SHGetSpecialFolderPathW.SHELL32 ref: 00007FF674B25241
Part of subcall function 00007FF674B2520C: GetModuleHandleW.KERNEL32 ref: 00007FF674B2528E
Part of subcall function 00007FF674B2520C: LoadStringW.USER32 ref: 00007FF674B252AA
Part of subcall function 00007FF674B2520C: PathRemoveExtensionW.SHLWAPI ref: 00007FF674B252BB
Part of subcall function 00007FF674B2520C: GetModuleHandleW.KERNEL32 ref: 00007FF674B252F9
Part of subcall function 00007FF674B2520C: LoadStringW.USER32 ref: 00007FF674B25315
Part of subcall function 00007FF674B2520C: PathRemoveExtensionW.SHLWAPI ref: 00007FF674B25326

PostMessageW.USER32 ref: 00007FF674B25E89

Part of subcall function 00007FF674B27724: InitOnceExecuteOnce.KERNEL32(?,?,?,?,00007FF674B2CBF9), ref: 00007FF674B2773C

#281.IERTUTIL ref: 00007FF674B25EE0
#282.IERTUTIL ref: 00007FF674B25EFE
CoUninitialize.OLE32 ref: 00007FF674B25F44

Part of subcall function 00007FF674B2BE44: SetFileAttributesW.KERNEL32 ref: 00007FF674B2BF48
Part of subcall function 00007FF674B2BE44: wcscat_s.MSVCRT ref: 00007FF674B2C013
Part of subcall function 00007FF674B2BE44: wcscat_s.MSVCRT ref: 00007FF674B2C030
Part of subcall function 00007FF674B2BE44: FindFirstFileW.KERNEL32 ref: 00007FF674B2C048

Part of subcall function 00007FF674B23988: memset.MSVCRT ref: 00007FF674B239CE
Part of subcall function 00007FF674B23988: GetVersionExA.KERNEL32 ref: 00007FF674B239D8

Strings

In UserConfigIE. fRunningInstallStub=%1!d!, xrefs: 00007FF674B25BBB
In ShowIEDesktopIcon. fShow=%1!d!, xrefs: 00007FF674B25C0C
SBE is enabled. Set fShow to FALSE, xrefs: 00007FF674B25C4D
In ShowUserShortcuts. lsnSM=%1!d!, fShow=%2!d!, xrefs: 00007FF674B25D14
Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021494-0000-0000-C000-00000000004, xrefs: 00007FF674B25F38
Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021493-0000-0000-C000-00000000004, xrefs: 00007FF674B25F2C
Software\Clients\StartMenuInternet, xrefs: 00007FF674B25E77
Adobe\Flash Player\NativeCache, xrefs: 00007FF674B25E9E

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Path$File$Folder$HandleSpecial$ErrorLastLoadModuleOnceString$CurrentDirectoryMessage$AttributesDeleteExecuteExtensionInitPostRemovewcscat_s$#281#282#650#654CloseCreateExistsFindFirstFormatFreeInitializeKnownLocalReadTaskThreadTimeUninitializeValueVersionmemset
String ID: SBE is enabled. Set fShow to FALSE$Adobe\Flash Player\NativeCache$In ShowIEDesktopIcon. fShow=%1!d!$In ShowUserShortcuts. lsnSM=%1!d!, fShow=%2!d!$In UserConfigIE. fRunningInstallStub=%1!d!$Software\Clients\StartMenuInternet$Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021493-0000-0000-C000-00000000004$Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021494-0000-0000-C000-00000000004
API String ID: 503798684-980884874
Opcode ID: d41faeff84721ed1bd9eaa6f3b68f0cf017f28b01f6268df5b61b9c9ec436956
Instruction ID: 4a25ab73100f15af691a14ba49e929e86a8f2cc16b1e37e00b1297baa7802b89
Opcode Fuzzy Hash: d41faeff84721ed1bd9eaa6f3b68f0cf017f28b01f6268df5b61b9c9ec436956
Instruction Fuzzy Hash: E3B17F33A38642C6E710DB24E8D8AB9A760FF8AB84F405035E94E97695DF3CE945CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B38A44 Relevance: 33.7, APIs: 14, Strings: 5, Instructions: 498
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF674B49F2C: CoCreateInstance.OLE32(?,?,?,?,?,00007FF674B38A85), ref: 00007FF674B49FCA
Part of subcall function 00007FF674B49F2C: SysAllocString.OLEAUT32 ref: 00007FF674B4A00A

Part of subcall function 00007FF674B3814C: SysFreeString.OLEAUT32 ref: 00007FF674B381D6

SysFreeString.OLEAUT32 ref: 00007FF674B38AD8
StrCmpNW.SHLWAPI ref: 00007FF674B38B3F

Part of subcall function 00007FF674B21918: GetProcessHeap.KERNEL32 ref: 00007FF674B21921
Part of subcall function 00007FF674B21918: HeapAlloc.KERNEL32 ref: 00007FF674B21938

SysFreeString.OLEAUT32 ref: 00007FF674B38CF7
SysFreeString.OLEAUT32 ref: 00007FF674B38DFD
SysStringLen.OLEAUT32 ref: 00007FF674B38E0C
SysStringLen.OLEAUT32 ref: 00007FF674B38E4B
SysFreeString.OLEAUT32 ref: 00007FF674B38E8A
SysFreeString.OLEAUT32 ref: 00007FF674B38FEE
SysFreeString.OLEAUT32 ref: 00007FF674B39034
SysFreeString.OLEAUT32 ref: 00007FF674B3909A
SysStringLen.OLEAUT32 ref: 00007FF674B390EB
SysFreeString.OLEAUT32 ref: 00007FF674B39100
SysFreeString.OLEAUT32 ref: 00007FF674B39151

Strings

thumbprint, xrefs: 00007FF674B38CAD
publiccertificate, xrefs: 00007FF674B38B5C
signvalue, xrefs: 00007FF674B39059
NOTFOUND, xrefs: 00007FF674B39121
status, xrefs: 00007FF674B38A8F

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: String$Free$AllocHeap$CreateInstanceProcess
String ID: NOTFOUND$publiccertificate$signvalue$status$thumbprint
API String ID: 1790882235-479019699
Opcode ID: 0d54c112cf1ae56cca4db049aa18286424ddc298f1a7c7ab1b99240555bf85c3
Instruction ID: bbc2763455164bd92e2c1ca9d6fef8c92f1f786a3544e05a93c4c80e6dc99f36
Opcode Fuzzy Hash: 0d54c112cf1ae56cca4db049aa18286424ddc298f1a7c7ab1b99240555bf85c3
Instruction Fuzzy Hash: B232F52BA29B06C6EF548F6AD49836863A1FF86F84F054532DE0E97764DF39E844C341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B39428 Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 278
memorynetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00007FF674B3945C
SysStringLen.OLEAUT32 ref: 00007FF674B39477
HttpSendRequestW.WININET ref: 00007FF674B39493
InternetReadFile.WININET ref: 00007FF674B3951F
GetLastError.KERNEL32 ref: 00007FF674B3952F
SysStringByteLen.OLEAUT32 ref: 00007FF674B395BE
SysAllocStringByteLen.OLEAUT32 ref: 00007FF674B395CF
SysFreeString.OLEAUT32 ref: 00007FF674B395F4
HttpQueryInfoW.WININET ref: 00007FF674B394C8

Part of subcall function 00007FF674B21918: GetProcessHeap.KERNEL32 ref: 00007FF674B21921
Part of subcall function 00007FF674B21918: HeapAlloc.KERNEL32 ref: 00007FF674B21938

GetLastError.KERNEL32 ref: 00007FF674B39602
SysFreeString.OLEAUT32 ref: 00007FF674B39632
SysAllocString.OLEAUT32 ref: 00007FF674B39712

Strings

&clientkey=, xrefs: 00007FF674B3972B
&mac=, xrefs: 00007FF674B3975C
Content-Type: text/xml; charset=utf-8, xrefs: 00007FF674B39447
https://ieonline.microsoft.com/EUPP/v1/service?action=signvalue&appid=Microsoft_IE_EUPP, xrefs: 00007FF674B39681

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: String$Alloc$ByteErrorFreeHeapHttpLast$FileInfoInternetProcessQueryReadRequestSend
String ID: &clientkey=$&mac=$Content-Type: text/xml; charset=utf-8$https://ieonline.microsoft.com/EUPP/v1/service?action=signvalue&appid=Microsoft_IE_EUPP
API String ID: 2461892178-91891535
Opcode ID: 26c21fecc66d493dde6acd165f7bb7267dba74518328a5f411d9d28c9933de08
Instruction ID: c4ac1d2c2a7fb6ee142aaddc837279e2923db785805d6c9b44ed1f97746bfb69
Opcode Fuzzy Hash: 26c21fecc66d493dde6acd165f7bb7267dba74518328a5f411d9d28c9933de08
Instruction Fuzzy Hash: 14B15C23A28A52C7EB119F3698883B966A4FB4BF94F094535DE0E97784DF3CE8458740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2AFD8 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 205synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF674B2B014

Part of subcall function 00007FF674B21574: _vsnwprintf.MSVCRT ref: 00007FF674B215B4

CreateMutexExW.KERNEL32 ref: 00007FF674B2B056
WaitForSingleObjectEx.KERNEL32 ref: 00007FF674B2B07F

Part of subcall function 00007FF674B2899C: GetLastError.KERNEL32 ref: 00007FF674B289A0

Strings

Local\SM0:%d:%d:%hs, xrefs: 00007FF674B2B025
x, xrefs: 00007FF674B2B02F
wil, xrefs: 00007FF674B2B0C6
onecore\internal\sdk\inc\wil\opensource\wil\resource.h, xrefs: 00007FF674B2B2D6

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CreateCurrentErrorLastMutexObjectProcessSingleWait_vsnwprintf
String ID: Local\SM0:%d:%d:%hs$onecore\internal\sdk\inc\wil\opensource\wil\resource.h$wil$x
API String ID: 3333087404-3363748427
Opcode ID: 4e1b66a85bcca95b83280eb80358548f95c6b66c4e9b49a9152eb0d8a43a916d
Instruction ID: a53b8655fc8b919f3663c79143f7613fe209b47aa52e45c7bacc3efe41c6ec77
Opcode Fuzzy Hash: 4e1b66a85bcca95b83280eb80358548f95c6b66c4e9b49a9152eb0d8a43a916d
Instruction Fuzzy Hash: 65817233A28A42C2EB21DF65E4986BAB760FB8AF84F444135DA4D97755DF3CE845C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2607C Relevance: 24.7, APIs: 7, Strings: 7, Instructions: 198registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B266E8: GetLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF674B21A63), ref: 00007FF674B26721
Part of subcall function 00007FF674B266E8: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF674B21A63), ref: 00007FF674B26799
Part of subcall function 00007FF674B266E8: PostThreadMessageW.USER32 ref: 00007FF674B267B9

CoInitializeEx.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF674B22A2C), ref: 00007FF674B260CC
RegOpenKeyExW.ADVAPI32 ref: 00007FF674B262B2
RegOpenKeyExW.ADVAPI32 ref: 00007FF674B262EB
RegDeleteKeyW.ADVAPI32 ref: 00007FF674B26310
PostMessageW.USER32 ref: 00007FF674B26338
SHChangeNotify.SHELL32 ref: 00007FF674B26356
CoUninitialize.OLE32 ref: 00007FF674B26362

Part of subcall function 00007FF674B23CD8: GetVersionExW.KERNEL32 ref: 00007FF674B23CFE

Part of subcall function 00007FF674B23EDC: RegCreateKeyExW.ADVAPI32 ref: 00007FF674B23F32
Part of subcall function 00007FF674B23EDC: RegSetValueW.ADVAPI32 ref: 00007FF674B23FEB
Part of subcall function 00007FF674B23EDC: RegCloseKey.ADVAPI32 ref: 00007FF674B23FFC

Part of subcall function 00007FF674B250F0: SHGetSpecialFolderPathW.SHELL32 ref: 00007FF674B25132

Part of subcall function 00007FF674B25188: SHGetKnownFolderPath.SHELL32(00007FF674B22A2C), ref: 00007FF674B251B3
Part of subcall function 00007FF674B25188: CoTaskMemFree.OLE32 ref: 00007FF674B251DC

Part of subcall function 00007FF674B2520C: SHGetSpecialFolderPathW.SHELL32 ref: 00007FF674B25241
Part of subcall function 00007FF674B2520C: GetModuleHandleW.KERNEL32 ref: 00007FF674B2528E
Part of subcall function 00007FF674B2520C: LoadStringW.USER32 ref: 00007FF674B252AA
Part of subcall function 00007FF674B2520C: PathRemoveExtensionW.SHLWAPI ref: 00007FF674B252BB
Part of subcall function 00007FF674B2520C: GetModuleHandleW.KERNEL32 ref: 00007FF674B252F9
Part of subcall function 00007FF674B2520C: LoadStringW.USER32 ref: 00007FF674B25315
Part of subcall function 00007FF674B2520C: PathRemoveExtensionW.SHLWAPI ref: 00007FF674B25326

Part of subcall function 00007FF674B268E0: SHCreateItemFromParsingName.SHELL32 ref: 00007FF674B268F4
Part of subcall function 00007FF674B268E0: CoCreateInstance.OLE32 ref: 00007FF674B26924

Strings

shell:::{871C5380-42A0-1069-A2EA-08002B30309D}, xrefs: 00007FF674B2624E
Locale, xrefs: 00007FF674B262C6
In ShowHideIE. fShow=%1!d!, fForceAssociations=%2!d!, fPreserveSpadValues=%3!d!, xrefs: 00007FF674B260B5
In SetIEShowHideFlags. fShow=%1!d!, fPreserveSpadValues=%2!d!, xrefs: 00007FF674B260F4
Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}, xrefs: 00007FF674B26295, 00007FF674B262E1
Software\Clients\StartMenuInternet, xrefs: 00007FF674B26328
Version, xrefs: 00007FF674B262FF

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Path$CreateFolderMessage$ExtensionHandleLoadModuleOpenPostRemoveSpecialString$ChangeCloseDeleteFormatFreeFromInitializeInstanceItemKnownLocalNameNotifyParsingTaskThreadTimeUninitializeValueVersion
String ID: In SetIEShowHideFlags. fShow=%1!d!, fPreserveSpadValues=%2!d!$In ShowHideIE. fShow=%1!d!, fForceAssociations=%2!d!, fPreserveSpadValues=%3!d!$Locale$Software\Clients\StartMenuInternet$Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}$Version$shell:::{871C5380-42A0-1069-A2EA-08002B30309D}
API String ID: 2920985195-3834798340
Opcode ID: 51dfb5291f5a70fcc6bfd49ad1c65dd96561e4be8d432076c7aa28d2bc72d843
Instruction ID: a6e5d98661a2c64e9f2c3beb13d2069d8169986ccc87d5bee5da79bc7d5e2770
Opcode Fuzzy Hash: 51dfb5291f5a70fcc6bfd49ad1c65dd96561e4be8d432076c7aa28d2bc72d843
Instruction Fuzzy Hash: E981C023F28642C6F710DB25A8C8AB9A660BF9AF84F406534DD0D97696DF3CED49C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B391C4 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 141networkCOMMON

Download Yara Rule

APIs

InternetCanonicalizeUrlW.WININET ref: 00007FF674B39222
memset.MSVCRT ref: 00007FF674B39247
InternetCrackUrlW.WININET ref: 00007FF674B3928F
InternetOpenW.WININET ref: 00007FF674B392B7
InternetConnectW.WININET ref: 00007FF674B392F9
HttpOpenRequestW.WININET ref: 00007FF674B3934A
InternetCloseHandle.WININET ref: 00007FF674B39376
GetLastError.KERNEL32 ref: 00007FF674B39384
InternetCloseHandle.WININET ref: 00007FF674B393A1

Part of subcall function 00007FF674B39428: SysAllocString.OLEAUT32 ref: 00007FF674B3945C
Part of subcall function 00007FF674B39428: SysStringLen.OLEAUT32 ref: 00007FF674B39477
Part of subcall function 00007FF674B39428: HttpSendRequestW.WININET ref: 00007FF674B39493
Part of subcall function 00007FF674B39428: HttpQueryInfoW.WININET ref: 00007FF674B394C8
Part of subcall function 00007FF674B39428: InternetReadFile.WININET ref: 00007FF674B3951F
Part of subcall function 00007FF674B39428: GetLastError.KERNEL32 ref: 00007FF674B3952F
Part of subcall function 00007FF674B39428: SysFreeString.OLEAUT32 ref: 00007FF674B395F4
Part of subcall function 00007FF674B39428: SysFreeString.OLEAUT32 ref: 00007FF674B39632

GetLastError.KERNEL32 ref: 00007FF674B393AF
InternetCloseHandle.WININET ref: 00007FF674B393CC
GetLastError.KERNEL32(?,00007FF674B39945), ref: 00007FF674B393DA

Strings

POST, xrefs: 00007FF674B39322
IE_EUPP, xrefs: 00007FF674B392AE

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Internet$ErrorLastString$CloseHandleHttp$FreeOpenRequest$AllocCanonicalizeConnectCrackFileInfoQueryReadSendmemset
String ID: IE_EUPP$POST
API String ID: 1847757306-3869093421
Opcode ID: ba3e533db3d407efd3c5f658493dd1e50e431329b58360ea42ebc0e4c1b34b0e
Instruction ID: 65ebe3e538f312e9824e47ca161ea37a5f0feb0c400570a509652b97206ae6ff
Opcode Fuzzy Hash: ba3e533db3d407efd3c5f658493dd1e50e431329b58360ea42ebc0e4c1b34b0e
Instruction Fuzzy Hash: 64518373618B81CAE7209F65E8986AABBA0FB8AB85F445135DE4D83754DF3CD905CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B47EBC Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 215librarynativeloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00007FF674B47F35
GetProcAddress.KERNEL32 ref: 00007FF674B47F53

Part of subcall function 00007FF674B47848: RegGetValueW.ADVAPI32 ref: 00007FF674B47881

Part of subcall function 00007FF674B4790C: LoadLibraryExW.KERNEL32 ref: 00007FF674B47942
Part of subcall function 00007FF674B4790C: GetProcAddress.KERNEL32 ref: 00007FF674B47960
Part of subcall function 00007FF674B4790C: GetProcAddress.KERNEL32 ref: 00007FF674B47979
Part of subcall function 00007FF674B4790C: FreeLibrary.KERNEL32 ref: 00007FF674B47BBE

NtQueryLicenseValue.NTDLL ref: 00007FF674B47F85
FreeLibrary.KERNEL32 ref: 00007FF674B47FFB
NtQueryLicenseValue.NTDLL ref: 00007FF674B481AD

Strings

AllowTelemetry, xrefs: 00007FF674B4802D, 00007FF674B48063, 00007FF674B480CF, 00007FF674B48166
OptInLevel, xrefs: 00007FF674B47F02
NtQuerySecurityPolicy, xrefs: 00007FF674B47F49
Reserved.PlatformSigned, xrefs: 00007FF674B47ED8
CodeIntegrity.Telemetry, xrefs: 00007FF674B47EED
ntdll.dll, xrefs: 00007FF674B47F19
Software\Policies\Microsoft\Windows\DataCollection, xrefs: 00007FF674B4803B
AllowTelemetry_PolicyManager, xrefs: 00007FF674B480F9

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Library$AddressProcValue$FreeLicenseLoadQuery
String ID: AllowTelemetry$AllowTelemetry_PolicyManager$CodeIntegrity.Telemetry$NtQuerySecurityPolicy$OptInLevel$Reserved.PlatformSigned$Software\Policies\Microsoft\Windows\DataCollection$ntdll.dll
API String ID: 1629355636-1971245831
Opcode ID: 58153877028cc207b23342fb6e019d5e90d2b3fbfe5319eb45a851325eb809a4
Instruction ID: 32572de0b20f5e7e6e0e55bf4389e23eacde863bbe94069b690e0396db219b0c
Opcode Fuzzy Hash: 58153877028cc207b23342fb6e019d5e90d2b3fbfe5319eb45a851325eb809a4
Instruction Fuzzy Hash: D7A16D77A24742CAE7158F68D4C82E87BA0FB0AB98F504136DE0D93798EF39D985C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B46918 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 207synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF674B46954

Part of subcall function 00007FF674B21574: _vsnwprintf.MSVCRT ref: 00007FF674B215B4

CreateMutexExW.KERNEL32 ref: 00007FF674B46996
WaitForSingleObjectEx.KERNEL32 ref: 00007FF674B469BF

Part of subcall function 00007FF674B2899C: GetLastError.KERNEL32 ref: 00007FF674B289A0

Strings

Local\SM0:%d:%d:%hs, xrefs: 00007FF674B46965
wil, xrefs: 00007FF674B46A06
onecore\internal\sdk\inc\wil\opensource\wil\resource.h, xrefs: 00007FF674B46C30

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CreateCurrentErrorLastMutexObjectProcessSingleWait_vsnwprintf
String ID: Local\SM0:%d:%d:%hs$onecore\internal\sdk\inc\wil\opensource\wil\resource.h$wil
API String ID: 3333087404-847674279
Opcode ID: e768dbed83ba385b23fc2c8b1f8f5ba2f3c5fcdde328f5b82fdacd1f3d40aa78
Instruction ID: 7d0c456a05d8c1a53782010178f8bc36477064a4a3c8bbcb2c8643994cbae8e2
Opcode Fuzzy Hash: e768dbed83ba385b23fc2c8b1f8f5ba2f3c5fcdde328f5b82fdacd1f3d40aa78
Instruction Fuzzy Hash: F7819573628A42C2E760DB65E4992B9A760FB8BFD4F448131DA4E87795DF3CE8458700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B22E20 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B266E8: GetLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF674B21A63), ref: 00007FF674B26721
Part of subcall function 00007FF674B266E8: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF674B21A63), ref: 00007FF674B26799
Part of subcall function 00007FF674B266E8: PostThreadMessageW.USER32 ref: 00007FF674B267B9

Part of subcall function 00007FF674B2BE44: SetFileAttributesW.KERNEL32 ref: 00007FF674B2BF48
Part of subcall function 00007FF674B2BE44: wcscat_s.MSVCRT ref: 00007FF674B2C013
Part of subcall function 00007FF674B2BE44: wcscat_s.MSVCRT ref: 00007FF674B2C030
Part of subcall function 00007FF674B2BE44: FindFirstFileW.KERNEL32 ref: 00007FF674B2C048

Part of subcall function 00007FF674B2C164: #820.IERTUTIL ref: 00007FF674B2C1FC
Part of subcall function 00007FF674B2C164: CoTaskMemAlloc.OLE32 ref: 00007FF674B2C270
Part of subcall function 00007FF674B2C164: CoTaskMemFree.OLE32 ref: 00007FF674B2C2E0

GetModuleFileNameW.KERNEL32 ref: 00007FF674B22E88
memset.MSVCRT ref: 00007FF674B22EC8
CreateProcessW.KERNEL32 ref: 00007FF674B22F1E
CloseHandle.KERNEL32 ref: 00007FF674B22F33
CloseHandle.KERNEL32 ref: 00007FF674B22F44
SHDeleteKeyW.SHLWAPI ref: 00007FF674B22F63
BrandIEActiveSetup.IEDKCS32 ref: 00007FF674B22F7D

Strings

h, xrefs: 00007FF674B22ECF
In CmdClearIconCacheOnStartup, xrefs: 00007FF674B22E65
SIGNUP, xrefs: 00007FF674B22F72
SOFTWARE\Microsoft\Active Setup\Installed Components\{2D46B6DC-2207-486B-B523-A557E6D54B47}, xrefs: 00007FF674B22F55
-ClearIconCache, xrefs: 00007FF674B22E9C
In CmdOldUserInstall, xrefs: 00007FF674B22E39

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: File$CloseHandleMessageTaskwcscat_s$#820ActiveAllocAttributesBrandCreateDeleteFindFirstFormatFreeLocalModuleNamePostProcessSetupThreadTimememset
String ID: -ClearIconCache$In CmdClearIconCacheOnStartup$In CmdOldUserInstall$SIGNUP$SOFTWARE\Microsoft\Active Setup\Installed Components\{2D46B6DC-2207-486B-B523-A557E6D54B47}$h
API String ID: 492487243-1244318026
Opcode ID: a0e4242b6bb6a4f1bd931a2b3f6605bf2f64768bcdbb8fadd79dd7b0dededb28
Instruction ID: 738995209650b2c4441f6e301ee1b3526d9e0a5b81895b6b740f3273ab463b0b
Opcode Fuzzy Hash: a0e4242b6bb6a4f1bd931a2b3f6605bf2f64768bcdbb8fadd79dd7b0dededb28
Instruction Fuzzy Hash: 50418733A28A42C6E710DB24E4887BAB7A0FF8AB54F815135D54DC7955DF7CD549CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B42178 Relevance: 21.2, APIs: 14, Instructions: 178encryptionCOMMON

Download Yara Rule

APIs

CryptSetKeyParam.ADVAPI32(00000000,00007FF674B41EC1), ref: 00007FF674B421A8
memcpy_s.MSVCRT ref: 00007FF674B42202
CryptEncrypt.ADVAPI32 ref: 00007FF674B42256
memcpy_s.MSVCRT ref: 00007FF674B4229F
CryptEncrypt.ADVAPI32 ref: 00007FF674B422D1
GetLastError.KERNEL32 ref: 00007FF674B422F0
GetLastError.KERNEL32 ref: 00007FF674B4230A
GetLastError.KERNEL32 ref: 00007FF674B4231F
GetLastError.KERNEL32 ref: 00007FF674B42351
GetLastError.KERNEL32 ref: 00007FF674B42366
GetLastError.KERNEL32 ref: 00007FF674B4237B
GetLastError.KERNEL32 ref: 00007FF674B423B8
GetLastError.KERNEL32 ref: 00007FF674B423CD
GetLastError.KERNEL32 ref: 00007FF674B423E2

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$Crypt$Encryptmemcpy_s$Param
String ID:
API String ID: 2866623800-0
Opcode ID: 8be2f38d318b77d545bf02cc743ee1b4ebe2e8a3ebeb97f5eb84f5401a0f1d1c
Instruction ID: c425990157ba9ce9962719e63907587442c953aa316d1cd7ad7f8dbe10ade0d4
Opcode Fuzzy Hash: 8be2f38d318b77d545bf02cc743ee1b4ebe2e8a3ebeb97f5eb84f5401a0f1d1c
Instruction Fuzzy Hash: 12715233A18B86CAE7645F59A488779BAA4FF8AFC4F458134DE49C3644DF3CE8049741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2C400 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 145fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF674B2C45E
#149.IERTUTIL ref: 00007FF674B2C4BB
CloseHandle.KERNEL32 ref: 00007FF674B2C4D6
GetLastError.KERNEL32 ref: 00007FF674B2C4EC
wcscpy_s.MSVCRT ref: 00007FF674B2C52A
wcscat_s.MSVCRT ref: 00007FF674B2C547
FindFirstFileW.KERNEL32 ref: 00007FF674B2C55F
wcscat_s.MSVCRT ref: 00007FF674B2C5BF
FindNextFileW.KERNEL32 ref: 00007FF674B2C5FF
FindClose.KERNEL32 ref: 00007FF674B2C616
GetLastError.KERNEL32 ref: 00007FF674B2C624

Strings

., xrefs: 00007FF674B2C588

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: FileFind$CloseErrorLastwcscat_s$#149CreateFirstHandleNextwcscpy_s
String ID: .
API String ID: 2239470773-248832578
Opcode ID: f008a50d0a282a497e30cf7c828cdb131c741717744b734e58d450f3c4f62908
Instruction ID: ac2b4d99c92a125d4c4ae2203b3212b628bed8850823339b600b2b63e8153b09
Opcode Fuzzy Hash: f008a50d0a282a497e30cf7c828cdb131c741717744b734e58d450f3c4f62908
Instruction Fuzzy Hash: 46513033618A82CAE7219F65E4882BABBB0FB4AB94F405131DE4D87694DF7CD949C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B47C00 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 174memoryregistryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF674B47C5B

Part of subcall function 00007FF674B478A8: LoadLibraryExW.KERNEL32 ref: 00007FF674B478BB
Part of subcall function 00007FF674B478A8: GetProcAddress.KERNEL32 ref: 00007FF674B478D6

RegOpenKeyExW.ADVAPI32 ref: 00007FF674B47CBD
RegQueryInfoKeyW.ADVAPI32 ref: 00007FF674B47D28
GetProcessHeap.KERNEL32 ref: 00007FF674B47D53
HeapAlloc.KERNEL32 ref: 00007FF674B47D67
RegEnumKeyExW.ADVAPI32 ref: 00007FF674B47DC2
GetProcessHeap.KERNEL32 ref: 00007FF674B47E51
HeapFree.KERNEL32 ref: 00007FF674B47E65
RegCloseKey.ADVAPI32 ref: 00007FF674B47E7B

Strings

\Users, xrefs: 00007FF674B47C80

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Heap$Process$AddressAllocCloseEnumFreeInfoLibraryLoadOpenProcQuerymemset
String ID: \Users
API String ID: 3246958429-3656258783
Opcode ID: 4936f739c7c3f11413a2ccd7c8750c1b3afaf99fbc9a789f57217991891f4188
Instruction ID: aba5cf4208d4906b81a3ee6365aa96dbfefdbfc72417c7077d5c5ab45a7e9d17
Opcode Fuzzy Hash: 4936f739c7c3f11413a2ccd7c8750c1b3afaf99fbc9a789f57217991891f4188
Instruction Fuzzy Hash: BB717633A18781C7E7108F69A4843AABAA4FB8AB94F504235DE8D97754DF3CD946CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2BE44 Relevance: 16.7, APIs: 11, Instructions: 199fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32 ref: 00007FF674B2BEC9
SetFileAttributesW.KERNEL32 ref: 00007FF674B2BF48
GetLastError.KERNEL32 ref: 00007FF674B2BF5D
SHGetFolderPathW.SHELL32 ref: 00007FF674B2BFCD
wcscat_s.MSVCRT ref: 00007FF674B2BFF4
wcscat_s.MSVCRT ref: 00007FF674B2C013
wcscat_s.MSVCRT ref: 00007FF674B2C030
FindFirstFileW.KERNEL32 ref: 00007FF674B2C048
wcscat_s.MSVCRT ref: 00007FF674B2C0A9
FindNextFileW.KERNEL32 ref: 00007FF674B2C107
FindClose.KERNEL32 ref: 00007FF674B2C11E

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: wcscat_s$FileFind$FolderPath$AttributesCloseErrorFirstLastNext
String ID:
API String ID: 1467164853-0
Opcode ID: f12e9b86f85f06c19c7fa6bd0e87e8bfb962c93708858dfe9d94cec63dcfa135
Instruction ID: 3028ec11423cc0063860a7c26601ed2df85d41cb8311039173d638079e10cced
Opcode Fuzzy Hash: f12e9b86f85f06c19c7fa6bd0e87e8bfb962c93708858dfe9d94cec63dcfa135
Instruction Fuzzy Hash: A7917F33628B82CAE760CF25D4842BAB7B0FB4AB58F405231DA5E87794DF39E955C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2C9CC Relevance: 16.6, APIs: 11, Instructions: 127COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B2CD70: LocaleNameToLCID.KERNEL32(?,?,00000000,00007FF674B2C9E8), ref: 00007FF674B2CD7F

GetSystemInfo.KERNEL32 ref: 00007FF674B2C9F5
#701.IERTUTIL(?,?,?,?,?,?,?,?,?,?,?,?,?,0000000B,00007FF674B226E4), ref: 00007FF674B2CA26
IsJITInProgress.URLMON ref: 00007FF674B2CA83
GetSystemInfo.KERNEL32 ref: 00007FF674B2CA9E
IsJITInProgress.URLMON ref: 00007FF674B2CAB9
#701.IERTUTIL ref: 00007FF674B2CAE3
IsJITInProgress.URLMON ref: 00007FF674B2CB1F

Part of subcall function 00007FF674B2CEF8: #701.IERTUTIL ref: 00007FF674B2CF08

IsJITInProgress.URLMON ref: 00007FF674B2CB71
IsJITInProgress.URLMON ref: 00007FF674B2CB8B
EnterCriticalSection.KERNEL32 ref: 00007FF674B2CBA3
LeaveCriticalSection.KERNEL32 ref: 00007FF674B2CBC3

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Progress$#701$CriticalInfoSectionSystem$EnterLeaveLocaleName
String ID:
API String ID: 4012763942-0
Opcode ID: f6bf05161040f0e39d6b128640514a387d574d76e5d44c79f1733446c3cdcf89
Instruction ID: fb562ef1c5336867c8eea09bb4b5ffad37ab7f2272e9755863328ae8129b8721
Opcode Fuzzy Hash: f6bf05161040f0e39d6b128640514a387d574d76e5d44c79f1733446c3cdcf89
Instruction Fuzzy Hash: 02513F23E29A47C6FA50DB64E4DC278A761AF9BF45F448174C90EC3292DF2DBC86C611

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B41FDC Relevance: 16.6, APIs: 11, Instructions: 108encryptionCOMMON

Download Yara Rule

APIs

CryptCreateHash.ADVAPI32(00000000,00000000,?,00007FF674B41EEC), ref: 00007FF674B42018
CryptSetHashParam.ADVAPI32(?,00007FF674B41EEC), ref: 00007FF674B42052
CryptHashData.ADVAPI32(?,00007FF674B41EEC), ref: 00007FF674B4206F
CryptGetHashParam.ADVAPI32(?,00007FF674B41EEC), ref: 00007FF674B4209B
GetLastError.KERNEL32(?,00007FF674B41EEC), ref: 00007FF674B420B5
GetLastError.KERNEL32(?,00007FF674B41EEC), ref: 00007FF674B420CF
GetLastError.KERNEL32(?,00007FF674B41EEC), ref: 00007FF674B420E4
CryptDestroyHash.ADVAPI32(?,00007FF674B41EEC), ref: 00007FF674B42102
GetLastError.KERNEL32(?,00007FF674B41EEC), ref: 00007FF674B42110
GetLastError.KERNEL32(?,00007FF674B41EEC), ref: 00007FF674B4212A
GetLastError.KERNEL32(?,00007FF674B41EEC), ref: 00007FF674B4213F

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$CryptHash$Param$CreateDataDestroy
String ID:
API String ID: 2164413237-0
Opcode ID: 0677921c7873d9e26123bdd32bc7af7f9c069c4b3c1de20bbab9879168927b8f
Instruction ID: f0a791bbb5f6b1f58ed5f9e13a0e72943f2e21d87d71bd70e62fc34a3942737c
Opcode Fuzzy Hash: 0677921c7873d9e26123bdd32bc7af7f9c069c4b3c1de20bbab9879168927b8f
Instruction Fuzzy Hash: B8415A23A14B42CAE7508FB5A8886B96AA0FB8EFC5F559134DE0DC3714DF78D845D710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B41A34 Relevance: 16.6, APIs: 11, Instructions: 96encryptionCOMMON

Download Yara Rule

APIs

memcpy_s.MSVCRT ref: 00007FF674B41A77
CryptCreateHash.ADVAPI32(?,?,?,?,?,00007FF674B4178F), ref: 00007FF674B41A9C
CryptHashData.ADVAPI32(?,?,?,?,?,00007FF674B4178F), ref: 00007FF674B41ABF
CryptDeriveKey.ADVAPI32(?,?,?,?,?,00007FF674B4178F), ref: 00007FF674B41AE8
GetLastError.KERNEL32(?,?,?,?,?,00007FF674B4178F), ref: 00007FF674B41AF8
GetLastError.KERNEL32(?,?,?,?,?,00007FF674B4178F), ref: 00007FF674B41B12
GetLastError.KERNEL32(?,?,?,?,?,00007FF674B4178F), ref: 00007FF674B41B27
CryptDestroyHash.ADVAPI32(?,?,?,?,?,00007FF674B4178F), ref: 00007FF674B41B46
GetLastError.KERNEL32(?,?,?,?,?,00007FF674B4178F), ref: 00007FF674B41B54
GetLastError.KERNEL32(?,?,?,?,?,00007FF674B4178F), ref: 00007FF674B41B6E
GetLastError.KERNEL32(?,?,?,?,?,00007FF674B4178F), ref: 00007FF674B41B83

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$Crypt$Hash$CreateDataDeriveDestroymemcpy_s
String ID:
API String ID: 628050030-0
Opcode ID: 757bcc50501b083fa4f97aeafdf3291241dcb769b1309e26ce1440de5bdc71aa
Instruction ID: ace212825d3c7510b9d76461ce51b4f72861eba033f99be0b72e3eb8467c10cf
Opcode Fuzzy Hash: 757bcc50501b083fa4f97aeafdf3291241dcb769b1309e26ce1440de5bdc71aa
Instruction Fuzzy Hash: 41412036B14A82CAE7105F65A898679BBA0FB8AFC5F589134DA4EC3754DF3CD8058700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B23AC0 Relevance: 15.1, APIs: 10, Instructions: 114fileCOMMON

Download Yara Rule

APIs

#654.IERTUTIL ref: 00007FF674B23B17
FindResourceW.KERNEL32 ref: 00007FF674B23B2D
LoadResource.KERNEL32 ref: 00007FF674B23B4A
LockResource.KERNEL32 ref: 00007FF674B23B62

Part of subcall function 00007FF674B27C9C: #650.IERTUTIL ref: 00007FF674B27CBF

Part of subcall function 00007FF674B278F4: #650.IERTUTIL ref: 00007FF674B27925

wcsrchr.MSVCRT ref: 00007FF674B23BF1
SHCreateDirectory.SHELL32 ref: 00007FF674B23C14
CreateFileW.KERNEL32 ref: 00007FF674B23C49
SizeofResource.KERNEL32 ref: 00007FF674B23C63
WriteFile.KERNEL32 ref: 00007FF674B23C87
CloseHandle.KERNEL32 ref: 00007FF674B23C96

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Resource$#650CreateFile$#654CloseDirectoryFindHandleLoadLockSizeofWritewcsrchr
String ID:
API String ID: 3992202063-0
Opcode ID: e663a5a9296f81b5ce4c4dc3147b47dc55602735e08862a974465eae1023ae49
Instruction ID: 504a70d8a017ee3d81ea958e4d50be06e0564534cc86b7865ef39b5d6d5fcb62
Opcode Fuzzy Hash: e663a5a9296f81b5ce4c4dc3147b47dc55602735e08862a974465eae1023ae49
Instruction Fuzzy Hash: BC515033629B81C7EB10CF25E4885A9BBA0FB8AB90F559135DA4D47B54DF3DD909CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B3A2C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 104encryptionCOMMON

Download Yara Rule

APIs

CertOpenStore.CRYPT32 ref: 00007FF674B3A327
CertFindCertificateInStore.CRYPT32 ref: 00007FF674B3A35A
GetLastError.KERNEL32 ref: 00007FF674B3A3D0

Part of subcall function 00007FF674B39FA4: CertGetIntendedKeyUsage.CRYPT32 ref: 00007FF674B39FDA
Part of subcall function 00007FF674B39FA4: CertGetEnhancedKeyUsage.CRYPT32 ref: 00007FF674B3A00F
Part of subcall function 00007FF674B39FA4: CertGetEnhancedKeyUsage.CRYPT32 ref: 00007FF674B3A041
Part of subcall function 00007FF674B39FA4: StrCmpNA.SHLWAPI ref: 00007FF674B3A07F
Part of subcall function 00007FF674B39FA4: StrCmpNW.SHLWAPI(?,?,00000000,00000000,?,00007FF674B3A1D9), ref: 00007FF674B3A0F1

Part of subcall function 00007FF674B3A460: CertGetCertificateChain.CRYPT32 ref: 00007FF674B3A4C6
Part of subcall function 00007FF674B3A460: CertVerifyCertificateChainPolicy.CRYPT32 ref: 00007FF674B3A528
Part of subcall function 00007FF674B3A460: CertVerifyCertificateChainPolicy.CRYPT32 ref: 00007FF674B3A55B
Part of subcall function 00007FF674B3A460: CertFreeCertificateChain.CRYPT32 ref: 00007FF674B3A5B5

CryptImportPublicKeyInfo.CRYPT32 ref: 00007FF674B3A3B3
GetLastError.KERNEL32 ref: 00007FF674B3A3F8
CertFreeCertificateContext.CRYPT32 ref: 00007FF674B3A41A
CertCloseStore.CRYPT32 ref: 00007FF674B3A430

Strings

Trust, xrefs: 00007FF674B3A30B

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Cert$Certificate$Chain$StoreUsage$EnhancedErrorFreeLastPolicyVerify$CloseContextCryptFindImportInfoIntendedOpenPublic
String ID: Trust
API String ID: 1112488655-3418866602
Opcode ID: 418a099fe22bddacef5450bc4e7ea9d1b8a840be03ec48669bb194fea85fa35f
Instruction ID: 42b568c81e4be785982f15e31193adfc381212093fb30527db316a192a297fd2
Opcode Fuzzy Hash: 418a099fe22bddacef5450bc4e7ea9d1b8a840be03ec48669bb194fea85fa35f
Instruction Fuzzy Hash: 34415D33A28B42C7E7149B26A488769B6E0FB4AFC1F558134DE4D87B54DF3CE8158700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B4A53C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 93nativeCOMMON

Download Yara Rule

APIs

OpenGlobalizationUserSettingsKey.KERNELBASE ref: 00007FF674B4A59A
SHGetValueW.SHLWAPI ref: 00007FF674B4A5F1
CharNextW.USER32 ref: 00007FF674B4A619
#123.MLANG ref: 00007FF674B4A63D
GetUserDefaultLocaleName.KERNELBASE ref: 00007FF674B4A66C
NtClose.NTDLL ref: 00007FF674B4A687

Strings

Software\Microsoft\Internet Explorer\International, xrefs: 00007FF674B4A5E1
AcceptLanguage, xrefs: 00007FF674B4A5B4

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: User$#123CharCloseDefaultGlobalizationLocaleNameNextOpenSettingsValue
String ID: AcceptLanguage$Software\Microsoft\Internet Explorer\International
API String ID: 3635003594-784331173
Opcode ID: 21795c197fcef2542fd14a67f6fef2d471253d6f6bb6cdadff1d7ba3978edd78
Instruction ID: 4e667c9542ba5cd21875c807cc142883497c7950d3305c41705cff1edaee154f
Opcode Fuzzy Hash: 21795c197fcef2542fd14a67f6fef2d471253d6f6bb6cdadff1d7ba3978edd78
Instruction Fuzzy Hash: 92414233628B42C6EB509F15E4941B9B7A1FB8AF80F454136EA8E83754DF3CD945CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2520C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathW.SHELL32 ref: 00007FF674B25241

Part of subcall function 00007FF674B2AB18: LocalFree.KERNEL32 ref: 00007FF674B2AD46

Part of subcall function 00007FF674B24B80: SHCreateDirectory.SHELL32 ref: 00007FF674B24C3D
Part of subcall function 00007FF674B24B80: PathFileExistsW.SHLWAPI ref: 00007FF674B24C98

GetModuleHandleW.KERNEL32 ref: 00007FF674B2528E
LoadStringW.USER32 ref: 00007FF674B252AA
PathRemoveExtensionW.SHLWAPI ref: 00007FF674B252BB
GetModuleHandleW.KERNEL32 ref: 00007FF674B252F9
LoadStringW.USER32 ref: 00007FF674B25315
PathRemoveExtensionW.SHLWAPI ref: 00007FF674B25326

Part of subcall function 00007FF674B2AB18: LocalAlloc.KERNELBASE ref: 00007FF674B2ABE6

Strings

Internet Explorer, xrefs: 00007FF674B2525A

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Path$ExtensionHandleLoadLocalModuleRemoveString$AllocCreateDirectoryExistsFileFolderFreeSpecial
String ID: Internet Explorer
API String ID: 715972500-1412615936
Opcode ID: aa88c3ac500360a9e8df74dbcd466899ee021f3be11f88d2dd11f0dbe3618c1c
Instruction ID: 9468de096a3d93d1afe97dffe21421d9d1f233c5574af549ec8ec00fecec7a6d
Opcode Fuzzy Hash: aa88c3ac500360a9e8df74dbcd466899ee021f3be11f88d2dd11f0dbe3618c1c
Instruction Fuzzy Hash: 98316633624AC1C6E760DF24E858BFA7760FB8AB49F855532DA0E87A54DF38D609C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B41D98 Relevance: 13.6, APIs: 9, Instructions: 150encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B21918: GetProcessHeap.KERNEL32 ref: 00007FF674B21921
Part of subcall function 00007FF674B21918: HeapAlloc.KERNEL32 ref: 00007FF674B21938

memcpy_s.MSVCRT ref: 00007FF674B41E10
memcpy_s.MSVCRT ref: 00007FF674B41E2F
CryptGenRandom.ADVAPI32 ref: 00007FF674B41E55
memcpy_s.MSVCRT ref: 00007FF674B41E79
EnterCriticalSection.KERNEL32 ref: 00007FF674B41E90
LeaveCriticalSection.KERNEL32 ref: 00007FF674B41EFC
GetLastError.KERNEL32 ref: 00007FF674B41F4C
GetLastError.KERNEL32 ref: 00007FF674B41F62
GetLastError.KERNEL32 ref: 00007FF674B41F78

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLastmemcpy_s$CriticalHeapSection$AllocCryptEnterLeaveProcessRandom
String ID:
API String ID: 2147994481-0
Opcode ID: 4035378c043bd339f2aedd8ded78f911d5d68c00ac44f36c34e4ffbb85d88af0
Instruction ID: 53b93c538dd33e53c33209cd7f167393f8478a4b742a5bd2c3d53fb71e6c499b
Opcode Fuzzy Hash: 4035378c043bd339f2aedd8ded78f911d5d68c00ac44f36c34e4ffbb85d88af0
Instruction Fuzzy Hash: C2517326B28782CAE7509F25A4886B9BBA0FB8AFC4F544130DE4E83755DF3CD806C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B418AC Relevance: 13.6, APIs: 9, Instructions: 101encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B428B4: CertEnumCertificatesInStore.CRYPT32 ref: 00007FF674B428E2
Part of subcall function 00007FF674B428B4: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF674B41691), ref: 00007FF674B428F6
Part of subcall function 00007FF674B428B4: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF674B41691), ref: 00007FF674B42910
Part of subcall function 00007FF674B428B4: CertCloseStore.CRYPT32 ref: 00007FF674B42946

CryptGetKeyParam.ADVAPI32 ref: 00007FF674B419B3

Part of subcall function 00007FF674B42968: CertGetCertificateContextProperty.CRYPT32 ref: 00007FF674B42998
Part of subcall function 00007FF674B42968: CertGetCertificateContextProperty.CRYPT32 ref: 00007FF674B429C7

CryptImportPublicKeyInfo.CRYPT32 ref: 00007FF674B4191F
GetLastError.KERNEL32 ref: 00007FF674B4193A
GetLastError.KERNEL32 ref: 00007FF674B41950
CertFreeCertificateContext.CRYPT32 ref: 00007FF674B41984
GetLastError.KERNEL32 ref: 00007FF674B419C9
GetLastError.KERNEL32 ref: 00007FF674B419DF
GetLastError.KERNEL32 ref: 00007FF674B419F5

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$Cert$CertificateContext$CryptPropertyStore$CertificatesCloseEnumFreeImportInfoParamPublic
String ID:
API String ID: 506061795-0
Opcode ID: ec301fba079c3e79e77ec65c55d91e94d749e2b1c439bf8865befa02d1bfd9f5
Instruction ID: a6aba9cf1c6fda0fe822fa38ebdbabcd661d15af0c1b0a246b6025cd14426331
Opcode Fuzzy Hash: ec301fba079c3e79e77ec65c55d91e94d749e2b1c439bf8865befa02d1bfd9f5
Instruction Fuzzy Hash: D6413C23A14B46CBE7109F69A49837ABBA0FB8AF95F544135CB4AC3654DF7CE806C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2E470 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 251memorywindowCOMMON

Download Yara Rule

APIs

SHStrDupW.SHLWAPI ref: 00007FF674B2E54F
PostMessageW.USER32 ref: 00007FF674B2E56E
SysAllocString.OLEAUT32 ref: 00007FF674B2E655
VarBstrCmp.OLEAUT32 ref: 00007FF674B2E67D
SysFreeString.OLEAUT32 ref: 00007FF674B2E68E
CoTaskMemFree.OLE32 ref: 00007FF674B2E582

Part of subcall function 00007FF674B2D258: EventWriteTransfer.ADVAPI32 ref: 00007FF674B2D29E

Strings

searchscope, xrefs: 00007FF674B2E548

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: FreeString$AllocBstrEventMessagePostTaskTransferWrite
String ID: searchscope
API String ID: 931234260-110112929
Opcode ID: 1a34b0a395925d51a76eef7d56bac9bd8bc80b14c89a0f0eb8e94144aad5cbfa
Instruction ID: 4e24daeec44241f53e1d1738019d0a4ed0d2bb1278e9fc2d4d45ed19bd44b57e
Opcode Fuzzy Hash: 1a34b0a395925d51a76eef7d56bac9bd8bc80b14c89a0f0eb8e94144aad5cbfa
Instruction Fuzzy Hash: 46A15F23A28602C6FB64CBA6D4D86B967A0BF56F88F544435DE0E87A95DF3CE945C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B37904 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 110encryptionstringCOMMON

Download Yara Rule

APIs

strnlen.MSVCRT ref: 00007FF674B3794B
isalnum.MSVCRT ref: 00007FF674B37974
CryptStringToBinaryA.CRYPT32 ref: 00007FF674B379CF
CryptStringToBinaryA.CRYPT32 ref: 00007FF674B37A19
GetLastError.KERNEL32 ref: 00007FF674B37A29

Strings

thumbprint, xrefs: 00007FF674B3790E

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: BinaryCryptString$ErrorLastisalnumstrnlen
String ID: thumbprint
API String ID: 1551080337-1670052307
Opcode ID: 63c1dd2fe8e88f6f9018054e15f627d5ed35639a7994b987a01a1c9410be33c7
Instruction ID: 2e7759c51521247cc61ad8d7bda42ab93ef85a79e45ba4f63ad7fce1bc8ed391
Opcode Fuzzy Hash: 63c1dd2fe8e88f6f9018054e15f627d5ed35639a7994b987a01a1c9410be33c7
Instruction Fuzzy Hash: 93418E27A18B42C7E7109F22A888379BA94FB4BF84F158275DA4D83750DF3DE9468700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B39AC0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68encryptionCOMMON

Download Yara Rule

APIs

CryptCreateHash.ADVAPI32 ref: 00007FF674B39B0F
CryptHashData.ADVAPI32 ref: 00007FF674B39B2D
CryptGetHashParam.ADVAPI32 ref: 00007FF674B39B5C
GetLastError.KERNEL32 ref: 00007FF674B39B70
CryptDestroyHash.ADVAPI32 ref: 00007FF674B39B8F
GetLastError.KERNEL32 ref: 00007FF674B39B9D

Strings

, xrefs: 00007FF674B39B54

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CryptHash$ErrorLast$CreateDataDestroyParam
String ID:
API String ID: 3383248918-3916222277
Opcode ID: 910abb4f31203d810479c8316337f4fa5b8bbf951344f6cad23898a8ba4fdc71
Instruction ID: d62cb79560624302afa38f016d498d71a949f213e8eef85019d22dab77df341a
Opcode Fuzzy Hash: 910abb4f31203d810479c8316337f4fa5b8bbf951344f6cad23898a8ba4fdc71
Instruction Fuzzy Hash: 08212C32A28B81C7E7408B66A588769BAA0FB8AFC5F559175DA4D87B54DF38D804C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2CBE8 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B27724: InitOnceExecuteOnce.KERNEL32(?,?,?,?,00007FF674B2CBF9), ref: 00007FF674B2773C

LoadLibraryW.KERNEL32 ref: 00007FF674B2CC08
GetProcAddress.KERNEL32 ref: 00007FF674B2CC26
LocalFree.KERNEL32 ref: 00007FF674B2CC74
FreeLibrary.KERNEL32 ref: 00007FF674B2CC83

Strings

SLGetWindowsInformation, xrefs: 00007FF674B2CC1C
shell32-license-UseBingAsDefaultSearchProvider, xrefs: 00007FF674B2CC46
slc.dll, xrefs: 00007FF674B2CC01

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: FreeLibraryOnce$AddressExecuteInitLoadLocalProc
String ID: SLGetWindowsInformation$shell32-license-UseBingAsDefaultSearchProvider$slc.dll
API String ID: 3052823752-3737774969
Opcode ID: c7aba29e0fda476fc9f68490eab564b2d9cd2b3cba63d77795e6c30f49d19d61
Instruction ID: ee22dff780c1da9f1d2df3c6974bc46e4a2588f1fe570000d3262c11d02dafc0
Opcode Fuzzy Hash: c7aba29e0fda476fc9f68490eab564b2d9cd2b3cba63d77795e6c30f49d19d61
Instruction Fuzzy Hash: 01111936A28A42D6EA00DB24E4881B9BBB0FF57F95B545531DA4D83254DF3DE849CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B39BD8 Relevance: 12.1, APIs: 8, Instructions: 102encryptionCOMMON

Download Yara Rule

APIs

CryptCreateHash.ADVAPI32 ref: 00007FF674B39C43
CryptSetHashParam.ADVAPI32 ref: 00007FF674B39C66
CryptVerifySignatureW.ADVAPI32 ref: 00007FF674B39CCB
GetLastError.KERNEL32 ref: 00007FF674B39CE1
CryptDestroyKey.ADVAPI32 ref: 00007FF674B39D00
GetLastError.KERNEL32 ref: 00007FF674B39D21
CryptDestroyHash.ADVAPI32 ref: 00007FF674B39D40

Part of subcall function 00007FF674B3A2C0: CertOpenStore.CRYPT32 ref: 00007FF674B3A327
Part of subcall function 00007FF674B3A2C0: CertFindCertificateInStore.CRYPT32 ref: 00007FF674B3A35A
Part of subcall function 00007FF674B3A2C0: CryptImportPublicKeyInfo.CRYPT32 ref: 00007FF674B3A3B3
Part of subcall function 00007FF674B3A2C0: CertFreeCertificateContext.CRYPT32 ref: 00007FF674B3A41A
Part of subcall function 00007FF674B3A2C0: CertCloseStore.CRYPT32 ref: 00007FF674B3A430

GetLastError.KERNEL32 ref: 00007FF674B39D4E

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Crypt$Cert$ErrorHashLastStore$CertificateDestroy$CloseContextCreateFindFreeImportInfoOpenParamPublicSignatureVerify
String ID:
API String ID: 1994448431-0
Opcode ID: 890716f793129f8509c954d34c6e6982eae01f1929bf4754abfd0fc505bd8673
Instruction ID: f254b70feb0d2a6ae4ca034a4ae73051c5bbd3ad65d361aeb3c836c56ec120f8
Opcode Fuzzy Hash: 890716f793129f8509c954d34c6e6982eae01f1929bf4754abfd0fc505bd8673
Instruction Fuzzy Hash: E9411F33A28B42C7E7509B76E4887B9A6A0FB8AF85F458131DA4DC7654DF3CE804C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B3F060 Relevance: 11.0, APIs: 7, Instructions: 459COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B21918: GetProcessHeap.KERNEL32 ref: 00007FF674B21921
Part of subcall function 00007FF674B21918: HeapAlloc.KERNEL32 ref: 00007FF674B21938

memcpy_s.MSVCRT ref: 00007FF674B3F3C8

Part of subcall function 00007FF674B41098: StrCmpNIA.SHLWAPI ref: 00007FF674B4115C

memcpy_s.MSVCRT ref: 00007FF674B3F595
memcpy_s.MSVCRT ref: 00007FF674B3F5DA
memcpy_s.MSVCRT ref: 00007FF674B3F615
memcpy_s.MSVCRT ref: 00007FF674B3F64F
memcpy_s.MSVCRT ref: 00007FF674B3F6C4
memcpy_s.MSVCRT ref: 00007FF674B3F73F

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: memcpy_s$Heap$AllocProcess
String ID:
API String ID: 1309595355-0
Opcode ID: 308e2109f80933f03ac11630729c6f3ab86348cf32f4d4a9c56d79f4a7131f44
Instruction ID: 8cb72c7fe682e978671397e4530c3ad12a82a7ef2a6d29f63def6825a3c1c438
Opcode Fuzzy Hash: 308e2109f80933f03ac11630729c6f3ab86348cf32f4d4a9c56d79f4a7131f44
Instruction Fuzzy Hash: 99223C73618BC5C6EB74CB16E4847AAB7A5FB89B90F504126DA8D83B58DF3CE445CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B48468 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B2AB18: LocalFree.KERNEL32 ref: 00007FF674B2AD46

FindFirstFileExW.KERNEL32 ref: 00007FF674B484E3
GetLastError.KERNEL32 ref: 00007FF674B484F8
FindNextFileW.KERNEL32 ref: 00007FF674B485AD
GetLastError.KERNEL32 ref: 00007FF674B485BD
FindClose.KERNEL32 ref: 00007FF674B485F2

Strings

., xrefs: 00007FF674B48542

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Find$ErrorFileLast$CloseFirstFreeLocalNext
String ID: .
API String ID: 2978595652-248832578
Opcode ID: 1ea91f550a2f4aad4062f718024bbed3e61d999c2b9c0c91896d1233eb3f0dce
Instruction ID: e02cd5caedbfc2dbdeb047a7b773f29b79ee10733a26e129edf85361e6366c43
Opcode Fuzzy Hash: 1ea91f550a2f4aad4062f718024bbed3e61d999c2b9c0c91896d1233eb3f0dce
Instruction Fuzzy Hash: FA41A927A28682C6E7219B69A8C83BA6790FB46BE4F404231DE5DC76D4DF7CDD45C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B41738 Relevance: 10.6, APIs: 7, Instructions: 92encryptionCOMMON

Download Yara Rule

APIs

CryptGenRandom.ADVAPI32 ref: 00007FF674B41767
memcpy_s.MSVCRT ref: 00007FF674B417DC
CryptEncrypt.ADVAPI32 ref: 00007FF674B41816
GetLastError.KERNEL32 ref: 00007FF674B41826
GetLastError.KERNEL32 ref: 00007FF674B4183B
GetLastError.KERNEL32 ref: 00007FF674B41855

Part of subcall function 00007FF674B41A34: memcpy_s.MSVCRT ref: 00007FF674B41A77
Part of subcall function 00007FF674B41A34: CryptCreateHash.ADVAPI32(?,?,?,?,?,00007FF674B4178F), ref: 00007FF674B41A9C
Part of subcall function 00007FF674B41A34: CryptHashData.ADVAPI32(?,?,?,?,?,00007FF674B4178F), ref: 00007FF674B41ABF
Part of subcall function 00007FF674B41A34: CryptDeriveKey.ADVAPI32(?,?,?,?,?,00007FF674B4178F), ref: 00007FF674B41AE8
Part of subcall function 00007FF674B41A34: GetLastError.KERNEL32(?,?,?,?,?,00007FF674B4178F), ref: 00007FF674B41AF8
Part of subcall function 00007FF674B41A34: GetLastError.KERNEL32(?,?,?,?,?,00007FF674B4178F), ref: 00007FF674B41B12
Part of subcall function 00007FF674B41A34: CryptDestroyHash.ADVAPI32(?,?,?,?,?,00007FF674B4178F), ref: 00007FF674B41B46

Part of subcall function 00007FF674B41A34: GetLastError.KERNEL32(?,?,?,?,?,00007FF674B4178F), ref: 00007FF674B41B27
Part of subcall function 00007FF674B41A34: GetLastError.KERNEL32(?,?,?,?,?,00007FF674B4178F), ref: 00007FF674B41B54
Part of subcall function 00007FF674B41A34: GetLastError.KERNEL32(?,?,?,?,?,00007FF674B4178F), ref: 00007FF674B41B6E

Part of subcall function 00007FF674B21918: GetProcessHeap.KERNEL32 ref: 00007FF674B21921
Part of subcall function 00007FF674B21918: HeapAlloc.KERNEL32 ref: 00007FF674B21938

GetLastError.KERNEL32 ref: 00007FF674B4186A

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$Crypt$Hash$Heapmemcpy_s$AllocCreateDataDeriveDestroyEncryptProcessRandom
String ID:
API String ID: 4253960083-0
Opcode ID: bf52dbc145db6dbe62ae2a3575e2deafe5a1517ee12479ea82a7979a1ee0e114
Instruction ID: 4bec69a1eba81d8dc5b48b82058e1a8f4294fcddbdc4ead549653ac003745cfe
Opcode Fuzzy Hash: bf52dbc145db6dbe62ae2a3575e2deafe5a1517ee12479ea82a7979a1ee0e114
Instruction Fuzzy Hash: 8A415233A18B46C7EB109B69E4982AAB7A0FB8AF90F544135DB4E83754DF3DE845C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B499FC Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B49938: GetCurrentThread.KERNEL32 ref: 00007FF674B49949
Part of subcall function 00007FF674B49938: OpenThreadToken.ADVAPI32(?,?,?,00007FF674B49A15,?,?,?,?,?,?,?,?,00000000,00007FF674B496F5), ref: 00007FF674B49962
Part of subcall function 00007FF674B49938: GetLastError.KERNEL32(?,?,?,00007FF674B49A15,?,?,?,?,?,?,?,?,00000000,00007FF674B496F5), ref: 00007FF674B49972
Part of subcall function 00007FF674B49938: GetCurrentProcess.KERNEL32(?,?,?,00007FF674B49A15,?,?,?,?,?,?,?,?,00000000,00007FF674B496F5), ref: 00007FF674B4999E
Part of subcall function 00007FF674B49938: OpenProcessToken.ADVAPI32(?,?,?,00007FF674B49A15,?,?,?,?,?,?,?,?,00000000,00007FF674B496F5), ref: 00007FF674B499B5

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF674B496F5), ref: 00007FF674B49A24
GetTokenInformation.ADVAPI32(?,?,?,?,?,?,?,?,00000000,00007FF674B496F5), ref: 00007FF674B49A4A
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF674B49AB5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF674B496F5), ref: 00007FF674B49AC9
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF674B496F5), ref: 00007FF674B49AE3
HeapFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF674B496F5), ref: 00007FF674B49AF7
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF674B496F5), ref: 00007FF674B49B08

Part of subcall function 00007FF674B49B28: GetLastError.KERNEL32(?,?,?,?,00000000,00007FF674B49A6F,?,?,?,?,?,?,?,?,00000000,00007FF674B496F5), ref: 00007FF674B49B4C
Part of subcall function 00007FF674B49B28: HeapAlloc.KERNEL32(?,?,?,?,00000000,00007FF674B49A6F,?,?,?,?,?,?,?,?,00000000,00007FF674B496F5), ref: 00007FF674B49B6C
Part of subcall function 00007FF674B49B28: GetTokenInformation.ADVAPI32(?,?,?,?,00000000,00007FF674B49A6F,?,?,?,?,?,?,?,?,00000000,00007FF674B496F5), ref: 00007FF674B49B97

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: HeapProcessToken$ErrorLast$CurrentInformationOpenThread$AllocCloseConvertFreeHandleString
String ID:
API String ID: 1022525647-0
Opcode ID: 543189498478a5dcd76b9a40d2e9153d3c3716ef1c32a4e1b3c30bf1b2211a10
Instruction ID: 70c471e84b5da2376ee20747f68d3fa4362e1bc05d99860269c33bfbb7d21d2f
Opcode Fuzzy Hash: 543189498478a5dcd76b9a40d2e9153d3c3716ef1c32a4e1b3c30bf1b2211a10
Instruction Fuzzy Hash: 89311E32A18B42D7E7009B79A5986B966A0FB8BFD1F448531DA4E87654DF3CE8458700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B24E48 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44fileCOMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNEL32 ref: 00007FF674B24E72
FindFirstFileW.KERNEL32 ref: 00007FF674B24E8E

Part of subcall function 00007FF674B24494: SetFileAttributesW.KERNEL32(?,00007FF674B25154), ref: 00007FF674B244E1
Part of subcall function 00007FF674B24494: DeleteFileW.KERNEL32(?,00007FF674B25154), ref: 00007FF674B244F2
Part of subcall function 00007FF674B24494: SHChangeNotify.SHELL32 ref: 00007FF674B2450D

FindNextFileW.KERNEL32 ref: 00007FF674B24EB8
FindClose.KERNEL32 ref: 00007FF674B24ECB
SetCurrentDirectoryW.KERNEL32 ref: 00007FF674B24EDA

Strings

*.{871C5380-42A0-1069-A2EA-08002B30309D}, xrefs: 00007FF674B24E87

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: File$Find$CurrentDirectory$AttributesChangeCloseDeleteFirstNextNotify
String ID: *.{871C5380-42A0-1069-A2EA-08002B30309D}
API String ID: 2401681968-4084126563
Opcode ID: 4fc075e66d76155e84885767b839dcb44ac4f67ac72fd912f787004181335062
Instruction ID: f4b72325d6d040abb64f709cf3b1f7d7c5831d3e415ab2049baed1f238ec30a2
Opcode Fuzzy Hash: 4fc075e66d76155e84885767b839dcb44ac4f67ac72fd912f787004181335062
Instruction Fuzzy Hash: 2111EF36618B41C6EA549B15E488279B7A0FB8AFE0F859231DE5D83B94DF3CD949C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B39D90 Relevance: 9.1, APIs: 6, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptStringToBinaryW.CRYPT32 ref: 00007FF674B39DD7
GetLastError.KERNEL32(?,?,?,?,?,00000000,?,00007FF674B3A171), ref: 00007FF674B39E94

Part of subcall function 00007FF674B21918: GetProcessHeap.KERNEL32 ref: 00007FF674B21921
Part of subcall function 00007FF674B21918: HeapAlloc.KERNEL32 ref: 00007FF674B21938

CryptStringToBinaryW.CRYPT32 ref: 00007FF674B39E1F
GetLastError.KERNEL32(?,?,?,?,?,00000000,?,00007FF674B3A171), ref: 00007FF674B39E3A
GetLastError.KERNEL32(?,?,?,?,?,00000000,?,00007FF674B3A171), ref: 00007FF674B39E54

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$BinaryCryptHeapString$AllocProcess
String ID:
API String ID: 2934262020-0
Opcode ID: bc8209b1d5e3aaa763b00372c98e3be3816294a6967263068237765458285d1a
Instruction ID: 44e29c45c386f73be9c111d919bf3206ce122b48935a625574f3cd64fc5f1077
Opcode Fuzzy Hash: bc8209b1d5e3aaa763b00372c98e3be3816294a6967263068237765458285d1a
Instruction Fuzzy Hash: 30313433A18B51CBE3109F7AA894269B6D4FB8AF80F598534DA4DC3754DF3CE8458710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B34B30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135encryptionCOMMON

Download Yara Rule

APIs

CryptGenRandom.ADVAPI32 ref: 00007FF674B38501
GetLastError.KERNEL32 ref: 00007FF674B38511

Strings

https://ieonline.microsoft.com/EUPP/v1/service?action=needfirstrun&appid=Microsoft_IE_EUPP, xrefs: 00007FF674B38540
dsp, xrefs: 00007FF674B34B49

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CryptErrorLastRandom
String ID: dsp$https://ieonline.microsoft.com/EUPP/v1/service?action=needfirstrun&appid=Microsoft_IE_EUPP
API String ID: 1176002950-197285457
Opcode ID: 94c841943a80b725a154659ee9bb0d460b1465342de61d40c4e6136a7117f412
Instruction ID: 42c88d1c1560d89155d10f5c2004ff96ca6605187b96c075754a5b630363f5ea
Opcode Fuzzy Hash: 94c841943a80b725a154659ee9bb0d460b1465342de61d40c4e6136a7117f412
Instruction Fuzzy Hash: 35516B63B28A02CAFB10CB66E4883AD77A4EB8AB84F554535DE4D87754DF3CE805C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B41610 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71encryptionCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF674B416A3
GetLastError.KERNEL32 ref: 00007FF674B416B8
GetLastError.KERNEL32 ref: 00007FF674B416CD
CryptAcquireContextW.ADVAPI32 ref: 00007FF674B41679

Part of subcall function 00007FF674B2D258: EventWriteTransfer.ADVAPI32 ref: 00007FF674B2D29E

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 00007FF674B41670

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$AcquireContextCryptEventTransferWrite
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 3111804345-63410773
Opcode ID: 7013af233b247626a86cbe2e685cce53afd791b4687dfb3ff12f67b82d2771a9
Instruction ID: 6b7e769365e774fb8f0fb4ca7fde30fb7e335f5527388eef7e2c806c9607b1fe
Opcode Fuzzy Hash: 7013af233b247626a86cbe2e685cce53afd791b4687dfb3ff12f67b82d2771a9
Instruction Fuzzy Hash: 0E314C22B28B42C6FB409B69E8DC279A6A4BF8AF80F944134DA4DC3655DF7DEC44C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B3A604 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73encryptionCOMMON

Download Yara Rule

APIs

CryptHashCertificate.CRYPT32 ref: 00007FF674B3A69E
memcmp.MSVCRT ref: 00007FF674B3A6D2
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00007FF674B3A6E8

Strings

, xrefs: 00007FF674B3A6AE

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CertificateCryptErrorHashLastmemcmp
String ID:
API String ID: 2621720666-3916222277
Opcode ID: beb198c45fe2eb45f3ba0d2edce4396efef914c5032ffa7aab696a7868173ba4
Instruction ID: 55428a59ebe8531cd5b58311dc3598089b75e95c4b68eb419c129d2ed3e456ae
Opcode Fuzzy Hash: beb198c45fe2eb45f3ba0d2edce4396efef914c5032ffa7aab696a7868173ba4
Instruction Fuzzy Hash: 0D313C63A28B45C6EB54CB26D4C836977A0FB8AF84F615136DB4D83354DF39D890CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B37B98 Relevance: 6.1, APIs: 4, Instructions: 63encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32 ref: 00007FF674B37BDE
CryptBinaryToStringA.CRYPT32 ref: 00007FF674B37C17
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF674B38893), ref: 00007FF674B37C27

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: BinaryCryptString$ErrorLast
String ID:
API String ID: 1952235381-0
Opcode ID: 7faef8d175d153ec5999ba720219abc7d543e97fee4a5a02fb4b65eaafd313ea
Instruction ID: afcfc82b1a7228361639895448f5775462f149183b27884e7fc4ef1873dc6988
Opcode Fuzzy Hash: 7faef8d175d153ec5999ba720219abc7d543e97fee4a5a02fb4b65eaafd313ea
Instruction Fuzzy Hash: D8212C36A18B42C7E7109B66A488379B7A0FB8BF94F948235DB8D87754EF3DD8508700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B41BC0 Relevance: 6.0, APIs: 4, Instructions: 44encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyKey.ADVAPI32 ref: 00007FF674B41C00
CryptDestroyKey.ADVAPI32 ref: 00007FF674B41C1A
CryptDestroyKey.ADVAPI32 ref: 00007FF674B41C34
CryptReleaseContext.ADVAPI32 ref: 00007FF674B41C50

Part of subcall function 00007FF674B2195C: GetProcessHeap.KERNEL32 ref: 00007FF674B21969
Part of subcall function 00007FF674B2195C: HeapFree.KERNEL32 ref: 00007FF674B2197D

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Crypt$Destroy$Heap$ContextFreeProcessRelease
String ID:
API String ID: 4130806261-0
Opcode ID: 37608e07f94970868204d9c5889e474f14a27a3ad23203aff61fd3f90885cdb5
Instruction ID: 06ed85f8c094bb2ad934e759adac9546ac4ad25f4ef2e1bfa1f4cde363709b33
Opcode Fuzzy Hash: 37608e07f94970868204d9c5889e474f14a27a3ad23203aff61fd3f90885cdb5
Instruction Fuzzy Hash: E211E933A26A05C6EB559F69C49D33927A1EF8AF49F144234CA0E8A655CF3DD885C380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B481E4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B47EBC: LoadLibraryExW.KERNEL32 ref: 00007FF674B47F35
Part of subcall function 00007FF674B47EBC: GetProcAddress.KERNEL32 ref: 00007FF674B47F53
Part of subcall function 00007FF674B47EBC: NtQueryLicenseValue.NTDLL ref: 00007FF674B47F85
Part of subcall function 00007FF674B47EBC: FreeLibrary.KERNEL32 ref: 00007FF674B47FFB

NtQueryLicenseValue.NTDLL ref: 00007FF674B482BF

Part of subcall function 00007FF674B4790C: LoadLibraryExW.KERNEL32 ref: 00007FF674B47942
Part of subcall function 00007FF674B4790C: GetProcAddress.KERNEL32 ref: 00007FF674B47960
Part of subcall function 00007FF674B4790C: GetProcAddress.KERNEL32 ref: 00007FF674B47979
Part of subcall function 00007FF674B4790C: FreeLibrary.KERNEL32 ref: 00007FF674B47BBE

Strings

AllowTelemetry, xrefs: 00007FF674B48259
ConfigureTelemetryOptInSettingsUx, xrefs: 00007FF674B4822E

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Library$AddressProc$FreeLicenseLoadQueryValue
String ID: AllowTelemetry$ConfigureTelemetryOptInSettingsUx
API String ID: 1791012833-1228298405
Opcode ID: a5ff96c5f5e4c22bc1729518e74bc9a03b828c902d5197af8ff95c7d4cbe084c
Instruction ID: 7a0bf33057a53707d648f9bfd6a7592345103ccd47511f81a9f59015b22416ce
Opcode Fuzzy Hash: a5ff96c5f5e4c22bc1729518e74bc9a03b828c902d5197af8ff95c7d4cbe084c
Instruction Fuzzy Hash: 4D314277A24652CEEB408F65D8C86E877A0FB16B98F405135EB0E82A89DF78D994C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B28A24 Relevance: 4.7, APIs: 3, Instructions: 185threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF674B28B25
IsDebuggerPresent.KERNEL32 ref: 00007FF674B28C1B
OutputDebugStringW.KERNEL32 ref: 00007FF674B28C96

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CurrentDebugDebuggerOutputPresentStringThread
String ID:
API String ID: 4268342597-0
Opcode ID: 8243d28325cf24086773e4294987398340669782a28f90ff9699478599bbd646
Instruction ID: a7d5995c1440d4626340693e9a38f844a1cf4901fa9da1e7e6cf85c9837eb4d7
Opcode Fuzzy Hash: 8243d28325cf24086773e4294987398340669782a28f90ff9699478599bbd646
Instruction Fuzzy Hash: C2811A23A29B82C5EAA5DF25A4C8239B7A0FF46F84F184539C94D87794DF3DE885C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B23988 Relevance: 3.1, APIs: 2, Instructions: 72COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF674B239CE
GetVersionExA.KERNEL32 ref: 00007FF674B239D8

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Versionmemset
String ID:
API String ID: 3136939366-0
Opcode ID: 5d765d1aa94e121c9bb204fb79acca56ea2461e29a67720dc8b20508bc9c2d3a
Instruction ID: 70def847ea4c0696a927cd7df7e58325e3aba375cf92916b0f1dd1800671ee87
Opcode Fuzzy Hash: 5d765d1aa94e121c9bb204fb79acca56ea2461e29a67720dc8b20508bc9c2d3a
Instruction Fuzzy Hash: 23314433628A81C7F7609B65E4987A9BBA0FB8BB40F855135DA8E43755DF3CD849CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B34570 Relevance: 3.1, APIs: 2, Instructions: 62encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B21918: GetProcessHeap.KERNEL32 ref: 00007FF674B21921
Part of subcall function 00007FF674B21918: HeapAlloc.KERNEL32 ref: 00007FF674B21938

CryptAcquireContextW.ADVAPI32 ref: 00007FF674B345B3
CryptReleaseContext.ADVAPI32 ref: 00007FF674B3461C

Part of subcall function 00007FF674B2195C: GetProcessHeap.KERNEL32 ref: 00007FF674B21969
Part of subcall function 00007FF674B2195C: HeapFree.KERNEL32 ref: 00007FF674B2197D

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Heap$ContextCryptProcess$AcquireAllocFreeRelease
String ID:
API String ID: 1797299605-0
Opcode ID: 76b06eff4b275ef8f6e2f11b060ec25ef5aaf63a98b159382b0fb0ab1f79f4bd
Instruction ID: 7ca9313c48249ce14464a28edee8525c401e406ebb716a9c4815092f39b2be4d
Opcode Fuzzy Hash: 76b06eff4b275ef8f6e2f11b060ec25ef5aaf63a98b159382b0fb0ab1f79f4bd
Instruction Fuzzy Hash: 0B216237A29751C2EB55CF269598339A2A0EF86F84F058134DA4D87788CF3CDC518740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B275FC Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF674B27619
RaiseException.KERNEL32 ref: 00007FF674B2764D

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Exception$FilterRaiseUnhandled
String ID:
API String ID: 1484249558-0
Opcode ID: 0fb342618ff3edf3ad4110a71cf5484b8004638d52aa2a5b849267a315ff63a8
Instruction ID: ca29f883810d26a9d1b08533a3ace032929fbed57ded1d52eff3a0a9f968db8f
Opcode Fuzzy Hash: 0fb342618ff3edf3ad4110a71cf5484b8004638d52aa2a5b849267a315ff63a8
Instruction Fuzzy Hash: 5BF09033618B41C2D7349B94F054379BAA1FB9AB80F148139DE8D47758DF3CD5548B44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B40A14 Relevance: 1.6, APIs: 1, Instructions: 52timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,80004005,00007FF674B33F22), ref: 00007FF674B40A54

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: 08229f71d2b421a5ebc962edb65bfc9ecc3d687c9c5d5d9e937d16c59b9e2e82
Instruction ID: ba07c844f2ef6d8c6c8f02be2695decfa815ba386a919a1118fdace09b0539f0
Opcode Fuzzy Hash: 08229f71d2b421a5ebc962edb65bfc9ecc3d687c9c5d5d9e937d16c59b9e2e82
Instruction Fuzzy Hash: DE116033A28742C6E6508B15A48416A76E5FB86FC4F284531DE8C83BD6DF38ED428700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B344F8 Relevance: 1.5, APIs: 1, Instructions: 30encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(?,?,?,00007FF674B344D4), ref: 00007FF674B3453B

Part of subcall function 00007FF674B2195C: GetProcessHeap.KERNEL32 ref: 00007FF674B21969
Part of subcall function 00007FF674B2195C: HeapFree.KERNEL32 ref: 00007FF674B2197D

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Heap$ContextCryptFreeProcessRelease
String ID:
API String ID: 2055178999-0
Opcode ID: 0075a531acb6a4a57998c2b0fa9afa38cf5faaa91c6d82a484ca66be2462e6af
Instruction ID: 4773e208b40042245481368b0ed152d1ac35f17937a9e82b8bb42badefe51b2e
Opcode Fuzzy Hash: 0075a531acb6a4a57998c2b0fa9afa38cf5faaa91c6d82a484ca66be2462e6af
Instruction Fuzzy Hash: 95F0FB27A29B06D6EE458F65E89837833A4EB8AF84F588131CA5D47714DF3CD8518340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B4C780 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF674B4C78B

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 9fa09372ac2b6e558fa1f18efe20d62e2307cb08916f1b98f1b5cb8d4ae77b8c
Instruction ID: d96fce6f26bb836e6eb180db61a0b78e16a1d81d744028d45e76c834260df59f
Opcode Fuzzy Hash: 9fa09372ac2b6e558fa1f18efe20d62e2307cb08916f1b98f1b5cb8d4ae77b8c
Instruction Fuzzy Hash: A2B09215E35802C2DA04AB699CE906022A0BB5AB80FC10431C00DC2120DF1CA99B8700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B4AA0C Relevance: .7, Instructions: 654COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70e19bb8407c61e34a1c47f5836692da4dcdc1168991121e7300244e00ac3f58
Instruction ID: 82e0f835aa9a9839fd79e255aabd4db2effa518367415e349a483134cbbbe018
Opcode Fuzzy Hash: 70e19bb8407c61e34a1c47f5836692da4dcdc1168991121e7300244e00ac3f58
Instruction Fuzzy Hash: 9312B4B7F3841047D72DCB19EC52FA976A2B7A4348749A02CA607D3F44EA3DFE158A44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B32ABC Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b43e82328ffc99bc7a76766c94d34ce768ff662acadee616fb778ad22910b8d
Instruction ID: cf222de9b08dfdd78d307ce7bc58c104a64e55403e101f0cb2b108c74ed53b76
Opcode Fuzzy Hash: 7b43e82328ffc99bc7a76766c94d34ce768ff662acadee616fb778ad22910b8d
Instruction Fuzzy Hash: EAA13937B18A56DBEB18CFB6D4942AD33B1FB49B88B014535DE09A7A48DF38E8158740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B42CB0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6f0404d8c561c9b3f4b608d8456b6dc327ba9193c3a7336f6d2d0eee7641468
Instruction ID: bfb07edd9ab406f2d516262b0f622fe390c0f64b9cd33f6eab7fe6472b6f505c
Opcode Fuzzy Hash: f6f0404d8c561c9b3f4b608d8456b6dc327ba9193c3a7336f6d2d0eee7641468
Instruction Fuzzy Hash: FE7147B3B356A587E76C8E18C459A783292A781BC0B55C53DDA0AC7BC4DE3DED40EB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B461EC Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6295b9f36efd4c31760cdbdb0637aafd2c8a61e40401817d281a79d7845f3b9
Instruction ID: af13fe155a5244f2098761d4176d3f5de3c1c60df566e5897968970c5e1243c2
Opcode Fuzzy Hash: d6295b9f36efd4c31760cdbdb0637aafd2c8a61e40401817d281a79d7845f3b9
Instruction Fuzzy Hash: 88518AB7B24A41CAEB548F6AD8457A976A0F749B88F044039DE0DC7B54DE3DEC42C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B4BCBC Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03af0761061c05c8087de23d13a430ad1254f8bc16d93bf78891331ee02789e6
Instruction ID: bd0efb04b6edd403de325609fbf86da543fad2618c2dc77a47b4fdeddbc72eb8
Opcode Fuzzy Hash: 03af0761061c05c8087de23d13a430ad1254f8bc16d93bf78891331ee02789e6
Instruction Fuzzy Hash: 1F412633B305254AD71C4D3C562B52DDD9E93C5380B90F93AE686CBFADDD2AD9128A80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B47248 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID:
API String ID: 17069307-0
Opcode ID: efcf36a41483f191ae8fd3f63107bbbfd02d3235443d560fe9aa57f3555be380
Instruction ID: f887ba1a4a48dfbc2311e9c82db376c94bcdd9e3641423dffa8e153ebd1fbc2e
Opcode Fuzzy Hash: efcf36a41483f191ae8fd3f63107bbbfd02d3235443d560fe9aa57f3555be380
Instruction Fuzzy Hash: 3A31D833B3855187EBA88A3DD88576A66D1E786BC4F448134EA49C7B88DE3CDC42CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B473A4 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID:
API String ID: 17069307-0
Opcode ID: 21526c3751e8ed0ec6a44f8fc99c6866a5f772b44d916c1507a819e601cca11c
Instruction ID: b5e12ab7fbc26f27011a5ae234324ee76b170450d8af132ad5a62d5aa7dbeb77
Opcode Fuzzy Hash: 21526c3751e8ed0ec6a44f8fc99c6866a5f772b44d916c1507a819e601cca11c
Instruction Fuzzy Hash: 7431D533B3856186EBA88A3DD88573A66D1E785BC4F449134EA0DC7B88DE3CDC42CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B4BB30 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8601153844eb919040d69870f82575c3ddd0f300710fa1108b9e361430ee609
Instruction ID: e263f9fa82e59a56ed291003f456bc61d92621d3e7d8156e6ffc7ff4f50849d3
Opcode Fuzzy Hash: a8601153844eb919040d69870f82575c3ddd0f300710fa1108b9e361430ee609
Instruction Fuzzy Hash: EA316C7BB3416047C71C4E3CA65751DA98ED3D5380780B93AEA46CBFD9DD3AE9128B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B4790C Relevance: 54.4, APIs: 14, Strings: 17, Instructions: 188
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32 ref: 00007FF674B47942
GetProcAddress.KERNEL32 ref: 00007FF674B47960
GetProcAddress.KERNEL32 ref: 00007FF674B47979
FreeLibrary.KERNEL32 ref: 00007FF674B47BBE

Strings

LimitEnhancedDiagnosticDataWindowsAnalytics, xrefs: 00007FF674B47A08
PolicyManager_FreeGetPolicyData, xrefs: 00007FF674B4796C
DisableTelemetryOptInChangeNotification, xrefs: 00007FF674B47A43
policymanager.dll, xrefs: 00007FF674B47936
DisableOneSettingsDownloads, xrefs: 00007FF674B47AED
ConfigureTelemetryOptInChangeNotification, xrefs: 00007FF674B47A29
EnableOneSettingsAuditing, xrefs: 00007FF674B47B0A
AllowCommercialDataPipeline, xrefs: 00007FF674B47AB3
DisableTelemetryOptInSettingsUx, xrefs: 00007FF674B47A69
AllowTelemetry, xrefs: 00007FF674B47AD0
PolicyManager_GetPolicy, xrefs: 00007FF674B47956
System, xrefs: 00007FF674B479B5
DisableDiagnosticDataViewer, xrefs: 00007FF674B47A96
ConfigureTelemetryOptInSettingsUx, xrefs: 00007FF674B47A4F
DisableDeviceDelete, xrefs: 00007FF674B47A75
Software\Policies\Microsoft\Windows\DataCollection, xrefs: 00007FF674B47B37
onecore\base\telemetry\permission\lib\telemetrypermission.cpp, xrefs: 00007FF674B47BD2

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: AddressLibraryProc$FreeLoad
String ID: AllowCommercialDataPipeline$AllowTelemetry$ConfigureTelemetryOptInChangeNotification$ConfigureTelemetryOptInSettingsUx$DisableDeviceDelete$DisableDiagnosticDataViewer$DisableOneSettingsDownloads$DisableTelemetryOptInChangeNotification$DisableTelemetryOptInSettingsUx$EnableOneSettingsAuditing$LimitEnhancedDiagnosticDataWindowsAnalytics$PolicyManager_FreeGetPolicyData$PolicyManager_GetPolicy$Software\Policies\Microsoft\Windows\DataCollection$System$onecore\base\telemetry\permission\lib\telemetrypermission.cpp$policymanager.dll
API String ID: 2256533930-4007305814
Opcode ID: d7e29df087f457c5de8cb134c514b690fdb605c60d433f5d44d951e1b6349e47
Instruction ID: 54772edb2d86083aa66bf051b81fe024dd105d3c8ad8838da880634cea923259
Opcode Fuzzy Hash: d7e29df087f457c5de8cb134c514b690fdb605c60d433f5d44d951e1b6349e47
Instruction Fuzzy Hash: A0811E62B28742C6EB108F15E8983B9A7A5BF46FD5F488135CE0E86690EF3DE945C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B26984 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 176
processfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF674B266E8: GetLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF674B21A63), ref: 00007FF674B26721
Part of subcall function 00007FF674B266E8: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF674B21A63), ref: 00007FF674B26799
Part of subcall function 00007FF674B266E8: PostThreadMessageW.USER32 ref: 00007FF674B267B9

memset.MSVCRT ref: 00007FF674B269E4
CreateFileW.KERNEL32 ref: 00007FF674B26A53
GetCurrentProcess.KERNEL32 ref: 00007FF674B26A6C
GetCurrentProcess.KERNEL32 ref: 00007FF674B26A7B
DuplicateHandle.KERNEL32 ref: 00007FF674B26AAA
GetStdHandle.KERNEL32 ref: 00007FF674B26AC3
CreateProcessW.KERNEL32 ref: 00007FF674B26B21
WaitForSingleObject.KERNEL32 ref: 00007FF674B26B3A
GetLastError.KERNEL32 ref: 00007FF674B26B55
CloseHandle.KERNEL32 ref: 00007FF674B26B71
GetLastError.KERNEL32 ref: 00007FF674B26B81
GetLastError.KERNEL32 ref: 00007FF674B26BAA
CloseHandle.KERNEL32 ref: 00007FF674B26C1D
CloseHandle.KERNEL32 ref: 00007FF674B26C2D
CloseHandle.KERNEL32 ref: 00007FF674B26C47
CloseHandle.KERNEL32 ref: 00007FF674B26C60
CloseHandle.KERNEL32 ref: 00007FF674B26C79

Strings

Command line returned: %1!lx!, xrefs: 00007FF674B26BB6
Unable to get exit code. Error: 0x%1!08lx!, xrefs: 00007FF674B26C07
Launching command line to remove package: %1, xrefs: 00007FF674B269CA
Command line returned: 0x%1!08lx!, xrefs: 00007FF674B26BEF
Output will be redirected to: %1, xrefs: 00007FF674B26AD4

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Handle$Close$ErrorLastProcess$CreateCurrentMessage$DuplicateFileFormatLocalObjectPostSingleThreadTimeWaitmemset
String ID: Command line returned: %1!lx!$Command line returned: 0x%1!08lx!$Launching command line to remove package: %1$Output will be redirected to: %1$Unable to get exit code. Error: 0x%1!08lx!
API String ID: 1923633004-2439298233
Opcode ID: e61bc17935f51f890f659f4c3badc670e13e6b26dbd3ac3fc10281759deeaf24
Instruction ID: ae663d055b45a42eec363ab870ffe4dcb2dd790db07792387bcf2b9920db1ee4
Opcode Fuzzy Hash: e61bc17935f51f890f659f4c3badc670e13e6b26dbd3ac3fc10281759deeaf24
Instruction Fuzzy Hash: 95814E33A14A41CAE7109F60E4882BDBBB1FB4AB98F449535DE4E97B54CF38D949CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B26EB4 Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 243memorycomCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 00007FF674B26F03
VariantInit.OLEAUT32 ref: 00007FF674B26F1B
VariantInit.OLEAUT32 ref: 00007FF674B26F3D
VariantInit.OLEAUT32 ref: 00007FF674B26F60
VariantInit.OLEAUT32 ref: 00007FF674B26F84
VariantClear.OLEAUT32 ref: 00007FF674B26FD2
VariantClear.OLEAUT32 ref: 00007FF674B26FEB
VariantClear.OLEAUT32 ref: 00007FF674B27003
VariantClear.OLEAUT32 ref: 00007FF674B2701B

Part of subcall function 00007FF674B21918: GetProcessHeap.KERNEL32 ref: 00007FF674B21921
Part of subcall function 00007FF674B21918: HeapAlloc.KERNEL32 ref: 00007FF674B21938

SysAllocString.OLEAUT32 ref: 00007FF674B27067
SysFreeString.OLEAUT32 ref: 00007FF674B270BB
SHRegGetUSValueW.SHLWAPI ref: 00007FF674B27179
SysAllocString.OLEAUT32 ref: 00007FF674B271AF
SysFreeString.OLEAUT32 ref: 00007FF674B271FF
SHRegDeleteUSValueW.SHLWAPI ref: 00007FF674B2723E

Strings

\Microsoft\Internet Explorer, xrefs: 00007FF674B27059
CleanupTask, xrefs: 00007FF674B2710B, 00007FF674B27230
Software\Microsoft\Internet Explorer\Setup, xrefs: 00007FF674B27119, 00007FF674B27237
`, xrefs: 00007FF674B2712E

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Variant$ClearInitString$Alloc$FreeHeapValue$CreateDeleteInstanceProcess
String ID: CleanupTask$Software\Microsoft\Internet Explorer\Setup$\Microsoft\Internet Explorer$`
API String ID: 3735153245-2320231753
Opcode ID: cf56510f970fa3706afead685d104fdbaa79b40ce2b366772bfb952bebc5dbc9
Instruction ID: a7fb683b4339ad368159f2da55e67fa70e0db66a9087e8e6c7c9866299a779fb
Opcode Fuzzy Hash: cf56510f970fa3706afead685d104fdbaa79b40ce2b366772bfb952bebc5dbc9
Instruction Fuzzy Hash: 40C14D23A18B86C6EB01CF68D4993B9A7A0FF8AB44F445235DA4D83765DF3DE949C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B38674 Relevance: 31.8, APIs: 7, Strings: 11, Instructions: 265memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B32FD0: #57.IERTUTIL ref: 00007FF674B33020
Part of subcall function 00007FF674B32FD0: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF674B3304C
Part of subcall function 00007FF674B32FD0: SysAllocString.OLEAUT32 ref: 00007FF674B33078
Part of subcall function 00007FF674B32FD0: RegOpenKeyExW.ADVAPI32 ref: 00007FF674B330BB
Part of subcall function 00007FF674B32FD0: RegGetValueW.ADVAPI32 ref: 00007FF674B330FF
Part of subcall function 00007FF674B32FD0: RegCloseKey.ADVAPI32 ref: 00007FF674B3312D
Part of subcall function 00007FF674B32FD0: SysStringLen.OLEAUT32 ref: 00007FF674B33169

SysFreeString.OLEAUT32 ref: 00007FF674B387DC

Part of subcall function 00007FF674B39AC0: CryptCreateHash.ADVAPI32 ref: 00007FF674B39B0F
Part of subcall function 00007FF674B39AC0: CryptHashData.ADVAPI32 ref: 00007FF674B39B2D
Part of subcall function 00007FF674B39AC0: CryptGetHashParam.ADVAPI32 ref: 00007FF674B39B5C
Part of subcall function 00007FF674B39AC0: CryptDestroyHash.ADVAPI32 ref: 00007FF674B39B8F

SysAllocString.OLEAUT32 ref: 00007FF674B388F5
SysFreeString.OLEAUT32 ref: 00007FF674B38942
SysStringByteLen.OLEAUT32 ref: 00007FF674B38975
SysAllocStringByteLen.OLEAUT32 ref: 00007FF674B38986

Part of subcall function 00007FF674B49D84: SysFreeString.OLEAUT32 ref: 00007FF674B49E61

Part of subcall function 00007FF674B2195C: GetProcessHeap.KERNEL32 ref: 00007FF674B21969
Part of subcall function 00007FF674B2195C: HeapFree.KERNEL32 ref: 00007FF674B2197D

SysFreeString.OLEAUT32 ref: 00007FF674B389AC
SysFreeString.OLEAUT32 ref: 00007FF674B389C2

Strings

rid, xrefs: 00007FF674B387C6
euppid, xrefs: 00007FF674B38781
thumbprint, xrefs: 00007FF674B3889D
product, xrefs: 00007FF674B38746
hashvalue, xrefs: 00007FF674B38857
trademark, xrefs: 00007FF674B38767
<?xml version="1.0" encoding="utf-8"?>, xrefs: 00007FF674B388EE
<request/>, xrefs: 00007FF674B38704
https://ieonline.microsoft.com/EUPP/v1/service?action=signvalue&appid=Microsoft_IE_EUPP, xrefs: 00007FF674B3867D
type, xrefs: 00007FF674B3879A
source, xrefs: 00007FF674B388C5

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: String$Free$CryptHash$Alloc$ByteHeap$CloseConvertCreateDataDestroyOpenParamProcessValue
String ID: <?xml version="1.0" encoding="utf-8"?>$<request/>$euppid$hashvalue$https://ieonline.microsoft.com/EUPP/v1/service?action=signvalue&appid=Microsoft_IE_EUPP$product$rid$source$thumbprint$trademark$type
API String ID: 3186373301-1803989589
Opcode ID: e8029c8896fdcb2ec9a47429c66e0de3bfe13a4086b319dfd8f3c86771fac7a4
Instruction ID: 9e5d785ae31308c54c585c3dd5c6bc6d461bd23a01fad963d7eb478e044ffad7
Opcode Fuzzy Hash: e8029c8896fdcb2ec9a47429c66e0de3bfe13a4086b319dfd8f3c86771fac7a4
Instruction Fuzzy Hash: F5B12923A24A56C6FB009B76C8883AC67A2EF86F98F554131DE0DDB655DF38EC46C341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B3D888 Relevance: 30.2, APIs: 20, Instructions: 193fileCOMMON

Download Yara Rule

APIs

UnmapViewOfFile.KERNEL32(?,?,?,?,?,?,00000000,00007FF674B3DF82), ref: 00007FF674B3D8D8
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00007FF674B3DF82), ref: 00007FF674B3D8F2
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00007FF674B3DF82), ref: 00007FF674B3D908
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,00007FF674B3DF82), ref: 00007FF674B3D956
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00007FF674B3DF82), ref: 00007FF674B3D970
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00007FF674B3DF82), ref: 00007FF674B3D986
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00007FF674B3DF82), ref: 00007FF674B3D99C
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,00007FF674B3DF82), ref: 00007FF674B3D9D5
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00007FF674B3DF82), ref: 00007FF674B3D9EF
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00007FF674B3DF82), ref: 00007FF674B3DA05
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00007FF674B3DF82), ref: 00007FF674B3DA1B
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,00007FF674B3DF82), ref: 00007FF674B3DA53
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00007FF674B3DF82), ref: 00007FF674B3DA6D
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00007FF674B3DF82), ref: 00007FF674B3DA83
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00007FF674B3DF82), ref: 00007FF674B3DA99
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,00007FF674B3DF82), ref: 00007FF674B3DACD
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00007FF674B3DF82), ref: 00007FF674B3DAE7
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00007FF674B3DF82), ref: 00007FF674B3DAFD
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00007FF674B3DF82), ref: 00007FF674B3DB11

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$CloseHandle$FileUnmapView
String ID:
API String ID: 3410133523-0
Opcode ID: 74045a0d449d6bef91c49103180d8784fdffa1ba190b2088dc9f717b97990db0
Instruction ID: d3d4148adfb0238eb2546563a1eaa4de28f57dc5a145ad596a544c4ab145183a
Opcode Fuzzy Hash: 74045a0d449d6bef91c49103180d8784fdffa1ba190b2088dc9f717b97990db0
Instruction Fuzzy Hash: 39810A62B28B46CBE7505F7694D83796A98FF4AF45F849234CB2AC3290DF3CE8455210

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B42658 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 137registryencryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B49078: GetModuleFileNameW.KERNEL32 ref: 00007FF674B490AE
Part of subcall function 00007FF674B49078: _wcsicmp.MSVCRT ref: 00007FF674B490D9

#690.IERTUTIL ref: 00007FF674B426B9
wcsncmp.MSVCRT ref: 00007FF674B426DF
RegOpenKeyExW.ADVAPI32 ref: 00007FF674B42714
RegCreateKeyExW.ADVAPI32 ref: 00007FF674B42759
CertOpenStore.CRYPT32 ref: 00007FF674B42789
GetLastError.KERNEL32 ref: 00007FF674B427A1
GetLastError.KERNEL32 ref: 00007FF674B427B6
RegCloseKey.ADVAPI32 ref: 00007FF674B427EA
RegCloseKey.ADVAPI32 ref: 00007FF674B427FB
CertOpenStore.CRYPT32 ref: 00007FF674B42827
GetLastError.KERNEL32 ref: 00007FF674B4283F
GetLastError.KERNEL32 ref: 00007FF674B42854
GetLastError.KERNEL32 ref: 00007FF674B42869

Strings

MSIEHistoryJournal, xrefs: 00007FF674B4280C
HistoryJournalCertificate, xrefs: 00007FF674B42738
HKCU\, xrefs: 00007FF674B426D3

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$Open$CertCloseStore$#690CreateFileModuleName_wcsicmpwcsncmp
String ID: HKCU\$HistoryJournalCertificate$MSIEHistoryJournal
API String ID: 2454733814-1739054375
Opcode ID: 877664214de6385cc0f7077c3cf025e2f3f09668462cc534a9615fe57af687fb
Instruction ID: ea87a3a1aaaf11d6a190cd3c2db8aba2864a46f0d7a04665b2147d09b9e713b9
Opcode Fuzzy Hash: 877664214de6385cc0f7077c3cf025e2f3f09668462cc534a9615fe57af687fb
Instruction Fuzzy Hash: C2512B33628B42C6E7509B69E498769B7A4FF8ABD1F449234DA4D83754DF7CE809C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B48E30 Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 140memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeExW.VERSION(?,?,?,?,?,?,?,?,00007FF674B26295), ref: 00007FF674B48E73
LocalAlloc.KERNELBASE ref: 00007FF674B48E93
GetFileVersionInfoExW.VERSION(?,?,?,?,?,?,?,?,00007FF674B26295), ref: 00007FF674B48EBF
VerQueryValueW.VERSION(?,?,?,?,?,?,?,?,00007FF674B26295), ref: 00007FF674B48EEA
StrTrimW.SHLWAPI(?,?,?,?,?,?,?,?,00007FF674B26295), ref: 00007FF674B49013

Part of subcall function 00007FF674B21574: _vsnwprintf.MSVCRT ref: 00007FF674B215B4

VerQueryValueW.VERSION(?,?,?,?,?,?,?,?,00007FF674B26295), ref: 00007FF674B48F42
VerQueryValueW.VERSION(?,?,?,?,?,?,?,?,00007FF674B26295), ref: 00007FF674B48F7C
VerQueryValueW.VERSION(?,?,?,?,?,?,?,?,00007FF674B26295), ref: 00007FF674B48FB2
VerQueryValueW.VERSION(?,?,?,?,?,?,?,?,00007FF674B26295), ref: 00007FF674B48FE8
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00007FF674B26295), ref: 00007FF674B4903B

Strings

\StringFileInfo\%04X%04X\%s, xrefs: 00007FF674B48F13
\VarFileInfo\Translation, xrefs: 00007FF674B48EE3
FileVersion, xrefs: 00007FF674B48F02
\StringFileInfo\04090000\%s, xrefs: 00007FF674B48FC5
\StringFileInfo\040904E4\%s, xrefs: 00007FF674B48F8F
\StringFileInfo\040904B0\%s, xrefs: 00007FF674B48F59

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: QueryValue$FileInfoLocalVersion$AllocFreeSizeTrim_vsnwprintf
String ID: FileVersion$\StringFileInfo\%04X%04X\%s$\StringFileInfo\04090000\%s$\StringFileInfo\040904B0\%s$\StringFileInfo\040904E4\%s$\VarFileInfo\Translation
API String ID: 386413036-2944779872
Opcode ID: b3ae8742d7e359fa9e7e6561ef99e026b185d2259bc52ef6266ec8c7645275df
Instruction ID: 28d5086c5a909a258da3a5401cfa46f9f642ac8bb8f3d8e93b5a1554decda836
Opcode Fuzzy Hash: b3ae8742d7e359fa9e7e6561ef99e026b185d2259bc52ef6266ec8c7645275df
Instruction Fuzzy Hash: 8A512C33B18A42D6EB108B75E8585E97761FB8AF84B814132DE0DA7754DF38E949C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B28464 Relevance: 26.4, APIs: 2, Strings: 13, Instructions: 153windowthreadCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32 ref: 00007FF674B28545
GetCurrentThreadId.KERNEL32 ref: 00007FF674B285C4

Part of subcall function 00007FF674B283D8: _vsnwprintf.MSVCRT ref: 00007FF674B28410

Strings

[%hs], xrefs: 00007FF674B2868D
[%hs(%hs)], xrefs: 00007FF674B28674
ReturnHr, xrefs: 00007FF674B28507
CallContext:[%hs] , xrefs: 00007FF674B2864D
%hs(%d) tid(%x) %08X %ws, xrefs: 00007FF674B285DD
(caller: %p) , xrefs: 00007FF674B285AF
Exception, xrefs: 00007FF674B28510
%hs(%u)\%hs!%p: , xrefs: 00007FF674B28571
LogHr, xrefs: 00007FF674B284FE
Msg:[%ws] , xrefs: 00007FF674B28632
, xrefs: 00007FF674B28617
%hs!%p: , xrefs: 00007FF674B2858F
FailFast, xrefs: 00007FF674B284F5

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CurrentFormatMessageThread_vsnwprintf
String ID: $%hs!%p: $%hs(%d) tid(%x) %08X %ws$%hs(%u)\%hs!%p: $(caller: %p) $CallContext:[%hs] $Exception$FailFast$LogHr$Msg:[%ws] $ReturnHr$[%hs(%hs)]$[%hs]
API String ID: 223436642-3173542853
Opcode ID: 109af04919337dab591c5b886a71723b77b00c5ac2e51ef06a02aa46d7378c5c
Instruction ID: f98bfa371254f899dfc793dfd4d59d3521615498eeb654cbf7b89086dfe7eafc
Opcode Fuzzy Hash: 109af04919337dab591c5b886a71723b77b00c5ac2e51ef06a02aa46d7378c5c
Instruction Fuzzy Hash: 7F616E23A28742C2EA51DB51E4985BAA3A1FF46F84F441636EA4DD3794DF3CED44C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B26C94 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 113COMMON

Download Yara Rule

APIs

CompareStringOrdinal.KERNEL32 ref: 00007FF674B26CEB
memset.MSVCRT ref: 00007FF674B26D0F
swscanf_s.MSVCRT ref: 00007FF674B26D78
CompareStringOrdinal.KERNEL32 ref: 00007FF674B26DB7
StrStrW.SHLWAPI ref: 00007FF674B26DDA
ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF674B26E22
fgetws.MSVCRT ref: 00007FF674B26E5C
fclose.MSVCRT ref: 00007FF674B26E74

Strings

VER_IEMAJORVERSION.2, xrefs: 00007FF674B26DCC
"%%windir%%\System32\dism.exe" /online /remove-package /packagename:%s, xrefs: 00007FF674B26DF7
', xrefs: 00007FF674B26D16
Microsoft-Windows-InternetExplorer-Package-TopLevel, xrefs: 00007FF674B26CE4
Superseded, xrefs: 00007FF674B26DB0
%%%us | %%%us, xrefs: 00007FF674B26D2C
(, xrefs: 00007FF674B26D56

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CompareOrdinalString$EnvironmentExpandStringsfclosefgetwsmemsetswscanf_s
String ID: "%%windir%%\System32\dism.exe" /online /remove-package /packagename:%s$%%%us | %%%us$'$($Microsoft-Windows-InternetExplorer-Package-TopLevel$Superseded$VER_IEMAJORVERSION.2
API String ID: 3943657873-1226670232
Opcode ID: 3f0b104de08c516934f2c3ceac26d29a9de8d2e8c20ff9f6c0e8912f9b7e30b0
Instruction ID: a852155082db155d9e0429b82fa171c5588ebd75c6a31c7eeca1325314a706cd
Opcode Fuzzy Hash: 3f0b104de08c516934f2c3ceac26d29a9de8d2e8c20ff9f6c0e8912f9b7e30b0
Instruction Fuzzy Hash: 71513F33A24A86DAE760DF24D8882E9B7A1FB5AF48F805131DA4D87654DF3CDA49C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B3E860 Relevance: 25.8, APIs: 17, Instructions: 291fileCOMMON

Download Yara Rule

APIs

GetFileSizeEx.KERNEL32 ref: 00007FF674B3E95B
GetLastError.KERNEL32 ref: 00007FF674B3E96B
GetLastError.KERNEL32 ref: 00007FF674B3E984
SetFilePointer.KERNEL32 ref: 00007FF674B3E9C8
GetLastError.KERNEL32 ref: 00007FF674B3E9D9
GetLastError.KERNEL32 ref: 00007FF674B3E9EE
GetLastError.KERNEL32 ref: 00007FF674B3EA01
SetEndOfFile.KERNEL32 ref: 00007FF674B3EA2B
GetLastError.KERNEL32 ref: 00007FF674B3EA3B
GetLastError.KERNEL32 ref: 00007FF674B3EA50
GetLastError.KERNEL32 ref: 00007FF674B3EA63
FlushFileBuffers.KERNEL32 ref: 00007FF674B3EA95
CreateFileMappingW.KERNEL32 ref: 00007FF674B3EAD1
#50.IERTUTIL ref: 00007FF674B3EAF0
MapViewOfFile.KERNEL32 ref: 00007FF674B3EB28
memset.MSVCRT ref: 00007FF674B3EB4C
GetLastError.KERNEL32 ref: 00007FF674B3EC7C

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$File$BuffersCreateFlushMappingPointerSizeViewmemset
String ID:
API String ID: 804094210-0
Opcode ID: 3a1a484193333aed796fab24437ed2a1a7eed25374e7ff067f007c46046bdcd9
Instruction ID: 6fbdb9ec1b51ccf1ea3b3a5e4046de753afc044964eb5afae1b11be287cfbb89
Opcode Fuzzy Hash: 3a1a484193333aed796fab24437ed2a1a7eed25374e7ff067f007c46046bdcd9
Instruction Fuzzy Hash: 55C15F73A18B92C7E7508F66E4987697AE4FB8AF88F548536DA4D83750DF3CE8058700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B32FD0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 151registrymemoryCOMMON

Download Yara Rule

APIs

#57.IERTUTIL ref: 00007FF674B33020
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF674B3304C
SysAllocString.OLEAUT32 ref: 00007FF674B33078
RegOpenKeyExW.ADVAPI32 ref: 00007FF674B330BB
RegGetValueW.ADVAPI32 ref: 00007FF674B330FF
RegCloseKey.ADVAPI32 ref: 00007FF674B3312D

Part of subcall function 00007FF674B216BC: SysStringLen.OLEAUT32 ref: 00007FF674B21707

SysStringLen.OLEAUT32 ref: 00007FF674B33169
memcpy_s.MSVCRT ref: 00007FF674B33194
SysFreeString.OLEAUT32 ref: 00007FF674B331C1
LocalFree.KERNEL32 ref: 00007FF674B331D9
LocalFree.KERNEL32 ref: 00007FF674B331EF

Strings

MachineGuid, xrefs: 00007FF674B330F1
N/A, xrefs: 00007FF674B3313E
SOFTWARE\Microsoft\Cryptography, xrefs: 00007FF674B330AD

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: String$Free$Local$AllocCloseConvertOpenValuememcpy_s
String ID: MachineGuid$N/A$SOFTWARE\Microsoft\Cryptography
API String ID: 914379026-238228221
Opcode ID: 4d81af1253eda9a4fba4b1541149e29a514f510839cc8880669393de02f4828d
Instruction ID: 737c1b957ae819d4b8b50f29ad8c319a44fe9ee6012a670b94385d0db7733dce
Opcode Fuzzy Hash: 4d81af1253eda9a4fba4b1541149e29a514f510839cc8880669393de02f4828d
Instruction Fuzzy Hash: 6B512C33618B42C6E6108F26E88827ABBA4FB8AB90F555135DE8D83754DF3DD959C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B219BC Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 106registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B266E8: GetLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF674B21A63), ref: 00007FF674B26721
Part of subcall function 00007FF674B266E8: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF674B21A63), ref: 00007FF674B26799
Part of subcall function 00007FF674B266E8: PostThreadMessageW.USER32 ref: 00007FF674B267B9

RegOpenKeyExW.ADVAPI32 ref: 00007FF674B21A84
memset.MSVCRT ref: 00007FF674B21AA6
RegQueryValueExW.ADVAPI32 ref: 00007FF674B21AD4
RegSetValueExW.ADVAPI32 ref: 00007FF674B21B53
RegCloseKey.ADVAPI32 ref: 00007FF674B21B76

Strings

Original First Home Page Text:[%1!ls!]., xrefs: 00007FF674B21B1D
Original First Home Page Result:%1!lx!, xrefs: 00007FF674B21B07
Setting Home Page., xrefs: 00007FF674B21A02
`, xrefs: 00007FF674B21B38
Software\microsoft\Internet Explorer\Main, xrefs: 00007FF674B21A76
Setting Home Page. Failed to open registry Key, xrefs: 00007FF674B21B84
An invalid value is set in the reg value., xrefs: 00007FF674B21AF3
Writing Single Home Page to XP Result:%2!lx!, xrefs: 00007FF674B21B5F

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: MessageValue$CloseFormatLocalOpenPostQueryThreadTimememset
String ID: An invalid value is set in the reg value.$Original First Home Page Result:%1!lx!$Original First Home Page Text:[%1!ls!].$Setting Home Page.$Setting Home Page. Failed to open registry Key$Software\microsoft\Internet Explorer\Main$Writing Single Home Page to XP Result:%2!lx!$`
API String ID: 3787667049-2357394903
Opcode ID: 697ee2f033f14768bbca42a7767b423c6ccb72d77bfcef2f312441f28d038ba0
Instruction ID: 6774b9b5fd6d9125dba7d03ef29441707c9fd763e3f015de415b2b3c5f33d26a
Opcode Fuzzy Hash: 697ee2f033f14768bbca42a7767b423c6ccb72d77bfcef2f312441f28d038ba0
Instruction Fuzzy Hash: F8512326A28B81C5F7118B18E4895F9F360FF9AB84F445135DE4D83665EF3CE985C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2C674 Relevance: 22.6, APIs: 15, Instructions: 149memoryCOMMON

Download Yara Rule

APIs

GetKernelObjectSecurity.ADVAPI32 ref: 00007FF674B2C6B4
GetLastError.KERNEL32 ref: 00007FF674B2C6CA
LocalAlloc.KERNELBASE ref: 00007FF674B2C6E1
GetKernelObjectSecurity.ADVAPI32 ref: 00007FF674B2C716
GetLastError.KERNEL32 ref: 00007FF674B2C726
GetSecurityDescriptorSacl.ADVAPI32 ref: 00007FF674B2C767
GetAce.ADVAPI32 ref: 00007FF674B2C7A7
GetLengthSid.ADVAPI32 ref: 00007FF674B2C7D7
LocalAlloc.KERNELBASE ref: 00007FF674B2C7EA
GetLengthSid.ADVAPI32 ref: 00007FF674B2C806
CopySid.ADVAPI32 ref: 00007FF674B2C81A
LocalFree.KERNEL32 ref: 00007FF674B2C832
LocalFree.KERNEL32 ref: 00007FF674B2C885

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Local$Security$AllocErrorFreeKernelLastLengthObject$CopyDescriptorSacl
String ID:
API String ID: 3500360645-0
Opcode ID: d3b797466126dfc056c2a9ceb9da21bf7a473a0801e90d60c8930e5e4c970a27
Instruction ID: 62385cdf3f84a4ecaad3af3e2e7aa2338d8e597630c74ea334d0620c2942f6d4
Opcode Fuzzy Hash: d3b797466126dfc056c2a9ceb9da21bf7a473a0801e90d60c8930e5e4c970a27
Instruction Fuzzy Hash: 51512A37A18B42CBE7548F65A8881B97AA4FB4BF85B548131CE0E97754EF3CE845C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B338F0 Relevance: 21.2, APIs: 4, Strings: 8, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B2CCA4: LoadLibraryW.KERNEL32 ref: 00007FF674B2CCD5
Part of subcall function 00007FF674B2CCA4: GetProcAddress.KERNEL32 ref: 00007FF674B2CCFC
Part of subcall function 00007FF674B2CCA4: FreeLibrary.KERNEL32 ref: 00007FF674B2CD24

_wcsnicmp.MSVCRT ref: 00007FF674B339D7
_wcsnicmp.MSVCRT ref: 00007FF674B33A14
_wcsnicmp.MSVCRT ref: 00007FF674B33A51
_wcsnicmp.MSVCRT ref: 00007FF674B33A97

Strings

http://www.yandex.com/favicon.ico, xrefs: 00007FF674B33ABB
{2562B2EF-500D-49FC-A350-5BC0D4C56EE3}, xrefs: 00007FF674B3397D
https://www.haosou.com/s?src=win10&ie=utf-8&q={searchTerms}, xrefs: 00007FF674B33967
https://www.sogou.com/tx?hdq=sogou-wsse-6abba5d8ab1f4f32&query={searchTerms}, xrefs: 00007FF674B33984
https://yandex.ru/search/?text={searchTerms}&clid=2233627, xrefs: 00007FF674B339F7
https://suggest.yandex.ru/suggest-ff.cgi?srv=ie11&part={searchTerms}&clid=2233627, xrefs: 00007FF674B33A34
{461B4783-36F5-45B9-883E-35BA5ED4A823}, xrefs: 00007FF674B33960
{8C3078A0-9AAB-4371-85D1-656CA8E46EE8}, xrefs: 00007FF674B339BC

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: _wcsnicmp$Library$AddressFreeLoadProc
String ID: http://www.yandex.com/favicon.ico$https://suggest.yandex.ru/suggest-ff.cgi?srv=ie11&part={searchTerms}&clid=2233627$https://www.haosou.com/s?src=win10&ie=utf-8&q={searchTerms}$https://www.sogou.com/tx?hdq=sogou-wsse-6abba5d8ab1f4f32&query={searchTerms}$https://yandex.ru/search/?text={searchTerms}&clid=2233627${2562B2EF-500D-49FC-A350-5BC0D4C56EE3}${461B4783-36F5-45B9-883E-35BA5ED4A823}${8C3078A0-9AAB-4371-85D1-656CA8E46EE8}
API String ID: 584558329-729423207
Opcode ID: e25aa7b836383d6f71ad2f2080bfeeb7f6664c7ed43af9669be0d297b218caaf
Instruction ID: b15a8ad531ab8bf33817dc4bb26f006cd6826d5fa354f18ccad24660dff5b3fc
Opcode Fuzzy Hash: e25aa7b836383d6f71ad2f2080bfeeb7f6664c7ed43af9669be0d297b218caaf
Instruction Fuzzy Hash: D9814127A28A46D7EB50CF66D8C81A9A761FB4AF88B445432DE0D87764DF3DED49C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B46C48 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

WaitForSingleObjectEx.KERNEL32 ref: 00007FF674B46C9A
GetLastError.KERNEL32 ref: 00007FF674B46CE0
SetLastError.KERNEL32 ref: 00007FF674B46CF8
GetProcessHeap.KERNEL32 ref: 00007FF674B46D39
HeapFree.KERNEL32 ref: 00007FF674B46D4D

Strings

onecore\internal\sdk\inc\wil\opensource\wil\resource.h, xrefs: 00007FF674B46DFA

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorHeapLast$FreeObjectProcessSingleWait
String ID: onecore\internal\sdk\inc\wil\opensource\wil\resource.h
API String ID: 453756160-3341287125
Opcode ID: 6dc2f5e5708b4a8988b3acd2d793e6f27e4c36014d555acfc29201e1b004f11d
Instruction ID: 2a9450bcb18edf5e552544206afd5ad8e2dc3a0ec81101dd9f8eb11ffe4821dc
Opcode Fuzzy Hash: 6dc2f5e5708b4a8988b3acd2d793e6f27e4c36014d555acfc29201e1b004f11d
Instruction Fuzzy Hash: 93713473A18682D6EB649B69E4983B967A0FF4BFC0F484531DA4E87695DF2CEC54C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B21BC0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 100libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF674B21BE3
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF674B21C2E
LocalFree.KERNEL32 ref: 00007FF674B21CC5
SysFreeString.OLEAUT32 ref: 00007FF674B21CD5

Part of subcall function 00007FF674B216BC: SysAllocStringLen.OLEAUT32 ref: 00007FF674B2172D
Part of subcall function 00007FF674B216BC: SysStringLen.OLEAUT32 ref: 00007FF674B21744
Part of subcall function 00007FF674B216BC: memcpy_s.MSVCRT ref: 00007FF674B21766
Part of subcall function 00007FF674B216BC: memcpy_s.MSVCRT ref: 00007FF674B217A6
Part of subcall function 00007FF674B216BC: SysFreeString.OLEAUT32 ref: 00007FF674B217D5

Part of subcall function 00007FF674B2163C: SysStringLen.OLEAUT32 ref: 00007FF674B21654
Part of subcall function 00007FF674B2163C: VarBstrCat.OLEAUT32 ref: 00007FF674B21676
Part of subcall function 00007FF674B2163C: SysFreeString.OLEAUT32 ref: 00007FF674B2168B

Part of subcall function 00007FF674B266E8: GetLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF674B21A63), ref: 00007FF674B26721
Part of subcall function 00007FF674B266E8: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF674B21A63), ref: 00007FF674B26799
Part of subcall function 00007FF674B266E8: PostThreadMessageW.USER32 ref: 00007FF674B267B9

GetLastError.KERNEL32 ref: 00007FF674B21CE3
FreeSid.ADVAPI32 ref: 00007FF674B21D0C

Part of subcall function 00007FF674B216BC: SysStringLen.OLEAUT32 ref: 00007FF674B21707

Strings

Unable to get SID for %1!ls!. Result:%2!lx!, xrefs: 00007FF674B21D1D
(A;CI;KR;;;, xrefs: 00007FF674B21C47
Unable to Format Sid for %1!ls! to append to Extended ACL., xrefs: 00007FF674B21CAE
Unable to Append Sid for %1!ls! to Extended ACL. Result:%2!lx!, xrefs: 00007FF674B21C93
DeriveAppContainerSidFromAppContainerName, xrefs: 00007FF674B21BDC
Unable to convert Sid to string for %1!ls!. Result:%2!lx!, xrefs: 00007FF674B21CF2

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: String$Free$LocalMessagememcpy_s$AddressAllocBstrConvertErrorFormatLastPostProcThreadTime
String ID: (A;CI;KR;;;$DeriveAppContainerSidFromAppContainerName$Unable to Append Sid for %1!ls! to Extended ACL. Result:%2!lx!$Unable to Format Sid for %1!ls! to append to Extended ACL.$Unable to convert Sid to string for %1!ls!. Result:%2!lx!$Unable to get SID for %1!ls!. Result:%2!lx!
API String ID: 3912539464-613229433
Opcode ID: 50e590a39987bf04f19c564ba7751c20197d28acae0ffaff3b293b9699e4d937
Instruction ID: 65f9c5c7ef864b3299513859861c7dd457b7a04f0279275d70f794eaa04441bb
Opcode Fuzzy Hash: 50e590a39987bf04f19c564ba7751c20197d28acae0ffaff3b293b9699e4d937
Instruction Fuzzy Hash: 4341EC67A28A46D5EB01DB25DC982F86B60FF86F88F449532D90DC7695DE3CE945C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B24F14 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathW.SHELL32 ref: 00007FF674B24F48
GetCurrentDirectoryW.KERNEL32 ref: 00007FF674B24F6A
GetModuleHandleW.KERNEL32 ref: 00007FF674B24F8D
LoadStringW.USER32 ref: 00007FF674B24FAB
GetCurrentDirectoryW.KERNEL32 ref: 00007FF674B24FD5

Part of subcall function 00007FF674B24E48: SetCurrentDirectoryW.KERNEL32 ref: 00007FF674B24E72
Part of subcall function 00007FF674B24E48: FindFirstFileW.KERNEL32 ref: 00007FF674B24E8E
Part of subcall function 00007FF674B24E48: FindNextFileW.KERNEL32 ref: 00007FF674B24EB8
Part of subcall function 00007FF674B24E48: FindClose.KERNEL32 ref: 00007FF674B24ECB
Part of subcall function 00007FF674B24E48: SetCurrentDirectoryW.KERNEL32 ref: 00007FF674B24EDA

SHGetValueW.SHLWAPI ref: 00007FF674B2502E
GetModuleHandleW.KERNEL32 ref: 00007FF674B25040
LoadStringW.USER32 ref: 00007FF674B2505E
SHGetSpecialFolderPathW.SHELL32 ref: 00007FF674B2507C
GetCurrentDirectoryW.KERNEL32 ref: 00007FF674B250A6

Strings

Software\Microsoft\Windows\CurrentVersion\OemStartMenuData, xrefs: 00007FF674B25027
DesktopShortcutsFolderName, xrefs: 00007FF674B2501B

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CurrentDirectory$Find$FileFolderHandleLoadModulePathSpecialString$CloseFirstNextValue
String ID: DesktopShortcutsFolderName$Software\Microsoft\Windows\CurrentVersion\OemStartMenuData
API String ID: 2124583704-3001445492
Opcode ID: d40038c5ab739152c01001ec89057b0f61bfb52042c9fb655e5264001d82ca32
Instruction ID: ea912faa83010074b0a50dddbe1a4ba8b30146612d44f88a3c3637fd71ab262d
Opcode Fuzzy Hash: d40038c5ab739152c01001ec89057b0f61bfb52042c9fb655e5264001d82ca32
Instruction Fuzzy Hash: 06416A33614B82D6EB649F24E8842FE7760FB8AB85F855535D60D87694DF3CD909C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2538C Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 60registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B266E8: GetLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF674B21A63), ref: 00007FF674B26721
Part of subcall function 00007FF674B266E8: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF674B21A63), ref: 00007FF674B26799
Part of subcall function 00007FF674B266E8: PostThreadMessageW.USER32 ref: 00007FF674B267B9

InitOnceExecuteOnce.KERNEL32(00007FF674B22A2C), ref: 00007FF674B253C2
RegOpenKeyExW.ADVAPI32 ref: 00007FF674B25410
RegCloseKey.ADVAPI32 ref: 00007FF674B25425
LoadLibraryExW.KERNEL32 ref: 00007FF674B25440
GetProcAddress.KERNEL32 ref: 00007FF674B2545E
FreeLibrary.KERNEL32 ref: 00007FF674B25491

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE, xrefs: 00007FF674B25402
In FixupIEAssocations. fForceAssociations=%1!d!, xrefs: 00007FF674B25398
SBE is enabled. Bailed out FixupIEAssociations., xrefs: 00007FF674B253D7
ieframe.dll, xrefs: 00007FF674B25433
DllInstall, xrefs: 00007FF674B25454
ForceAssoc, xrefs: 00007FF674B2546F

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: LibraryMessageOnce$AddressCloseExecuteFormatFreeInitLoadLocalOpenPostProcThreadTime
String ID: SBE is enabled. Bailed out FixupIEAssociations.$DllInstall$ForceAssoc$In FixupIEAssocations. fForceAssociations=%1!d!$Software\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE$ieframe.dll
API String ID: 193145673-1861194879
Opcode ID: fdf5c71c4a2b7b028b86c68d215e98ef43ea7d0903141b4d16275a5db3ad0bbb
Instruction ID: 5bb7116169f8a84c358bf8b9eb81ee7abb8310f2b3e6b65a173231dc2a0df530
Opcode Fuzzy Hash: fdf5c71c4a2b7b028b86c68d215e98ef43ea7d0903141b4d16275a5db3ad0bbb
Instruction Fuzzy Hash: 2A311E27A29A02D6EB008B14F8D81B4E760FF4BF81F859135D91E836A4EF3CE945C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B25944 Relevance: 19.6, APIs: 13, Instructions: 139fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF674B259AE
GetLastError.KERNEL32 ref: 00007FF674B259C3
GetLastError.KERNEL32 ref: 00007FF674B259D9
GetLastError.KERNEL32 ref: 00007FF674B259EF
ReadFile.KERNEL32 ref: 00007FF674B25A2B
GetLastError.KERNEL32 ref: 00007FF674B25A3F
GetLastError.KERNEL32 ref: 00007FF674B25A55
GetLastError.KERNEL32 ref: 00007FF674B25A6B
CloseHandle.KERNEL32 ref: 00007FF674B25A89
DeleteFileW.KERNEL32 ref: 00007FF674B25AB7
GetLastError.KERNEL32 ref: 00007FF674B25AC7
GetLastError.KERNEL32 ref: 00007FF674B25ADD
GetLastError.KERNEL32 ref: 00007FF674B25AF3

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$File$CloseCreateDeleteHandleRead
String ID:
API String ID: 2438661856-0
Opcode ID: 5b603998b6ceaa0a23056b6cc8eb0660d0551a6a7f702e7e6f99fb80496b2575
Instruction ID: 3ef4ff18e8d214ac8ee5342e6de5c53a4db86c6f174dd743e2a127bd82ddf627
Opcode Fuzzy Hash: 5b603998b6ceaa0a23056b6cc8eb0660d0551a6a7f702e7e6f99fb80496b2575
Instruction Fuzzy Hash: 64513C22728B42CAE7109F6594D93B9B6A4FF4BF85F818135DB4EC3654DF7CE8048610

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B3E1D8 Relevance: 19.6, APIs: 13, Instructions: 100synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?,?,?,?,?,?,00007FF674B3E155,?,?,00000000,00007FF674B3DE97,?,?,00000000,00007FF674B40BDC), ref: 00007FF674B3E1FC
#50.IERTUTIL(?,?,?,?,?,?,?,00007FF674B3E155,?,?,00000000,00007FF674B3DE97,?,?,00000000,00007FF674B40BDC), ref: 00007FF674B3E217
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,00007FF674B3E155,?,?,00000000,00007FF674B3DE97,?,?,00000000,00007FF674B40BDC), ref: 00007FF674B3E22D
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,00007FF674B3E155,?,?,00000000,00007FF674B3DE97,?,?,00000000,00007FF674B40BDC), ref: 00007FF674B3E23C
DuplicateHandle.KERNEL32 ref: 00007FF674B3E266
GetLastError.KERNEL32 ref: 00007FF674B3E27A
GetLastError.KERNEL32 ref: 00007FF674B3E294
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00007FF674B3E155,?,?,00000000,00007FF674B3DE97,?,?,00000000,00007FF674B40BDC), ref: 00007FF674B3E2CA
OpenMutexW.KERNEL32(?,?,?,?,?,?,?,00007FF674B3E155,?,?,00000000,00007FF674B3DE97,?,?,00000000,00007FF674B40BDC), ref: 00007FF674B3E2E2
GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF674B3E155,?,?,00000000,00007FF674B3DE97,?,?,00000000,00007FF674B40BDC), ref: 00007FF674B3E2F6
GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF674B3E155,?,?,00000000,00007FF674B3DE97,?,?,00000000,00007FF674B40BDC), ref: 00007FF674B3E310
GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF674B3E155,?,?,00000000,00007FF674B3DE97,?,?,00000000,00007FF674B40BDC), ref: 00007FF674B3E323

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$CurrentHandleMutexProcess$CloseCreateDuplicateOpen
String ID:
API String ID: 3779884535-0
Opcode ID: 5095cc0b268e8af13cc5d5acf29afcb5ad415a373148948c14eea26036640252
Instruction ID: 8b90aa162b266359607b9126802a7109f9a8327b9202523ca326fe6aa4e521cf
Opcode Fuzzy Hash: 5095cc0b268e8af13cc5d5acf29afcb5ad415a373148948c14eea26036640252
Instruction Fuzzy Hash: 8B410262614B42CBE7009F66A898379BA90FB8BF81F489135DA4EC3354DF7CE8058610

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B33340 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 102COMMON

Download Yara Rule

APIs

StrCmpNIW.SHLWAPI ref: 00007FF674B333D4
StrCmpNIW.SHLWAPI ref: 00007FF674B33433
StrStrIW.SHLWAPI ref: 00007FF674B33446
SysFreeString.OLEAUT32 ref: 00007FF674B334A0
SysFreeString.OLEAUT32 ref: 00007FF674B334B1

Strings

EUPP_, xrefs: 00007FF674B33429
EUPP, xrefs: 00007FF674B33457
_EUPP_, xrefs: 00007FF674B3343C
msn., xrefs: 00007FF674B3337B
%s_%s, xrefs: 00007FF674B33463
bing., xrefs: 00007FF674B3338C

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: FreeString
String ID: %s_%s$EUPP$EUPP_$_EUPP_$bing.$msn.
API String ID: 3341692771-4073838992
Opcode ID: a6c5943611e90d1ee6adf931ce3ae08aace9fa8024b07ed6f67d21dd5ce845c4
Instruction ID: 9f98d3019ed57e2d8a764882b9b9ef078d7d1fef14c16c7a1dc0c0c866afa1e1
Opcode Fuzzy Hash: a6c5943611e90d1ee6adf931ce3ae08aace9fa8024b07ed6f67d21dd5ce845c4
Instruction Fuzzy Hash: CB41A833629B81C6E710DB66E4842AAB7A1FB4AF90F915131EE5D83798DF3CE945C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B232E0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 84comlibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B266E8: GetLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF674B21A63), ref: 00007FF674B26721
Part of subcall function 00007FF674B266E8: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF674B21A63), ref: 00007FF674B26799
Part of subcall function 00007FF674B266E8: PostThreadMessageW.USER32 ref: 00007FF674B267B9

Part of subcall function 00007FF674B27724: InitOnceExecuteOnce.KERNEL32(?,?,?,?,00007FF674B2CBF9), ref: 00007FF674B2773C

GetCurrentProcess.KERNEL32 ref: 00007FF674B2330F
SetPriorityClass.KERNEL32 ref: 00007FF674B23323
GetCurrentProcess.KERNEL32 ref: 00007FF674B23364
CoCreateInstance.OLE32 ref: 00007FF674B233AA
GetCurrentProcess.KERNEL32 ref: 00007FF674B233EB
SetPriorityClass.KERNEL32 ref: 00007FF674B233FF
GetModuleHandleW.KERNEL32 ref: 00007FF674B23439
GetProcAddress.KERNEL32 ref: 00007FF674B2344F

Strings

kernel32.dll, xrefs: 00007FF674B23432
In CmdInitializeHistoryRoaming, xrefs: 00007FF674B232EA
SetProcessInformation, xrefs: 00007FF674B23448

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CurrentProcess$ClassMessageOncePriority$AddressCreateExecuteFormatHandleInitInstanceLocalModulePostProcThreadTime
String ID: In CmdInitializeHistoryRoaming$SetProcessInformation$kernel32.dll
API String ID: 2110875543-2055926704
Opcode ID: 89cc65f50b90458f721d85a568bbed32039c1b2468aefd17dc3849896a318b65
Instruction ID: 5104d86e637f5ce85d713b1c38d0636783e283f17e6e80059baeed0254812162
Opcode Fuzzy Hash: 89cc65f50b90458f721d85a568bbed32039c1b2468aefd17dc3849896a318b65
Instruction Fuzzy Hash: CB41ED36A28A42C6E740DB55E8D8279E761FB8AF81F449135DA0EC3764DF3CE889C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B46F08 Relevance: 18.1, APIs: 12, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF674B46F3E
GetLastError.KERNEL32 ref: 00007FF674B46F26

Part of subcall function 00007FF674B471FC: SetThreadpoolTimer.KERNEL32(?,?,00007FF674B458B3,00007FF674B46EEC), ref: 00007FF674B4720D
Part of subcall function 00007FF674B471FC: WaitForThreadpoolTimerCallbacks.KERNEL32(?,?,00007FF674B458B3,00007FF674B46EEC), ref: 00007FF674B47221

GetLastError.KERNEL32 ref: 00007FF674B46F58
SetLastError.KERNEL32 ref: 00007FF674B46F70
GetProcessHeap.KERNEL32 ref: 00007FF674B46F95
HeapFree.KERNEL32 ref: 00007FF674B46FA9
GetProcessHeap.KERNEL32 ref: 00007FF674B46FCA
HeapFree.KERNEL32 ref: 00007FF674B46FDE
DeleteCriticalSection.KERNEL32 ref: 00007FF674B46FED
GetProcessHeap.KERNEL32 ref: 00007FF674B4700D
HeapFree.KERNEL32 ref: 00007FF674B47021
DeleteCriticalSection.KERNEL32 ref: 00007FF674B47031

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Heap$ErrorLast$FreeProcess$CriticalDeleteSectionThreadpoolTimer$CallbacksWait
String ID:
API String ID: 3162582620-0
Opcode ID: d207e9815ab27ac350c386903735fa1a50f151cd4ddcb94d343ef91208cf2083
Instruction ID: 4bb565e43fd75d48865e859f1d7823e44c783f0d0d3eb1b7e47143a84dee8b5c
Opcode Fuzzy Hash: d207e9815ab27ac350c386903735fa1a50f151cd4ddcb94d343ef91208cf2083
Instruction Fuzzy Hash: 8A41EF37B25A51D7EA499B65A598378A760FF4BFC1F099134CA0E87755CF3CE8258300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B24158 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 195commemoryCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,?,?,?,?,?,00000000,?,?,00000001,00000000,?,00007FF674B25154), ref: 00007FF674B241B3
CoTaskMemAlloc.OLE32(?,?,?,?,?,?,00000000,?,?,00000001,00000000,?,00007FF674B25154), ref: 00007FF674B24263
memcpy_s.MSVCRT ref: 00007FF674B24288
PropVariantClear.OLE32(?,?,?,?,?,?,00000000,?,?,00000001,00000000,?,00007FF674B25154), ref: 00007FF674B242CC
PropVariantClear.OLE32(?,?,?,?,?,?,00000000,?,?,00000001,00000000,?,00007FF674B25154), ref: 00007FF674B2432C
PropVariantClear.OLE32(?,?,?,?,?,?,00000000,?,?,00000001,00000000,?,00007FF674B25154), ref: 00007FF674B24373

Part of subcall function 00007FF674B21574: _vsnwprintf.MSVCRT ref: 00007FF674B215B4

SHSetLocalizedName.SHELL32 ref: 00007FF674B2443A

Strings

%HOMEDRIVE%%HOMEPATH%, xrefs: 00007FF674B24206
@"%%windir%%\System32\ie4uinit.exe",-%d, xrefs: 00007FF674B241D6
%windir%\System32\ie4uinit.exe, xrefs: 00007FF674B24430

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ClearPropVariant$AllocCreateInstanceLocalizedNameTask_vsnwprintfmemcpy_s
String ID: %HOMEDRIVE%%HOMEPATH%$%windir%\System32\ie4uinit.exe$@"%%windir%%\System32\ie4uinit.exe",-%d
API String ID: 839107887-2483958424
Opcode ID: d3b344539d0de9ecf688537e5404ccacdadc421d05d63f6f44b714d9c327b181
Instruction ID: 31354030351d678baa092dfe53534ff2084d8e6a0f9f45a255604f5654684f04
Opcode Fuzzy Hash: d3b344539d0de9ecf688537e5404ccacdadc421d05d63f6f44b714d9c327b181
Instruction Fuzzy Hash: 4791ED37768B46C6EA808B26E8C8169B760FB8AF94F505132DE5E87764DF3DD845C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B3A13C Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 101encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B39D90: CryptStringToBinaryW.CRYPT32 ref: 00007FF674B39DD7
Part of subcall function 00007FF674B39D90: CryptStringToBinaryW.CRYPT32 ref: 00007FF674B39E1F

CertOpenStore.CRYPT32 ref: 00007FF674B3A199
CertCreateCertificateContext.CRYPT32 ref: 00007FF674B3A1BD
CertFreeCertificateContext.CRYPT32 ref: 00007FF674B3A238

Part of subcall function 00007FF674B3A460: CertGetCertificateChain.CRYPT32 ref: 00007FF674B3A4C6
Part of subcall function 00007FF674B3A460: CertVerifyCertificateChainPolicy.CRYPT32 ref: 00007FF674B3A528
Part of subcall function 00007FF674B3A460: CertVerifyCertificateChainPolicy.CRYPT32 ref: 00007FF674B3A55B
Part of subcall function 00007FF674B3A460: CertFreeCertificateChain.CRYPT32 ref: 00007FF674B3A5B5

CertAddCertificateContextToStore.CRYPT32 ref: 00007FF674B3A207
GetLastError.KERNEL32 ref: 00007FF674B3A21B
GetLastError.KERNEL32 ref: 00007FF674B3A246
CertCloseStore.CRYPT32 ref: 00007FF674B3A265

Part of subcall function 00007FF674B39FA4: CertGetIntendedKeyUsage.CRYPT32 ref: 00007FF674B39FDA
Part of subcall function 00007FF674B39FA4: CertGetEnhancedKeyUsage.CRYPT32 ref: 00007FF674B3A00F
Part of subcall function 00007FF674B39FA4: CertGetEnhancedKeyUsage.CRYPT32 ref: 00007FF674B3A041
Part of subcall function 00007FF674B39FA4: StrCmpNA.SHLWAPI ref: 00007FF674B3A07F
Part of subcall function 00007FF674B39FA4: StrCmpNW.SHLWAPI(?,?,00000000,00000000,?,00007FF674B3A1D9), ref: 00007FF674B3A0F1

GetLastError.KERNEL32 ref: 00007FF674B3A273

Strings

Trust, xrefs: 00007FF674B3A17E
status, xrefs: 00007FF674B3A143

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Cert$Certificate$Chain$ContextErrorLastStoreUsage$BinaryCryptEnhancedFreePolicyStringVerify$CloseCreateIntendedOpen
String ID: Trust$status
API String ID: 2930961322-3800218552
Opcode ID: f3c09dccc9d3103b643e8fccd427b4574e2ef2678e9715cc45a0b3d93624772a
Instruction ID: 0f4d1fd72216414c4a678d7f86880a285be9f5750780f32c59cc22d3b4d6b607
Opcode Fuzzy Hash: f3c09dccc9d3103b643e8fccd427b4574e2ef2678e9715cc45a0b3d93624772a
Instruction Fuzzy Hash: 10412123B28B42CBEB019B6698983B9A794FF4AF81F548135DA0DC7754DF2DEC058610

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B22FB0 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 93registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B266E8: GetLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF674B21A63), ref: 00007FF674B26721
Part of subcall function 00007FF674B266E8: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF674B21A63), ref: 00007FF674B26799
Part of subcall function 00007FF674B266E8: PostThreadMessageW.USER32 ref: 00007FF674B267B9

Part of subcall function 00007FF674B273A0: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,00007FF674B23015), ref: 00007FF674B273D9
Part of subcall function 00007FF674B273A0: RegQueryValueExW.ADVAPI32 ref: 00007FF674B27414
Part of subcall function 00007FF674B273A0: RegCloseKey.ADVAPI32 ref: 00007FF674B27427

StrCmpNIW.SHLWAPI ref: 00007FF674B23042
RegOpenKeyExW.ADVAPI32 ref: 00007FF674B230DD
RegDeleteValueW.ADVAPI32 ref: 00007FF674B230F9
RegCloseKey.ADVAPI32 ref: 00007FF674B2310A

Strings

In CmdUserConfig, xrefs: 00007FF674B22FDE
In HandleDeferredCommand, xrefs: 00007FF674B22FF1
DeferMigrationCommand, xrefs: 00007FF674B230F2
Command Result: 0x%1!08lx!, xrefs: 00007FF674B2309F
Executing Deferred Command: %1!lS!, xrefs: 00007FF674B23076
SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\InstallInfo, xrefs: 00007FF674B230CF

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CloseMessageOpenValue$DeleteFormatLocalPostQueryThreadTime
String ID: Command Result: 0x%1!08lx!$DeferMigrationCommand$Executing Deferred Command: %1!lS!$In CmdUserConfig$In HandleDeferredCommand$SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\InstallInfo
API String ID: 2657112078-2717220108
Opcode ID: bd7e353a74a0e7106ae6a93f7360adb18c6766d2e634bfc9e1c6e68d3aae5d4f
Instruction ID: 8393c1f33ae771bf6f9f7db9191ef8111e09e69f64c94d5ead882dafd78dc15d
Opcode Fuzzy Hash: bd7e353a74a0e7106ae6a93f7360adb18c6766d2e634bfc9e1c6e68d3aae5d4f
Instruction Fuzzy Hash: CD414F33A28A46C2EA10DB25E8C85BAB761FF8AF80F415135DA4D83795DF3DE949C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B497B0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNEL32(?,?,?,?,?,?,?,00007FF674B48D5E,?,?,?,?,?,?,00007FF674B48E0D), ref: 00007FF674B497D8
#791.IERTUTIL(?,?,?,?,?,?,?,00007FF674B48D5E,?,?,?,?,?,?,00007FF674B48E0D), ref: 00007FF674B497F9
#791.IERTUTIL(?,?,?,?,?,?,?,00007FF674B48D5E,?,?,?,?,?,?,00007FF674B48E0D), ref: 00007FF674B4980E
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,00007FF674B48D5E,?,?,?,?,?,?,00007FF674B48E0D), ref: 00007FF674B4982F
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,00007FF674B48D5E,?,?,?,?,?,?,00007FF674B48E0D), ref: 00007FF674B4983E
DuplicateHandle.KERNEL32 ref: 00007FF674B4986C
GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF674B48D5E,?,?,?,?,?,?,00007FF674B48E0D), ref: 00007FF674B49885

Strings

Local\windows_ie_global_counters, xrefs: 00007FF674B497CB, 00007FF674B498D5

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: #791CurrentProcess$DuplicateErrorFileHandleLastMappingOpen
String ID: Local\windows_ie_global_counters
API String ID: 1064913255-3887093185
Opcode ID: 362dde08f6432f6780a17795f3fddc82f3ef1a745c7a5242259ba2bb2f54605d
Instruction ID: b866ae956fb140c382f900e3d194a095479b6aaa6364e572b5e20d585a7eb6d3
Opcode Fuzzy Hash: 362dde08f6432f6780a17795f3fddc82f3ef1a745c7a5242259ba2bb2f54605d
Instruction Fuzzy Hash: 2331FD32918B41C7E7049B29A898179BBE1FB8BFD1F498175DA4E83754DF3CE845CA00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B21D68 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 62registrymemorylibraryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF674B21D92
SysAllocString.OLEAUT32 ref: 00007FF674B21DAD
LoadLibraryExW.KERNEL32 ref: 00007FF674B21DD6
#38.IERTUTIL ref: 00007FF674B21E01
SysFreeString.OLEAUT32 ref: 00007FF674B21E2A

Part of subcall function 00007FF674B21BC0: GetProcAddress.KERNEL32 ref: 00007FF674B21BE3
Part of subcall function 00007FF674B21BC0: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF674B21C2E
Part of subcall function 00007FF674B21BC0: LocalFree.KERNEL32 ref: 00007FF674B21CC5
Part of subcall function 00007FF674B21BC0: SysFreeString.OLEAUT32 ref: 00007FF674B21CD5
Part of subcall function 00007FF674B21BC0: FreeSid.ADVAPI32 ref: 00007FF674B21D0C

Strings

Userenv.dll, xrefs: 00007FF674B21DCD
Failed to set security descriptor. Result:%1!lx!, xrefs: 00007FF674B21E14
D:PAI(A;CI;KA;;;SY)(A;CI;KA;;;BA)(A;CI;KR;;;RC)(A;CI;KR;;;S-1-15-3-4096), xrefs: 00007FF674B21DA6
Failed to open registry key. Result:%1!lx!, xrefs: 00007FF674B21E3B
SOFTWARE\Microsoft\Internet Explorer\TypedURLs, xrefs: 00007FF674B21D84

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: FreeString$AddressAllocConvertLibraryLoadLocalOpenProc
String ID: D:PAI(A;CI;KA;;;SY)(A;CI;KA;;;BA)(A;CI;KR;;;RC)(A;CI;KR;;;S-1-15-3-4096)$Failed to open registry key. Result:%1!lx!$Failed to set security descriptor. Result:%1!lx!$SOFTWARE\Microsoft\Internet Explorer\TypedURLs$Userenv.dll
API String ID: 4191680482-1078209490
Opcode ID: 2479fba6ecf8c3f49dd4311a1a1a9579d21e38bb50acd51c46ef2d5251b76e5b
Instruction ID: 74ca8ba9387f54706eff00c512ca170d35481d3677a536b34d4cd2a4da28cff6
Opcode Fuzzy Hash: 2479fba6ecf8c3f49dd4311a1a1a9579d21e38bb50acd51c46ef2d5251b76e5b
Instruction Fuzzy Hash: 87213323B28A42C2EB019B15E8985B9B760FF8BF80F445535DA0DC7795EF2DE945C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B3D390 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 62COMMON

Download Yara Rule

APIs

StrCmpICW.SHLWAPI ref: 00007FF674B3D3AE
StrCmpICW.SHLWAPI ref: 00007FF674B3D3CD

Strings

about:tabs, xrefs: 00007FF674B3D3A4
msn.com, xrefs: 00007FF674B3D42E
about:newsfeed, xrefs: 00007FF674B3D3C3
msn.cn, xrefs: 00007FF674B3D443

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID:
String ID: about:newsfeed$about:tabs$msn.cn$msn.com
API String ID: 0-2860905812
Opcode ID: 409c5a39f79a9f84fd6ca4ef747c434dafc49d6eff7c75db491955da3b2f73f0
Instruction ID: c65dd662b114efabb5ff88955f8aba32e512bdf0aadde4eba2ca254310d0320a
Opcode Fuzzy Hash: 409c5a39f79a9f84fd6ca4ef747c434dafc49d6eff7c75db491955da3b2f73f0
Instruction Fuzzy Hash: AF211023A2CA42C2EB408B26E4D8379A364FF86F84F415031DA1E87655DF6DE945CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2B9B8 Relevance: 16.6, APIs: 11, Instructions: 149fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF674B2B9FD
GetLastError.KERNEL32 ref: 00007FF674B2BA16
SHCreateDirectoryExW.SHELL32 ref: 00007FF674B2BA37
CreateFileW.KERNEL32 ref: 00007FF674B2BA77
GetLastError.KERNEL32 ref: 00007FF674B2BA90
ConvertStringSidToSidW.ADVAPI32 ref: 00007FF674B2BAD3
IsValidSid.ADVAPI32 ref: 00007FF674B2BB07
#99.IERTUTIL ref: 00007FF674B2BB26
LocalFree.KERNEL32 ref: 00007FF674B2BB3F
#37.IERTUTIL ref: 00007FF674B2BB8D
CloseHandle.KERNEL32 ref: 00007FF674B2BBBA

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Create$ErrorFileLast$CloseConvertDirectoryFreeHandleLocalStringValid
String ID:
API String ID: 1059847807-0
Opcode ID: 8379c2c836cacb1e7552f376acb2577f16b3ca5837fab9557e8f4243c7a556ea
Instruction ID: 02c40ca5d1da43c5db3930eb6d59d1cde2d4bcd551ffb9ce8c2fedd8a212fd00
Opcode Fuzzy Hash: 8379c2c836cacb1e7552f376acb2577f16b3ca5837fab9557e8f4243c7a556ea
Instruction Fuzzy Hash: 3B516F33A28A42CAF7608F6595CC77D7AA0EB4BF94F448274CE0A83794CF78E9458700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B48634 Relevance: 16.6, APIs: 11, Instructions: 104fileCOMMON

Download Yara Rule

APIs

#74.IERTUTIL(?,?,?,00007FF674B48821), ref: 00007FF674B4864B

Part of subcall function 00007FF674B48468: FindFirstFileExW.KERNEL32 ref: 00007FF674B484E3
Part of subcall function 00007FF674B48468: GetLastError.KERNEL32 ref: 00007FF674B484F8
Part of subcall function 00007FF674B48468: FindClose.KERNEL32 ref: 00007FF674B485F2

#81.IERTUTIL(?,?,?,00007FF674B48821), ref: 00007FF674B48699
RemoveDirectoryW.KERNEL32(?,?,?,00007FF674B48821), ref: 00007FF674B486B7
DeleteFileW.KERNEL32(?,?,?,00007FF674B48821), ref: 00007FF674B486C5
CloseHandle.KERNEL32(?,?,?,00007FF674B48821), ref: 00007FF674B486DA
GetLastError.KERNEL32(?,?,?,00007FF674B48821), ref: 00007FF674B486EA
GetLastError.KERNEL32(?,?,?,00007FF674B48821), ref: 00007FF674B4870A
#81.IERTUTIL(?,?,?,00007FF674B48821), ref: 00007FF674B4873F
CloseHandle.KERNEL32(?,?,?,00007FF674B48821), ref: 00007FF674B4875C
SetFileAttributesW.KERNEL32(?,?,?,00007FF674B48821), ref: 00007FF674B48774
#78.IERTUTIL(?,?,?,00007FF674B48821), ref: 00007FF674B48791

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CloseErrorFileLast$FindHandle$AttributesDeleteDirectoryFirstRemove
String ID:
API String ID: 679420900-0
Opcode ID: 2333e0278e3660317a866f4f4b84cafd3e26b381e4e7be0e84ffc5c6d7d53956
Instruction ID: 39e07b2c21454a67fc6bfd039f80bd18ae62742e36f481e333e73c71187697d1
Opcode Fuzzy Hash: 2333e0278e3660317a866f4f4b84cafd3e26b381e4e7be0e84ffc5c6d7d53956
Instruction Fuzzy Hash: 53416337A29A42C7E6505B29A4D8179B7A0FF8BFD1F548230CA5E832D4DF3CEC458610

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B3966C Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 235memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B21918: GetProcessHeap.KERNEL32 ref: 00007FF674B21921
Part of subcall function 00007FF674B21918: HeapAlloc.KERNEL32 ref: 00007FF674B21938

SysAllocString.OLEAUT32 ref: 00007FF674B39712
SysFreeString.OLEAUT32 ref: 00007FF674B397E6

Strings

&clientkey=, xrefs: 00007FF674B3972B
&mac=, xrefs: 00007FF674B3975C
https://ieonline.microsoft.com/EUPP/v1/service?action=signvalue&appid=Microsoft_IE_EUPP, xrefs: 00007FF674B39681

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: AllocHeapString$FreeProcess
String ID: &clientkey=$&mac=$https://ieonline.microsoft.com/EUPP/v1/service?action=signvalue&appid=Microsoft_IE_EUPP
API String ID: 1731201402-1362008807
Opcode ID: 3816e086b299a4cc2a1300ed84fc3ebccc5f375c3635537345a1b7a59f41c14d
Instruction ID: 3b1ebe297d266c0c0c053fb153c276e8279337145b5ae16683d4f957133ea39b
Opcode Fuzzy Hash: 3816e086b299a4cc2a1300ed84fc3ebccc5f375c3635537345a1b7a59f41c14d
Instruction Fuzzy Hash: 2D916E23A28A52C7EB009F3698883B867A5FB86F88F044531DE4D97795DF3CE8418340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B3B930 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 171COMMON

Download Yara Rule

APIs

StrCmpICW.SHLWAPI(?,?,?,?,?,00007FF674B35421), ref: 00007FF674B3BA14
StrCmpICW.SHLWAPI(?,?,?,?,?,00007FF674B35421), ref: 00007FF674B3BAA0
_wtoi.MSVCRT ref: 00007FF674B3BABF
StrCmpICW.SHLWAPI(?,?,?,?,?,00007FF674B35421), ref: 00007FF674B3BB28
StrCmpICW.SHLWAPI(?,?,?,?,?,00007FF674B35421), ref: 00007FF674B3BB3D
StrCmpICW.SHLWAPI(?,?,?,?,?,00007FF674B35421), ref: 00007FF674B3BB69

Strings

false, xrefs: 00007FF674B3BB5D
true, xrefs: 00007FF674B3BB31
Missing, xrefs: 00007FF674B3BA08, 00007FF674B3BA94, 00007FF674B3BB1C

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: _wtoi
String ID: Missing$false$true
API String ID: 259676474-471191888
Opcode ID: 196ed2b58b35eceaa92fffad63318e7fbfd4ca98f1aef7307ee865983edc4b6e
Instruction ID: f86f3a7278bafd3d7e95cb9f5b692a39454b8041a76ce27402752d1c08cb8944
Opcode Fuzzy Hash: 196ed2b58b35eceaa92fffad63318e7fbfd4ca98f1aef7307ee865983edc4b6e
Instruction Fuzzy Hash: C5717533628A82D3EB20DB25D4982B97765FF45B88F555131DA4DC72A9EF3CEA06C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B293DC Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 95synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF674B293EE

Strings

wil, xrefs: 00007FF674B29532

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ObjectSingleWait
String ID: wil
API String ID: 24740636-1589926490
Opcode ID: 6bdb0238c23ff1ae886b08c3defc4ac29a78ec758ae353d6e4c157323aab8f8c
Instruction ID: e51d02dcb86ff6cec9f31917154f78dc25d6a9561ce89712fa2fb2172ec48d85
Opcode Fuzzy Hash: 6bdb0238c23ff1ae886b08c3defc4ac29a78ec758ae353d6e4c157323aab8f8c
Instruction Fuzzy Hash: AE410032B28A43C3F7608B25E4982796AA1EF87F91F649131D51EC7A94DF3CEC458701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B27D24 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 80registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,?,?,?,00007FF674B22B13), ref: 00007FF674B27D69
RegQueryValueExW.ADVAPI32(?,?,?,?,?,00007FF674B22B13), ref: 00007FF674B27D94
RegCloseKey.ADVAPI32(?,?,?,?,?,00007FF674B22B13), ref: 00007FF674B27DB2
RegOpenKeyExW.ADVAPI32(?,?,?,?,?,00007FF674B22B13), ref: 00007FF674B27DF2
RegQueryValueExW.ADVAPI32 ref: 00007FF674B27E2C
RegCloseKey.ADVAPI32 ref: 00007FF674B27E50

Strings

ShowIconsCommand, xrefs: 00007FF674B27D7D
IconsVisible, xrefs: 00007FF674B27E0F
SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\InstallInfo, xrefs: 00007FF674B27D5B, 00007FF674B27DE4

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: IconsVisible$SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\InstallInfo$ShowIconsCommand
API String ID: 3677997916-1059487045
Opcode ID: 5be104d143eb5f7c6fa198d48af2afca4c1ca6a80ce7f527c97ca91055afdb84
Instruction ID: 4de8911e0ba178a8a5f7b40cd4e75576c10397834964e251ed85505ac58f42a6
Opcode Fuzzy Hash: 5be104d143eb5f7c6fa198d48af2afca4c1ca6a80ce7f527c97ca91055afdb84
Instruction Fuzzy Hash: A3414333628B42CBE7508F24E8845B8B764FB4AB49F445A39D65D83754DF3CD954CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B23160 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B266E8: GetLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF674B21A63), ref: 00007FF674B26721
Part of subcall function 00007FF674B266E8: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF674B21A63), ref: 00007FF674B26799
Part of subcall function 00007FF674B266E8: PostThreadMessageW.USER32 ref: 00007FF674B267B9

GetTempPathW.KERNEL32 ref: 00007FF674B231A0
GetTempFileNameW.KERNEL32 ref: 00007FF674B231CE
ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF674B231F7
_wfopen_s.MSVCRT ref: 00007FF674B23238
DeleteFileW.KERNEL32 ref: 00007FF674B23271

Part of subcall function 00007FF674B26984: memset.MSVCRT ref: 00007FF674B269E4
Part of subcall function 00007FF674B26984: CreateFileW.KERNEL32 ref: 00007FF674B26A53
Part of subcall function 00007FF674B26984: GetCurrentProcess.KERNEL32 ref: 00007FF674B26A6C
Part of subcall function 00007FF674B26984: GetCurrentProcess.KERNEL32 ref: 00007FF674B26A7B
Part of subcall function 00007FF674B26984: DuplicateHandle.KERNEL32 ref: 00007FF674B26AAA
Part of subcall function 00007FF674B26984: GetStdHandle.KERNEL32 ref: 00007FF674B26AC3
Part of subcall function 00007FF674B26984: CreateProcessW.KERNEL32 ref: 00007FF674B26B21
Part of subcall function 00007FF674B26984: WaitForSingleObject.KERNEL32 ref: 00007FF674B26B3A

Strings

"%windir%\System32\dism.exe" /online /get-packages /format:table /english, xrefs: 00007FF674B231F0
In CmdAdminScavengeSystem, xrefs: 00007FF674B2317B
SCS, xrefs: 00007FF674B231BF
Total Packages Removed from the system: %1!u!, xrefs: 00007FF674B23259

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: FileProcess$CreateCurrentHandleMessageTemp$DeleteDuplicateEnvironmentExpandFormatLocalNameObjectPathPostSingleStringsThreadTimeWait_wfopen_smemset
String ID: "%windir%\System32\dism.exe" /online /get-packages /format:table /english$In CmdAdminScavengeSystem$SCS$Total Packages Removed from the system: %1!u!
API String ID: 3374882768-3963655054
Opcode ID: 34169c7784d37b292fcb58473443cfe22f8864090464c93d647c9d2556a4eff6
Instruction ID: da9e03ac44808af24c2eb9f9de5d7357a48fdb0684f7b3327146634e4584dbc1
Opcode Fuzzy Hash: 34169c7784d37b292fcb58473443cfe22f8864090464c93d647c9d2556a4eff6
Instruction Fuzzy Hash: 19312163A38A82D2FB10DB24E8C86B5A7A0FF5AF44F806035D54EC7595DF2CE949CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B3EDF0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

GetFileSizeEx.KERNEL32 ref: 00007FF674B3EE0C
GetLastError.KERNEL32 ref: 00007FF674B3EE1C
GetLastError.KERNEL32 ref: 00007FF674B3EE3A
GetLastError.KERNEL32 ref: 00007FF674B3EF95

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$FileSize
String ID:
API String ID: 3064237074-0
Opcode ID: d2194b5c11767ecf8dc2fb3d879d30169cb808aa268f63147da05f82ace5149b
Instruction ID: 5ffc5a183a1d85eff6d676e692096a83e82d5d4a4e4beddbceda9031009b3a5c
Opcode Fuzzy Hash: d2194b5c11767ecf8dc2fb3d879d30169cb808aa268f63147da05f82ace5149b
Instruction Fuzzy Hash: 0A516073A14A42CBE7608F39E4983697AE1FB8AB44F158139DB5AC3354DF3CE8048B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2BC88 Relevance: 15.1, APIs: 10, Instructions: 104COMMON

Download Yara Rule

APIs

#793.IERTUTIL ref: 00007FF674B2BCC9
GetCurrentProcess.KERNEL32 ref: 00007FF674B2BCDA
#139.IERTUTIL ref: 00007FF674B2BCE9
#820.IERTUTIL ref: 00007FF674B2BD17
SHCreateDirectoryExW.SHELL32 ref: 00007FF674B2BD39
GetFileAttributesW.KERNEL32 ref: 00007FF674B2BD6A
SetFileAttributesW.KERNEL32 ref: 00007FF674B2BD87
#820.IERTUTIL ref: 00007FF674B2BDA7
SetFileAttributesW.KERNEL32 ref: 00007FF674B2BDEA
GetLastError.KERNEL32 ref: 00007FF674B2BDFA

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: AttributesFile$#820$#139#793CreateCurrentDirectoryErrorLastProcess
String ID:
API String ID: 2696254595-0
Opcode ID: fae78069ca079565081da3dc80a885bb45554384e10e5ec58db0abe4914ac82d
Instruction ID: daa90b31f695d036039323cf05b306126084d70822dc6544b6c6c8220e4c4d49
Opcode Fuzzy Hash: fae78069ca079565081da3dc80a885bb45554384e10e5ec58db0abe4914ac82d
Instruction Fuzzy Hash: C9416F33628A82C7F7509B25A89C3B9BAA0FF8AF81F555431DA4EC3654DF3CE845C610

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B26520 Relevance: 15.1, APIs: 10, Instructions: 102filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B26440: SHGetFolderPathW.SHELL32 ref: 00007FF674B2647C
Part of subcall function 00007FF674B26440: SHCreateDirectoryExW.SHELL32 ref: 00007FF674B264BD

CreateFileW.KERNEL32 ref: 00007FF674B26592
GetLastError.KERNEL32 ref: 00007FF674B265AB
SetFilePointer.KERNEL32 ref: 00007FF674B265CA
WriteFile.KERNEL32 ref: 00007FF674B265F7
SetEvent.KERNEL32 ref: 00007FF674B26618
GetMessageW.USER32 ref: 00007FF674B2663B
CloseHandle.KERNEL32 ref: 00007FF674B26660
WriteFile.KERNEL32 ref: 00007FF674B26688
LocalFree.KERNEL32 ref: 00007FF674B26699
GetLastError.KERNEL32 ref: 00007FF674B266A7

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: File$CreateErrorLastWrite$CloseDirectoryEventFolderFreeHandleLocalMessagePathPointer
String ID:
API String ID: 2312078311-0
Opcode ID: f0adad517c9266593d0c2c92f6e6b8e58f63b40e3a9136dadebe801c95e3c54f
Instruction ID: 700bf8529a73f29d24af557d2c8e887d1c02f2b761f22b1a79980935c9a7f9f8
Opcode Fuzzy Hash: f0adad517c9266593d0c2c92f6e6b8e58f63b40e3a9136dadebe801c95e3c54f
Instruction Fuzzy Hash: 35413333A18A81C6E7108F55E4586B9BB60FB8EF94F555231DA5D83B94CF3CE945CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2A4EC Relevance: 14.4, APIs: 4, Strings: 4, Instructions: 429COMMON

Download Yara Rule

APIs

wcsncmp.MSVCRT(?,?,?,?,?,?,?,?,Software\Microsoft\Windows\CurrentVersion\Policies,?,00000104,?,?,00000104,00000106,00007FF674B2AD37), ref: 00007FF674B2A61E
iswalpha.MSVCRT ref: 00007FF674B2A63C
iswalpha.MSVCRT ref: 00007FF674B2A667
wcschr.MSVCRT ref: 00007FF674B2A74D

Strings

::$DATA, xrefs: 00007FF674B2AA57
\\?\UNC\, xrefs: 00007FF674B2A5FB
\\?\, xrefs: 00007FF674B2A60E, 00007FF674B2A6BA
Software\Microsoft\Windows\CurrentVersion\Policies, xrefs: 00007FF674B2A504

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: iswalpha$wcschrwcsncmp
String ID: ::$DATA$Software\Microsoft\Windows\CurrentVersion\Policies$\\?\$\\?\UNC\
API String ID: 3137813441-3817109965
Opcode ID: d135f5f2d6c09b0cfcbbfe3d3e237421e2657f54bfe0869330cc61c7e0719452
Instruction ID: 7b54fdb18ebb7a252239c74bb159b6d1096ca64a1ef0807493725ee091cce4e6
Opcode Fuzzy Hash: d135f5f2d6c09b0cfcbbfe3d3e237421e2657f54bfe0869330cc61c7e0719452
Instruction Fuzzy Hash: 93029023E28652C5EB20DB65D5882BD67B0BB1EFA8F444535CA1D976D4EF7CE886C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2C164 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 174memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B2BE44: SetFileAttributesW.KERNEL32 ref: 00007FF674B2BF48
Part of subcall function 00007FF674B2BE44: wcscat_s.MSVCRT ref: 00007FF674B2C013
Part of subcall function 00007FF674B2BE44: wcscat_s.MSVCRT ref: 00007FF674B2C030
Part of subcall function 00007FF674B2BE44: FindFirstFileW.KERNEL32 ref: 00007FF674B2C048

#820.IERTUTIL ref: 00007FF674B2C1FC
CoTaskMemAlloc.OLE32 ref: 00007FF674B2C270
CoTaskMemFree.OLE32 ref: 00007FF674B2C2E0
GetTempPathW.KERNEL32 ref: 00007FF674B2C330
GetFileAttributesW.KERNEL32 ref: 00007FF674B2C381
SetFileAttributesW.KERNEL32 ref: 00007FF674B2C39D
GetLastError.KERNEL32 ref: 00007FF674B2C3AD

Strings

Low, xrefs: 00007FF674B2C340

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: File$Attributes$Taskwcscat_s$#820AllocErrorFindFirstFreeLastPathTemp
String ID: Low
API String ID: 1950158008-2865053249
Opcode ID: 86e1b355c7ca45e56bc0dc40dbe8a7449fb765d06f80ca52b91b52d8b90c7994
Instruction ID: 101dbe31b6c75e72cfb63996bded768d6e64d592651395344a1c5d734c6d490f
Opcode Fuzzy Hash: 86e1b355c7ca45e56bc0dc40dbe8a7449fb765d06f80ca52b91b52d8b90c7994
Instruction Fuzzy Hash: B671B033A28782C6EB10CF61A4C82AAA7B4FB4AB58F500635DE5D87795DF3DE905C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B29200 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

CreateSemaphoreExW.KERNEL32 ref: 00007FF674B29299
GetLastError.KERNEL32 ref: 00007FF674B292B5

Part of subcall function 00007FF674B29144: CloseHandle.KERNEL32 ref: 00007FF674B29118

SetLastError.KERNEL32 ref: 00007FF674B292CD
CreateSemaphoreExW.KERNEL32 ref: 00007FF674B2933F
GetLastError.KERNEL32 ref: 00007FF674B2935C
SetLastError.KERNEL32 ref: 00007FF674B29374

Strings

_p0, xrefs: 00007FF674B29255
wil, xrefs: 00007FF674B292F8

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$CreateSemaphore$CloseHandle
String ID: _p0$wil
API String ID: 4237752484-1814513734
Opcode ID: 974dab5438ba72f666739c6ae042477e74ff44e6f058be151dd752c44fa664a9
Instruction ID: 5c2f2507ce5fe7c040a2b1f86d03536cd0686c7ef9fac7d5e3a435e4089dd8c5
Opcode Fuzzy Hash: 974dab5438ba72f666739c6ae042477e74ff44e6f058be151dd752c44fa664a9
Instruction Fuzzy Hash: EF415022728B42C6E711DF61A4D92BAB650FB4AF90F445535DE4E97795CF3CE809C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2B2F0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

WaitForSingleObjectEx.KERNEL32 ref: 00007FF674B2B347
GetLastError.KERNEL32 ref: 00007FF674B2B38D
SetLastError.KERNEL32 ref: 00007FF674B2B3A5
GetProcessHeap.KERNEL32 ref: 00007FF674B2B3D2
HeapFree.KERNEL32 ref: 00007FF674B2B3E6
GetProcessHeap.KERNEL32 ref: 00007FF674B2B42D
HeapFree.KERNEL32 ref: 00007FF674B2B441

Strings

onecore\internal\sdk\inc\wil\opensource\wil\resource.h, xrefs: 00007FF674B2B487

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Heap$ErrorFreeLastProcess$ObjectSingleWait
String ID: onecore\internal\sdk\inc\wil\opensource\wil\resource.h
API String ID: 1185803644-3341287125
Opcode ID: 798ec6a4e127bbea67d68a011c29ac65229ddd1b1d73ff4a62db56c77dfc0236
Instruction ID: 97ab53da6f25331639948cea1638859f175721561ff67264879ab96d1fc9c7b4
Opcode Fuzzy Hash: 798ec6a4e127bbea67d68a011c29ac65229ddd1b1d73ff4a62db56c77dfc0236
Instruction Fuzzy Hash: 17413F23A28A42C6EA54DF66A499179B7A0FF4BF90F084535DA9EC7791DF3CE8458300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B27778 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00000000,00000000,?,00007FF674B26002), ref: 00007FF674B277B2
IsWow64Process.KERNEL32(?,?,00000000,00000000,?,00007FF674B26002), ref: 00007FF674B277C6
ExpandEnvironmentStringsW.KERNEL32(?,?,00000000,00000000,?,00007FF674B26002), ref: 00007FF674B277F3

Part of subcall function 00007FF674B2AD88: wcsncmp.MSVCRT(?,?,?,?,00000000,00007FF674B3D7D9), ref: 00007FF674B2ADB9

GetNativeSystemInfo.KERNEL32(?,?,00000000,00000000,?,00007FF674B26002), ref: 00007FF674B2784A
SHGetSpecialFolderPathW.SHELL32(?,?,00000000,00000000,?,00007FF674B26002), ref: 00007FF674B27871

Strings

Internet Explorer\, xrefs: 00007FF674B2787A
%ProgramW6432%\Internet Explorer, xrefs: 00007FF674B277EC
IEXPLORE.EXE, xrefs: 00007FF674B2780C, 00007FF674B2788F

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Process$CurrentEnvironmentExpandFolderInfoNativePathSpecialStringsSystemWow64wcsncmp
String ID: %ProgramW6432%\Internet Explorer$IEXPLORE.EXE$Internet Explorer\
API String ID: 2223505443-224271814
Opcode ID: 56112e856824c7fbd9ce2f4ab7963766a276cc6e845af2545ff842cc57269990
Instruction ID: 17bb4fb505630645278d62fff6d3b4193b4f6166dcca14bcb272435e7ac0b151
Opcode Fuzzy Hash: 56112e856824c7fbd9ce2f4ab7963766a276cc6e845af2545ff842cc57269990
Instruction Fuzzy Hash: 31418333A28742D7FB10DB56E4885ADA7A1FB8AB80F844135D94D83A94DF3CE94AC704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B496D4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B49618: CheckTokenMembership.ADVAPI32 ref: 00007FF674B4964D
Part of subcall function 00007FF674B49618: LocalFree.KERNEL32 ref: 00007FF674B49688

CreateFileMappingW.KERNEL32 ref: 00007FF674B49721
LocalFree.KERNEL32 ref: 00007FF674B49735
#791.IERTUTIL ref: 00007FF674B4974B
#791.IERTUTIL ref: 00007FF674B49760
#134.IERTUTIL ref: 00007FF674B4977E
CloseHandle.KERNEL32 ref: 00007FF674B49791

Strings

l, xrefs: 00007FF674B49715
Local\windows_ie_global_counters, xrefs: 00007FF674B496FD

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: #791FreeLocal$#134CheckCloseCreateFileHandleMappingMembershipToken
String ID: Local\windows_ie_global_counters$l
API String ID: 3701204471-1037400814
Opcode ID: 6a07bc5000afcae5f0536fd83b16e131618e6017704f7a5ac26c34b2e31e9fb7
Instruction ID: 9562d0ed799dcff4235529864e07223bfbeab7662ed65f600393dce1a2add059
Opcode Fuzzy Hash: 6a07bc5000afcae5f0536fd83b16e131618e6017704f7a5ac26c34b2e31e9fb7
Instruction Fuzzy Hash: 90113032725642C7EB105F65A4886B8BBA1FB8BFA5F449234DA5E87390CF3CE8458710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2955C Relevance: 13.7, APIs: 9, Instructions: 199memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF674B2963D
HeapAlloc.KERNEL32 ref: 00007FF674B29654
GetProcessHeap.KERNEL32 ref: 00007FF674B2966F
GetProcessHeap.KERNEL32 ref: 00007FF674B29696
HeapFree.KERNEL32 ref: 00007FF674B296AB
memcpy_s.MSVCRT ref: 00007FF674B29704
memcpy_s.MSVCRT ref: 00007FF674B2975B
memcpy_s.MSVCRT ref: 00007FF674B297B8
memset.MSVCRT ref: 00007FF674B297E4

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Heap$Processmemcpy_s$AllocFreememset
String ID:
API String ID: 3570669803-0
Opcode ID: 45926e0f18bdd19c35f1f494f03541535911647802c18b8760a590afe30b7e56
Instruction ID: 8df2636047e4de2bc624d54e322e47777e707d350a45c99f50807ed76fcc0c6d
Opcode Fuzzy Hash: 45926e0f18bdd19c35f1f494f03541535911647802c18b8760a590afe30b7e56
Instruction Fuzzy Hash: 2F818073B19746C6EA55CF21A5885B8BBA4FB17FC4B599131CA4E87760DF38E892C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B35870 Relevance: 13.7, APIs: 9, Instructions: 168synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF674B358A1
GetLastError.KERNEL32 ref: 00007FF674B358B4
GetLastError.KERNEL32 ref: 00007FF674B358CA
GetLastError.KERNEL32 ref: 00007FF674B358E0
#76.IERTUTIL ref: 00007FF674B35944
#654.IERTUTIL ref: 00007FF674B359AE
#654.IERTUTIL ref: 00007FF674B35A62
#675.IERTUTIL ref: 00007FF674B35A86
ReleaseMutex.KERNEL32 ref: 00007FF674B35AA8

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$#654$#675MutexObjectReleaseSingleWait
String ID:
API String ID: 2927321091-0
Opcode ID: 0c56a65c3552b1288960f9c7fbaa0c1be0852d569064d0fafba70605d432244c
Instruction ID: f63c087a3f591f78e3bc7d9ce52cacdb62cf93557fafeb9deae5fc1b9e6f7019
Opcode Fuzzy Hash: 0c56a65c3552b1288960f9c7fbaa0c1be0852d569064d0fafba70605d432244c
Instruction Fuzzy Hash: 01714937A29642C7E7108F36D8C837A6BA4FB96F99F064135CA4D83295DF3DE8458710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B303C4 Relevance: 13.6, APIs: 9, Instructions: 148COMMON

Download Yara Rule

APIs

StrCmpICW.SHLWAPI ref: 00007FF674B303EB
StrCmpICW.SHLWAPI ref: 00007FF674B30402
StrCmpICW.SHLWAPI ref: 00007FF674B30419
StrCmpICW.SHLWAPI ref: 00007FF674B30430
StrCmpICW.SHLWAPI ref: 00007FF674B30447
StrCmpICW.SHLWAPI ref: 00007FF674B3045A
StrCmpICW.SHLWAPI ref: 00007FF674B3046D
StrCmpICW.SHLWAPI ref: 00007FF674B30480
SysFreeString.OLEAUT32 ref: 00007FF674B30554

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 41cf15fabd146d7465c0d33d0292cb9adaf94f146215165010667bcd354e2547
Instruction ID: e58ac89d87b440881357cebf3f65ce03aeda5c158bc56d0892e789b0d52f883c
Opcode Fuzzy Hash: 41cf15fabd146d7465c0d33d0292cb9adaf94f146215165010667bcd354e2547
Instruction Fuzzy Hash: 4561B467A28A06C6EB80DB2AD5D83786760EF86FC8F155131DE0E877A9DF2CD945C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2B698 Relevance: 13.6, APIs: 9, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

#57.IERTUTIL(00007FF674B2BC4A), ref: 00007FF674B2B6C0
GetLengthSid.ADVAPI32 ref: 00007FF674B2B6D9
LocalAlloc.KERNELBASE ref: 00007FF674B2B709
memset.MSVCRT ref: 00007FF674B2B729
memcpy_s.MSVCRT ref: 00007FF674B2B73C
AddAccessAllowedAceEx.ADVAPI32 ref: 00007FF674B2B766
GetLastError.KERNEL32 ref: 00007FF674B2B77D
LocalFree.KERNEL32 ref: 00007FF674B2B79A
LocalFree.KERNEL32 ref: 00007FF674B2B7B9

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Local$Free$AccessAllocAllowedErrorLastLengthmemcpy_smemset
String ID:
API String ID: 916274048-0
Opcode ID: 7962a7456dcbdc222df6675433a6f9a4ef09bbceb7c55295d27dd7293cc987f1
Instruction ID: 6596c3edbdcc902a636b8644895a5189a43e94b6604afaaae3b57e527827308f
Opcode Fuzzy Hash: 7962a7456dcbdc222df6675433a6f9a4ef09bbceb7c55295d27dd7293cc987f1
Instruction Fuzzy Hash: 16316D37628B92C6D7009F16A988179BBA1FB8EFD1B558134DE4E87760DF3CE8458740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B306D4 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 183COMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32 ref: 00007FF674B307BA
SysFreeString.OLEAUT32 ref: 00007FF674B3080A
SysFreeString.OLEAUT32 ref: 00007FF674B30831
SysFreeString.OLEAUT32 ref: 00007FF674B3085E
SysStringLen.OLEAUT32 ref: 00007FF674B3088A
SysFreeString.OLEAUT32 ref: 00007FF674B30972

Strings

/%s/, xrefs: 00007FF674B307E9

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: String$Free
String ID: /%s/
API String ID: 1391021980-1213264659
Opcode ID: 0fa5be6dcfd814801c1ac8aae1cc2ad027252285884e19df7b15d70a70b34a36
Instruction ID: 7bf658075ea1351e48e9dffc08ab51bb327c2d0355ce7fdd8281a2544c924d3e
Opcode Fuzzy Hash: 0fa5be6dcfd814801c1ac8aae1cc2ad027252285884e19df7b15d70a70b34a36
Instruction Fuzzy Hash: EF813323A28A86C7EB508B2AD4C82796760FF86F84F505131EA4D97769DF3DED45C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B3E69C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 121COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF674B3E6DB
LCMapStringW.KERNEL32 ref: 00007FF674B3E71C
GetLastError.KERNEL32 ref: 00007FF674B3E7E0
GetLastError.KERNEL32 ref: 00007FF674B3E7FA
GetLastError.KERNEL32 ref: 00007FF674B3E80F

Strings

%X_, xrefs: 00007FF674B3E7A0
\, xrefs: 00007FF674B3E786

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$FullNamePathString
String ID: %X_$\
API String ID: 1618852869-896525776
Opcode ID: c817e3bbf5ebc8898db713c0ceba47c3f2fecd17d122c1faecd8bd99f94e5c52
Instruction ID: b3305b770128ec437f629758481141bfba2fe100b917a6000db0ddb646d8f993
Opcode Fuzzy Hash: c817e3bbf5ebc8898db713c0ceba47c3f2fecd17d122c1faecd8bd99f94e5c52
Instruction Fuzzy Hash: F9419323B28682C7EB104B65E4983BA6690FF96F84F444136DA4ED3794DF3CE845C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B39FA4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 115encryptionCOMMON

Download Yara Rule

APIs

CertGetIntendedKeyUsage.CRYPT32 ref: 00007FF674B39FDA
CertGetEnhancedKeyUsage.CRYPT32 ref: 00007FF674B3A00F

Part of subcall function 00007FF674B21918: GetProcessHeap.KERNEL32 ref: 00007FF674B21921
Part of subcall function 00007FF674B21918: HeapAlloc.KERNEL32 ref: 00007FF674B21938

CertGetEnhancedKeyUsage.CRYPT32 ref: 00007FF674B3A041
StrCmpNA.SHLWAPI ref: 00007FF674B3A07F
StrCmpNW.SHLWAPI(?,?,00000000,00000000,?,00007FF674B3A1D9), ref: 00007FF674B3A0F1

Strings

IE Enhanced User Preference Protection, xrefs: 00007FF674B3A0E7
1.3.6.1.4.1.311.13.1, xrefs: 00007FF674B3A078

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CertUsage$EnhancedHeap$AllocIntendedProcess
String ID: 1.3.6.1.4.1.311.13.1$IE Enhanced User Preference Protection
API String ID: 2896830453-1085473373
Opcode ID: 27802ad501e3ffc3026af28544888c3dfc19fd62ba4f648d902956be8982135e
Instruction ID: 6d61281a73cf1e644df0d7652de13b6879a2464e246a2947aba2ebf1809eb9b5
Opcode Fuzzy Hash: 27802ad501e3ffc3026af28544888c3dfc19fd62ba4f648d902956be8982135e
Instruction Fuzzy Hash: ED416C23A28B42C3E6009B36A8C8279B794EB8AF90F549534DA5D837A4DF3CEC55C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B48B90 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 75registryCOMMON

Download Yara Rule

APIs

SLGetWindowsInformationDWORD.SLC ref: 00007FF674B48BB9
#701.IERTUTIL ref: 00007FF674B48BF4
#701.IERTUTIL ref: 00007FF674B48C4E
RegSetKeyValueW.ADVAPI32 ref: 00007FF674B48CBB

Strings

DisableFirstRunCustomize, xrefs: 00007FF674B48C9C
Microsoft-Windows-IE-InternetExplorer-IEAppDeprecation, xrefs: 00007FF674B48BB2
Software\Microsoft\Internet Explorer\Main, xrefs: 00007FF674B48CA8

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: #701$InformationValueWindows
String ID: DisableFirstRunCustomize$Microsoft-Windows-IE-InternetExplorer-IEAppDeprecation$Software\Microsoft\Internet Explorer\Main
API String ID: 1300295446-3127308057
Opcode ID: 532cdf3c4ce8ecdf123ca2bbeb1a215f4c3757aa633642d46c4d2360cd878880
Instruction ID: b0ee251acd08fd3295bd896046da6b2e5cc4c55896e88839f5f07b22b20ac914
Opcode Fuzzy Hash: 532cdf3c4ce8ecdf123ca2bbeb1a215f4c3757aa633642d46c4d2360cd878880
Instruction Fuzzy Hash: 69311277A2A603C6FB049B28E8D837AA691AF46B94F444134E54DC22A5DF7DE889C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B23EDC Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32 ref: 00007FF674B23F32
RegOpenKeyExW.ADVAPI32 ref: 00007FF674B23F50
StrCmpIW.SHLWAPI ref: 00007FF674B23FC2
RegSetValueW.ADVAPI32 ref: 00007FF674B23FEB
RegCloseKey.ADVAPI32 ref: 00007FF674B23FFC

Strings

Software\Clients\StartMenuInternet, xrefs: 00007FF674B23EFA
IEXPLORE.EXE, xrefs: 00007FF674B23F9F, 00007FF674B23FBB

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CloseCreateOpenValue
String ID: IEXPLORE.EXE$Software\Clients\StartMenuInternet
API String ID: 776291540-1175255948
Opcode ID: 435efc2ff8bef9bd25fb89d3b70caebd33e8010c89ec6103a6f11550acd99859
Instruction ID: 5ea62c0b7c58354c84506dfa5f58aff742668739cc64f5b0bf88ff75b75922a8
Opcode Fuzzy Hash: 435efc2ff8bef9bd25fb89d3b70caebd33e8010c89ec6103a6f11550acd99859
Instruction Fuzzy Hash: 0E31FC33928B86C7E760CB60F48876AF7A4FB9AB95F405135DA4D82A54DF7CD948CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B3C9B8 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00007FF674B3C9ED

Part of subcall function 00007FF674B216BC: SysStringLen.OLEAUT32 ref: 00007FF674B21707

SysStringLen.OLEAUT32 ref: 00007FF674B3CA1F

Part of subcall function 00007FF674B216BC: SysAllocStringLen.OLEAUT32 ref: 00007FF674B2172D
Part of subcall function 00007FF674B216BC: SysStringLen.OLEAUT32 ref: 00007FF674B21744
Part of subcall function 00007FF674B216BC: memcpy_s.MSVCRT ref: 00007FF674B21766
Part of subcall function 00007FF674B216BC: memcpy_s.MSVCRT ref: 00007FF674B217A6
Part of subcall function 00007FF674B216BC: SysFreeString.OLEAUT32 ref: 00007FF674B217D5

SysFreeString.OLEAUT32 ref: 00007FF674B3CA51
SysFreeString.OLEAUT32 ref: 00007FF674B3CA6A

Strings

bing.com, xrefs: 00007FF674B3CF3C
&pc=, xrefs: 00007FF674B3CF6A
&pc=%s, xrefs: 00007FF674B3CFA0

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: String$Free$Allocmemcpy_s
String ID: &pc=$&pc=%s$bing.com
API String ID: 3413315342-245000116
Opcode ID: 0a7451fd29d4b065e9a55a3cc0956230aeb508da04ff9b6b6a4124023c214d98
Instruction ID: ab3a2a398006adbd0c38f8551eb29a19af7147b9e9435df6937535b46d972081
Opcode Fuzzy Hash: 0a7451fd29d4b065e9a55a3cc0956230aeb508da04ff9b6b6a4124023c214d98
Instruction Fuzzy Hash: ED21E933A18B42C3D601DB56E488069ABB0FB8AF90B599131DE4D87759EF39E951C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B49510 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 64registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,00000000,00007FF674B496F5), ref: 00007FF674B4954E
RegQueryValueExW.ADVAPI32 ref: 00007FF674B4958F
RegQueryValueExW.ADVAPI32 ref: 00007FF674B495CE
RegCloseKey.ADVAPI32 ref: 00007FF674B495EC

Strings

OOBEInProgress, xrefs: 00007FF674B495B1
SystemSetupInProgress, xrefs: 00007FF674B4956F
SYSTEM\Setup, xrefs: 00007FF674B4953D

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: OOBEInProgress$SYSTEM\Setup$SystemSetupInProgress
API String ID: 1586453840-252206877
Opcode ID: 9c58a30d26de4208d1da9d762cf33a83a44f58d37aaa6920f580d32a3a9bad46
Instruction ID: 3d73a8f30fe2c4cdf7fbf05a6aac20667ffd90ed9dc5ac28ec304aa467173cce
Opcode Fuzzy Hash: 9c58a30d26de4208d1da9d762cf33a83a44f58d37aaa6920f580d32a3a9bad46
Instruction Fuzzy Hash: FD215237614B42CAEB608F34E8845A9BBA4FB4AB9CF455235EA4D83B54DF38D445CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B36594 Relevance: 12.2, APIs: 8, Instructions: 205memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B3D4D0: LocalAlloc.KERNELBASE ref: 00007FF674B3D4F5
Part of subcall function 00007FF674B3D4D0: LocalFree.KERNEL32(?,?,00000000,00007FF674B35774,?,?,00000000,00007FF674B2F250,?,?,00000000,00007FF674B2F16B), ref: 00007FF674B3D516

#682.IERTUTIL(?,?,?,?,00000000,00000001,?,00007FF674B357A1,?,?,00000000,00007FF674B2F250,?,?,00000000,00007FF674B2F16B), ref: 00007FF674B36627
#665.IERTUTIL(?,?,?,?,00000000,00000001,?,00007FF674B357A1,?,?,00000000,00007FF674B2F250,?,?,00000000,00007FF674B2F16B), ref: 00007FF674B36696
#665.IERTUTIL(?,?,?,?,00000000,00000001,?,00007FF674B357A1,?,?,00000000,00007FF674B2F250,?,?,00000000,00007FF674B2F16B), ref: 00007FF674B366B5
#651.IERTUTIL ref: 00007FF674B3673E
GetProcessHeap.KERNEL32(?,?,?,?,00000000,00000001,?,00007FF674B357A1,?,?,00000000,00007FF674B2F250,?,?,00000000,00007FF674B2F16B), ref: 00007FF674B36816
HeapFree.KERNEL32(?,?,?,?,00000000,00000001,?,00007FF674B357A1,?,?,00000000,00007FF674B2F250,?,?,00000000,00007FF674B2F16B), ref: 00007FF674B3682A
GetProcessHeap.KERNEL32(?,?,?,?,00000000,00000001,?,00007FF674B357A1,?,?,00000000,00007FF674B2F250,?,?,00000000,00007FF674B2F16B), ref: 00007FF674B36848
HeapFree.KERNEL32(?,?,?,?,00000000,00000001,?,00007FF674B357A1,?,?,00000000,00007FF674B2F250,?,?,00000000,00007FF674B2F16B), ref: 00007FF674B3685C

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Heap$Free$#665LocalProcess$#651#682Alloc
String ID:
API String ID: 2616862846-0
Opcode ID: 1f94fd93e0105e52b721851efbb18a617eab9b1fe0398d126bc1d56a9c079642
Instruction ID: 71e02425066febc2b2ef2d09013ca640154830fd0513fc9f69b15274a7de7de1
Opcode Fuzzy Hash: 1f94fd93e0105e52b721851efbb18a617eab9b1fe0398d126bc1d56a9c079642
Instruction Fuzzy Hash: 54814232A18652C7E7148F66A58827AE7A5FB8AFD4F454035EE4D83B58DF7CE8418B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2B7F8 Relevance: 12.1, APIs: 8, Instructions: 99COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF674B2B845
OpenProcessToken.ADVAPI32 ref: 00007FF674B2B85E
GetNamedSecurityInfoW.ADVAPI32 ref: 00007FF674B2B8AE
LocalFree.KERNEL32 ref: 00007FF674B2B941

Part of subcall function 00007FF674B2B698: #57.IERTUTIL(00007FF674B2BC4A), ref: 00007FF674B2B6C0
Part of subcall function 00007FF674B2B698: GetLengthSid.ADVAPI32 ref: 00007FF674B2B6D9
Part of subcall function 00007FF674B2B698: LocalAlloc.KERNELBASE ref: 00007FF674B2B709
Part of subcall function 00007FF674B2B698: memset.MSVCRT ref: 00007FF674B2B729
Part of subcall function 00007FF674B2B698: memcpy_s.MSVCRT ref: 00007FF674B2B73C
Part of subcall function 00007FF674B2B698: AddAccessAllowedAceEx.ADVAPI32 ref: 00007FF674B2B766
Part of subcall function 00007FF674B2B698: LocalFree.KERNEL32 ref: 00007FF674B2B79A
Part of subcall function 00007FF674B2B698: LocalFree.KERNEL32 ref: 00007FF674B2B7B9

SetNamedSecurityInfoW.ADVAPI32 ref: 00007FF674B2B908
LocalFree.KERNEL32 ref: 00007FF674B2B929
CloseHandle.KERNEL32 ref: 00007FF674B2B962
GetLastError.KERNEL32 ref: 00007FF674B2B970

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Local$Free$InfoNamedProcessSecurity$AccessAllocAllowedCloseCurrentErrorHandleLastLengthOpenTokenmemcpy_smemset
String ID:
API String ID: 347426353-0
Opcode ID: a769e73b1f198c410ddc8979925be2b96bb23d339d11469fc9f76f961d368ea9
Instruction ID: 769cec7a909915f23531497557d266a4ffecd911349a749a9025d77aa663331e
Opcode Fuzzy Hash: a769e73b1f198c410ddc8979925be2b96bb23d339d11469fc9f76f961d368ea9
Instruction Fuzzy Hash: C7410A33628B82C6E750CF55E4883B9A7A4FB8AB94F804135DA8D87A55DF7CE845CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B42968 Relevance: 12.1, APIs: 8, Instructions: 85encryptionCOMMON

Download Yara Rule

APIs

CertGetCertificateContextProperty.CRYPT32 ref: 00007FF674B42998
CertGetCertificateContextProperty.CRYPT32 ref: 00007FF674B429C7
GetLastError.KERNEL32 ref: 00007FF674B429DF
GetLastError.KERNEL32 ref: 00007FF674B429F9
GetLastError.KERNEL32 ref: 00007FF674B42A39
GetLastError.KERNEL32 ref: 00007FF674B42A53

Part of subcall function 00007FF674B21918: GetProcessHeap.KERNEL32 ref: 00007FF674B21921
Part of subcall function 00007FF674B21918: HeapAlloc.KERNEL32 ref: 00007FF674B21938

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$CertCertificateContextHeapProperty$AllocProcess
String ID:
API String ID: 3057230840-0
Opcode ID: 0c5d1fda1ef6bfb705892f337418ff3f6a49e2f81b20b62324457c2966637a02
Instruction ID: 131fa68ad31f01217e28cf13a364555ac222c9b363b9bc6a9675c5b3bf995e59
Opcode Fuzzy Hash: 0c5d1fda1ef6bfb705892f337418ff3f6a49e2f81b20b62324457c2966637a02
Instruction Fuzzy Hash: 04311023714B82CAE7145F6A9898279BAA4FF8AFC5B489134DE4AC3354DF7CEC059610

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2561C Relevance: 10.7, APIs: 7, Instructions: 153registryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00007FF674B25686
RegEnumKeyExW.ADVAPI32 ref: 00007FF674B2570D
RegOpenKeyExW.ADVAPI32 ref: 00007FF674B25739

Part of subcall function 00007FF674B2561C: RegCloseKey.ADVAPI32 ref: 00007FF674B2575C

RegEnumValueW.ADVAPI32 ref: 00007FF674B257E3
_wcsnicmp.MSVCRT ref: 00007FF674B25804
RegDeleteValueW.ADVAPI32 ref: 00007FF674B2581A

Part of subcall function 00007FF674B21918: GetProcessHeap.KERNEL32 ref: 00007FF674B21921
Part of subcall function 00007FF674B21918: HeapAlloc.KERNEL32 ref: 00007FF674B21938

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: EnumHeapValue$AllocCloseDeleteInfoOpenProcessQuery_wcsnicmp
String ID:
API String ID: 1988773347-0
Opcode ID: c80c2d447968bac7e0f757add1cfb8683f00219ccc02fde240ff9d97f38e097d
Instruction ID: abb3a3a6a9edf866c77f67fd64f54895aba0a6b2b9f296167f6c540c2db3e30f
Opcode Fuzzy Hash: c80c2d447968bac7e0f757add1cfb8683f00219ccc02fde240ff9d97f38e097d
Instruction Fuzzy Hash: D5517B33B28B41CAE710CF61A8885BC77A8FB4AB94B514638DE6D97B94DF38D941C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B3B6F4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

#662.IERTUTIL ref: 00007FF674B3B788
#665.IERTUTIL ref: 00007FF674B3B7B7
#655.IERTUTIL ref: 00007FF674B3B7FA
#657.IERTUTIL ref: 00007FF674B3B87A

Part of subcall function 00007FF674B3B544: #655.IERTUTIL ref: 00007FF674B3B5CD

#657.IERTUTIL ref: 00007FF674B3B8EB

Strings

W, xrefs: 00007FF674B3B72C

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: #655#657$#662#665
String ID: W
API String ID: 3353587207-655174618
Opcode ID: 759166db18ef9005b19cb714e448f63e57b424fcc4ed654e23d080dcac4e5661
Instruction ID: 16a8a7547b342c560c0e25bda7094dd5396cd55240820a267e7f8e27bb1ca290
Opcode Fuzzy Hash: 759166db18ef9005b19cb714e448f63e57b424fcc4ed654e23d080dcac4e5661
Instruction Fuzzy Hash: C8513D23A2C682C7E7208F66E4887B9B760FB8AB94F504035DA4D83699DF7DE945C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B45D60 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 110memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF674B45E59
GetProcAddress.KERNEL32 ref: 00007FF674B45E76
GetProcessHeap.KERNEL32 ref: 00007FF674B45ED9
HeapFree.KERNEL32 ref: 00007FF674B45EEF

Strings

RtlNotifyFeatureUsage, xrefs: 00007FF674B45E6C
ntdll.dll, xrefs: 00007FF674B45E52

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Heap$AddressFreeHandleModuleProcProcess
String ID: RtlNotifyFeatureUsage$ntdll.dll
API String ID: 3729415315-2443152447
Opcode ID: 96b39f8874dcf63b06524510102518e02031d1d5a76a6b6f7ba653090f454df2
Instruction ID: 9567114eaf58431b56ebb72e658032a829de45317f861679b30ab2790508c4ac
Opcode Fuzzy Hash: 96b39f8874dcf63b06524510102518e02031d1d5a76a6b6f7ba653090f454df2
Instruction Fuzzy Hash: D7416423A39F42C2FA609B19E8D87B9A690AF56FC4F854135DE0DC7691DF2CEC84C611

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2826C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 00007FF674B282C4
wcschr.MSVCRT ref: 00007FF674B282E1

Strings

\\?\, xrefs: 00007FF674B2835F
Software\Microsoft\Windows\CurrentVersion\Policies, xrefs: 00007FF674B2827E

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: wcschr
String ID: Software\Microsoft\Windows\CurrentVersion\Policies$\\?\
API String ID: 1497570035-1297041245
Opcode ID: b42dcdf16d11872bbd43d63cb3988fd6a8d1910d59d534f940cd18d7537ea9d0
Instruction ID: cfac1af43d1e984fe4fc3016e037c60f5922bddbc8545951b65933e46b453054
Opcode Fuzzy Hash: b42dcdf16d11872bbd43d63cb3988fd6a8d1910d59d534f940cd18d7537ea9d0
Instruction Fuzzy Hash: 02412C23A28641C6EA15DF1598881BAB7A0FB46FA4B499731DA2DC73D4EF7CEC45C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B49B28 Relevance: 10.6, APIs: 7, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,00000000,00007FF674B49A6F,?,?,?,?,?,?,?,?,00000000,00007FF674B496F5), ref: 00007FF674B49B4C
HeapAlloc.KERNEL32(?,?,?,?,00000000,00007FF674B49A6F,?,?,?,?,?,?,?,?,00000000,00007FF674B496F5), ref: 00007FF674B49B6C
GetTokenInformation.ADVAPI32(?,?,?,?,00000000,00007FF674B49A6F,?,?,?,?,?,?,?,?,00000000,00007FF674B496F5), ref: 00007FF674B49B97
GetLastError.KERNEL32(?,?,?,?,00000000,00007FF674B49A6F,?,?,?,?,?,?,?,?,00000000,00007FF674B496F5), ref: 00007FF674B49BAF
GetLastError.KERNEL32(?,?,?,?,00000000,00007FF674B49A6F,?,?,?,?,?,?,?,?,00000000,00007FF674B496F5), ref: 00007FF674B49BC9
HeapFree.KERNEL32(?,?,?,?,00000000,00007FF674B49A6F,?,?,?,?,?,?,?,?,00000000,00007FF674B496F5), ref: 00007FF674B49C00

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$Heap$AllocFreeInformationToken
String ID:
API String ID: 1666231400-0
Opcode ID: 7d48a1188cbbd30f450ea4df74bbc18aa4b8eb2196aedb313955f411440782e6
Instruction ID: 09b97a7ae5c01d1cb120f1523e8f71f42ebf8e237c1695e8a473633fea41a5a1
Opcode Fuzzy Hash: 7d48a1188cbbd30f450ea4df74bbc18aa4b8eb2196aedb313955f411440782e6
Instruction Fuzzy Hash: CB314132A18B52CAE7108F3AA888679BAD0BB4BFD1F448534DE4EC7755DE3CE8058740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B454AC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 80libraryloaderCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 00007FF674B454E4
GetModuleHandleW.KERNEL32 ref: 00007FF674B4551D
GetProcAddress.KERNEL32 ref: 00007FF674B4553A
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF674B455BF

Strings

ntdll.dll, xrefs: 00007FF674B45516
RtlRegisterFeatureConfigurationChangeNotification, xrefs: 00007FF674B45530

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ExclusiveLock$AcquireAddressHandleModuleProcRelease
String ID: RtlRegisterFeatureConfigurationChangeNotification$ntdll.dll
API String ID: 303310891-4023217342
Opcode ID: 4904b21f2ad604199fa21768c5bc73090c2a3bd9920e4de4b433bec205bcb950
Instruction ID: 284288718aa9a40fe6dd462f227af7540113f964be3ca4aa7b37a60dc1dfadea
Opcode Fuzzy Hash: 4904b21f2ad604199fa21768c5bc73090c2a3bd9920e4de4b433bec205bcb950
Instruction Fuzzy Hash: BE311626A29F42C1EA408F59E8D8379A7A1BB5AFD4F454031DE4D87754EF3CE985C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B459F8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 75libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B42B4C: GetModuleHandleW.KERNEL32 ref: 00007FF674B42B7B
Part of subcall function 00007FF674B42B4C: GetProcAddress.KERNEL32 ref: 00007FF674B42B98

GetLastError.KERNEL32 ref: 00007FF674B45A55

Part of subcall function 00007FF674B43C48: GetModuleHandleW.KERNEL32 ref: 00007FF674B43C70
Part of subcall function 00007FF674B43C48: GetProcAddress.KERNEL32 ref: 00007FF674B43C8D

SetLastError.KERNEL32 ref: 00007FF674B45A6D
GetModuleHandleW.KERNEL32 ref: 00007FF674B45AA5
GetProcAddress.KERNEL32 ref: 00007FF674B45AC2

Strings

RtlSubscribeWnfStateChangeNotification, xrefs: 00007FF674B45AB8
ntdll.dll, xrefs: 00007FF674B45A9E

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: AddressHandleModuleProc$ErrorLast
String ID: RtlSubscribeWnfStateChangeNotification$ntdll.dll
API String ID: 798792539-2214456325
Opcode ID: d47f8e060707303971e46c4fac0b74203bf9d46e649ea22f1daa8a814d434ab5
Instruction ID: 4debdeb78f2bd7a486ac1c84061ea7032b4ef9438abd59762e872a0c9238c2d8
Opcode Fuzzy Hash: d47f8e060707303971e46c4fac0b74203bf9d46e649ea22f1daa8a814d434ab5
Instruction Fuzzy Hash: CE312333A29B42C6EB418B54E4D83B9B3A4BB4AF95F464135DA4D87790DF3CE889C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B48958 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B2AB18: LocalFree.KERNEL32 ref: 00007FF674B2AD46

SetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF674B48394,?,00000000,?,00007FF674B4859F), ref: 00007FF674B489A3
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF674B48394,?,00000000,?,00007FF674B4859F), ref: 00007FF674B489B3
CreateFile2.KERNEL32 ref: 00007FF674B48A17
SetFileAttributesW.KERNEL32 ref: 00007FF674B48A37
GetLastError.KERNEL32 ref: 00007FF674B48A43

Strings

, xrefs: 00007FF674B489E5

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: AttributesErrorFileLast$CreateFile2FreeLocal
String ID:
API String ID: 2781035858-3916222277
Opcode ID: f3a717655c47b2bcf0a206714054644786fed6e40f58c9a3de2352a801b34eae
Instruction ID: f7c7c7357b3a81939e4ceb42798cc81fcdc1661c4b9f1df5bf6931592dbd0a77
Opcode Fuzzy Hash: f3a717655c47b2bcf0a206714054644786fed6e40f58c9a3de2352a801b34eae
Instruction Fuzzy Hash: 70316132A14B82C7E3008B15E58466ABBA0FB46FA5F509330DB5983694DF7CE8568B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B24028 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 66registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32 ref: 00007FF674B2407A
RegCloseKey.ADVAPI32 ref: 00007FF674B2408B
RegCreateKeyExW.ADVAPI32 ref: 00007FF674B240D5
RegSetValueExW.ADVAPI32 ref: 00007FF674B24108
RegCloseKey.ADVAPI32 ref: 00007FF674B2411B

Strings

Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}, xrefs: 00007FF674B240B0

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CloseValue$CreateQuery
String ID: Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}
API String ID: 1259008579-2693928049
Opcode ID: c9f8b029a8b0d5ae3bc7802d96a0725188ca4125c49e01aa0ccec99e63157c2a
Instruction ID: bbe62c55a21a44eee64c0b618e22f8ec3e292cefa09f9fd2ba457734bf1991a3
Opcode Fuzzy Hash: c9f8b029a8b0d5ae3bc7802d96a0725188ca4125c49e01aa0ccec99e63157c2a
Instruction Fuzzy Hash: 68312C37618B81C7DB608F55F49466ABBA4FB89B94F455231EA8D83B18DF7CD444CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B48844 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

#654.IERTUTIL ref: 00007FF674B48882
ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF674B488AF
#654.IERTUTIL ref: 00007FF674B48929

Part of subcall function 00007FF674B21574: _vsnwprintf.MSVCRT ref: 00007FF674B215B4

Part of subcall function 00007FF674B279FC: #654.IERTUTIL(?,?,?,?,?,?,00007FF674B3D85D), ref: 00007FF674B27A25

Strings

%windir%, xrefs: 00007FF674B488A3
-CleanupEmeDataStores, xrefs: 00007FF674B488BF
%s\system32\ie4uinit.exe %s, xrefs: 00007FF674B488D5

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: #654$EnvironmentExpandStrings_vsnwprintf
String ID: %s\system32\ie4uinit.exe %s$%windir%$-CleanupEmeDataStores
API String ID: 3028992113-2826242292
Opcode ID: 882a687b2d0f1e8face0d908b8d86f86e78cf34d3bc256f0e62fded5e30fded2
Instruction ID: c5c4f72f25b822e7a32df1aa70957d27cf0d0dd0282b25ce6fc2275bef5d3241
Opcode Fuzzy Hash: 882a687b2d0f1e8face0d908b8d86f86e78cf34d3bc256f0e62fded5e30fded2
Instruction Fuzzy Hash: FF214473628A82C3E750CB54E8997A6B760FB8AB84F801131DB4DC7654DF3CE948CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2CCA4 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 54libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B21830: memset.MSVCRT ref: 00007FF674B21867
Part of subcall function 00007FF674B21830: VerSetConditionMask.KERNEL32 ref: 00007FF674B21887
Part of subcall function 00007FF674B21830: VerSetConditionMask.KERNEL32 ref: 00007FF674B2189C
Part of subcall function 00007FF674B21830: VerSetConditionMask.KERNEL32 ref: 00007FF674B218B1
Part of subcall function 00007FF674B21830: VerifyVersionInfoW.KERNEL32 ref: 00007FF674B218DC

LoadLibraryW.KERNEL32 ref: 00007FF674B2CCD5
GetProcAddress.KERNEL32 ref: 00007FF674B2CCFC
FreeLibrary.KERNEL32 ref: 00007FF674B2CD24

Strings

slc.dll, xrefs: 00007FF674B2CCCE
SLGetWindowsInformationDWORD, xrefs: 00007FF674B2CCF2
Internet-Browser-License-LicensedPartnerID, xrefs: 00007FF674B2CD12

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ConditionMask$Library$AddressFreeInfoLoadProcVerifyVersionmemset
String ID: Internet-Browser-License-LicensedPartnerID$SLGetWindowsInformationDWORD$slc.dll
API String ID: 179017354-4234991666
Opcode ID: 68dd85d134c14a3697c27e661238cb0b4201a4028add230c28eeb201c643efd7
Instruction ID: 5989c84e1ebbf1fda4fc47f9ff760797926cba2cff3183b5a085df7af89cfbd4
Opcode Fuzzy Hash: 68dd85d134c14a3697c27e661238cb0b4201a4028add230c28eeb201c643efd7
Instruction Fuzzy Hash: B7115923A29A41C6EA109F05E4D82B9ABB0FB9AF81F544034DA4D87755DF3DEC89DB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B3E114 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

OpenMutexW.KERNEL32(?,?,00000000,00007FF674B3DE97,?,?,00000000,00007FF674B40BDC), ref: 00007FF674B3E12B
CloseHandle.KERNEL32(?,?,00000000,00007FF674B3DE97,?,?,00000000,00007FF674B40BDC), ref: 00007FF674B3E170
GetLastError.KERNEL32(?,?,00000000,00007FF674B3DE97,?,?,00000000,00007FF674B40BDC), ref: 00007FF674B3E180
GetLastError.KERNEL32(?,?,00000000,00007FF674B3DE97,?,?,00000000,00007FF674B40BDC), ref: 00007FF674B3E19A

Part of subcall function 00007FF674B3E1D8: CreateMutexW.KERNEL32(?,?,?,?,?,?,?,00007FF674B3E155,?,?,00000000,00007FF674B3DE97,?,?,00000000,00007FF674B40BDC), ref: 00007FF674B3E1FC
Part of subcall function 00007FF674B3E1D8: #50.IERTUTIL(?,?,?,?,?,?,?,00007FF674B3E155,?,?,00000000,00007FF674B3DE97,?,?,00000000,00007FF674B40BDC), ref: 00007FF674B3E217
Part of subcall function 00007FF674B3E1D8: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,00007FF674B3E155,?,?,00000000,00007FF674B3DE97,?,?,00000000,00007FF674B40BDC), ref: 00007FF674B3E22D
Part of subcall function 00007FF674B3E1D8: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,00007FF674B3E155,?,?,00000000,00007FF674B3DE97,?,?,00000000,00007FF674B40BDC), ref: 00007FF674B3E23C
Part of subcall function 00007FF674B3E1D8: DuplicateHandle.KERNEL32 ref: 00007FF674B3E266
Part of subcall function 00007FF674B3E1D8: CloseHandle.KERNEL32(?,?,?,?,?,?,?,00007FF674B3E155,?,?,00000000,00007FF674B3DE97,?,?,00000000,00007FF674B40BDC), ref: 00007FF674B3E2CA

GetLastError.KERNEL32(?,?,00000000,00007FF674B3DE97,?,?,00000000,00007FF674B40BDC), ref: 00007FF674B3E1AD

Strings

Local\IEHistJournalGlobal_3bf1c317-e96b-46f6-ba88-50c001d497aa, xrefs: 00007FF674B3E11D, 00007FF674B3E149

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorHandleLast$CloseCurrentMutexProcess$CreateDuplicateOpen
String ID: Local\IEHistJournalGlobal_3bf1c317-e96b-46f6-ba88-50c001d497aa
API String ID: 3831808724-600561470
Opcode ID: 23073b8ef0e03cb0dee782dc404174976a2cab6242dc4f802b5ee1706a92d5b2
Instruction ID: 5ae3615383177e7f23607fb2d033e32039987885ce599351ea98267c76b74d8a
Opcode Fuzzy Hash: 23073b8ef0e03cb0dee782dc404174976a2cab6242dc4f802b5ee1706a92d5b2
Instruction Fuzzy Hash: 3A11F132628E43C6F7515B76E8D837AAA90EF4BF85F449435D90EC3254EF2CEC548600

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B478A8 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 21libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00007FF674B478BB
GetProcAddress.KERNEL32 ref: 00007FF674B478D6

Strings

Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection, xrefs: 00007FF674B478F8
RtlIsStateSeparationEnabled, xrefs: 00007FF674B478CC
ntdll.dll, xrefs: 00007FF674B478AE
OSDATA\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection, xrefs: 00007FF674B478EF

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: OSDATA\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection$RtlIsStateSeparationEnabled$Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection$ntdll.dll
API String ID: 2574300362-100155017
Opcode ID: c04dcd58cbc17c43e5736dfd680682fbbcaed1e9d24bbe59e114f45746ade5a0
Instruction ID: 9351ac1c1e4bd9db31434b6c0f5d2fba9ae686ffeb4d19553a2c181ca47f22f1
Opcode Fuzzy Hash: c04dcd58cbc17c43e5736dfd680682fbbcaed1e9d24bbe59e114f45746ade5a0
Instruction Fuzzy Hash: B3F01226B39B02C2FE455B05E8C8174A760BF47F91F849035C40D83350EF3CA989C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B442C4 Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

memcpy_s.MSVCRT ref: 00007FF674B4436B
memcmp.MSVCRT ref: 00007FF674B443E7
memcmp.MSVCRT ref: 00007FF674B44446
memcmp.MSVCRT ref: 00007FF674B4449C
memcpy_s.MSVCRT ref: 00007FF674B444F2
memcpy_s.MSVCRT ref: 00007FF674B44553

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: memcmpmemcpy_s
String ID:
API String ID: 1855548253-0
Opcode ID: 68150fb1adb10f8d19270eefc5884ffcb0b852d7997bec9ba89d8f84d5425c6a
Instruction ID: 046876efe2c20643ac3cc8edc086292314c5413b8b7aa64148ddf3b397b232d3
Opcode Fuzzy Hash: 68150fb1adb10f8d19270eefc5884ffcb0b852d7997bec9ba89d8f84d5425c6a
Instruction Fuzzy Hash: FA91AF23A14692CAEB208F69D4885BD3761FB5AFD8B214136DE5D97B88DF38DD52C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B4A250 Relevance: 9.1, APIs: 6, Instructions: 140COMMON

Download Yara Rule

APIs

PathIsURLW.SHLWAPI ref: 00007FF674B4A29B
GetCurrentDirectoryW.KERNEL32 ref: 00007FF674B4A31B
UrlCreateFromPathW.SHLWAPI ref: 00007FF674B4A34A
UrlCreateFromPathW.SHLWAPI ref: 00007FF674B4A391

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Path$CreateFrom$CurrentDirectory
String ID:
API String ID: 1023945515-0
Opcode ID: b75043f01db1fa734c951a543ef75efc84d6ed3fb2b385e2b787aba20dcdfe6b
Instruction ID: 08058f280977d1dd6332093f1b0a31d1e80435882a0b2a2622d8ea704f3d46a6
Opcode Fuzzy Hash: b75043f01db1fa734c951a543ef75efc84d6ed3fb2b385e2b787aba20dcdfe6b
Instruction Fuzzy Hash: 54514E33B28A52C7EB10DB69E4846BD6761FB8AB84F005135EE0E93B95DF3CE8458740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B216BC Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32 ref: 00007FF674B21707
SysAllocStringLen.OLEAUT32 ref: 00007FF674B2172D
SysStringLen.OLEAUT32 ref: 00007FF674B21744
memcpy_s.MSVCRT ref: 00007FF674B21766
memcpy_s.MSVCRT ref: 00007FF674B217A6
SysFreeString.OLEAUT32 ref: 00007FF674B217D5

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: String$memcpy_s$AllocFree
String ID:
API String ID: 3865269606-0
Opcode ID: 240d5a64fd82d3d9d51975dc3bb1993ada37545a00bee49ef6ebdbffab0deeda
Instruction ID: 1ca119f5ace09b0530967aa57f74bf9c1b514c42fadb3d591312304ff7b21499
Opcode Fuzzy Hash: 240d5a64fd82d3d9d51975dc3bb1993ada37545a00bee49ef6ebdbffab0deeda
Instruction Fuzzy Hash: 5341A073A24A42C2EA24DF5598C8178A6A1BFCAF91B188635DE5DC77A0DF3CEC45C200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B3C800 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF674B3C85E
memset.MSVCRT ref: 00007FF674B3C86F
memset.MSVCRT ref: 00007FF674B3C885
memset.MSVCRT ref: 00007FF674B3C894
StrCmpICW.SHLWAPI ref: 00007FF674B3C965
StrCmpICW.SHLWAPI ref: 00007FF674B3C97A

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: fefb7610e6acfedc5583788c293b2c1997f8b1710b4fbb97aeabdf5e97d918e8
Instruction ID: 9aae3222e4dc4606a083ff18644124517c472dbd8378f5cbd1d13aea65af139b
Opcode Fuzzy Hash: fefb7610e6acfedc5583788c293b2c1997f8b1710b4fbb97aeabdf5e97d918e8
Instruction Fuzzy Hash: 9A414C77714A81C6EB60CF26D8882E96761FB99F88F419032DE4D87764EE39D946D300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B356E8 Relevance: 9.1, APIs: 6, Instructions: 101synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,00000000,00007FF674B2F250,?,?,00000000,00007FF674B2F16B), ref: 00007FF674B3570B
GetLastError.KERNEL32(?,?,00000000,00007FF674B2F250,?,?,00000000,00007FF674B2F16B), ref: 00007FF674B3571E
GetLastError.KERNEL32(?,?,00000000,00007FF674B2F250,?,?,00000000,00007FF674B2F16B), ref: 00007FF674B35733
GetLastError.KERNEL32(?,?,00000000,00007FF674B2F250,?,?,00000000,00007FF674B2F16B), ref: 00007FF674B35748
#672.IERTUTIL(?,?,00000000,00007FF674B2F250,?,?,00000000,00007FF674B2F16B), ref: 00007FF674B357FF
ReleaseMutex.KERNEL32(?,?,00000000,00007FF674B2F250,?,?,00000000,00007FF674B2F16B), ref: 00007FF674B35848

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$#672MutexObjectReleaseSingleWait
String ID:
API String ID: 551975906-0
Opcode ID: 21c8ae7bcd83e9771f9f4a1ec3c697094afa109cf085233710482315e4fe4506
Instruction ID: 00530e7fc00436dc3a7c0b3cbe319818f2271c2a899a2b11c581e223a03684ac
Opcode Fuzzy Hash: 21c8ae7bcd83e9771f9f4a1ec3c697094afa109cf085233710482315e4fe4506
Instruction Fuzzy Hash: CA415F33A28642C7F7809F3798993796B94EF86F84F455134DA09C3695DF3CEC058610

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2D5CC Relevance: 9.1, APIs: 6, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00007FF674B2D5FA
VarBstrCmp.OLEAUT32 ref: 00007FF674B2D625
SysAllocString.OLEAUT32 ref: 00007FF674B2D63C
VarBstrCmp.OLEAUT32 ref: 00007FF674B2D663
SysFreeString.OLEAUT32 ref: 00007FF674B2D696
SysFreeString.OLEAUT32 ref: 00007FF674B2D6AB

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: String$AllocBstrFree
String ID:
API String ID: 359749342-0
Opcode ID: 1e20656773bdb0b06bc6aa223e059a0aa9c850de746c4aaa8eb820e3b96a9f43
Instruction ID: 49fbba8e434cdb50412314a13aa18ba5fadf693c80fd0b035c473c3eca1bfd89
Opcode Fuzzy Hash: 1e20656773bdb0b06bc6aa223e059a0aa9c850de746c4aaa8eb820e3b96a9f43
Instruction Fuzzy Hash: 4F31B133A28A42C2EA218F59E488279B7A0FB8AF90F594131DE1D83795DF3DE845C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B31AC0 Relevance: 9.1, APIs: 6, Instructions: 99synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF674B31B19
GetLastError.KERNEL32 ref: 00007FF674B31B2C
GetLastError.KERNEL32 ref: 00007FF674B31B46
GetLastError.KERNEL32 ref: 00007FF674B31B5B
QISearch.SHLWAPI ref: 00007FF674B31BE9

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$ObjectSearchSingleWait
String ID:
API String ID: 3990731185-0
Opcode ID: e0944001fa6a1d6b620a1bb0a5398021aacddec031f73d5c9a66093980c2bb20
Instruction ID: bb14eb41bc9acee6c738d779028a05fa320bc29951bda1cd24c5d37cdf3fa4e1
Opcode Fuzzy Hash: e0944001fa6a1d6b620a1bb0a5398021aacddec031f73d5c9a66093980c2bb20
Instruction Fuzzy Hash: 14414F23A28B42C7EB549B6694D83786BA8FF8AF81F444175DA0D87795EF3CE8418340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B45718 Relevance: 9.1, APIs: 6, Instructions: 89threadtimeCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 00007FF674B45782
CreateThreadpoolTimer.KERNEL32 ref: 00007FF674B457D9
GetLastError.KERNEL32 ref: 00007FF674B457F1
SetLastError.KERNEL32 ref: 00007FF674B45809
SetThreadpoolTimer.KERNEL32 ref: 00007FF674B45838
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF674B45850

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorExclusiveLastLockThreadpoolTimer$AcquireCreateRelease
String ID:
API String ID: 117860038-0
Opcode ID: 9aed23e82d132a15d41d2a396b67c9487a3dbd35fdf0626fed179054b0ce0515
Instruction ID: 5e7a3d748e85c08dd3bd49d2b45c10b53ac57e30e3bbd4fd3b3601bd83950d5b
Opcode Fuzzy Hash: 9aed23e82d132a15d41d2a396b67c9487a3dbd35fdf0626fed179054b0ce0515
Instruction Fuzzy Hash: 2A316227A28B81C6EA618B25A4C8179ABA0FF4BFE0F455535DE4E43B54DF3CE8458B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B37638 Relevance: 9.1, APIs: 6, Instructions: 89COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF674B37689
GetLastError.KERNEL32 ref: 00007FF674B37752

Part of subcall function 00007FF674B21918: GetProcessHeap.KERNEL32 ref: 00007FF674B21921
Part of subcall function 00007FF674B21918: HeapAlloc.KERNEL32 ref: 00007FF674B21938

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,00007FF674B37B27), ref: 00007FF674B376D9
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF674B37B27), ref: 00007FF674B376F4
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF674B37B27), ref: 00007FF674B3770E

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$ByteCharHeapMultiWide$AllocProcess
String ID:
API String ID: 289723558-0
Opcode ID: f7f5d8281df42106d5d424511c6a8742336de28875b75e8773f47e469580e9de
Instruction ID: 005aeab41d75698288195db57f9300a62dbd76f1b1087696021e681954e20edd
Opcode Fuzzy Hash: f7f5d8281df42106d5d424511c6a8742336de28875b75e8773f47e469580e9de
Instruction Fuzzy Hash: 3F313C37A28B42C7E7109B66A5983797AE0FB8AF95F548234CB4987354DF7CE8048740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B45000 Relevance: 9.1, APIs: 6, Instructions: 76COMMON

Download Yara Rule

APIs

AcquireSRWLockShared.KERNEL32 ref: 00007FF674B45021
ReleaseSRWLockShared.KERNEL32 ref: 00007FF674B45041
EnterCriticalSection.KERNEL32 ref: 00007FF674B45061
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF674B45070
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF674B450C8
LeaveCriticalSection.KERNEL32 ref: 00007FF674B450ED

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Lock$AcquireCriticalExclusiveReleaseSectionShared$EnterLeave
String ID:
API String ID: 3221859647-0
Opcode ID: 4db5293840bb064735ada58c6a5ff5cb4cfe286d78248bac55efe07f0a40d3bf
Instruction ID: c021219c3ed282e1401e36ce5b19862bf3b5d566470d8f902bc0e3fac528ba0d
Opcode Fuzzy Hash: 4db5293840bb064735ada58c6a5ff5cb4cfe286d78248bac55efe07f0a40d3bf
Instruction Fuzzy Hash: CF318227B18E81C6EA118F25A598179AB60FB8AFD4B499130DF4E47B04CF3CE8858740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B46008 Relevance: 9.1, APIs: 6, Instructions: 76threadtimeCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 00007FF674B4605C
CreateThreadpoolTimer.KERNEL32 ref: 00007FF674B460A5
GetLastError.KERNEL32 ref: 00007FF674B460BD
SetLastError.KERNEL32 ref: 00007FF674B460D5
SetThreadpoolTimer.KERNEL32 ref: 00007FF674B4610A
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF674B46122

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorExclusiveLastLockThreadpoolTimer$AcquireCreateRelease
String ID:
API String ID: 117860038-0
Opcode ID: 1b19bf096620836a551ed67004da282b00b8f38c7e08bb86b2568c0a97377c79
Instruction ID: 4b54dc333b5f353c8dfa4f868568b699426bc280ff8901254c45658f9c9ceba9
Opcode Fuzzy Hash: 1b19bf096620836a551ed67004da282b00b8f38c7e08bb86b2568c0a97377c79
Instruction Fuzzy Hash: C2317227A28B91D6EB505F29E498278ABA0FB4AFD0F045131CE4D87B55CF3CE8658700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B3D4D0 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 70memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE ref: 00007FF674B3D4F5
LocalFree.KERNEL32(?,?,00000000,00007FF674B35774,?,?,00000000,00007FF674B2F250,?,?,00000000,00007FF674B2F16B), ref: 00007FF674B3D516
memset.MSVCRT ref: 00007FF674B3D59E

Strings

Software\Policies\Microsoft\Internet Explorer\Infodelivery, xrefs: 00007FF674B3D5C7
Software\Microsoft\Windows\CurrentVersion\Policies, xrefs: 00007FF674B3D5AE
Software\Policies\Microsoft\Internet Explorer, xrefs: 00007FF674B3D5C0

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Local$AllocFreememset
String ID: Software\Microsoft\Windows\CurrentVersion\Policies$Software\Policies\Microsoft\Internet Explorer$Software\Policies\Microsoft\Internet Explorer\Infodelivery
API String ID: 3749828606-3808456074
Opcode ID: 80be77c6de241351d6a52ace3fc2eb49041b77060a09e86989deae8f5346bb27
Instruction ID: 0a7ca6aebbd054218f70233c5d36b6524bc2107de76b7e111a1761c8acc20918
Opcode Fuzzy Hash: 80be77c6de241351d6a52ace3fc2eb49041b77060a09e86989deae8f5346bb27
Instruction Fuzzy Hash: 28316B23E2C646C7F6518B2AE4D8379A669EB4AF84FD54035D61EC3691DF2CFD828700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B35AD4 Relevance: 9.1, APIs: 6, Instructions: 69synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF674B35AFD
GetLastError.KERNEL32 ref: 00007FF674B35B10
GetLastError.KERNEL32 ref: 00007FF674B35B2A
GetLastError.KERNEL32 ref: 00007FF674B35B3F
#74.IERTUTIL ref: 00007FF674B35B7B
ReleaseMutex.KERNEL32 ref: 00007FF674B35BAD

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$MutexObjectReleaseSingleWait
String ID:
API String ID: 3488842590-0
Opcode ID: c6cb1b1544684603a92f51156c5af88fdd185bf1753478ddd8e8b2db321eaa02
Instruction ID: f6c196cd89b67a310b3d76584f75674b2113f885e9bf0092be8739ba1326201f
Opcode Fuzzy Hash: c6cb1b1544684603a92f51156c5af88fdd185bf1753478ddd8e8b2db321eaa02
Instruction Fuzzy Hash: BA217422719B42CBE7045F66A9D83397AA0EF8BF90F458574DA5EC3791DF2CE8448700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B438C0 Relevance: 9.1, APIs: 6, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF674B438F7
HeapAlloc.KERNEL32 ref: 00007FF674B4390B
GetProcessHeap.KERNEL32 ref: 00007FF674B43924
memcpy_s.MSVCRT ref: 00007FF674B4395F
GetProcessHeap.KERNEL32 ref: 00007FF674B43978
HeapFree.KERNEL32 ref: 00007FF674B4398C

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Heap$Process$AllocFreememcpy_s
String ID:
API String ID: 3519707287-0
Opcode ID: aa210cd04906db95f9748722d6304b6edf133017f7e199c6d90576bfed211e4b
Instruction ID: 1805f1a433dd3f4fc249211dea2b5363fab451a861b4643c808322c07942fae5
Opcode Fuzzy Hash: aa210cd04906db95f9748722d6304b6edf133017f7e199c6d90576bfed211e4b
Instruction Fuzzy Hash: FE314B37624F41C6EB048F56E458269BBA0FB5AFD4B089231CE5E43754CF38E846C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B399D4 Relevance: 9.1, APIs: 6, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 00007FF674B399F0
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,00007FF674B39783), ref: 00007FF674B39A13
SysAllocStringLen.OLEAUT32 ref: 00007FF674B39A26
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,00007FF674B39783), ref: 00007FF674B39A4F
SysFreeString.OLEAUT32 ref: 00007FF674B39A7B
SysFreeString.OLEAUT32 ref: 00007FF674B39AA2

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: String$Free$ByteCharMultiWide$Alloc
String ID:
API String ID: 246500865-0
Opcode ID: 65a410a9ed790447233d16f6684bcdd76bee5b67b7499c6f4f0f8008fa8304d9
Instruction ID: 250a96daf6a9da47b2efdf905752eab9bb5749b5b091596d21a76fe7ad673cfd
Opcode Fuzzy Hash: 65a410a9ed790447233d16f6684bcdd76bee5b67b7499c6f4f0f8008fa8304d9
Instruction Fuzzy Hash: 34214F32618B41C7E7149B69E888269BBA1FB8AF90F588334DA4D43B95DF3CD945C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B47758 Relevance: 9.1, APIs: 6, Instructions: 58COMMON

Download Yara Rule

APIs

#793.IERTUTIL(?,?,?,00007FF674B2114A), ref: 00007FF674B47780
#791.IERTUTIL(?,?,?,00007FF674B2114A), ref: 00007FF674B47793
#791.IERTUTIL(?,?,?,00007FF674B2114A), ref: 00007FF674B477AF
#597.IERTUTIL(?,?,?,00007FF674B2114A), ref: 00007FF674B477BF
#594.IERTUTIL(?,?,?,00007FF674B2114A), ref: 00007FF674B477CF
#398.IERTUTIL(?,?,?,00007FF674B2114A), ref: 00007FF674B477DF

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: #791$#398#594#597#793
String ID:
API String ID: 1768570115-0
Opcode ID: 8cfc270b118f4dc606346083a4800a4609f7c5540dabd661f83e06911b6a0c3e
Instruction ID: 308662ed9aa7ace146df4cfe3373853eca1bc1bfab7842d4498b57387e1b4795
Opcode Fuzzy Hash: 8cfc270b118f4dc606346083a4800a4609f7c5540dabd661f83e06911b6a0c3e
Instruction Fuzzy Hash: 3F116333D28682C7E6105B19A48C579BB60FF4BF91F4A9474D95E93380CF3CAC45C650

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B49938 Relevance: 9.0, APIs: 6, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00007FF674B49949
OpenThreadToken.ADVAPI32(?,?,?,00007FF674B49A15,?,?,?,?,?,?,?,?,00000000,00007FF674B496F5), ref: 00007FF674B49962
GetLastError.KERNEL32(?,?,?,00007FF674B49A15,?,?,?,?,?,?,?,?,00000000,00007FF674B496F5), ref: 00007FF674B49972
GetCurrentProcess.KERNEL32(?,?,?,00007FF674B49A15,?,?,?,?,?,?,?,?,00000000,00007FF674B496F5), ref: 00007FF674B4999E
OpenProcessToken.ADVAPI32(?,?,?,00007FF674B49A15,?,?,?,?,?,?,?,?,00000000,00007FF674B496F5), ref: 00007FF674B499B5
GetLastError.KERNEL32(?,?,?,00007FF674B49A15,?,?,?,?,?,?,?,?,00000000,00007FF674B496F5), ref: 00007FF674B499C9

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CurrentErrorLastOpenProcessThreadToken
String ID:
API String ID: 4013858454-0
Opcode ID: 787ed4f9ecf75da4bd73d7d0c2e55bad2fa6868813a7a14b32510526e528b220
Instruction ID: 7ed6bf1e47283ff4c832c675d262f7f70809f5488941bc8acc93a15da63066a9
Opcode Fuzzy Hash: 787ed4f9ecf75da4bd73d7d0c2e55bad2fa6868813a7a14b32510526e528b220
Instruction Fuzzy Hash: EA11EF36624B42CBE7481B7A98A97797AD0FB5BF81F44913DDA4FC7290DE3CE8458600

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B4C954 Relevance: 9.0, APIs: 6, Instructions: 49timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF674B4C984
GetCurrentProcessId.KERNEL32 ref: 00007FF674B4C992
GetCurrentThreadId.KERNEL32 ref: 00007FF674B4C99E
GetTickCount.KERNEL32 ref: 00007FF674B4C9AA
GetTickCount.KERNEL32 ref: 00007FF674B4C9BA
QueryPerformanceCounter.KERNEL32 ref: 00007FF674B4C9D5

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: 473da3024dd97dc2c5c58d81bb17125a548f5c86a36c7e0a4e59a3afdd0f3c03
Instruction ID: a2ab78525aa2f40c9b6ce8af92543243223409c9a60462ac7d6ccb69c88777a3
Opcode Fuzzy Hash: 473da3024dd97dc2c5c58d81bb17125a548f5c86a36c7e0a4e59a3afdd0f3c03
Instruction Fuzzy Hash: 03112127B14F41CAEB00DF65E89816833A4FB5AB98F401A35EA5D87B54DF7CE9A4C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B41098 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 274COMMON

Download Yara Rule

APIs

StrCmpNIA.SHLWAPI ref: 00007FF674B4115C
EnterCriticalSection.KERNEL32 ref: 00007FF674B4134B
LeaveCriticalSection.KERNEL32 ref: 00007FF674B41373

Part of subcall function 00007FF674B424A0: QueueUserWorkItem.KERNEL32 ref: 00007FF674B424BF

CreateUri.URLMON ref: 00007FF674B41214

Part of subcall function 00007FF674B2195C: GetProcessHeap.KERNEL32 ref: 00007FF674B21969
Part of subcall function 00007FF674B2195C: HeapFree.KERNEL32 ref: 00007FF674B2197D

Strings

https://, xrefs: 00007FF674B41155

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CriticalHeapSection$CreateEnterFreeItemLeaveProcessQueueUserWork
String ID: https://
API String ID: 2263833432-4275131719
Opcode ID: 8c61f924bf8f51843a04d91dae1add2a6d571a1d8561f744914102045fcfb1d9
Instruction ID: 8a0127a733360c07426d74fc518579465c38052a0b5b8c8e18bae72a98339b12
Opcode Fuzzy Hash: 8c61f924bf8f51843a04d91dae1add2a6d571a1d8561f744914102045fcfb1d9
Instruction Fuzzy Hash: BFC16C23F29B56D9EB10CF69D4883AD67A5BB86B88F600035DE4D97B85DF39E815C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B3FD04 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 208COMMON

Download Yara Rule

APIs

GetFileSizeEx.KERNEL32 ref: 00007FF674B3FD52
GetLastError.KERNEL32 ref: 00007FF674B3FD62
GetLastError.KERNEL32 ref: 00007FF674B3FD78

Strings

'g, xrefs: 00007FF674B3FF8A

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$FileSize
String ID: 'g
API String ID: 3064237074-1221219425
Opcode ID: 35262efbbc48682b715a7b015c3ee6f52e6a86979b9f98825a1df257739a03c0
Instruction ID: 3e7b4f3512feee3bbfd09270bcd7c99cccb52841209cf2de1b72c975700844d6
Opcode Fuzzy Hash: 35262efbbc48682b715a7b015c3ee6f52e6a86979b9f98825a1df257739a03c0
Instruction Fuzzy Hash: E0A1FA72A28242CBE7648F2AE0C866AB6A1FB46B44F504139EB49C7655CF7DFC41DB04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B42F5C Relevance: 9.0, APIs: 7, Instructions: 207memoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF674B42F9A

Part of subcall function 00007FF674B42B4C: GetModuleHandleW.KERNEL32 ref: 00007FF674B42B7B
Part of subcall function 00007FF674B42B4C: GetProcAddress.KERNEL32 ref: 00007FF674B42B98

GetProcessHeap.KERNEL32 ref: 00007FF674B43035
HeapFree.KERNEL32 ref: 00007FF674B43049
GetProcessHeap.KERNEL32 ref: 00007FF674B43055
HeapAlloc.KERNEL32 ref: 00007FF674B43069
GetProcessHeap.KERNEL32 ref: 00007FF674B4321D
HeapFree.KERNEL32 ref: 00007FF674B43231

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Heap$Process$Free$AddressAllocHandleModuleProcmemset
String ID:
API String ID: 2903015918-0
Opcode ID: 65e0c406d3f7512303b76326628a94aebff9ed825d42034f5b9b6d879e46bb1a
Instruction ID: 28fc771e8f720d5a8fd5a404feecd45ca3d7bf1e185485390524972b92565481
Opcode Fuzzy Hash: 65e0c406d3f7512303b76326628a94aebff9ed825d42034f5b9b6d879e46bb1a
Instruction Fuzzy Hash: 35913C33B14A61CAEB20CF69E4845A9BBB0FB5AB88B485135DF4E83754DF38E594C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B382E0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00007FF674B3830C
SysFreeString.OLEAUT32 ref: 00007FF674B3833E
SysFreeString.OLEAUT32 ref: 00007FF674B38477

Strings

signvalue, xrefs: 00007FF674B38305
https://ieonline.microsoft.com/EUPP/v1/service?action=signvalue&appid=Microsoft_IE_EUPP, xrefs: 00007FF674B383F6

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: String$Free$Alloc
String ID: https://ieonline.microsoft.com/EUPP/v1/service?action=signvalue&appid=Microsoft_IE_EUPP$signvalue
API String ID: 986138563-2343436192
Opcode ID: a572de9d37b10c572b738654052b43543e0c83e224a03e6a7ac514f2632ccb76
Instruction ID: c06cfbd5cebefc7cebee971cdbe22a38f8fe6eac687555526a726db8bbbd47e6
Opcode Fuzzy Hash: a572de9d37b10c572b738654052b43543e0c83e224a03e6a7ac514f2632ccb76
Instruction Fuzzy Hash: CA51E437A28B45C2EB50DB16E488328B7A5FB8AF80F158135DB9D87B64DF39E851C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2B4A0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

OpenSemaphoreW.KERNEL32 ref: 00007FF674B2B510
GetLastError.KERNEL32 ref: 00007FF674B2B524

Strings

_p0, xrefs: 00007FF674B2B4F1
wil, xrefs: 00007FF674B2B573, 00007FF674B2B5F7, 00007FF674B2B646

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLastOpenSemaphore
String ID: _p0$wil
API String ID: 1909229842-1814513734
Opcode ID: 8f1c8197586efdea456c0d4e54f5c59f0ea7551b1bf842886e12527a411a622f
Instruction ID: dae52348630e12419a6a21e22708ccebff7c91248b8be201f353079a5a01cdf5
Opcode Fuzzy Hash: 8f1c8197586efdea456c0d4e54f5c59f0ea7551b1bf842886e12527a411a622f
Instruction Fuzzy Hash: 43518E23B28A82D6EB21DB61D8992F96391BB8AF84F441131DA0D9B755DF3CED05C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2E970 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56synchronizationwindowCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?,00000001,00007FF674B2E73B), ref: 00007FF674B2E990
GetLastError.KERNEL32(?,?,00000001,00007FF674B2E73B), ref: 00007FF674B2E99F
PostMessageW.USER32 ref: 00007FF674B2E9E8
GetLastError.KERNEL32 ref: 00007FF674B2E9F8

Strings

{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}, xrefs: 00007FF674B2E982

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$CreateMessageMutexPost
String ID: {66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}
API String ID: 1064731545-2535197689
Opcode ID: 0dd03cabf84300492fa786156e98facfc12e6935b8a979c80a5d1f3feb9e3d26
Instruction ID: 94bab58cb4d702b7b111e4e5c0a09a6f021f1ed89281f4f6b55d8654008707d9
Opcode Fuzzy Hash: 0dd03cabf84300492fa786156e98facfc12e6935b8a979c80a5d1f3feb9e3d26
Instruction Fuzzy Hash: B5215E22A28B82C7EB508B6AE488279B7A0FB8AF84F549131DA4D87754DF3DDC05C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B25F80 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B266E8: GetLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF674B21A63), ref: 00007FF674B26721
Part of subcall function 00007FF674B266E8: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF674B21A63), ref: 00007FF674B26799
Part of subcall function 00007FF674B266E8: PostThreadMessageW.USER32 ref: 00007FF674B267B9

SHDeleteValueW.SHLWAPI ref: 00007FF674B25FE4
SHSetValueW.SHLWAPI ref: 00007FF674B26043

Strings

Software\Microsoft\Windows\CurrentVersion\Explorer\RemoveAccess, xrefs: 00007FF674B25FDD, 00007FF674B26025
In SetIEExplorerAccess. fShow=%1!d!, fPreserveSpadValues=%2!d!, xrefs: 00007FF674B25FAE
iexplore.exe, xrefs: 00007FF674B25FCF, 00007FF674B2601A

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: MessageValue$DeleteFormatLocalPostThreadTime
String ID: In SetIEExplorerAccess. fShow=%1!d!, fPreserveSpadValues=%2!d!$Software\Microsoft\Windows\CurrentVersion\Explorer\RemoveAccess$iexplore.exe
API String ID: 2337993085-105929265
Opcode ID: c1f53402722c7b61a180e48bae6a5efa4dd725ea96e3fd642e4a0b769368deaa
Instruction ID: f780c555fa7c1bd0dddb50e055bfa5bc76fda41214f892ecbc2240a180ee1059
Opcode Fuzzy Hash: c1f53402722c7b61a180e48bae6a5efa4dd725ea96e3fd642e4a0b769368deaa
Instruction Fuzzy Hash: 62214133628A41C1EA20DB14E8D86A6B7A0FB99FA0F904335DA6D837D5DF3CD945C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B273A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,?,?,?,00007FF674B23015), ref: 00007FF674B273D9
RegQueryValueExW.ADVAPI32 ref: 00007FF674B27414
RegCloseKey.ADVAPI32 ref: 00007FF674B27427

Strings

DeferMigrationCommand, xrefs: 00007FF674B273FA
SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\InstallInfo, xrefs: 00007FF674B273C3

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: DeferMigrationCommand$SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\InstallInfo
API String ID: 3677997916-3890334675
Opcode ID: 0946ee757f948a6dd990c49542e51ada67983e5ef61673ebc22e33b5a32d5811
Instruction ID: d1bb3a3a71c3ce316867399538bf438c0534b9ed24d7a8613b732531d09a0cc4
Opcode Fuzzy Hash: 0946ee757f948a6dd990c49542e51ada67983e5ef61673ebc22e33b5a32d5811
Instruction Fuzzy Hash: C311D037618B41C3E3108F68E48856ABBB5FB8ABD0F655235DA5C83714EF39D845C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B24D58 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B21574: _vsnwprintf.MSVCRT ref: 00007FF674B215B4

SHGetValueW.SHLWAPI ref: 00007FF674B24DD0
SHSetValueW.SHLWAPI ref: 00007FF674B24E11

Strings

{871C5380-42A0-1069-A2EA-08002B30309D}, xrefs: 00007FF674B24D7C
Attributes, xrefs: 00007FF674B24DB0, 00007FF674B24DF9
Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\%s\ShellFolder, xrefs: 00007FF674B24D8D

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Value$_vsnwprintf
String ID: Attributes$Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\%s\ShellFolder${871C5380-42A0-1069-A2EA-08002B30309D}
API String ID: 2219702684-1335838630
Opcode ID: f3a24ecc632a362d4d645f0bc6a2c1484e3f96eaf544e095b4abd2511e78a88c
Instruction ID: 3a3ef62353c9dff2f5b25507fb5f712522fc8715881b8266aaf6ec3fc3acb3e3
Opcode Fuzzy Hash: f3a24ecc632a362d4d645f0bc6a2c1484e3f96eaf544e095b4abd2511e78a88c
Instruction Fuzzy Hash: D0213E73629B81C6EB108B54F48839AB7A0FB89B54F841222E69D43B58CF7CD545CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B23E28 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

SHGetValueW.SHLWAPI ref: 00007FF674B23E62
SHGetValueW.SHLWAPI ref: 00007FF674B23EB1

Strings

system\Setup, xrefs: 00007FF674B23E4E, 00007FF674B23E9E
SystemSetupInProgress, xrefs: 00007FF674B23E40
UpgradeInProgress, xrefs: 00007FF674B23E8F

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Value
String ID: SystemSetupInProgress$UpgradeInProgress$system\Setup
API String ID: 3702945584-4024946984
Opcode ID: c147cfceacf426b6f2114d5ba9af16899c8a7fe802ed39993bab37a0ccafd479
Instruction ID: 46a424dcc8b87d7a11293718bc7019653e8d696f11233c805d8dd48805774eeb
Opcode Fuzzy Hash: c147cfceacf426b6f2114d5ba9af16899c8a7fe802ed39993bab37a0ccafd479
Instruction Fuzzy Hash: ED113D73618B41C7EB109F64E4882AAB7A4FB8AB50F904636DB5C82794DF3DD948CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2296C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32 ref: 00007FF674B22997
GetEnvironmentVariableW.KERNEL32 ref: 00007FF674B229B9
GetLastError.KERNEL32 ref: 00007FF674B229C9

Strings

INSTALLER_SHADOWED_COMPONENT_IDENTITY, xrefs: 00007FF674B229B2
INSTALLER_WINNING_COMPONENT_IDENTITY, xrefs: 00007FF674B22990

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: EnvironmentVariable$ErrorLast
String ID: INSTALLER_SHADOWED_COMPONENT_IDENTITY$INSTALLER_WINNING_COMPONENT_IDENTITY
API String ID: 1936246020-224403506
Opcode ID: 32495d554ce1e6d95e37de35e43dd4084d6055df9eb18f07b58ab3107ef2f7fc
Instruction ID: d8c6ff3fa7def637704ebab6d3b437d6b605d3e68d3f9b3b1e4e05b2a24d0225
Opcode Fuzzy Hash: 32495d554ce1e6d95e37de35e43dd4084d6055df9eb18f07b58ab3107ef2f7fc
Instruction Fuzzy Hash: 75011D72B38942C6FA609B14E4D83B9A6A0FB9AF84F815131CA4DC7254DF3CE945C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B44598 Relevance: 7.8, APIs: 5, Instructions: 274COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B43E2C: memcpy_s.MSVCRT ref: 00007FF674B43E75
Part of subcall function 00007FF674B43E2C: memcpy_s.MSVCRT ref: 00007FF674B43EDE

memcmp.MSVCRT ref: 00007FF674B4462B
memcpy_s.MSVCRT ref: 00007FF674B446AA

Part of subcall function 00007FF674B442C4: memcpy_s.MSVCRT ref: 00007FF674B4436B
Part of subcall function 00007FF674B442C4: memcmp.MSVCRT ref: 00007FF674B44446

memmove_s.MSVCRT ref: 00007FF674B4488A
memcpy_s.MSVCRT ref: 00007FF674B448FF

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: memcpy_s$memcmp$memmove_s
String ID:
API String ID: 2013778500-0
Opcode ID: 9da43df6d4f1fc0f812a56dc30ed6e0d29868c6679c4b7b70a108a369951fc3b
Instruction ID: 123b5a1a81b9d052d461ff42eb2d2d603977b016a9419a10e499f1080cb5afb8
Opcode Fuzzy Hash: 9da43df6d4f1fc0f812a56dc30ed6e0d29868c6679c4b7b70a108a369951fc3b
Instruction Fuzzy Hash: 46C17067F58691CAEB20CFB990846FC27B1EB16BC8B504136DE4DA7B48DE38D856C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B3DB54 Relevance: 7.7, APIs: 5, Instructions: 169timesynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B21918: GetProcessHeap.KERNEL32 ref: 00007FF674B21921
Part of subcall function 00007FF674B21918: HeapAlloc.KERNEL32 ref: 00007FF674B21938

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FF674B26295), ref: 00007FF674B3DC5E
GetSystemTime.KERNEL32 ref: 00007FF674B3DCB2
SystemTimeToFileTime.KERNEL32 ref: 00007FF674B3DCC8
SetFileTime.KERNEL32 ref: 00007FF674B3DCFC
WaitForSingleObject.KERNEL32 ref: 00007FF674B3DD14

Part of subcall function 00007FF674B3E400: ReleaseMutex.KERNEL32(?,?,?,00007FF674B409D6), ref: 00007FF674B3E40A
Part of subcall function 00007FF674B3E400: GetLastError.KERNEL32(?,?,?,00007FF674B409D6), ref: 00007FF674B3E41C
Part of subcall function 00007FF674B3E400: GetLastError.KERNEL32(?,?,?,00007FF674B409D6), ref: 00007FF674B3E434

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Time$ErrorFileHeapLastObjectSingleSystemWait$AllocMutexProcessRelease
String ID:
API String ID: 530240592-0
Opcode ID: 8d8a3290b94e9f7285a6d839b2ae02dcbfddf4ed58952d545f2d8b6686c7577e
Instruction ID: 032324df61404056fa52fd42823226079fc0a0ff3cc2a3e418b9df7c5cabfe55
Opcode Fuzzy Hash: 8d8a3290b94e9f7285a6d839b2ae02dcbfddf4ed58952d545f2d8b6686c7577e
Instruction Fuzzy Hash: 75619F23B28B82C3E7108B7694D83B96698FB8AF84F809131DA5D87695DF7CE841D300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B36088 Relevance: 7.7, APIs: 5, Instructions: 164COMMON

Download Yara Rule

APIs

CoTaskMemFree.OLE32(?,00000000,?,00007FF674B2EE33), ref: 00007FF674B361A2
SHStrDupW.SHLWAPI(?,00000000,?,00007FF674B2EE33), ref: 00007FF674B361AE
CoTaskMemFree.OLE32(?,00000000,?,00007FF674B2EE33), ref: 00007FF674B361D6
SHStrDupW.SHLWAPI(?,00000000,?,00007FF674B2EE33), ref: 00007FF674B361E2
memcpy_s.MSVCRT ref: 00007FF674B3622A

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: FreeTask$memcpy_s
String ID:
API String ID: 3307904802-0
Opcode ID: 52b867c85d3fd97b9696bab05222bbfa6b3aa13e1ece795fcefb982131d5ae19
Instruction ID: a5e4462a6558c9f3fe3ac5a8cda0c3f20dd967c9ca0b843fdf52e2d288a7c9ba
Opcode Fuzzy Hash: 52b867c85d3fd97b9696bab05222bbfa6b3aa13e1ece795fcefb982131d5ae19
Instruction Fuzzy Hash: E671F626A29B06C7EB65DB66D58836977A0FB4AF40F054535CB4E87B91DF38F860C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B37794 Relevance: 7.6, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF674B38893), ref: 00007FF674B377EC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF674B38893), ref: 00007FF674B378BE

Part of subcall function 00007FF674B21918: GetProcessHeap.KERNEL32 ref: 00007FF674B21921
Part of subcall function 00007FF674B21918: HeapAlloc.KERNEL32 ref: 00007FF674B21938

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF674B38893), ref: 00007FF674B37844
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF674B38893), ref: 00007FF674B37861
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF674B38893), ref: 00007FF674B3787B

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$ByteCharHeapMultiWide$AllocProcess
String ID:
API String ID: 289723558-0
Opcode ID: 341cf5bd28714aafd77f24a6869c4122df8b41f709976b79a9da73efec3f81a0
Instruction ID: 3450b32ed38932798bdd0f4a5479f9894890010c52373204bc95c0fa65885e39
Opcode Fuzzy Hash: 341cf5bd28714aafd77f24a6869c4122df8b41f709976b79a9da73efec3f81a0
Instruction Fuzzy Hash: 11418C36A14B82CAE7109B66A8882787AA4FB8BF80B548134CF4DD7754DF3CE804C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B31600 Relevance: 7.6, APIs: 5, Instructions: 91synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF674B31650
GetLastError.KERNEL32 ref: 00007FF674B31663
GetLastError.KERNEL32 ref: 00007FF674B3167D
GetLastError.KERNEL32 ref: 00007FF674B31693
ReleaseMutex.KERNEL32 ref: 00007FF674B316BC

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$MutexObjectReleaseSingleWait
String ID:
API String ID: 3488842590-0
Opcode ID: 45c93d64a24b5013e3aa04704b84c5a70deb4255425aba1c728199f095129b87
Instruction ID: 6be0fa3082215386988b2dd4fa00e1b58fcf69ec2638d7e1c4194fb97a0edf3c
Opcode Fuzzy Hash: 45c93d64a24b5013e3aa04704b84c5a70deb4255425aba1c728199f095129b87
Instruction Fuzzy Hash: FB413D27628B46C6EA609F66E4D837977A4FF8AF90F484135CA4E87751DF3CEC458600

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B48334 Relevance: 7.6, APIs: 5, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B21918: GetProcessHeap.KERNEL32 ref: 00007FF674B21921
Part of subcall function 00007FF674B21918: HeapAlloc.KERNEL32 ref: 00007FF674B21938

CloseHandle.KERNEL32(?,00000000,?,00007FF674B4859F), ref: 00007FF674B483A8
SetFileAttributesW.KERNEL32 ref: 00007FF674B483C0
#85.IERTUTIL(?,00000000,?,00007FF674B4859F), ref: 00007FF674B483EA
CloseHandle.KERNEL32 ref: 00007FF674B48412
SetFileAttributesW.KERNEL32 ref: 00007FF674B4842A

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: AttributesCloseFileHandleHeap$AllocProcess
String ID:
API String ID: 977303244-0
Opcode ID: e274e3b18f940fc1c2b0c713c3ce29d9a4113d7b5169154283517c1723ac2fa9
Instruction ID: f9033c753bcdd8069f9de7f8ac4e64fdc00d4104548cefd32514a413f595356e
Opcode Fuzzy Hash: e274e3b18f940fc1c2b0c713c3ce29d9a4113d7b5169154283517c1723ac2fa9
Instruction Fuzzy Hash: 64316D37A28A52C2D6108B199488038B6A1FB86FF0B599330DE7D977D4DF38EC428340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2D130 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF674B2D169
GetUserDefaultLocaleName.KERNELBASE ref: 00007FF674B2D17A
_wcsnicmp.MSVCRT ref: 00007FF674B2D1A3
GetSystemDefaultLocaleName.KERNELBASE ref: 00007FF674B2D1DB
_wcsnicmp.MSVCRT ref: 00007FF674B2D1F9

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: DefaultLocaleName_wcsnicmp$SystemUsermemset
String ID:
API String ID: 3446605168-0
Opcode ID: 7dd38079e8b8d1b161cb5d7aee0b511de44794c030a94791b8fa11ea766817e8
Instruction ID: 00d3f350573eb5e4da9e75be2698202ae44d3463da553c2866436fd1cb8dd19c
Opcode Fuzzy Hash: 7dd38079e8b8d1b161cb5d7aee0b511de44794c030a94791b8fa11ea766817e8
Instruction Fuzzy Hash: 0A316E33618A86C6EB20CF51E4983A9B7A5FB8AB84F948535CA8E83754DF3CD915C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B29144 Relevance: 7.6, APIs: 5, Instructions: 51synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32 ref: 00007FF674B29148
GetLastError.KERNEL32 ref: 00007FF674B2918E
SetLastError.KERNEL32 ref: 00007FF674B291A6
GetLastError.KERNEL32 ref: 00007FF674B291BF
SetLastError.KERNEL32 ref: 00007FF674B291D7

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$MutexRelease
String ID:
API String ID: 3084565237-0
Opcode ID: bac1c4b56fa18452e767bde95d816850919ad1b2b547528bd3be9fbd619d9969
Instruction ID: 8170365de0d06ebbe4e2d2a7223accdc00c2748d94f903bed3afccf6f4a427b7
Opcode Fuzzy Hash: bac1c4b56fa18452e767bde95d816850919ad1b2b547528bd3be9fbd619d9969
Instruction Fuzzy Hash: 87113723F24A91D7E7049B62E4993796660FB8FF81F459130DA0E57B45CF3CE8668700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B21830 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF674B21867
VerSetConditionMask.KERNEL32 ref: 00007FF674B21887
VerSetConditionMask.KERNEL32 ref: 00007FF674B2189C
VerSetConditionMask.KERNEL32 ref: 00007FF674B218B1
VerifyVersionInfoW.KERNEL32 ref: 00007FF674B218DC

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 708f62ab02d84b42226dea42d9c642bd027bf5e3d4e82d382ddd47a80a9e209b
Instruction ID: a419b83a940d77f94ac5afca91cab6a1ff04b2fcc9462137f2b9fc284b46df5c
Opcode Fuzzy Hash: 708f62ab02d84b42226dea42d9c642bd027bf5e3d4e82d382ddd47a80a9e209b
Instruction Fuzzy Hash: 13112C36518A81CAD721CF25E4943EAB7A0FB8EB84F419225DA4D87714EF3CE519CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B428B4 Relevance: 7.5, APIs: 5, Instructions: 46encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B42658: #690.IERTUTIL ref: 00007FF674B426B9
Part of subcall function 00007FF674B42658: wcsncmp.MSVCRT ref: 00007FF674B426DF
Part of subcall function 00007FF674B42658: RegOpenKeyExW.ADVAPI32 ref: 00007FF674B42714
Part of subcall function 00007FF674B42658: RegCreateKeyExW.ADVAPI32 ref: 00007FF674B42759
Part of subcall function 00007FF674B42658: CertOpenStore.CRYPT32 ref: 00007FF674B42789
Part of subcall function 00007FF674B42658: RegCloseKey.ADVAPI32 ref: 00007FF674B427EA
Part of subcall function 00007FF674B42658: RegCloseKey.ADVAPI32 ref: 00007FF674B427FB

CertEnumCertificatesInStore.CRYPT32 ref: 00007FF674B428E2
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF674B41691), ref: 00007FF674B428F6
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF674B41691), ref: 00007FF674B42910
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF674B41691), ref: 00007FF674B42925
CertCloseStore.CRYPT32 ref: 00007FF674B42946

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CertCloseErrorLastStore$Open$#690CertificatesCreateEnumwcsncmp
String ID:
API String ID: 3604553212-0
Opcode ID: bc792a905b81199ed5dd7cf56ca4bae12c518b21cdea93072ef47507df7e579a
Instruction ID: 1c0d92d621da20fd703837e48fa9c405bd8eda3d34d18d5df4dab0b8202249a0
Opcode Fuzzy Hash: bc792a905b81199ed5dd7cf56ca4bae12c518b21cdea93072ef47507df7e579a
Instruction Fuzzy Hash: 96114C23B24B82CAE7444B69A8D8379A6A0FF9EFC5F449130DA4EC3204DF7CD8048700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B452AC Relevance: 7.5, APIs: 6, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,00007FF674B4519F), ref: 00007FF674B452CD
HeapFree.KERNEL32(?,?,?,00007FF674B4519F), ref: 00007FF674B452E1
GetProcessHeap.KERNEL32(?,?,?,00007FF674B4519F), ref: 00007FF674B452FB
HeapFree.KERNEL32(?,?,?,00007FF674B4519F), ref: 00007FF674B4530F
GetProcessHeap.KERNEL32(?,?,?,00007FF674B4519F), ref: 00007FF674B45329
HeapFree.KERNEL32(?,?,?,00007FF674B4519F), ref: 00007FF674B4533D

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 9c1ccea412562e06cead4470327ebdc00304fd1a316e3f9d2135adfdf34fcef6
Instruction ID: 15a78786f2df505c4e643f1976eac0e6c447b9d3668e894fe633780ccf85c6bf
Opcode Fuzzy Hash: 9c1ccea412562e06cead4470327ebdc00304fd1a316e3f9d2135adfdf34fcef6
Instruction Fuzzy Hash: 12112A36A24B81C6E7048B6AA658379ABA1FB8FFD5F099234CE0A47714DF38E4458200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B372DC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 214COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B36E8C: CreateUri.URLMON ref: 00007FF674B36EDA
Part of subcall function 00007FF674B36E8C: SysFreeString.OLEAUT32 ref: 00007FF674B36F4D

CreateIUriBuilder.URLMON(?,?,?,00007FF674B33499), ref: 00007FF674B37343
UrlEscapeW.SHLWAPI(?,?,?,00007FF674B33499), ref: 00007FF674B37374
SysFreeString.OLEAUT32 ref: 00007FF674B375B5

Strings

%.*s%s%s=%s%.*s, xrefs: 00007FF674B374B0

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CreateFreeString$BuilderEscape
String ID: %.*s%s%s=%s%.*s
API String ID: 1165466252-2473103020
Opcode ID: 45b54442e8504d07e12223d4ea5c0af13c51757fe82d7f42a61899a280dab157
Instruction ID: 78289e9480479824b8a79d5a36e60cc0b7356bf545bbf3499856e3f73a76bc93
Opcode Fuzzy Hash: 45b54442e8504d07e12223d4ea5c0af13c51757fe82d7f42a61899a280dab157
Instruction Fuzzy Hash: 25A15D37718B46C6EB548F6AE484669B7A0FB8AF84F508131DA4D83B64DF3CE845CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B43738 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 113libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF674B437B5
GetProcAddress.KERNEL32 ref: 00007FF674B437D2

Strings

RtlQueryFeatureConfiguration, xrefs: 00007FF674B437C8
ntdll.dll, xrefs: 00007FF674B437AE

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RtlQueryFeatureConfiguration$ntdll.dll
API String ID: 1646373207-4111156962
Opcode ID: ff4ce8cbd6aef6cb2545a792f662ded6eacd254b3d43cf5fdd25bc099ded1673
Instruction ID: d038cc9f8b5ec6cc8fa6ef4833ebee3c9dd552c60912f4c3b86625945b42d911
Opcode Fuzzy Hash: ff4ce8cbd6aef6cb2545a792f662ded6eacd254b3d43cf5fdd25bc099ded1673
Instruction Fuzzy Hash: FD417F77B29B428BEB548B19E884665B6A0FB95BD0F085035DA5E83750EF3CE845CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B3D708 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

#791.IERTUTIL ref: 00007FF674B3D734
#660.IERTUTIL ref: 00007FF674B3D750

Part of subcall function 00007FF674B27944: #652.IERTUTIL ref: 00007FF674B27978

#660.IERTUTIL ref: 00007FF674B3D803

Strings

Low, xrefs: 00007FF674B3D7C8

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: #660$#652#791
String ID: Low
API String ID: 1912657141-2865053249
Opcode ID: c0c388e4f501b1343f714e18dfc0c900613578cec6049a7754bd568e96714392
Instruction ID: b05509d2ed9897274de22622e594c100c166dfad9d9dc4364170aa958b5aed89
Opcode Fuzzy Hash: c0c388e4f501b1343f714e18dfc0c900613578cec6049a7754bd568e96714392
Instruction Fuzzy Hash: B1313062B28A83C7FB509B65E8D93BA6354EF87F84F804035DA5DC7695DE2CE805C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2A034 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

iswalpha.MSVCRT ref: 00007FF674B2A058
wcsncmp.MSVCRT(?,?,?,00007FF674B2A7D1,?,?,?,?,?,?,?,?,Software\Microsoft\Windows\CurrentVersion\Policies,?,00000104,?), ref: 00007FF674B2A0E3
iswalpha.MSVCRT ref: 00007FF674B2A0F7

Strings

\\?\, xrefs: 00007FF674B2A0D9

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: iswalpha$wcsncmp
String ID: \\?\
API String ID: 1827288291-4282027825
Opcode ID: 8905a606073eae4a5cc23113bb84bbfe3cbc7af7e9bc4174df03e98159e8b837
Instruction ID: 5b9b4022261517ce2929f2f4796b596bb50f9187624bafebaae8c6c3ad07cdf2
Opcode Fuzzy Hash: 8905a606073eae4a5cc23113bb84bbfe3cbc7af7e9bc4174df03e98159e8b837
Instruction Fuzzy Hash: BE317023A28603C1EB54DF25E49827AA2A4EF4BFA5F449035CA0DD32C4DF6DEC99C301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2A3FC Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B2AF6C: wcschr.MSVCRT ref: 00007FF674B2AF7E
Part of subcall function 00007FF674B2AF6C: wcschr.MSVCRT ref: 00007FF674B2AF9B
Part of subcall function 00007FF674B2AF6C: wcschr.MSVCRT ref: 00007FF674B2AFB6

wcsncmp.MSVCRT ref: 00007FF674B2A430

Strings

.lnk, xrefs: 00007FF674B2A48B
\\?\, xrefs: 00007FF674B2A429
\, xrefs: 00007FF674B2A465

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: wcschr$wcsncmp
String ID: .lnk$\$\\?\
API String ID: 511192645-3340180466
Opcode ID: 12781204174246d00d7153b5e28fd67304a95d37bef90932ca220a45398a763f
Instruction ID: a5f20c1451697b3e570b8243bb4a68fc940b5b94a9adc7333d1cfb5943e136b8
Opcode Fuzzy Hash: 12781204174246d00d7153b5e28fd67304a95d37bef90932ca220a45398a763f
Instruction Fuzzy Hash: E221B813B28B42C1EE60DB59E58C178A292DF4AFA4F544532DA5D87F94DE7CEC80C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B3DFF4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B3E57C: #791.IERTUTIL(?,?,?,?,00000000,?,?,00007FF674B3E02D), ref: 00007FF674B3E5CB
Part of subcall function 00007FF674B3E57C: CreateFileW.KERNEL32 ref: 00007FF674B3E600
Part of subcall function 00007FF674B3E57C: GetLastError.KERNEL32 ref: 00007FF674B3E60F

memset.MSVCRT ref: 00007FF674B3E042

Part of subcall function 00007FF674B3E69C: GetFullPathNameW.KERNEL32 ref: 00007FF674B3E6DB
Part of subcall function 00007FF674B3E69C: LCMapStringW.KERNEL32 ref: 00007FF674B3E71C

OpenMutexW.KERNEL32 ref: 00007FF674B3E0CF

Part of subcall function 00007FF674B3E1D8: CreateMutexW.KERNEL32(?,?,?,?,?,?,?,00007FF674B3E155,?,?,00000000,00007FF674B3DE97,?,?,00000000,00007FF674B40BDC), ref: 00007FF674B3E1FC
Part of subcall function 00007FF674B3E1D8: #50.IERTUTIL(?,?,?,?,?,?,?,00007FF674B3E155,?,?,00000000,00007FF674B3DE97,?,?,00000000,00007FF674B40BDC), ref: 00007FF674B3E217
Part of subcall function 00007FF674B3E1D8: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,00007FF674B3E155,?,?,00000000,00007FF674B3DE97,?,?,00000000,00007FF674B40BDC), ref: 00007FF674B3E22D
Part of subcall function 00007FF674B3E1D8: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,00007FF674B3E155,?,?,00000000,00007FF674B3DE97,?,?,00000000,00007FF674B40BDC), ref: 00007FF674B3E23C
Part of subcall function 00007FF674B3E1D8: DuplicateHandle.KERNEL32 ref: 00007FF674B3E266
Part of subcall function 00007FF674B3E1D8: CloseHandle.KERNEL32(?,?,?,?,?,?,?,00007FF674B3E155,?,?,00000000,00007FF674B3DE97,?,?,00000000,00007FF674B40BDC), ref: 00007FF674B3E2CA

Strings

Local\IEHistJournalMx_1699bb90-bebe-4437-b6e8-a6b7123fa38e_, xrefs: 00007FF674B3E072
Local\IEHistJournalFm_24c20119-753b-4f33-887d-f2381810562d_, xrefs: 00007FF674B3E0A9

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CreateCurrentHandleMutexProcess$#791CloseDuplicateErrorFileFullLastNameOpenPathStringmemset
String ID: Local\IEHistJournalFm_24c20119-753b-4f33-887d-f2381810562d_$Local\IEHistJournalMx_1699bb90-bebe-4437-b6e8-a6b7123fa38e_
API String ID: 1835007835-223612499
Opcode ID: ca36de9cfc639684a43628448f5b0e6451a92d5799841ab4c09a911419569783
Instruction ID: ac5f57f01d825ae80e66d740c3ebdd8cd21f87dc449078f9f4ed27400d7cf87b
Opcode Fuzzy Hash: ca36de9cfc639684a43628448f5b0e6451a92d5799841ab4c09a911419569783
Instruction Fuzzy Hash: DE219363728B81C2E740DB65E5897EA63A0EB8AB84F440132EA8D87759DF3CD915C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B266E8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64windowtimethreadCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF674B21A63), ref: 00007FF674B26721

Part of subcall function 00007FF674B267E8: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00007FF674B26768), ref: 00007FF674B26832
Part of subcall function 00007FF674B267E8: PostThreadMessageW.USER32 ref: 00007FF674B26853

FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF674B21A63), ref: 00007FF674B26799
PostThreadMessageW.USER32 ref: 00007FF674B267B9

Strings

%1!02d!/%2!02d!/%3!04d!:%4!02d!:%5!02d!:%6!02d!: , xrefs: 00007FF674B26757

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Message$FormatPostThread$LocalTime
String ID: %1!02d!/%2!02d!/%3!04d!:%4!02d!:%5!02d!:%6!02d!:
API String ID: 2193567623-20010298
Opcode ID: cb63d83ca76231a31d7671baae62dffd1df182e9952ead777b19c6976d593e17
Instruction ID: 20e1f44a5c596e5d41e4c8d94d7ae3562154766ce244b628d48a0edc1d8aa9a0
Opcode Fuzzy Hash: cb63d83ca76231a31d7671baae62dffd1df182e9952ead777b19c6976d593e17
Instruction Fuzzy Hash: A9214633B24B11CAE7108FA0E4845ADBBB4F749B99B445529EE8D53B68EF38C594CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B29EE4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,00007FF674B2A54D,?,?,?,?,?,?,?,?,Software\Microsoft\Windows\CurrentVersion\Policies,?,00000104,?), ref: 00007FF674B29F4A
GetProcAddress.KERNEL32(?,?,?,00007FF674B2A54D,?,?,?,?,?,?,?,?,Software\Microsoft\Windows\CurrentVersion\Policies,?,00000104,?), ref: 00007FF674B29F60

Strings

ntdll.dll, xrefs: 00007FF674B29F43
RtlAreLongPathsEnabled, xrefs: 00007FF674B29F59

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RtlAreLongPathsEnabled$ntdll.dll
API String ID: 1646373207-3809284139
Opcode ID: 6610c3df13943d460628f4b556de26dce6c0d8b6d1dd3bdba30ca0b3bda2a049
Instruction ID: 701e57e522612e3916d2dd5a5dda56946e3db2ca55ef8f3cc09b087ab6aa935e
Opcode Fuzzy Hash: 6610c3df13943d460628f4b556de26dce6c0d8b6d1dd3bdba30ca0b3bda2a049
Instruction Fuzzy Hash: 4B111767F39602CAFFA58B25E4A83B97690BF57F45F585435C80E86390EE2DBC448200

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2CE24 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetUserPreferredUILanguages.KERNEL32(?,?,00000000,00007FF674B2CDB5,?,?,00000000,00007FF674B2C9E8), ref: 00007FF674B2CE46

Part of subcall function 00007FF674B21918: GetProcessHeap.KERNEL32 ref: 00007FF674B21921
Part of subcall function 00007FF674B21918: HeapAlloc.KERNEL32 ref: 00007FF674B21938

memset.MSVCRT ref: 00007FF674B2CE93
GetUserPreferredUILanguages.KERNEL32(?,?,00000000,00007FF674B2CDB5,?,?,00000000,00007FF674B2C9E8), ref: 00007FF674B2CEAC

Strings

zh-cn, xrefs: 00007FF674B2CEC3

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: HeapLanguagesPreferredUser$AllocProcessmemset
String ID: zh-cn
API String ID: 724727097-1604153623
Opcode ID: 12b7172c76ebfab11d48bfc9e17e5b10c02491ebd9e620c2a7437f553ce72003
Instruction ID: d1e78a1950d2ad882457958c865618d35dd303f67a6d9dffc2d620b118830fda
Opcode Fuzzy Hash: 12b7172c76ebfab11d48bfc9e17e5b10c02491ebd9e620c2a7437f553ce72003
Instruction Fuzzy Hash: DF117533A24681C6DB44DF65E4C45B9B7A0EB8AFC4B459036DA0E87754DF38ED45CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B25858 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF674B258A2

Part of subcall function 00007FF674B21574: _vsnwprintf.MSVCRT ref: 00007FF674B215B4

RegCloseKey.ADVAPI32 ref: 00007FF674B25910

Strings

Software\Classes\Local Settings\MuiCache, xrefs: 00007FF674B25898
@%s, xrefs: 00007FF674B258B5

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CloseOpen_vsnwprintf
String ID: @%s$Software\Classes\Local Settings\MuiCache
API String ID: 2342809593-1369442998
Opcode ID: 4778afca581fe4c2ec7cf257b6e044eebec4e554100dbd66bd5dc58f4120dd82
Instruction ID: 8393e84fb068a8c9aad3e4e4a0532576a739b82f8890b44a0f821e657ca270e7
Opcode Fuzzy Hash: 4778afca581fe4c2ec7cf257b6e044eebec4e554100dbd66bd5dc58f4120dd82
Instruction Fuzzy Hash: 10215633728A81C2EA50CB15E8C82BAA260FF9AF84F450531DA4D87785DF3DD904C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B36DD0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

StrCmpICW.SHLWAPI(?,?,?,00007FF674B36EB9), ref: 00007FF674B36E12
SysAllocString.OLEAUT32 ref: 00007FF674B36E49

Strings

about:home, xrefs: 00007FF674B36E08
about:blank, xrefs: 00007FF674B36E21

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: AllocString
String ID: about:blank$about:home
API String ID: 2525500382-1158670746
Opcode ID: a45c483eb91492c9d0574b30df03977aab2d589e597594d87eefae69b77105cf
Instruction ID: 9ac5c089ceb1bccafc97750ea9effbb969b972f9e11381bfea4cc9abd1d30cd1
Opcode Fuzzy Hash: a45c483eb91492c9d0574b30df03977aab2d589e597594d87eefae69b77105cf
Instruction Fuzzy Hash: D911512362968182FA50DB29E8952A9A2A4EF85F90F864031EE4D83759DF7CD846C600

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B42BF4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF674B42C2B
GetProcAddress.KERNEL32 ref: 00007FF674B42C48

Strings

NtUpdateWnfStateData, xrefs: 00007FF674B42C3E
ntdll.dll, xrefs: 00007FF674B42C24

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtUpdateWnfStateData$ntdll.dll
API String ID: 1646373207-3251081820
Opcode ID: 978806689a33224d62decafdfc6581833d93efe07ea16e4602e8d24810a1ad67
Instruction ID: 8139eb1558a74bee1ff7bf9e32fb4d3036b07a9c048238e527c037544daf3184
Opcode Fuzzy Hash: 978806689a33224d62decafdfc6581833d93efe07ea16e4602e8d24810a1ad67
Instruction Fuzzy Hash: 8611FB76A28B92C6EB508B09F498665F7A0FB4AFC4F454535D94D87B54EF3CE844CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B25560 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32 ref: 00007FF674B25587
RegCreateKeyW.ADVAPI32 ref: 00007FF674B255A7
RegSetValueExW.ADVAPI32 ref: 00007FF674B255F6

Strings

Implementing, xrefs: 00007FF674B255BC

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CreateOpenValue
String ID: Implementing
API String ID: 2195001959-2263074448
Opcode ID: 67e30a86f41d69680b2b9d6c17cf86694e57295e31f4382248cff80b9d65b3af
Instruction ID: db83435790f83abb5c84856e97a20c3bc704d6eb71a2fa02ff1b54a2e479427f
Opcode Fuzzy Hash: 67e30a86f41d69680b2b9d6c17cf86694e57295e31f4382248cff80b9d65b3af
Instruction Fuzzy Hash: DC117773628A81C6EB508B64E48426AF7A0FB9DF90F515231EA4E87794DF7CD584CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B42B4C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF674B42B7B
GetProcAddress.KERNEL32 ref: 00007FF674B42B98

Strings

NtQueryWnfStateData, xrefs: 00007FF674B42B8E
ntdll.dll, xrefs: 00007FF674B42B74

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtQueryWnfStateData$ntdll.dll
API String ID: 1646373207-3115237368
Opcode ID: ba2e491b3dbb56c872d368d3a089219b561215f90e3d822142373721b1568491
Instruction ID: 7768500e62e111581e26d6db862c33b870f9c865235f75a9348e73e537dbac24
Opcode Fuzzy Hash: ba2e491b3dbb56c872d368d3a089219b561215f90e3d822142373721b1568491
Instruction Fuzzy Hash: 9E013926A29B46C2EA108F09F898529F7A0FF4AFC0B454131D94D83764EE3CE884CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B29E50 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF674B29E86
GetProcAddress.KERNEL32 ref: 00007FF674B29EA3

Strings

RtlDisownModuleHeapAllocation, xrefs: 00007FF674B29E99
ntdll.dll, xrefs: 00007FF674B29E7F

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RtlDisownModuleHeapAllocation$ntdll.dll
API String ID: 1646373207-704576883
Opcode ID: 325b02f8112d2c4dd9222ad764e22ff6498a5bc0369ff82a7b7ffd9f0ee0d3ed
Instruction ID: 0d227a3ad0d273b520aee8d2dbbb6125ba078d2ccc8033371babd209d8a717f5
Opcode Fuzzy Hash: 325b02f8112d2c4dd9222ad764e22ff6498a5bc0369ff82a7b7ffd9f0ee0d3ed
Instruction Fuzzy Hash: 2B011A36B29B92C2FA548B56F8D8135F6A0BF4AF80B445535D95D87768EF3CE889C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2F3AC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32 ref: 00007FF674B2F3E2
SHSendMessageBroadcastW.SHLWAPI ref: 00007FF674B2F41F

Strings

0u, xrefs: 00007FF674B2F3CA
Software\Microsoft\Internet Explorer\SearchScopes, xrefs: 00007FF674B2F410

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: MessageSend$BroadcastTimeout
String ID: 0u$Software\Microsoft\Internet Explorer\SearchScopes
API String ID: 3425702700-4149236433
Opcode ID: 6f3e3e78bfbe61eae2c21084f971a3e4db11849af9f853ffeeab749fde9d3730
Instruction ID: 2460747e518ca7557966b20420abab9f196997dd3cd4a84a40a280075b3efe58
Opcode Fuzzy Hash: 6f3e3e78bfbe61eae2c21084f971a3e4db11849af9f853ffeeab749fde9d3730
Instruction Fuzzy Hash: C8018F73A24B41C7E754CF28E8842AAB7A1FB86B45F545135C94E83794DF3CE986CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2D094 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B2D130: memset.MSVCRT ref: 00007FF674B2D169
Part of subcall function 00007FF674B2D130: GetUserDefaultLocaleName.KERNELBASE ref: 00007FF674B2D17A
Part of subcall function 00007FF674B2D130: _wcsnicmp.MSVCRT ref: 00007FF674B2D1A3
Part of subcall function 00007FF674B2D130: GetSystemDefaultLocaleName.KERNELBASE ref: 00007FF674B2D1DB
Part of subcall function 00007FF674B2D130: _wcsnicmp.MSVCRT ref: 00007FF674B2D1F9

memset.MSVCRT ref: 00007FF674B2D0D1
GetSystemDefaultLocaleName.KERNELBASE ref: 00007FF674B2D0DE
_wcsnicmp.MSVCRT ref: 00007FF674B2D0FA

Strings

zh-CN, xrefs: 00007FF674B2D0EE

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: DefaultLocaleName_wcsnicmp$Systemmemset$User
String ID: zh-CN
API String ID: 2466754949-4051137917
Opcode ID: 7412364b922baefeac7ed78c498e50b6f103cdd8c1bb1d7b821a7b0cdea23a7d
Instruction ID: 819f9722760dcfc5687c1db3e6bfc96fbc89a888a89183ff2e9a7621d3fcc60b
Opcode Fuzzy Hash: 7412364b922baefeac7ed78c498e50b6f103cdd8c1bb1d7b821a7b0cdea23a7d
Instruction Fuzzy Hash: 74015E33628682C2EB60DB24E4953B9B361FB96B49F805031D98E83645DF3CD549CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B29D50 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF674B29D7D
GetProcAddress.KERNEL32 ref: 00007FF674B29D9A

Strings

RtlNtStatusToDosErrorNoTeb, xrefs: 00007FF674B29D90
ntdll.dll, xrefs: 00007FF674B29D76

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RtlNtStatusToDosErrorNoTeb$ntdll.dll
API String ID: 1646373207-1321910969
Opcode ID: 529a0ab4ea28b072d3adebcf01f2b28696179c6e20dd8fe9857c5c5559e5e118
Instruction ID: 43a87cd213630a3d580d82466d014e3978369b4451ae36800b68db6f8c373205
Opcode Fuzzy Hash: 529a0ab4ea28b072d3adebcf01f2b28696179c6e20dd8fe9857c5c5559e5e118
Instruction Fuzzy Hash: CCF0BB26B29B42C6EE458B59F4E8175F6A4BF4BF80B495035C91D86354EE3CEC88D300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B29DD0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF674B29DF7
GetProcAddress.KERNEL32 ref: 00007FF674B29E14

Strings

ntdll.dll, xrefs: 00007FF674B29DF0
RtlDllShutdownInProgress, xrefs: 00007FF674B29E0A

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RtlDllShutdownInProgress$ntdll.dll
API String ID: 1646373207-582119455
Opcode ID: a1a0870a2c7b89d3d70ccdc3009ca4638aaf9076faf5fbb6f8fd8e1b55bd97c7
Instruction ID: 33344ea240eaebeadf35a884bdbd8d6d7a102feeddcb553adb931b68bb39aac0
Opcode Fuzzy Hash: a1a0870a2c7b89d3d70ccdc3009ca4638aaf9076faf5fbb6f8fd8e1b55bd97c7
Instruction Fuzzy Hash: 33F0A436A2AB43C6FE859B94F8D8175B7A0AF1BF41B441475C81D86360EF3CAC88C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2AF6C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 00007FF674B2AF7E
wcschr.MSVCRT ref: 00007FF674B2AF9B
wcschr.MSVCRT ref: 00007FF674B2AFB6

Strings

.lnk, xrefs: 00007FF674B2AF77, 00007FF674B2AF94

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: wcschr
String ID: .lnk
API String ID: 1497570035-24824748
Opcode ID: b476977faa064f2c98e2c5415e8122cf951e04792a3be6ca796d9cdcd0ab51b3
Instruction ID: e27725d9ae6d27239b55d74cf6dca648012861a703cf17f8b5416d0a164708e2
Opcode Fuzzy Hash: b476977faa064f2c98e2c5415e8122cf951e04792a3be6ca796d9cdcd0ab51b3
Instruction Fuzzy Hash: BFF01D32A26606CAEE04CB10E4C8278F761FB5EF09F889530C90DC6654EF3CAC89C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B28930 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF674B2894F
GetProcAddress.KERNEL32 ref: 00007FF674B28965

Strings

RaiseFailFastException, xrefs: 00007FF674B2895E
kernelbase.dll, xrefs: 00007FF674B28945

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RaiseFailFastException$kernelbase.dll
API String ID: 1646373207-919018592
Opcode ID: ec1ab4963161daf65c9f295ada60badb5975ea094209b7d17fae4cef2e4d209e
Instruction ID: 01ae97373966db43a2e5a1c55d0d0872291db910ea430c2c0f6a590629f1bdd0
Opcode Fuzzy Hash: ec1ab4963161daf65c9f295ada60badb5975ea094209b7d17fae4cef2e4d209e
Instruction Fuzzy Hash: 5FF0D036728B91D2EA454B06F598075E661FF4AFC0B489535DA4D47714DF3CD885C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B43CBC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF674B43CE4
GetProcAddress.KERNEL32 ref: 00007FF674B43D01

Strings

RtlUnregisterFeatureConfigurationChangeNotification, xrefs: 00007FF674B43CF7
ntdll.dll, xrefs: 00007FF674B43CDD

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RtlUnregisterFeatureConfigurationChangeNotification$ntdll.dll
API String ID: 1646373207-1836318313
Opcode ID: 861472fe62fcac2520ba6206cdf3b91ce8b8cc80c26636ae08eb756266b8c895
Instruction ID: a780e530a8552efc7d4b74814238b8e213a2a0679a82250223ea192ef35a2f89
Opcode Fuzzy Hash: 861472fe62fcac2520ba6206cdf3b91ce8b8cc80c26636ae08eb756266b8c895
Instruction Fuzzy Hash: FBF0A976A29B42D2FE558B45F8D8174E6A0AF5BF81B486135C81D86360EE3CA898C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B43C48 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF674B43C70
GetProcAddress.KERNEL32 ref: 00007FF674B43C8D

Strings

ntdll.dll, xrefs: 00007FF674B43C69
RtlUnsubscribeWnfNotificationWaitForCompletion, xrefs: 00007FF674B43C83

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RtlUnsubscribeWnfNotificationWaitForCompletion$ntdll.dll
API String ID: 1646373207-368597124
Opcode ID: 3049c999bce8b25c9dd2e805528ba28ae65de21aaf3702a7c96de8f326a53417
Instruction ID: 2fd0435bce4cf2f42ed2979fa0d875455319c610dc8e8555dee2bd38be8e1757
Opcode Fuzzy Hash: 3049c999bce8b25c9dd2e805528ba28ae65de21aaf3702a7c96de8f326a53417
Instruction Fuzzy Hash: 66F0A966A39B43C2FE559B55F8D8174F6A0AF4BF81F486035C81E86360EE3CA999C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B3B214 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

#651.IERTUTIL(00000001,?,?,?,00000001,00000001,?,00007FF674B36788), ref: 00007FF674B3B2D3
CoTaskMemFree.OLE32(?,00000001,00000001,?,00007FF674B36788), ref: 00007FF674B3B3BC
CoTaskMemFree.OLE32(?,00000001,00000001,?,00007FF674B36788), ref: 00007FF674B3B40F

Part of subcall function 00007FF674B3D250: SysFreeString.OLEAUT32 ref: 00007FF674B3D29B

CoTaskMemFree.OLE32(?,00000001,00000001,?,00007FF674B36788), ref: 00007FF674B3B464

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Free$Task$#651String
String ID:
API String ID: 2586053401-0
Opcode ID: e8577fdb0829290a446be47b258bcc0bbc949d914036d15d96dcabd148802ab3
Instruction ID: dd3e7115cbb76d92f43f22a63123f8a588450717bfd5c3b84596dbc41318997e
Opcode Fuzzy Hash: e8577fdb0829290a446be47b258bcc0bbc949d914036d15d96dcabd148802ab3
Instruction Fuzzy Hash: 33814E6362C682C2EA10DB66E8983BAB760FB86F84F414035DF4D8775ADF7DE9058704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B39838 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B38674: SysFreeString.OLEAUT32 ref: 00007FF674B387DC

SysStringLen.OLEAUT32 ref: 00007FF674B39880
SysFreeString.OLEAUT32 ref: 00007FF674B3997B
SysFreeString.OLEAUT32 ref: 00007FF674B3998B

Part of subcall function 00007FF674B37638: WideCharToMultiByte.KERNEL32 ref: 00007FF674B37689
Part of subcall function 00007FF674B37638: WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,00007FF674B37B27), ref: 00007FF674B376D9

SysFreeString.OLEAUT32 ref: 00007FF674B399A3

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: String$Free$ByteCharMultiWide
String ID:
API String ID: 1147213928-0
Opcode ID: 7af75bcef4ac888b84009e85356f050aee8c07f4cdf33415ba28b64d1f1702a7
Instruction ID: 82d3e280bb3620519029d3b53e062a1e50ca46ddea7e4bfaacdd83d8781ed87c
Opcode Fuzzy Hash: 7af75bcef4ac888b84009e85356f050aee8c07f4cdf33415ba28b64d1f1702a7
Instruction Fuzzy Hash: 77412E33B24B56C6EB008B7698883BC67A5FB86F98F114531DE5DA7B95CF38E9018740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B3A460 Relevance: 6.1, APIs: 4, Instructions: 103encryptionCOMMON

Download Yara Rule

APIs

CertGetCertificateChain.CRYPT32 ref: 00007FF674B3A4C6
CertFreeCertificateChain.CRYPT32 ref: 00007FF674B3A5B5

Part of subcall function 00007FF674B27724: InitOnceExecuteOnce.KERNEL32(?,?,?,?,00007FF674B2CBF9), ref: 00007FF674B2773C

CertVerifyCertificateChainPolicy.CRYPT32 ref: 00007FF674B3A528

Part of subcall function 00007FF674B34020: #796.IERTUTIL ref: 00007FF674B340C6

CertVerifyCertificateChainPolicy.CRYPT32 ref: 00007FF674B3A55B

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CertCertificateChain$OncePolicyVerify$#796ExecuteFreeInit
String ID:
API String ID: 2876893052-0
Opcode ID: b229a257957f0673dc6ffff8f45f8082e7830226e0fe465d2e5562a5c672266b
Instruction ID: 5821c978de071993588edc5175cd02dd44a041bf3c0201d04b444cb64e8fe5d0
Opcode Fuzzy Hash: b229a257957f0673dc6ffff8f45f8082e7830226e0fe465d2e5562a5c672266b
Instruction Fuzzy Hash: 0F412C33A28746CAE7108F35D4C83AC73A4FB5AB48F625135E60D87695DF79E994C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B34220 Relevance: 6.1, APIs: 4, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B34398: StrCmpW.SHLWAPI(?,?,00000001,00007FF674B3424C), ref: 00007FF674B343E2

#677.IERTUTIL ref: 00007FF674B342FC
#654.IERTUTIL ref: 00007FF674B34325
GetProcessHeap.KERNEL32 ref: 00007FF674B34337
HeapFree.KERNEL32 ref: 00007FF674B3434B

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Heap$#654#677FreeProcess
String ID:
API String ID: 3027164600-0
Opcode ID: 8d1676e6348f9a9a005560becea7c2c693df899d3e0704f5e87a42bc37155e89
Instruction ID: 4c2cf2268e2f65eed2342304263acecdf6b73a06820a22a17e373d9361f39149
Opcode Fuzzy Hash: 8d1676e6348f9a9a005560becea7c2c693df899d3e0704f5e87a42bc37155e89
Instruction Fuzzy Hash: 55414C37B24A52C7EB008B66D8442AC77A5FB8AF94F498132DE5C97794CF38E845C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B298C0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF674B29900
HeapAlloc.KERNEL32 ref: 00007FF674B29918
GetProcessHeap.KERNEL32 ref: 00007FF674B29933

Strings

P, xrefs: 00007FF674B298ED

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Heap$Process$Alloc
String ID: P
API String ID: 651230671-3110715001
Opcode ID: 0345d3ad1eaba446a8b575d645f2d279467e595c1d20cc6e5271e11f8fa7aa90
Instruction ID: a29bc8f0f80c7322a889e45ac6a6645c109f224483447ec3d2305b43f3b95df6
Opcode Fuzzy Hash: 0345d3ad1eaba446a8b575d645f2d279467e595c1d20cc6e5271e11f8fa7aa90
Instruction Fuzzy Hash: 98413A23B24651C2EB24CF56E488279B7A0FB5AF94B484535DB8E87754EF3CE891C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B3BEA0 Relevance: 6.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

VariantCopy.OLEAUT32 ref: 00007FF674B3BF07
VariantCopy.OLEAUT32 ref: 00007FF674B3BF42
VariantCopy.OLEAUT32 ref: 00007FF674B3BF7F
SHStrDupW.SHLWAPI(?,?,00007FF674B36294,?,00000000,?,00007FF674B2EE33), ref: 00007FF674B3BFCD

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CopyVariant
String ID:
API String ID: 3840901598-0
Opcode ID: 6c8d80fced1518bd5aeb84ff22d0d2438a443bf8cae78f916e4200faf5a0accb
Instruction ID: e5cbe8df1726d72d741114e9c23c514ec7168665e09d3037e5a2d75adeda5fd5
Opcode Fuzzy Hash: 6c8d80fced1518bd5aeb84ff22d0d2438a443bf8cae78f916e4200faf5a0accb
Instruction Fuzzy Hash: 71416D63B28642CBEB108F25D498379B7A0FB49B44F50A035DB4D8325DEF38E995CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B33CC8 Relevance: 6.1, APIs: 4, Instructions: 88memoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF674B33D27
SysFreeString.OLEAUT32 ref: 00007FF674B33DD1
SysFreeString.OLEAUT32 ref: 00007FF674B33DFE
SysAllocString.OLEAUT32 ref: 00007FF674B33E1B

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: String$Free$Allocmemset
String ID:
API String ID: 1001048240-0
Opcode ID: 3fbe98b7ccb2cdf8d2797c0f2f5876d06265a66315b42ae60f9d685a108c8e47
Instruction ID: 16dd1ce48fac3ec7eee2d01df59592aabd971518d22302bd3905b3e4b1a1a2c3
Opcode Fuzzy Hash: 3fbe98b7ccb2cdf8d2797c0f2f5876d06265a66315b42ae60f9d685a108c8e47
Instruction Fuzzy Hash: 54413C23A28A82CAFA508B65E4C837AA7A0EF56F44F445131DA4CC6654DF2CE984C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B4535C Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B45880: AcquireSRWLockExclusive.KERNEL32(?,?,?,00007FF674B4538E), ref: 00007FF674B458DF
Part of subcall function 00007FF674B45880: ReleaseSRWLockExclusive.KERNEL32(?,?,?,00007FF674B4538E), ref: 00007FF674B45903

AcquireSRWLockExclusive.KERNEL32 ref: 00007FF674B453C9
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF674B4541D
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF674B45462
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF674B4547E

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID:
API String ID: 17069307-0
Opcode ID: f2d6d357a5c6e861bcd5f9ce7ce5464fecbef8d782c0958c18000f0f59de180d
Instruction ID: 972b104afc2449959c25f4acbb4645fba3a93cdea578bcb2baed004f73810e9c
Opcode Fuzzy Hash: f2d6d357a5c6e861bcd5f9ce7ce5464fecbef8d782c0958c18000f0f59de180d
Instruction Fuzzy Hash: F1316C27A28B52C6FA149B1A90D82B86790EF4BFD1F495031DF4E8B795CF6CEC458700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B3E57C Relevance: 6.1, APIs: 4, Instructions: 76fileCOMMON

Download Yara Rule

APIs

#791.IERTUTIL(?,?,?,?,00000000,?,?,00007FF674B3E02D), ref: 00007FF674B3E5CB
CreateFileW.KERNEL32 ref: 00007FF674B3E600
GetLastError.KERNEL32 ref: 00007FF674B3E60F
#134.IERTUTIL ref: 00007FF674B3E662

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: #134#791CreateErrorFileLast
String ID:
API String ID: 3111463030-0
Opcode ID: 9b3fa42b258e1af2ff0fddb85f60d35296ec5483da6e38b465a16a14830b53b2
Instruction ID: fcd70678d9e1a262667e37696652fb3766e4ea77518189f98a834b63109d73f3
Opcode Fuzzy Hash: 9b3fa42b258e1af2ff0fddb85f60d35296ec5483da6e38b465a16a14830b53b2
Instruction Fuzzy Hash: BA219533A14742C7E7108F66A444669BA91F79AFA0F498335CE6A837D4CF3CD845C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B455EC Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 00007FF674B4565B
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF674B45683
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF674B456B0
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF674B456EC

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID:
API String ID: 17069307-0
Opcode ID: 9484ef23ef66995cb8cebd05d3ba6ff4f16e486a42f3f3f8429a96a8b3686e52
Instruction ID: e3376f77ee3b70c90aa39a34142194ae2fef63b661d63f396eb1e1c50318e320
Opcode Fuzzy Hash: 9484ef23ef66995cb8cebd05d3ba6ff4f16e486a42f3f3f8429a96a8b3686e52
Instruction Fuzzy Hash: E3314723A19E82C5FB908F59A4983B967A0FB4AFD4F494431CE4D87685DF3CE945C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B4C280 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00007FF674B4C2F3
RtlLookupFunctionEntry.NTDLL ref: 00007FF674B4C312
RtlVirtualUnwind.NTDLL ref: 00007FF674B4C35F
__raise_securityfailure.LIBCMT ref: 00007FF674B4C444

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: 6104ea6d15c116b22e10311e22a450f8896651630cbd4009b77cb0c5c530354d
Instruction ID: 2c63c36ab332840b54c59cbbbcd275627f9d93c6ba449c21bb2a7adf3520a9a3
Opcode Fuzzy Hash: 6104ea6d15c116b22e10311e22a450f8896651630cbd4009b77cb0c5c530354d
Instruction Fuzzy Hash: BA41C736A29B01C1EA509B58F888369F7A4FB9AB84F904435E98DC2764DF7DE984C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B40CB8 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01b7fbef9da7edfe6e4d3f1f34d7361b19584e1a29772f2f3867b65ec92f4638
Instruction ID: 5d6da6a0324dd37402efaf5afbc923e1394aef076e996c987f92a25805400729
Opcode Fuzzy Hash: 01b7fbef9da7edfe6e4d3f1f34d7361b19584e1a29772f2f3867b65ec92f4638
Instruction Fuzzy Hash: A3216033B18B82CAE7104F59A4C4239AA94FB9AFD0B588234DA9EC3754DF3CE8149700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B3ED1C Relevance: 6.1, APIs: 4, Instructions: 56fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B3E480: SetFilePointer.KERNEL32(?,?,00000000,00007FF674B3ED3A), ref: 00007FF674B3E48E
Part of subcall function 00007FF674B3E480: GetLastError.KERNEL32(?,?,00000000,00007FF674B3ED3A), ref: 00007FF674B3E4A1
Part of subcall function 00007FF674B3E480: GetLastError.KERNEL32(?,?,00000000,00007FF674B3ED3A), ref: 00007FF674B3E4BB

ReadFile.KERNEL32 ref: 00007FF674B3ED60
GetLastError.KERNEL32 ref: 00007FF674B3ED86
GetLastError.KERNEL32 ref: 00007FF674B3EDA0

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$File$PointerRead
String ID:
API String ID: 839530781-0
Opcode ID: 4a702489ef7c82fbdc707b00079c7569a797754f8e54539d71e92391bc0f0f26
Instruction ID: 43e70eceb3d463883bf8289c0c97a079b9f1ba2c6c146dd4025c6165daba3109
Opcode Fuzzy Hash: 4a702489ef7c82fbdc707b00079c7569a797754f8e54539d71e92391bc0f0f26
Instruction Fuzzy Hash: 41215437618A42C7E3105F6AE48426ABBA0FB8AF80F548535DB4DC3654DF7DE804DB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B45930 Relevance: 6.0, APIs: 4, Instructions: 46threadtimeCOMMON

Download Yara Rule

APIs

CreateThreadpoolTimer.KERNEL32 ref: 00007FF674B45967
GetLastError.KERNEL32(?,?,?,00007FF674B45476), ref: 00007FF674B4597F

Part of subcall function 00007FF674B471FC: SetThreadpoolTimer.KERNEL32(?,?,00007FF674B458B3,00007FF674B46EEC), ref: 00007FF674B4720D
Part of subcall function 00007FF674B471FC: WaitForThreadpoolTimerCallbacks.KERNEL32(?,?,00007FF674B458B3,00007FF674B46EEC), ref: 00007FF674B47221

SetLastError.KERNEL32(?,?,?,00007FF674B45476), ref: 00007FF674B45997
SetThreadpoolTimer.KERNEL32(?,?,?,00007FF674B45476), ref: 00007FF674B459CC

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ThreadpoolTimer$ErrorLast$CallbacksCreateWait
String ID:
API String ID: 1675045912-0
Opcode ID: 4ffe3886d936dd9cf97f700037b8389747d06ca971561655349beef95bdcedae
Instruction ID: 10fbae276b388886ecd36ab77c84ef3c90215c89d109a7f43f687d2ad895d41b
Opcode Fuzzy Hash: 4ffe3886d936dd9cf97f700037b8389747d06ca971561655349beef95bdcedae
Instruction Fuzzy Hash: 8D117F23728B91CBE7109B19A48416D7B60FB4AFD0F445130DF4947B44CF38E8168700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B4C458 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00007FF674B4C463
RtlLookupFunctionEntry.NTDLL ref: 00007FF674B4C482
RtlVirtualUnwind.NTDLL ref: 00007FF674B4C4CF
__raise_securityfailure.LIBCMT ref: 00007FF674B4C545

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: d011016814abfa9f137b16db49bbe8797c0d7f4c6f76965e4151ae29e9a0422c
Instruction ID: d1fcd6b39ad681535dc0d642c4761af7774b92199184a71c32486e64b75bbc8e
Opcode Fuzzy Hash: d011016814abfa9f137b16db49bbe8797c0d7f4c6f76965e4151ae29e9a0422c
Instruction Fuzzy Hash: 4A21D436929B41C5E7509F58F888369F3A4FB86B84F500435EA8D83764DF7DE995C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B27AF4 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

#650.IERTUTIL ref: 00007FF674B27B34
#678.IERTUTIL ref: 00007FF674B27B55
GetProcessHeap.KERNEL32 ref: 00007FF674B27B68
HeapFree.KERNEL32 ref: 00007FF674B27B7C

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Heap$#650#678FreeProcess
String ID:
API String ID: 315297358-0
Opcode ID: 577d7a4dfe9738e694e253d3bc18a0e672679b04cb298def5968ab1958c18eca
Instruction ID: 04a8dbcd12f0e84b19633180f6bae7f3a8e23689a53f7e86e8509aad6e8fadf6
Opcode Fuzzy Hash: 577d7a4dfe9738e694e253d3bc18a0e672679b04cb298def5968ab1958c18eca
Instruction Fuzzy Hash: 2311F533A18B81C7E7008B16E4486A9BBA5F78AFD5F598234DB5C83714DF39E945CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B40810 Relevance: 6.0, APIs: 4, Instructions: 42fileCOMMON

Download Yara Rule

APIs

FlushViewOfFile.KERNEL32(?,?,80070000,00007FF674B3D8C7,?,?,?,?,?,?,00000000,00007FF674B3DF82), ref: 00007FF674B40831
GetLastError.KERNEL32(?,?,80070000,00007FF674B3D8C7,?,?,?,?,?,?,00000000,00007FF674B3DF82), ref: 00007FF674B40841
GetLastError.KERNEL32(?,?,80070000,00007FF674B3D8C7,?,?,?,?,?,?,00000000,00007FF674B3DF82), ref: 00007FF674B4085B

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$FileFlushView
String ID:
API String ID: 1289402859-0
Opcode ID: a990ed13d7ab2892ac924a7ef9e80ac26c524bb018c4a44be8a51b99141aedb2
Instruction ID: 6e2fd17df52497d84563d12442b623038e872cf3bf83d5a7402441cb582b255a
Opcode Fuzzy Hash: a990ed13d7ab2892ac924a7ef9e80ac26c524bb018c4a44be8a51b99141aedb2
Instruction Fuzzy Hash: E1017122B28A42CBEB145B79A8E833A76D0BF8EF85F549138C60EC7254DE2CDC044600

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B424A0 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

QueueUserWorkItem.KERNEL32 ref: 00007FF674B424BF
GetLastError.KERNEL32 ref: 00007FF674B424D6
GetLastError.KERNEL32 ref: 00007FF674B424F0

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$ItemQueueUserWork
String ID:
API String ID: 3747073370-0
Opcode ID: 14eacf8ad34e20e92eae9ff2b7d110eece5e15943b1edad12668735d67dbe069
Instruction ID: 71196caab8a2a056979d911d27510f83704aa83bb8d3525aa3810353606712ea
Opcode Fuzzy Hash: 14eacf8ad34e20e92eae9ff2b7d110eece5e15943b1edad12668735d67dbe069
Instruction Fuzzy Hash: 37012522B18A82CAE7144F5AA898275B694FF8AFC4F459134DA0EC7654CF7CE8449610

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B3A8A0 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00007FF674B3A8E9
VariantClear.OLEAUT32 ref: 00007FF674B3A8F8
VariantClear.OLEAUT32 ref: 00007FF674B3A908
CoTaskMemFree.OLE32 ref: 00007FF674B3A92C

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ClearVariant$FreeTask
String ID:
API String ID: 3803759766-0
Opcode ID: 083de675bfa0179a80c6382cde0368a67dd493d6665bec70bbd47de38c26da8b
Instruction ID: 3d762adc9102db66fd4e762580a2a15a1b4a0bda3840b9e79efda4253e6dbdb5
Opcode Fuzzy Hash: 083de675bfa0179a80c6382cde0368a67dd493d6665bec70bbd47de38c26da8b
Instruction Fuzzy Hash: 3B11BF33A19A82C6DA009F19E494179B774FB8AF94F544231DB4E43395CF3CE956C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B44F60 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF674B44F81
AcquireSRWLockExclusive.KERNEL32 ref: 00007FF674B44F90
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FF674B44FC7
LeaveCriticalSection.KERNEL32 ref: 00007FF674B44FDB

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CriticalExclusiveLockSection$AcquireEnterLeaveRelease
String ID:
API String ID: 1115728412-0
Opcode ID: 2740da7edc5023f3013e369249ed16852eadfd8aed36f7a2680fd41db22fe8c1
Instruction ID: 45a6de75c0ec357c4979a177c6192e3a1679c48a732bddba5df7793672dd01b2
Opcode Fuzzy Hash: 2740da7edc5023f3013e369249ed16852eadfd8aed36f7a2680fd41db22fe8c1
Instruction Fuzzy Hash: F0015263A28B82C3EE148B59A598179B760FB9FFD57189131DE4E43714DF3CE8918700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B3E480 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,00000000,00007FF674B3ED3A), ref: 00007FF674B3E48E
GetLastError.KERNEL32(?,?,00000000,00007FF674B3ED3A), ref: 00007FF674B3E4A1
GetLastError.KERNEL32(?,?,00000000,00007FF674B3ED3A), ref: 00007FF674B3E4BB
GetLastError.KERNEL32(?,?,00000000,00007FF674B3ED3A), ref: 00007FF674B3E4CE

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 2caabb295391575067a7288c4f57014de3cc3fa88c705d19cfaf46bc14124aa6
Instruction ID: 709d28cdcefa0bbd7b5630441e4763484260f86b8811291922088b44df44c44b
Opcode Fuzzy Hash: 2caabb295391575067a7288c4f57014de3cc3fa88c705d19cfaf46bc14124aa6
Instruction Fuzzy Hash: 4EF03C22B24A42CBF7142B7A98D93797AD0AF8FF51F549538CA1AC3690DE2CDC495610

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B3E400 Relevance: 6.0, APIs: 4, Instructions: 34synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(?,?,?,00007FF674B409D6), ref: 00007FF674B3E40A
GetLastError.KERNEL32(?,?,?,00007FF674B409D6), ref: 00007FF674B3E41C
GetLastError.KERNEL32(?,?,?,00007FF674B409D6), ref: 00007FF674B3E434
GetLastError.KERNEL32(?,?,?,00007FF674B409D6), ref: 00007FF674B3E447

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$MutexRelease
String ID:
API String ID: 3084565237-0
Opcode ID: f121569b6cc66ea61df892c088d04e2cd5a96ee013e412c85f6b2c4345931e00
Instruction ID: c94743f8d5c5899df4d1db69b6a5d006f6c6a6362a6e8e7d81705fc7daa2a5b8
Opcode Fuzzy Hash: f121569b6cc66ea61df892c088d04e2cd5a96ee013e412c85f6b2c4345931e00
Instruction Fuzzy Hash: 1DF04423B14E42CBE7001FBAA8D8279BAE4FF8EF85B959134C60AC3214DF2CDC444610

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B24B80 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 105fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B2A3FC: wcsncmp.MSVCRT ref: 00007FF674B2A430

Part of subcall function 00007FF674B2AB18: LocalFree.KERNEL32 ref: 00007FF674B2AD46

SHCreateDirectory.SHELL32 ref: 00007FF674B24C3D

Part of subcall function 00007FF674B245D0: GetShortPathNameW.KERNEL32 ref: 00007FF674B24622
Part of subcall function 00007FF674B245D0: GetShortPathNameW.KERNEL32 ref: 00007FF674B24672
Part of subcall function 00007FF674B245D0: PathFindFileNameW.SHLWAPI(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B24687
Part of subcall function 00007FF674B245D0: GetCurrentDirectoryW.KERNEL32(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B246B6
Part of subcall function 00007FF674B245D0: SetCurrentDirectoryW.KERNEL32(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B246CD
Part of subcall function 00007FF674B245D0: FindFirstFileW.KERNEL32(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B246ED
Part of subcall function 00007FF674B245D0: CoCreateInstance.OLE32(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B24724

Part of subcall function 00007FF674B245D0: StrCmpIW.SHLWAPI(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B247B4
Part of subcall function 00007FF674B245D0: StrCmpIW.SHLWAPI(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B247E0
Part of subcall function 00007FF674B245D0: PathRemoveBlanksW.SHLWAPI(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B2481E
Part of subcall function 00007FF674B245D0: StrCmpICW.SHLWAPI(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B24842
Part of subcall function 00007FF674B245D0: StrCmpICW.SHLWAPI(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B24860
Part of subcall function 00007FF674B245D0: FindNextFileW.KERNEL32(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B249CC
Part of subcall function 00007FF674B245D0: FindClose.KERNEL32(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B24A07
Part of subcall function 00007FF674B245D0: FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B24A68
Part of subcall function 00007FF674B245D0: lstrcmpW.KERNEL32(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B24A8C
Part of subcall function 00007FF674B245D0: lstrcmpW.KERNEL32(?,00000000,?,00000000,00000001,00000000,-000009FE,00007FF674B24D12), ref: 00007FF674B24AA7

PathFileExistsW.SHLWAPI ref: 00007FF674B24C98

Part of subcall function 00007FF674B2A334: wcschr.MSVCRT ref: 00007FF674B2A39C

Strings

-extoff, xrefs: 00007FF674B24CB0

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: FileFindPath$DirectoryName$CreateCurrentFirstShortlstrcmp$BlanksCloseExistsFreeInstanceLocalNextRemovewcschrwcsncmp
String ID: -extoff
API String ID: 3822344381-2466603806
Opcode ID: c74820fcb4a2a2f93b487c8b1967546ce1afa3201c7d9fbf7e440289c26192ec
Instruction ID: 60b564681767fc18897dcc4085bb4b1783cd5eab87dc1fcb2cdb3d8deca0fc65
Opcode Fuzzy Hash: c74820fcb4a2a2f93b487c8b1967546ce1afa3201c7d9fbf7e440289c26192ec
Instruction Fuzzy Hash: E7418333B24A82D6E721DF60D8896EA6764FB8AB84F405032DE4D97A95DF38DA05C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2F818 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B21918: GetProcessHeap.KERNEL32 ref: 00007FF674B21921
Part of subcall function 00007FF674B21918: HeapAlloc.KERNEL32 ref: 00007FF674B21938

SysFreeString.OLEAUT32 ref: 00007FF674B2F8F7
SysAllocString.OLEAUT32 ref: 00007FF674B2F906

Strings

UE00, xrefs: 00007FF674B2F8EB

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: AllocHeapString$FreeProcess
String ID: UE00
API String ID: 1731201402-1381591544
Opcode ID: 17f6459c08468355882be02e51cb817c036a6b031ab243b14968363aebf39485
Instruction ID: f601c57b8f3f14d9b4eeb56b4f711614337ca03ddc5dc2b334c8613e64450f7d
Opcode Fuzzy Hash: 17f6459c08468355882be02e51cb817c036a6b031ab243b14968363aebf39485
Instruction Fuzzy Hash: 4B312573A18B46C2EB54CB25E498369A7A0FB9AF88F154135CA4C87794DF3CE985C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B34A30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 00007FF674B34B0B

Strings

dsp, xrefs: 00007FF674B34A53
https://ieonline.microsoft.com/EUPP/v1/service?action=downloadcert&appid=Microsoft_IE_EUPP, xrefs: 00007FF674B34AC8

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: FreeString
String ID: dsp$https://ieonline.microsoft.com/EUPP/v1/service?action=downloadcert&appid=Microsoft_IE_EUPP
API String ID: 3341692771-2070162375
Opcode ID: ea82bb1b2e86758c26f27e03943679567735807967125d430fb171332bbd3d41
Instruction ID: 16492d48140288849c4abe4938f8a96f9e0df671cac4d40e7a1031f52016e670
Opcode Fuzzy Hash: ea82bb1b2e86758c26f27e03943679567735807967125d430fb171332bbd3d41
Instruction Fuzzy Hash: 0A213233A28B81C3E720CB11E8887AAB360F786B95F654135E68D87A58DF7DDC45CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B2FCD8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00007FF674B2FCEC

Part of subcall function 00007FF674B2163C: SysStringLen.OLEAUT32 ref: 00007FF674B21654
Part of subcall function 00007FF674B2163C: VarBstrCat.OLEAUT32 ref: 00007FF674B21676
Part of subcall function 00007FF674B2163C: SysFreeString.OLEAUT32 ref: 00007FF674B2168B

SysFreeString.OLEAUT32 ref: 00007FF674B2FD67

Part of subcall function 00007FF674B303C4: StrCmpICW.SHLWAPI ref: 00007FF674B303EB
Part of subcall function 00007FF674B303C4: StrCmpICW.SHLWAPI ref: 00007FF674B30402
Part of subcall function 00007FF674B303C4: StrCmpICW.SHLWAPI ref: 00007FF674B30419
Part of subcall function 00007FF674B303C4: StrCmpICW.SHLWAPI ref: 00007FF674B30430
Part of subcall function 00007FF674B303C4: StrCmpICW.SHLWAPI ref: 00007FF674B30447
Part of subcall function 00007FF674B303C4: StrCmpICW.SHLWAPI ref: 00007FF674B3045A
Part of subcall function 00007FF674B303C4: StrCmpICW.SHLWAPI ref: 00007FF674B3046D
Part of subcall function 00007FF674B303C4: StrCmpICW.SHLWAPI ref: 00007FF674B30480
Part of subcall function 00007FF674B303C4: SysFreeString.OLEAUT32 ref: 00007FF674B30554

Strings

&pc=, xrefs: 00007FF674B2FCE5

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: String$Free$AllocBstr
String ID: &pc=
API String ID: 3761010647-3864277979
Opcode ID: 495250f1939ba078fde6df1210045a948100059ffbccb603cf9ed9970849383b
Instruction ID: 1aab803b0e4902ccc23b1fd5ab200c58c83aad4592416e5026252e2ab2440834
Opcode Fuzzy Hash: 495250f1939ba078fde6df1210045a948100059ffbccb603cf9ed9970849383b
Instruction Fuzzy Hash: 1D112B27728A46C2EA00DB69E4D8279A760FF8AF80F544032DB4D87B65DF7DE845C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B26440 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32 ref: 00007FF674B2647C

Part of subcall function 00007FF674B2AD88: wcsncmp.MSVCRT(?,?,?,?,00000000,00007FF674B3D7D9), ref: 00007FF674B2ADB9

SHCreateDirectoryExW.SHELL32 ref: 00007FF674B264BD

Strings

Microsoft\Internet Explorer, xrefs: 00007FF674B264A2

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CreateDirectoryFolderPathwcsncmp
String ID: Microsoft\Internet Explorer
API String ID: 3141627564-1876886251
Opcode ID: 1c2af6220a707ccd682d11e67623f8456c1b84ebb8a8ad24e50317dee8785dd5
Instruction ID: 2631bf3a8208af7c8bd2365398a409e96d75c7f04ce87376681d735493fc3972
Opcode Fuzzy Hash: 1c2af6220a707ccd682d11e67623f8456c1b84ebb8a8ad24e50317dee8785dd5
Instruction Fuzzy Hash: 63119B22738B82C2FB64DB29A89937AA650EF8AFC4F445035DD5EC2785CE3CE8058600

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B272DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00007FF674B22A2C), ref: 00007FF674B2730E
CoTaskMemFree.OLE32 ref: 00007FF674B27359

Strings

StartMenuInternet, xrefs: 00007FF674B27339

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CreateFreeInstanceTask
String ID: StartMenuInternet
API String ID: 1992417041-1263441292
Opcode ID: 65c8765938c7bb8866d2c749a4acafbd5c50305eb6919e8ef7d4a0c0e61d20e9
Instruction ID: 172c8b4fc38ebeaf97f94ecd96a02d5e005bc4665b3a53e1ff6eb58b3edc49a1
Opcode Fuzzy Hash: 65c8765938c7bb8866d2c749a4acafbd5c50305eb6919e8ef7d4a0c0e61d20e9
Instruction Fuzzy Hash: 0211E727628B55C2EB408F16E4C8169B7B4FB8AF80B658135CA5D83764DE3ED885C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B49454 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B21574: _vsnwprintf.MSVCRT ref: 00007FF674B215B4

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF674B494B0
GetLastError.KERNEL32 ref: 00007FF674B494C0

Strings

D:(A;;GA;;;SY)(A;;0x%x;;;%s)S:(ML;;1;;;LW), xrefs: 00007FF674B4947F

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: DescriptorSecurity$ConvertErrorLastString_vsnwprintf
String ID: D:(A;;GA;;;SY)(A;;0x%x;;;%s)S:(ML;;1;;;LW)
API String ID: 3097636412-633327700
Opcode ID: 32a868900130f10a07f37e7b23fbb0cfe4507fe9e9fc30f5f8502ae82d30c165
Instruction ID: 0674c26a59bf338a14e321a716d90e73191d3506e06bf001e9a85b0b2e7a9af8
Opcode Fuzzy Hash: 32a868900130f10a07f37e7b23fbb0cfe4507fe9e9fc30f5f8502ae82d30c165
Instruction Fuzzy Hash: 2911A532718B82C7E7609B69E4D83A672D0FB8AB84F404131DA4DC7655DF3CD504C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B352A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23synchronizationCOMMON

Download Yara Rule

APIs

#74.IERTUTIL(?,?,00000000,00007FF674B2F241,?,?,00000000,00007FF674B2F16B), ref: 00007FF674B352B2
CreateMutexW.KERNEL32(?,?,00000000,00007FF674B2F241,?,?,00000000,00007FF674B2F16B), ref: 00007FF674B352D8

Strings

{5312EE61-79E3-4A24-BFE1-132B85B23C3A}, xrefs: 00007FF674B352C3

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: CreateMutex
String ID: {5312EE61-79E3-4A24-BFE1-132B85B23C3A}
API String ID: 1964310414-3805012793
Opcode ID: 7ca0a33b2076965cf598197e6da4bd3776b2a59d60b31e521d2ef4472e6c764b
Instruction ID: 4c47a30eeaf6b478f12c3f3355189e85f25904bdf5c3e9e40824824a8ffac6fb
Opcode Fuzzy Hash: 7ca0a33b2076965cf598197e6da4bd3776b2a59d60b31e521d2ef4472e6c764b
Instruction Fuzzy Hash: 94F01C33615B85D7D7088FA5F984069B6A1FB49B40785C439DA0E83314DF38E8A4C704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B22AE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B266E8: GetLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF674B21A63), ref: 00007FF674B26721
Part of subcall function 00007FF674B266E8: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF674B21A63), ref: 00007FF674B26799
Part of subcall function 00007FF674B266E8: PostThreadMessageW.USER32 ref: 00007FF674B267B9

CoInitializeEx.OLE32 ref: 00007FF674B22AFE

Part of subcall function 00007FF674B27D24: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,00007FF674B22B13), ref: 00007FF674B27D69
Part of subcall function 00007FF674B27D24: RegQueryValueExW.ADVAPI32(?,?,?,?,?,00007FF674B22B13), ref: 00007FF674B27D94
Part of subcall function 00007FF674B27D24: RegCloseKey.ADVAPI32(?,?,?,?,?,00007FF674B22B13), ref: 00007FF674B27DB2
Part of subcall function 00007FF674B27D24: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,00007FF674B22B13), ref: 00007FF674B27DF2
Part of subcall function 00007FF674B27D24: RegQueryValueExW.ADVAPI32 ref: 00007FF674B27E2C
Part of subcall function 00007FF674B27D24: RegCloseKey.ADVAPI32 ref: 00007FF674B27E50

Part of subcall function 00007FF674B2607C: CoInitializeEx.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF674B22A2C), ref: 00007FF674B260CC
Part of subcall function 00007FF674B2607C: RegOpenKeyExW.ADVAPI32 ref: 00007FF674B262B2

CoUninitialize.OLE32 ref: 00007FF674B22B20

Strings

In CmdApplySpadSettingsDuringMigration, xrefs: 00007FF674B22AE4

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Open$CloseInitializeMessageQueryValue$FormatLocalPostThreadTimeUninitialize
String ID: In CmdApplySpadSettingsDuringMigration
API String ID: 2480159940-3820774719
Opcode ID: 4174367b1b6ce160e34bf50ea1cbdb3962c900a571d6c64543995f93222ddfab
Instruction ID: ce68a50f41c62e1abeaa1e1fe0419771f0fde7324b407cfd98e809d61ec5cd91
Opcode Fuzzy Hash: 4174367b1b6ce160e34bf50ea1cbdb3962c900a571d6c64543995f93222ddfab
Instruction Fuzzy Hash: F1E0C922A28502C6E705AB31E8891B9E6A1EF8BF41F848175C10EC21A1DE2DED86C600

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B44950 Relevance: 5.2, APIs: 4, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF674B44C57
HeapFree.KERNEL32 ref: 00007FF674B44C6B
GetProcessHeap.KERNEL32 ref: 00007FF674B44CA0
HeapFree.KERNEL32 ref: 00007FF674B44CB4

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: f997c205010fc288fd5a0b7228d4dcfc87ea2b7f868bf142573f121389f65ca2
Instruction ID: 31957668dd7b617868b6b591f23ab7d5cec0e23418f6d52680bb59ed3e0082ca
Opcode Fuzzy Hash: f997c205010fc288fd5a0b7228d4dcfc87ea2b7f868bf142573f121389f65ca2
Instruction Fuzzy Hash: F5B17E37A18B91C9EB10CFA9E4841AD77B0FB4AB88F144125EE8C57B59DF78D865C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B44150 Relevance: 5.1, APIs: 4, Instructions: 100memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF674B44598: memmove_s.MSVCRT ref: 00007FF674B4488A

GetProcessHeap.KERNEL32 ref: 00007FF674B44205
HeapFree.KERNEL32 ref: 00007FF674B44219
GetProcessHeap.KERNEL32 ref: 00007FF674B44235
HeapFree.KERNEL32 ref: 00007FF674B44249

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Heap$FreeProcess$memmove_s
String ID:
API String ID: 2685253353-0
Opcode ID: 9f2f6f9ad99aa444c833984ef1cebe2f90c4001b7b8e9d91fe6567ba2f5a6c7a
Instruction ID: 2470a22a66e0053a32ae65f7fa55113586847925f0dde1380dc583cfb2391825
Opcode Fuzzy Hash: 9f2f6f9ad99aa444c833984ef1cebe2f90c4001b7b8e9d91fe6567ba2f5a6c7a
Instruction Fuzzy Hash: D941C133A28B81C6EB509F2AA4886A9B7A1FB8BFC4F549131DE4C53755CF38D895C300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B43F2C Relevance: 5.1, APIs: 4, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF674B43F89
HeapFree.KERNEL32 ref: 00007FF674B43F9D
GetProcessHeap.KERNEL32 ref: 00007FF674B43FCA
HeapFree.KERNEL32 ref: 00007FF674B43FDE

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: ca1b178f4e981ad6c83a3b974d5f4151b27e41fa69016bcf32e1961a2c0f62a6
Instruction ID: 4b342cf05d01972b0f174fcfd74d5a6e8b29e134d8960d2cfe321ed7255668d4
Opcode Fuzzy Hash: ca1b178f4e981ad6c83a3b974d5f4151b27e41fa69016bcf32e1961a2c0f62a6
Instruction Fuzzy Hash: 26315A27A14F94CAD3418F29A550269BB70F79AF94F18A224CF8C27715DF34E4E6C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B40DA4 Relevance: 5.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF674B40DE9
GetLastError.KERNEL32 ref: 00007FF674B40DFC
GetLastError.KERNEL32 ref: 00007FF674B40E16

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: ErrorLast$ByteCharMultiWide
String ID:
API String ID: 3361762293-0
Opcode ID: b4f58859e37be3f3b7ad670dfdef44e1a5b743730d720ea0daa23d3b524f62fa
Instruction ID: 781bb11086b64758ed81271b1f8dc82a6c2835d159692a7332e280b33a8fa3bd
Opcode Fuzzy Hash: b4f58859e37be3f3b7ad670dfdef44e1a5b743730d720ea0daa23d3b524f62fa
Instruction Fuzzy Hash: 60118273B18B82CAE7104B69A898239A6E1FF8AFC4B548634CB4DC3354DF3CD8149704

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B29810 Relevance: 5.0, APIs: 4, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF674B29845
HeapFree.KERNEL32 ref: 00007FF674B29859
GetProcessHeap.KERNEL32 ref: 00007FF674B2987D
HeapFree.KERNEL32 ref: 00007FF674B29891

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: e6166cf67018527b7d24403ca42b15034a47335c61b1ee02af31a56968c68bc2
Instruction ID: 8692ad10ae9c73504c4e4650e1cd5566985c3f12bac954d60de908892c2874d5
Opcode Fuzzy Hash: e6166cf67018527b7d24403ca42b15034a47335c61b1ee02af31a56968c68bc2
Instruction Fuzzy Hash: 1D110636A14B51C7EB008F66F5440ADBBA0FB8AF94B598125DB8E47718DF38E896C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF674B34428 Relevance: 5.0, APIs: 4, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,00000000,00007FF674B3440C,?,?,00000001,00007FF674B3424C), ref: 00007FF674B3444D
HeapFree.KERNEL32(?,?,00000000,00007FF674B3440C,?,?,00000001,00007FF674B3424C), ref: 00007FF674B34461
GetProcessHeap.KERNEL32(?,?,00000000,00007FF674B3440C,?,?,00000001,00007FF674B3424C), ref: 00007FF674B3447C
HeapFree.KERNEL32(?,?,00000000,00007FF674B3440C,?,?,00000001,00007FF674B3424C), ref: 00007FF674B34490

Memory Dump Source

Source File: 00000000.00000002.2099260182.00007FF674B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF674B20000, based on PE: true

Associated: 00000000.00000002.2099242774.00007FF674B20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099286845.00007FF674B4E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099313401.00007FF674B5E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2099334936.00007FF674B63000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff674b20000_ie4uinit.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: ac170bec7fb499c84ffd4a3d003431d913de9733b2990d02a0c697f4c453ab48
Instruction ID: 15cff20b3f64b153bdabfaa7fe80912eb8ea6aa461f55cb171a75b4e7836aca6
Opcode Fuzzy Hash: ac170bec7fb499c84ffd4a3d003431d913de9733b2990d02a0c697f4c453ab48
Instruction Fuzzy Hash: 20017C36A28A92C6D7149B56B958079BBA0FB8BFD0B48D130DF9D43B18CF38E8418700

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ie4uinit.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Cryptography

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: ie4uinit.exePID: 6364, Parent PID: 1028

General

File Activities

File Opened

File Attributes Queried

Volume Information Queried

Device IO

Section Activities

Sections loaded by Windows

Registry Activities

Windows Analysis Report
ie4uinit.exe

Function 00007FF674B4BFE0 Relevance: 10.6, APIs: 7, Instructions: 143
sleepCOMMON

Function 00007FF674B27BA4 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Function 00007FF674B4BF90 Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Function 00007FF674B49078 Relevance: 93.0, APIs: 27, Strings: 26, Instructions: 225
COMMON

Function 00007FF674B21E68 Relevance: 91.3, APIs: 9, Strings: 43, Instructions: 282
registryCOMMON

Function 00007FF674B22438 Relevance: 63.3, APIs: 24, Strings: 12, Instructions: 251
registrylibraryloaderCOMMON

Function 00007FF674B245D0 Relevance: 58.1, APIs: 26, Strings: 7, Instructions: 319
fileregistrystringCOMMON

Function 00007FF674B22B70 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 146
sleeplibraryloaderCOMMON

Function 00007FF674B234F8 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 209
commemorysynchronizationCOMMON

Function 00007FF674B25B88 Relevance: 35.2, APIs: 12, Strings: 8, Instructions: 224
filewindowCOMMON

Function 00007FF674B38A44 Relevance: 33.7, APIs: 14, Strings: 5, Instructions: 498
COMMON

Function 00007FF674B39428 Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 278
memorynetworkfileCOMMON