Edit tour

Windows Analysis Report
MemProfilerInstaller5_7_28.exe

Overview

General Information

Sample name:	MemProfilerInstaller5_7_28.exe
Analysis ID:	1446966
MD5:	7e45c0ea667dcf7b44cc304a0f159d32
SHA1:	d38693fb82dd2132fc314708e8fabb3aebe07668
SHA256:	9c249afa63fee4ecf8feab4512bbefba68949da7083349d26ffa439c06eab3c3
Infos:

Detection

Score:	8
Range:	0 - 100
Whitelisted:	false
Confidence:	20%

Signatures

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Classification

Process Tree

System is w10x64

MemProfilerInstaller5_7_28.exe (PID: 7296 cmdline: "C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe" MD5: 7E45C0EA667DCF7B44CC304A0F159D32)

MemProfilerInstaller5_7_28.exe (PID: 7316 cmdline: "C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe" -burn.clean.room="C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe" -burn.filehandle.attached=544 -burn.filehandle.self=536 MD5: B22C2660CB9454592A98077B00CD0DCD)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: 0_2_00579F8F DecryptFileW,	0_2_00579F8F
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: 0_2_0059F340 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,	0_2_0059F340
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: 0_2_00579D74 DecryptFileW,DecryptFileW,	0_2_00579D74
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_00139F8F DecryptFileW,	1_2_00139F8F
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_0015F340 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,	1_2_0015F340
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_00139D74 DecryptFileW,DecryptFileW,	1_2_00139D74

Source: MemProfilerInstaller5_7_28.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, REMOVABLE_RUN_FROM_SWAP, NET_RUN_FROM_SWAP

Source: MemProfilerInstaller5_7_28.exe

Static PE information: certificate valid

Source: MemProfilerInstaller5_7_28.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\agent\_work\66\s\build\ship\x86\mbahost.pdb source: MemProfilerInstaller5_7_28.exe, 00000001.00000002.2980291916.000000006CBE4000.00000002.00000001.01000000.00000007.sdmp, mbahost.dll.1.dr
Source:	Binary string: C:\agent\_work\66\s\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdbP source: Microsoft.Deployment.WindowsInstaller.dll.1.dr
Source:	Binary string: C:\agent\_work\66\s\build\ship\x86\burn.pdb source: MemProfilerInstaller5_7_28.exe, MemProfilerInstaller5_7_28.exe.0.dr
Source:	Binary string: C:\agent\_work\66\s\build\obj\ship\x86\core\BootstrapperCore.pdb source: MemProfilerInstaller5_7_28.exe, MemProfilerInstaller5_7_28.exe, 00000001.00000002.2977641737.00000000030D2000.00000002.00000001.01000000.0000000A.sdmp, BootstrapperCore.dll.1.dr
Source:	Binary string: C:\Sci\Build\NetMemProfiler\Installer\MemProfilerBootstrapper\obj\Release\MemProfilerBootstrapper.pdb source: MemProfilerInstaller5_7_28.exe, MemProfilerInstaller5_7_28.exe, 00000001.00000002.2978694391.0000000005F32000.00000002.00000001.01000000.0000000B.sdmp, MemProfilerBootstrapper.dll.1.dr
Source:	Binary string: C:\agent\_work\66\s\build\ship\x86\WixStdBA.pdb source: mbapreq.dll.1.dr
Source:	Binary string: C:\agent\_work\66\s\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdb source: Microsoft.Deployment.WindowsInstaller.dll.1.dr

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: 0_2_00579A1D FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	0_2_00579A1D
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: 0_2_005A3C72 FindFirstFileW,FindClose,	0_2_005A3C72
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: 0_2_00563D4E GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	0_2_00563D4E
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_00139A1D FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	1_2_00139A1D
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_00163C72 FindFirstFileW,FindClose,	1_2_00163C72
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_00123D4E GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	1_2_00123D4E

Source: MemProfilerInstaller5_7_28.exe	String found in binary or memory: http://appsyndication.org/2006/appsyn
Source: MemProfilerInstaller5_7_28.exe, MemProfilerInstaller5_7_28.exe.0.dr	String found in binary or memory: http://appsyndication.org/2006/appsynapplicationc:
Source: mbapreq.dll.1.dr, mbahost.dll.1.dr, Microsoft.Deployment.WindowsInstaller.dll.1.dr, BootstrapperCore.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: mbapreq.dll.1.dr, mbahost.dll.1.dr, Microsoft.Deployment.WindowsInstaller.dll.1.dr, BootstrapperCore.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: mbapreq.dll.1.dr, mbahost.dll.1.dr, Microsoft.Deployment.WindowsInstaller.dll.1.dr, BootstrapperCore.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
Source: MemProfilerInstaller5_7_28.exe, MemProfilerInstaller5_7_28.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: MemProfilerInstaller5_7_28.exe, MemProfilerInstaller5_7_28.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: MemProfilerInstaller5_7_28.exe, MemProfilerInstaller5_7_28.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: MemProfilerInstaller5_7_28.exe, MemProfilerInstaller5_7_28.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: mbapreq.dll.1.dr, mbahost.dll.1.dr, Microsoft.Deployment.WindowsInstaller.dll.1.dr, BootstrapperCore.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: mbapreq.dll.1.dr, mbahost.dll.1.dr, Microsoft.Deployment.WindowsInstaller.dll.1.dr, BootstrapperCore.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: mbapreq.dll.1.dr, mbahost.dll.1.dr, Microsoft.Deployment.WindowsInstaller.dll.1.dr, BootstrapperCore.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
Source: mbapreq.dll.1.dr, mbahost.dll.1.dr, Microsoft.Deployment.WindowsInstaller.dll.1.dr, BootstrapperCore.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: mbapreq.dll.1.dr, mbahost.dll.1.dr, Microsoft.Deployment.WindowsInstaller.dll.1.dr, BootstrapperCore.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: mbapreq.dll.1.dr, mbahost.dll.1.dr, Microsoft.Deployment.WindowsInstaller.dll.1.dr, BootstrapperCore.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L
Source: mbapreq.dll.1.dr, mbahost.dll.1.dr, Microsoft.Deployment.WindowsInstaller.dll.1.dr, BootstrapperCore.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: MemProfilerInstaller5_7_28.exe, MemProfilerInstaller5_7_28.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: MemProfilerInstaller5_7_28.exe, MemProfilerInstaller5_7_28.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: MemProfilerInstaller5_7_28.exe, MemProfilerInstaller5_7_28.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: MemProfilerInstaller5_7_28.exe, 00000001.00000002.2977836131.0000000003911000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/MemProfilerBootstrapper;component/views/wizardheadercontrol.xamld
Source: MemProfilerInstaller5_7_28.exe, MemProfilerInstaller5_7_28.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: mbapreq.dll.1.dr, mbahost.dll.1.dr, Microsoft.Deployment.WindowsInstaller.dll.1.dr, BootstrapperCore.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: mbapreq.dll.1.dr, mbahost.dll.1.dr, Microsoft.Deployment.WindowsInstaller.dll.1.dr, BootstrapperCore.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0K
Source: mbapreq.dll.1.dr, mbahost.dll.1.dr, Microsoft.Deployment.WindowsInstaller.dll.1.dr, BootstrapperCore.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: mbapreq.dll.1.dr, mbahost.dll.1.dr, Microsoft.Deployment.WindowsInstaller.dll.1.dr, BootstrapperCore.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: MemProfilerInstaller5_7_28.exe, MemProfilerInstaller5_7_28.exe.0.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: mbapreq.dll.1.dr, mbahost.dll.1.dr, Microsoft.Deployment.WindowsInstaller.dll.1.dr, BootstrapperCore.dll.1.dr	String found in binary or memory: http://wixtoolset.org
Source: MemProfilerInstaller5_7_28.exe	String found in binary or memory: http://wixtoolset.org/
Source: MemProfilerInstaller5_7_28.exe, 00000001.00000002.2977641737.00000000030D2000.00000002.00000001.01000000.0000000A.sdmp, Microsoft.Deployment.WindowsInstaller.dll.1.dr, BootstrapperCore.dll.1.dr	String found in binary or memory: http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/v
Source: MemProfilerInstaller5_7_28.exe, MemProfilerInstaller5_7_28.exe, 00000001.00000002.2977641737.00000000030D2000.00000002.00000001.01000000.0000000A.sdmp, Microsoft.Deployment.WindowsInstaller.dll.1.dr, BootstrapperCore.dll.1.dr	String found in binary or memory: http://wixtoolset.org/news/
Source: MemProfilerInstaller5_7_28.exe, Microsoft.Deployment.WindowsInstaller.dll.1.dr	String found in binary or memory: http://wixtoolset.org/releases/
Source: MemProfilerInstaller5_7_28.exe, 00000001.00000002.2977641737.00000000030D2000.00000002.00000001.01000000.0000000A.sdmp, BootstrapperCore.dll.1.dr	String found in binary or memory: http://wixtoolset.org/releases/SCreating
Source: mbapreq.thm.1.dr	String found in binary or memory: http://wixtoolset.org/schemas/thmutil/2010
Source: MemProfilerInstaller5_7_28.exe	String found in binary or memory: http://wixtoolset.org/telemetry/v
Source: MemProfilerInstaller5_7_28.exe, MemProfilerInstaller5_7_28.exe.0.dr	String found in binary or memory: https://memprofiler.com
Source: MemProfilerInstaller5_7_28.exe	String found in binary or memory: https://memprofiler.com/eula
Source: MemProfilerInstaller5_7_28.exe, 00000001.00000002.2978694391.0000000005F32000.00000002.00000001.01000000.0000000B.sdmp, MemProfilerBootstrapper.dll.1.dr	String found in binary or memory: https://memprofiler.com/eula;Failed
Source: MemProfilerInstaller5_7_28.exe, MemProfilerInstaller5_7_28.exe.0.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: mbapreq.dll.1.dr, mbahost.dll.1.dr, Microsoft.Deployment.WindowsInstaller.dll.1.dr, BootstrapperCore.dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: 0_2_0058C01F	0_2_0058C01F
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: 0_2_005901A6	0_2_005901A6
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: 0_2_005662CC	0_2_005662CC
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: 0_2_0059A28E	0_2_0059A28E
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: 0_2_00590461	0_2_00590461
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: 0_2_00592413	0_2_00592413
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: 0_2_00592642	0_2_00592642
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: 0_2_0059E73C	0_2_0059E73C
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: 0_2_0058F8C3	0_2_0058F8C3
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: 0_2_0058FC35	0_2_0058FC35
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: 0_2_00599DE0	0_2_00599DE0
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: 0_2_0058FEDF	0_2_0058FEDF
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: 0_2_00583F71	0_2_00583F71
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_0014C01F	1_2_0014C01F
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_001501A6	1_2_001501A6
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_0015A28E	1_2_0015A28E
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_001262CC	1_2_001262CC
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_00152413	1_2_00152413
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_00150461	1_2_00150461
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_00152642	1_2_00152642
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_0015E73C	1_2_0015E73C
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_0014F8C3	1_2_0014F8C3
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_0014FC35	1_2_0014FC35
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_00159DE0	1_2_00159DE0
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_0014FEDF	1_2_0014FEDF
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_00143F71	1_2_00143F71
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_05F3538E	1_2_05F3538E
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_6CBDD880	1_2_6CBDD880
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_6CBDDD2E	1_2_6CBDDD2E
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_6CBE2918	1_2_6CBE2918
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_6CBD7117	1_2_6CBD7117
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_6CBD6EE8	1_2_6CBD6EE8

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: String function: 005A2B5D appears 81 times
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: String function: 0059FFF0 appears 34 times
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: String function: 005638BA appears 498 times
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: String function: 0059FB09 appears 680 times
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: String function: 00562022 appears 54 times
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: String function: 00162B5D appears 79 times
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: String function: 001238BA appears 500 times
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: String function: 00122022 appears 54 times
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: String function: 0015FFF0 appears 34 times
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: String function: 0015FB09 appears 682 times

Source: MemProfilerInstaller5_7_28.exe	Binary or memory string: OriginalFilename vs MemProfilerInstaller5_7_28.exe
Source: MemProfilerInstaller5_7_28.exe, 00000001.00000002.2975026490.00000000006C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs MemProfilerInstaller5_7_28.exe
Source: MemProfilerInstaller5_7_28.exe, 00000001.00000002.2980339637.000000006CBEE000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamembahost.dll\ vs MemProfilerInstaller5_7_28.exe
Source: MemProfilerInstaller5_7_28.exe, 00000001.00000002.2977684399.00000000030E4000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenameBootstrapperCore.dll\ vs MemProfilerInstaller5_7_28.exe
Source: MemProfilerInstaller5_7_28.exe, 00000001.00000002.2978694391.0000000005F32000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilenameMemProfilerBootstrapper.dllP vs MemProfilerInstaller5_7_28.exe

Source: MemProfilerInstaller5_7_28.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, REMOVABLE_RUN_FROM_SWAP, NET_RUN_FROM_SWAP

Source: classification engine

Classification label: clean8.winEXE@3/35@0/0

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe

Code function: 0_2_00562078 FormatMessageW,GetLastError,LocalFree,

0_2_00562078

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: 0_2_00564639 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,		0_2_00564639
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_00124639 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,		1_2_00124639

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe

Code function: 0_2_005A28BD GetModuleHandleA,GetLastError,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CoCreateInstance,ExitProcess,

0_2_005A28BD

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe

Code function: 0_2_005868EE ChangeServiceConfigW,GetLastError,

0_2_005868EE

Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe

File created: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\

Jump to behavior

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Command line argument: cabinet.dll	0_2_00561070
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Command line argument: msi.dll	0_2_00561070
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Command line argument: version.dll	0_2_00561070
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Command line argument: wininet.dll	0_2_00561070
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Command line argument: comres.dll	0_2_00561070
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Command line argument: clbcatq.dll	0_2_00561070
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Command line argument: msasn1.dll	0_2_00561070
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Command line argument: crypt32.dll	0_2_00561070
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Command line argument: feclient.dll	0_2_00561070
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Command line argument: cabinet.dll	0_2_00561070
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Command line argument: cabinet.dll	1_2_00121070
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Command line argument: msi.dll	1_2_00121070
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Command line argument: version.dll	1_2_00121070
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Command line argument: wininet.dll	1_2_00121070
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Command line argument: comres.dll	1_2_00121070
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Command line argument: clbcatq.dll	1_2_00121070
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Command line argument: msasn1.dll	1_2_00121070
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Command line argument: crypt32.dll	1_2_00121070
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Command line argument: feclient.dll	1_2_00121070
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Command line argument: cabinet.dll	1_2_00121070

Source: MemProfilerInstaller5_7_28.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MemProfilerInstaller5_7_28.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: MemProfilerInstaller5_7_28.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: MemProfilerInstaller5_7_28.exe	String found in binary or memory: is already installed. Do you want to re-install
Source: MemProfilerInstaller5_7_28.exe	String found in binary or memory: resources/installerviewresources.baml
Source: MemProfilerInstaller5_7_28.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe

File read: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe "C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe"
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Process created: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe "C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe" -burn.clean.room="C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe" -burn.filehandle.attached=544 -burn.filehandle.self=536
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Process created: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe "C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe" -burn.clean.room="C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe" -burn.filehandle.attached=544 -burn.filehandle.self=536	Jump to behavior

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: msctfui.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: d3dcompiler_47.dll	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Section loaded: sxs.dll	Jump to behavior

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6D90F11-9C73-11D3-B32E-00C04F990BB4}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: MemProfilerInstaller5_7_28.exe

Static PE information: certificate valid

Source: MemProfilerInstaller5_7_28.exe

Static file information: File size 101670752 > 1048576

Source: MemProfilerInstaller5_7_28.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: MemProfilerInstaller5_7_28.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: MemProfilerInstaller5_7_28.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: MemProfilerInstaller5_7_28.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: MemProfilerInstaller5_7_28.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: MemProfilerInstaller5_7_28.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: MemProfilerInstaller5_7_28.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: MemProfilerInstaller5_7_28.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\agent\_work\66\s\build\ship\x86\mbahost.pdb source: MemProfilerInstaller5_7_28.exe, 00000001.00000002.2980291916.000000006CBE4000.00000002.00000001.01000000.00000007.sdmp, mbahost.dll.1.dr
Source:	Binary string: C:\agent\_work\66\s\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdbP source: Microsoft.Deployment.WindowsInstaller.dll.1.dr
Source:	Binary string: C:\agent\_work\66\s\build\ship\x86\burn.pdb source: MemProfilerInstaller5_7_28.exe, MemProfilerInstaller5_7_28.exe.0.dr
Source:	Binary string: C:\agent\_work\66\s\build\obj\ship\x86\core\BootstrapperCore.pdb source: MemProfilerInstaller5_7_28.exe, MemProfilerInstaller5_7_28.exe, 00000001.00000002.2977641737.00000000030D2000.00000002.00000001.01000000.0000000A.sdmp, BootstrapperCore.dll.1.dr
Source:	Binary string: C:\Sci\Build\NetMemProfiler\Installer\MemProfilerBootstrapper\obj\Release\MemProfilerBootstrapper.pdb source: MemProfilerInstaller5_7_28.exe, MemProfilerInstaller5_7_28.exe, 00000001.00000002.2978694391.0000000005F32000.00000002.00000001.01000000.0000000B.sdmp, MemProfilerBootstrapper.dll.1.dr
Source:	Binary string: C:\agent\_work\66\s\build\ship\x86\WixStdBA.pdb source: mbapreq.dll.1.dr
Source:	Binary string: C:\agent\_work\66\s\build\obj\ship\x86\WindowsInstaller\Microsoft.Deployment.WindowsInstaller.pdb source: Microsoft.Deployment.WindowsInstaller.dll.1.dr

Source: MemProfilerInstaller5_7_28.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: MemProfilerInstaller5_7_28.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: MemProfilerInstaller5_7_28.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: MemProfilerInstaller5_7_28.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: MemProfilerInstaller5_7_28.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: MemProfilerBootstrapper.dll.1.dr

Static PE information: 0xED4615F6 [Wed Feb 22 23:55:34 2096 UTC]

Source: MemProfilerInstaller5_7_28.exe	Static PE information: section name: .wixburn
Source: MemProfilerInstaller5_7_28.exe.0.dr	Static PE information: section name: .wixburn

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: 0_2_0058E806 push ecx; ret	0_2_0058E819
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_0014E806 push ecx; ret	1_2_0014E819
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_6CBD4476 push ecx; ret	1_2_6CBD4489
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_02AF50B2 pushfd ; iretd	1_2_02AF50B1
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_02AF506A pushfd ; iretd	1_2_02AF50B1
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_02AF5062 pushad ; iretd	1_2_02AF5069
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_02AF2642 push D000005Fh; iretd	1_2_02AF2661
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_02AF2592 pushfd ; iretd	1_2_02AF2591
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_02AF256B pushfd ; iretd	1_2_02AF2591
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_02AF5550 push esp; retf	1_2_02AF5559

Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	File created: C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\BootstrapperCore.dll	Jump to dropped file
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	File created: C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\mbapreq.dll	Jump to dropped file
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	File created: C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\Microsoft.Deployment.WindowsInstaller.dll	Jump to dropped file
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	File created: C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\MemProfilerBootstrapper.dll	Jump to dropped file
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	File created: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Jump to dropped file
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	File created: C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\mbahost.dll	Jump to dropped file

Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	File created: C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\BootstrapperCore.dll	Jump to dropped file
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	File created: C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\mbapreq.dll	Jump to dropped file
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	File created: C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\Microsoft.Deployment.WindowsInstaller.dll	Jump to dropped file
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	File created: C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\MemProfilerBootstrapper.dll	Jump to dropped file
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	File created: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Jump to dropped file
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	File created: C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\mbahost.dll	Jump to dropped file

Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Memory allocated: 2A90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Memory allocated: 3910000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Memory allocated: 5910000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Dropped PE file which has not been started: C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\BootstrapperCore.dll	Jump to dropped file
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Dropped PE file which has not been started: C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\mbapreq.dll	Jump to dropped file
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Dropped PE file which has not been started: C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\Microsoft.Deployment.WindowsInstaller.dll	Jump to dropped file
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Dropped PE file which has not been started: C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\MemProfilerBootstrapper.dll	Jump to dropped file
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Dropped PE file which has not been started: C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\mbahost.dll	Jump to dropped file

Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe

Evasive API call chain: GetLocalTime,DecisionNodes

Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe

API coverage: 8.9 %

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: 0_2_0059F79E GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 0059F839h	0_2_0059F79E
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: 0_2_0059F79E GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 0059F832h	0_2_0059F79E
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_0015F79E GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 0015F839h	1_2_0015F79E
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_0015F79E GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 0015F832h	1_2_0015F79E

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: 0_2_00579A1D FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	0_2_00579A1D
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: 0_2_005A3C72 FindFirstFileW,FindClose,	0_2_005A3C72
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: 0_2_00563D4E GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	0_2_00563D4E
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_00139A1D FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	1_2_00139A1D
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_00163C72 FindFirstFileW,FindClose,	1_2_00163C72
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_00123D4E GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	1_2_00123D4E

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe

Code function: 0_2_005A8EF4 VirtualQuery,GetSystemInfo,

0_2_005A8EF4

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe

Code function: 0_2_005934A2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_005934A2

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: 0_2_00594104 mov eax, dword ptr fs:[00000030h]	0_2_00594104
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_00154104 mov eax, dword ptr fs:[00000030h]	1_2_00154104
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_6CBD8FD6 mov eax, dword ptr fs:[00000030h]	1_2_6CBD8FD6

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe

Code function: 0_2_005639DF GetProcessHeap,RtlAllocateHeap,

0_2_005639DF

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: 0_2_0058E0A8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0058E0A8
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: 0_2_005934A2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_005934A2
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: 0_2_0058E574 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0058E574
Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe	Code function: 0_2_0058E707 SetUnhandledExceptionFilter,	0_2_0058E707
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_0014E0A8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0014E0A8
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_001534A2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_001534A2
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_0014E574 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0014E574
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_0014E707 SetUnhandledExceptionFilter,	1_2_0014E707
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_6CBD448C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_6CBD448C
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_6CBD42B6 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_6CBD42B6
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Code function: 1_2_6CBD7F77 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_6CBD7F77

Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe

Process created: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe "C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe" -burn.clean.room="C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe" -burn.filehandle.attached=544 -burn.filehandle.self=536

Jump to behavior

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe

Code function: 0_2_005A0FA6 InitializeSecurityDescriptor,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,SetEntriesInAclA,SetSecurityDescriptorOwner,GetLastError,SetSecurityDescriptorGroup,GetLastError,SetSecurityDescriptorDacl,GetLastError,CoInitializeSecurity,LocalFree,

0_2_005A0FA6

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe

Code function: 0_2_005A32B9 AllocateAndInitializeSid,CheckTokenMembership,

0_2_005A32B9

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe

Code function: 0_2_0058E937 cpuid

0_2_0058E937

Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Queries volume information: C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\BootstrapperCore.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Queries volume information: C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\MemProfilerBootstrapper.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe

Code function: 0_2_00574E6A ConvertStringSecurityDescriptorToSecurityDescriptorW,GetLastError,CreateNamedPipeW,GetLastError,CreateNamedPipeW,GetLastError,CloseHandle,LocalFree,

0_2_00574E6A

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe

Code function: 0_2_0056605F GetSystemTime,GetDateFormatW,GetLastError,GetLastError,GetDateFormatW,GetLastError,

0_2_0056605F

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe

Code function: 0_2_00566203 GetUserNameW,GetLastError,

0_2_00566203

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe

Code function: 0_2_005A8039 GetTimeZoneInformation,SystemTimeToTzSpecificLocalTime,

0_2_005A8039

Source: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe

Code function: 0_2_005651D2 GetModuleHandleW,CoInitializeEx,GetVersionExW,GetLastError,CoUninitialize,

0_2_005651D2

Source: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Command and Scripting Interpreter	1 Windows Service	1 Access Token Manipulation	1 Masquerading	OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Service Execution	1 DLL Side-Loading	1 Windows Service	11 Virtualization/Sandbox Evasion	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Native API	Logon Script (Windows)	12 Process Injection	1 Disable or Modify Tools	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Access Token Manipulation	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Process Injection	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Obfuscated Files or Information	DCSync	25 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
MemProfilerInstaller5_7_28.exe	0%	ReversingLabs
MemProfilerInstaller5_7_28.exe	0%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\BootstrapperCore.dll	0%	ReversingLabs
C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\BootstrapperCore.dll	0%	Virustotal	Browse
C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\MemProfilerBootstrapper.dll	0%	ReversingLabs
C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\MemProfilerBootstrapper.dll	0%	Virustotal	Browse
C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\Microsoft.Deployment.WindowsInstaller.dll	0%	Virustotal	Browse
C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\Microsoft.Deployment.WindowsInstaller.dll	0%	ReversingLabs
C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\mbahost.dll	0%	ReversingLabs
C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\mbahost.dll	0%	Virustotal	Browse
C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\mbapreq.dll	0%	ReversingLabs
C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\mbapreq.dll	0%	Virustotal	Browse
C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	0%	ReversingLabs
C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe	0%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://wixtoolset.org/releases/	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://appsyndication.org/2006/appsynapplicationc:	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://wixtoolset.org	0%	URL Reputation	safe
http://wixtoolset.org	0%	URL Reputation	safe
http://wixtoolset.org/schemas/thmutil/2010	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/v	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
http://wixtoolset.org/news/	0%	URL Reputation	safe
http://appsyndication.org/2006/appsyn	0%	URL Reputation	safe
https://memprofiler.com/eula	0%	Avira URL Cloud	safe
https://memprofiler.com	0%	Avira URL Cloud	safe
https://memprofiler.com/eula;Failed	0%	Avira URL Cloud	safe
http://defaultcontainer/MemProfilerBootstrapper;component/views/wizardheadercontrol.xamld	0%	Avira URL Cloud	safe
http://wixtoolset.org/	0%	Avira URL Cloud	safe
http://wixtoolset.org/telemetry/v	0%	Avira URL Cloud	safe
http://wixtoolset.org/releases/SCreating	0%	Avira URL Cloud	safe
http://wixtoolset.org/	0%	Virustotal		Browse
http://wixtoolset.org/telemetry/v	0%	Virustotal		Browse
http://wixtoolset.org/releases/SCreating	0%	Virustotal		Browse
https://memprofiler.com	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
https://memprofiler.com/eula	MemProfilerInstaller5_7_28.exe	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	MemProfilerInstaller5_7_28.exe, MemProfilerInstaller5_7_28.exe.0.dr	false	URL Reputation: safe	unknown
https://memprofiler.com	MemProfilerInstaller5_7_28.exe, MemProfilerInstaller5_7_28.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://wixtoolset.org/releases/	MemProfilerInstaller5_7_28.exe, Microsoft.Deployment.WindowsInstaller.dll.1.dr	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0	MemProfilerInstaller5_7_28.exe, MemProfilerInstaller5_7_28.exe.0.dr	false	URL Reputation: safe	unknown
http://appsyndication.org/2006/appsynapplicationc:	MemProfilerInstaller5_7_28.exe, MemProfilerInstaller5_7_28.exe.0.dr	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	MemProfilerInstaller5_7_28.exe, MemProfilerInstaller5_7_28.exe.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	MemProfilerInstaller5_7_28.exe, MemProfilerInstaller5_7_28.exe.0.dr	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	MemProfilerInstaller5_7_28.exe, MemProfilerInstaller5_7_28.exe.0.dr	false	URL Reputation: safe	unknown
http://wixtoolset.org	mbapreq.dll.1.dr, mbahost.dll.1.dr, Microsoft.Deployment.WindowsInstaller.dll.1.dr, BootstrapperCore.dll.1.dr	false	URL Reputation: safe URL Reputation: safe	unknown
http://wixtoolset.org/schemas/thmutil/2010	mbapreq.thm.1.dr	false	URL Reputation: safe	unknown
https://memprofiler.com/eula;Failed	MemProfilerInstaller5_7_28.exe, 00000001.00000002.2978694391.0000000005F32000.00000002.00000001.01000000.0000000B.sdmp, MemProfilerBootstrapper.dll.1.dr	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	MemProfilerInstaller5_7_28.exe, MemProfilerInstaller5_7_28.exe.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/v	MemProfilerInstaller5_7_28.exe, 00000001.00000002.2977641737.00000000030D2000.00000002.00000001.01000000.0000000A.sdmp, Microsoft.Deployment.WindowsInstaller.dll.1.dr, BootstrapperCore.dll.1.dr	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	MemProfilerInstaller5_7_28.exe, MemProfilerInstaller5_7_28.exe.0.dr	false	URL Reputation: safe	unknown
http://defaultcontainer/MemProfilerBootstrapper;component/views/wizardheadercontrol.xamld	MemProfilerInstaller5_7_28.exe, 00000001.00000002.2977836131.0000000003911000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://wixtoolset.org/	MemProfilerInstaller5_7_28.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://wixtoolset.org/telemetry/v	MemProfilerInstaller5_7_28.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	MemProfilerInstaller5_7_28.exe, MemProfilerInstaller5_7_28.exe.0.dr	false	URL Reputation: safe	unknown
http://wixtoolset.org/news/	MemProfilerInstaller5_7_28.exe, MemProfilerInstaller5_7_28.exe, 00000001.00000002.2977641737.00000000030D2000.00000002.00000001.01000000.0000000A.sdmp, Microsoft.Deployment.WindowsInstaller.dll.1.dr, BootstrapperCore.dll.1.dr	false	URL Reputation: safe	unknown
http://wixtoolset.org/releases/SCreating	MemProfilerInstaller5_7_28.exe, 00000001.00000002.2977641737.00000000030D2000.00000002.00000001.01000000.0000000A.sdmp, BootstrapperCore.dll.1.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://appsyndication.org/2006/appsyn	MemProfilerInstaller5_7_28.exe	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1446966
Start date and time:	2024-05-24 06:20:24 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	MemProfilerInstaller5_7_28.exe
Detection:	CLEAN
Classification:	clean8.winEXE@3/35@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 128 Number of non-executed functions: 271
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\BootstrapperCore.dll	TsU2RShnl7.exe	Get hash	malicious	PureLog Stealer	Browse
	ScreenToGif.2.40.Setup.x64.msi	Get hash	malicious	Unknown	Browse
	PDFCreator-5_1_2-Setup.exe	Get hash	malicious	Unknown	Browse
	PDFCreator-5_1_2-Setup.exe	Get hash	malicious	Unknown	Browse
	PDFCreator-5_1_2-Setup.exe	Get hash	malicious	Unknown	Browse
	PDFCreator-5_1_1-Setup.exe	Get hash	malicious	Unknown	Browse
	PDFCreator-5_1_1-Setup.exe	Get hash	malicious	Unknown	Browse
	https://www.pdfforge.org/pdfcreator/download	Get hash	malicious	Unknown	Browse
	https://download.pdfforge.org/download/pdfcreator/PDFCreator-stable?download	Get hash	malicious	Unknown	Browse
	PDFCreator-5_0_3-Setup.exe	Get hash	malicious	Unknown	Browse
C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\Microsoft.Deployment.WindowsInstaller.dll	Honeygain_install.exe.zip	Get hash	malicious	Unknown	Browse
	EmbravaConnect.msi	Get hash	malicious	PrivateLoader	Browse
	2503.msi	Get hash	malicious	AteraAgent	Browse
	ProSheets.msi	Get hash	malicious	Unknown	Browse
	AdobeAcrobat2.1.2.msi	Get hash	malicious	AteraAgent	Browse
	440e4d.msi	Get hash	malicious	AteraAgent	Browse
	OPSWAT NetWall OSI-Pi Service (Blue).msi	Get hash	malicious	Unknown	Browse
	OPSWAT_OPCDA_RED_Service.msi	Get hash	malicious	Unknown	Browse
	digitalform.msi	Get hash	malicious	AteraAgent	Browse
	OPSWAT NetWall OSI-Pi Service (Red).msi	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\.NET_Memory_Profiler_5.7_20240524002121.log

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3313
Entropy (8bit):	5.368160351396491
Encrypted:	false
SSDEEP:	96:22VI2o2x2y2P292s2w2OF292jSs2T2e2F2d24E2tG23242K2PHJ2Pi2Pd2B28HJx:22m2o2x2y2P292s2w2OF292jp2T2e2Fn
MD5:	6F8F1027A2CAAE2A80AD5FADA319DD95
SHA1:	F9807C8CB07C8B15D6E660F44F49A12116323EC6
SHA-256:	4ED1ECDBD6DDA15E1A021EAABA786E6AADFDF7CB370E3062D8AD3651C7425B48
SHA-512:	B3D36AE3195C62498E22B51DF9FAB1B7B5D228AA6B22FF91AF48601E1EBBECDB0F20338B5C249014FEFDE2736429AC8138F839020A2911B7721AD0E026AB0763
Malicious:	false
Reputation:	low
Preview:	[1C94:1C98][2024-05-24T00:21:20]i001: Burn v3.11.2.4516, Windows v10.0 (Build 19045: Service Pack 0), path: C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe..[1C94:1C98][2024-05-24T00:21:20]i000: Initializing string variable 'VsixInstallCommand' to value ''..[1C94:1C98][2024-05-24T00:21:20]i000: Initializing string variable 'VsixUninstallCommand' to value ''..[1C94:1C98][2024-05-24T00:21:20]i009: Command Line: '-burn.clean.room=C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe -burn.filehandle.attached=544 -burn.filehandle.self=536'..[1C94:1C98][2024-05-24T00:21:20]i000: Setting string variable 'WixBundleOriginalSource' to value 'C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe'..[1C94:1C98][2024-05-24T00:21:20]i000: Setting string variable 'WixBundleOriginalSourceFolder' to value 'C:\Users\user\Desktop\'..[1C94:1C98][2024-05-24T00:21:21]i000: Setting string variable 'WixBundleLog' to value 'C:\Users\user\AppData\Local\Temp\.NET_Memor

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1028\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2025
Entropy (8bit):	6.231406644010833
Encrypted:	false
SSDEEP:	48:cxX7DTAT8tMBCus9T3FVWmHdniarRFeOrw8Nhv2VyfN3mKNWFP44SBWWW1GyfiPq:8L4T2RJhfHP8+VYuTmQUc2mE
MD5:	1D4B831F77EFEC96FFBC70BC4B59B8B5
SHA1:	1B3ED82655AEC8A52DAEC60F8674BC7E07F8CFEB
SHA-256:	1B93556F07C35AC0564D57E0743CCBA231950962C6506C8D4A74A31CD66FD04C
SHA-512:	C6CCB188281F161DEBF02DCDDE24B77D8D14943DEED8852E77E5AFB18F3F62683AB1AE06DCEB1E09D53804A76DF6400A360712D8E7E228B7F971054BB4FB2496
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="zh-tw" Language="1028" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] ....</String>.. <String Id="Title">[WixBundleName] ...... Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">......</String>.. <String Id="HelpText">/passive \| /quiet - ...... UI ............ UI ... ........... UI ........../norestart - ................UI ............./log log.txt - ............ %TEMP% ......</String>.. <Stri

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1029\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2458
Entropy (8bit):	5.36165936198009
Encrypted:	false
SSDEEP:	48:cxX7DTZT8u9cktosM6re4mSTcIIyfI7sh/DMNwIHWAoN3mepNRfKPnWZ0hqAQZfC:8LxTK23f33AwIViRrRynRuZfiMS
MD5:	CC8C6D04DC707B38E0F0C08BA16FE49B
SHA1:	95EA7F570677AEA52393D02FDB21CEBB218A7343
SHA-256:	DC445E2457ED31ABF536871F90FF7CC96800A40B6BC033F37D45E3156A3B4FA9
SHA-512:	A4B19EBC8BB0D88ABA7D3D5783E28F8B6E0960582A540059BC71076B1203BF43BCA15EA726272D15395C7B4E431046ADA1CBB9D55072BBC5DBE7729C4599F0E0
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="cs-cz" Language="1029" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Instalace produktu [WixBundleName]</String>.. <String Id="Title">Pro instalaci produktu [WixBundleName] je vy.adov.no rozhran. Microsoft .NET Framework.</String>.. <String Id="ConfirmCancelMessage">Opravdu chcete akci zru.it?</String>.. <String Id="HelpHeader">N.pov.da k instalaci</String>.. <String Id="HelpText">/passive \| /quiet - Zobraz. minim.ln. u.ivatelsk. rozhran. bez jak.chkoli.. v.zev, nebo nezobraz. ..dn. u.ivatelsk. rozhran. ani ..dn. v.zvy. Ve v.choz.m.. nastaven. se jak u.ivatelsk. rozhran., tak i v.echny v.zvy zobrazuj....../norestart - Potla.. jak.koli p

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1030\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2286
Entropy (8bit):	5.061915970731254
Encrypted:	false
SSDEEP:	48:cxX7DCrT81tbzjamsjFq7LhzqGgdRDJNbqoN3mpN+ELPnfyOwYxPyzraXnAF:8LaTOkaEOiGd/BwF
MD5:	7C6E4CE87870B3B5E71D3EF4555500F8
SHA1:	E831E8978A48BEAFA04AAD52A564B7EADED4311D
SHA-256:	CAC263E0E90A4087446A290055257B1C39F17E11F065598CB2286DF4332C7696
SHA-512:	2A02415A3E5F073F4530FD87C97B685D95B8C0E1B15EFD185CC5CB046FCF1D0DCE28DB9889AD52588B96FE01841A7A61F6B7D6D2F669EAB10A8926C46B8E93D1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="da-dk" Language="1030" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Installation af [WixBundleName]</String>.. <String Id="Title">Microsoft .NET Framework skal v.re installeret i forbindelse med Installationen af [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Er du sikker p., at du vil annullere?</String>.. <String Id="HelpHeader">Hj.lp til installation</String>.. <String Id="HelpText">/passive \| /quiet - viser en minimal brugergr.nseflade uden prompter eller.. viser ingen brugergr.nseflade og ingen prompter... Brugergr.nsefladen og alle prompter vises som standard...../norestart - skjuler fors.g p. genstart. Der vises som standard en.. foresp.rgse

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1031\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2442
Entropy (8bit):	5.094465051245675
Encrypted:	false
SSDEEP:	48:cxX7DASTcCwit/soJy9hkVByUZN+29N3mfN65PS9CvZwZi7uuASD:8LxT8itGeVB97+gyC9BdaSD
MD5:	C8E7E0B4E63B3076047B7F49C76D56E1
SHA1:	4E44E656A0D552B2FFD65911CB45245364E5DBF3
SHA-256:	631D46CB048FB6CF0B9A1362F8E5A1854C46E9525A0260C7841A04B2316C8295
SHA-512:	FD7E8896F9414F0DB7A88F926F55EE24E0591DA676F330200BC6BB829EB32648D90D3094E0011BFE36C7BA8BE41DFD74B12D444AFEA0D2866801258DA4FA16E8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="de-de" Language="1031" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <UI Control="InstallButton" Width="180" />.. .. <String Id="Caption">[WixBundleName]-Setup</String>.. <String Id="Title">F.r das [WixBundleName]-Setup ist Microsoft .NET Framework erforderlich.</String>.. <String Id="ConfirmCancelMessage">Sind Sie sicher, dass Sie den Vorgang abbrechen m.chten?</String>.. <String Id="HelpHeader">Setup-Hilfe</String>.. <String Id="HelpText">/passive \| /quiet - zeigt eine minimale Benutzeroberfl.che ohne.. Eingabeaufforderungen oder keine Benutzeroberfl.che und keine.. Eingabeaufforderungen an. Standardm..ig werden die Benutzeroberfl.che und.. alle Eingabeaufforderungen angezeigt...../no

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1032\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3400
Entropy (8bit):	5.279888750092028
Encrypted:	false
SSDEEP:	48:cxX7D8jVT8dUk9Ug/usOo2pNSBIbESvR2drdESPzghC76DeN2hL0eLoN3mOLSNIx:8L45TCyop5riGzH7xgJit8IqSsBwqk
MD5:	074D5921AF07E6126049CB45814246ED
SHA1:	91D4BDDA8D2B703879CFE2C28550E0A46074FA57
SHA-256:	B8E90E20EDF110AAAAEA54FBC8533872831777BE5589E380CFDD17E1F93147B5
SHA-512:	28DAC36516BCC76BCC598C6E7ABDE359695F85AB7A830D6ADBC844EB240D9FA372CB5A5CE4DBE21E250408C6B246D371D3CDD656D2178FB0EC22DAC7D39CBD9F
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="el-gr" Language="1032" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">........... ... [WixBundleName]</String>.. <String Id="Title">... ... ........... ... [WixBundleName] .......... .. Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">..... ....... ... ...... .. ..... .......;</String>.. <String Id="HelpHeader">....... ... ... ...........</String>.. <String Id="HelpText">/passive \| /quiet - ......... ........ ........... ... ............. .......... ...... ..... ........ . ... ..

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1035\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2235
Entropy (8bit):	5.142592159444541
Encrypted:	false
SSDEEP:	48:cxX7DE+T8Z+bm5snwETMAoQEATN27uNBDReq4N3mJeNHNP64NsFKJJem4vyAs:8LZTDkZ7+2IBCht6J8neHs
MD5:	E338408F1101499EB22507A3451F7B06
SHA1:	83B42F9D7307265A108FC339D0460D36B66A8B94
SHA-256:	B7D9528F29761C82C3D926EFE5E0D5036A0E0D83EB4CCA7282846C86A9D6F9F3
SHA-512:	F7BE923DC2856E0941D0669E2DE5A5C307C98DC7EBA0A1B68728EB29C95B4625145C2AD3AC6F6B6D82F062887EA349E2187F1F91785DDE5A5083BC1150E56326
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="fi-fi" Language="1035" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] -asennus</String>.. <String Id="Title">Microsoft .NET Framework tarvitaan [WixBundleName] -asennusta varten</String>.. <String Id="ConfirmCancelMessage">Haluatko varmasti peruuttaa?</String>.. <String Id="HelpHeader">Asennusohjelman ohje</String>.. <String Id="HelpText">/passive \| /quiet - n.ytt.. mahdollisimman v.h.n k.ytt.liittym.st.; ei.. kehotteita tai ei k.ytt.liittym.. ja kehotteita. Oletusarvoisesti.. k.ytt.liittym. ja kaikki kehotteet n.ytet..n...../norestart - est.. uudelleenk.ynnistysyritykset. Oletusarvoisesti.. k.ytt.liittym. kysyy ennen uudelleenk.yn

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1036\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2306
Entropy (8bit):	5.076293283609686
Encrypted:	false
SSDEEP:	48:cxX7DyBT81BbKBswAL1xV1wjRcDSNwDXoN3mSZfNhkLPkQpznsdMEodAY:8LwTK5KHsijmEXY
MD5:	AA32A059AADD42431F7837CB1BE7257F
SHA1:	4CD21661E341080FB8C2DEFD9F32F134561FC3BA
SHA-256:	88E7DDACD6B714D94D5322876BD50051479B7A0C686DC2E9EB06B3B7A0BC06C9
SHA-512:	78E201F369E65535E25722DFC0EFE99EDF641F7C14EFF1526DC1CC047FF11640079F1E3D25C9072CF25F4804195891BE006FC5ED313063AFCB91FB5700120B88
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="fr-fr" Language="1036" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Installation de [WixBundleName]</String>.. <String Id="Title">Microsoft .NET Framework requis pour l'installation de [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.tes-vous s.r de vouloir annuler.?</String>.. <String Id="HelpHeader">Aide de l'installation</String>.. <String Id="HelpText">/passive \| /quiet - affiche une interface minimale sans invites ou n'affiche.. aucune interface ni aucune invite. Par d.faut, l'interface et toutes les.. invites sont affich.es...../norestart - annule toute tentative de red.marrage. Par d.faut, l'interface.. affiche une invite avant de red.marrer..

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1038\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2392
Entropy (8bit):	5.293225307744296
Encrypted:	false
SSDEEP:	48:cxX7DwzT8cSwvs48mF7GD/g1v0wH7N3wwJxL99oN3m/ZNRUYPBZRT1XESW3o/ULG:8LQT2wpFGbgT3wMN2QRj/y/LKr
MD5:	17FB605A2F02DA203DF06F714D1CC6DE
SHA1:	3A71D13D4CCA06116B111625C90DD1C451EA9228
SHA-256:	55CF62D54EFB79801A9D94B24B3C9BA221C2465417A068950D40A67C52BA66EF
SHA-512:	D05008D37143A1CC031F4B6268490A5A10FBB686C86984D20DB94843BDC4624EF9651D158DCB5B660FC239C3C3E8D087EB5D23FFFB8C4681910CBC376148F0F0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="hu-hu" Language="1038" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] telep.t.</String>.. <String Id="Title">A(z) [WixBundleName] telep.t.s.hez Microsoft .NET-keretrendszer sz.ks.ges</String>.. <String Id="ConfirmCancelMessage">Biztosan megszak.tja?</String>.. <String Id="HelpHeader">A telep.t. s.g.ja</String>.. <String Id="HelpText">/passive \| /quiet - Minim.lis felhaszn.l.i fel.let megjelen.t.se k.rd.sek.. n.lk.l, illetve felhaszn.l.i fel.let .s k.rd.sek megjelen.t.se n.lk.li.. telep.t.s. Alapesetben a felhaszn.l.i fel.let .s minden k.rd.s megjelenik...../norestart - Az .jraind.t.si k.r.sek elrejt.se. Alapeset

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1040\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2304
Entropy (8bit):	4.985260685429469
Encrypted:	false
SSDEEP:	48:cxX7DQyT81ebRcesyB+lY25ukVpkXJM2DJNXhpXZoN3mMhNTM+POYO/n1YxXlcI5:8LFTzLtkfwWKXHZi37MIDp
MD5:	50261379B89457B1980FF19CFABE6A08
SHA1:	F80B1F416539D33206CE3C24BA3B14B799A84813
SHA-256:	A40C94EB33F8841C79E9F6958433AFFD517F97B4570F731666AF572E63178BB7
SHA-512:	BBD9794181EEC95D6BE7A1B7BA83FD61AF2B2DF61D9DA8DDA2788B61BEC53C30FCEFE5222EDF134166532B36D3AB6CE8996F2D670DC6907C1864AF881A21EA40
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="it-it" Language="1040" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Installazione di [WixBundleName]</String>.. <String Id="Title">Microsoft .NET Framework necessario per l'installazione di [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Annullare?</String>.. <String Id="HelpHeader">Guida dell'installazione</String>.. <String Id="HelpText">/passive \| /quiet - visualizza l'interfaccia utente minima senza istruzioni.. oppure non visualizza n. l'interfaccia utente n. le istruzioni. Per.. impostazione predefinita vengono visualizzate interfaccia utente e.. istruzioni...../norestart - elimina eventuali tentativi di riavvio. Per impostazione.. predefinita l'int

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1041\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2545
Entropy (8bit):	5.923292576429967
Encrypted:	false
SSDEEP:	48:cxX7DpcYT86WyscLpTIFw6tnOUjsj/D3NIgHcQN3mKN/WPOhT0SXsDay+z8QZEcE:8L1TccOFw6tnOUjsjpICnlOO934apWz
MD5:	DB0F5BAB42403FD67C0A18E35E6880EC
SHA1:	C0A18C8C5BCD7B88C384B5304B56EEB85A0DA3DC
SHA-256:	CCDCDB111EFA152C5F9FF4930033698B843390A549699AE802098D87431F16FE
SHA-512:	589522BD4A26BF54CCF3564E392E41BBBA4E7B3FD1ED74E7F4F6AD6F2E65CDE11FFF32D0C5F3BCD09052FE5110FDC361D1926E220FD0BAD2D38CAC21BBE93211
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="ja-jp" Language="1041" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] ......</String>.. <String Id="Title">[WixBundleName] ........ Microsoft .NET Framework .....</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">..........</String>.. <String Id="HelpText">/passive \| /quiet - ... UI ....................UI.. .............. .....UI ....................../norestart - ........................

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1042\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2236
Entropy (8bit):	5.97627825234954
Encrypted:	false
SSDEEP:	48:cxX7D3sT8ZeusKOwOWGyKCstFmhENI2Y+kN3mp4iNmi6IPa0dDaoIunvZqIHU5UH:8LQTXvRFhIzl44wmgko04U5TY
MD5:	442F8463EF5CA42B99B2EFACA696BD01
SHA1:	67496DB91CBAA85AC0727B12FC2D35E990537DAC
SHA-256:	D22F6ADA97DBFFC1E7548E52163807F982B30B11A2A5109E71F42985102CCCBD
SHA-512:	A350EAF9E7AEAFAB1163D7C0B8D014AFE07EE98BAE3915CBDD3C26282E345A0838E853C89BAE8943474758DCBCFD0BB0724A0C75CBF969F321FAB4944E8704FD
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="ko-kr" Language="1042" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] ..</String>.. <String Id="Title">[WixBundleName] ... ... Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">........?</String>.. <String Id="HelpHeader">.. ...</String>.. <String Id="HelpText">/passive \| /quiet - ... .. .. UI. ..... UI. .... .... .... ..... ..... UI . .. .... ........../norestart - .. ..... ... ...... ..... UI. .. .... .. .... ......../log log.txt - .

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1043\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2312
Entropy (8bit):	4.965432037520827
Encrypted:	false
SSDEEP:	48:cxX7DK1T8u7hbU7Asd7MqpSwzCcHGFN9OsNN3mvoNBC7hPFtO7+xw7t0Yza2Al:8LcTtpGLFSwJHmPnnKhEBtsl
MD5:	67F28BCDB3BA6774CD66AA198B06FF38
SHA1:	85D843B7248A5E1173FF9BD59CB73BB505F69B66
SHA-256:	226B778604236931B4AE45F6F272586C884A11517444A34BF45CD5CAE49BE62E
SHA-512:	7BC7D3E6E19ECF865B2CABFC46C75D516561D5A8A81A8ED55B4EDBA41A13A7110F474473740200AFB035B9597A2511D08C2A2E7A9ADE2C2AB4D3F168944B8328
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="nl-nl" Language="1043" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Installatie</String>.. <String Id="Title">Microsoft .NET Framework is vereist voor installatie [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Weet u zeker dat u de installatie wilt annuleren?</String>.. <String Id="HelpHeader">Help bij Setup</String>.. <String Id="HelpText">/passive \| /quiet - geeft een minimale gebruikersinterface weer zonder prompts.. of geeft geen gebruikersinterface en geen prompts weer. Gebruikersinterface.. en alle prompts worden standaard weergegeven...../norestart - pogingen tot opnieuw opstarten onderdrukken... Gebruikersinterface vraagt standaard al

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1044\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2171
Entropy (8bit):	5.089922193759582
Encrypted:	false
SSDEEP:	48:cxX7DTeT8uUbnFdsLnFHv+Gpm1qL5DQNDDaoN3mpZfN15dPnfuOOg5wZ5uAq8fAS:8L+Tec1x8Siule4S
MD5:	5454F724C9CDAB8172678A1CC7057220
SHA1:	241A57018ACE1210881583A9CF646E7D2E51412F
SHA-256:	41545AC1247B61C3C3E2A7E4659D9FAD2BCCA8347C69F2EB7B9D0CF5FC31E113
SHA-512:	40E311EADA299996E32A7D35223CA678A03C869D63C023D59BC97A7B2049B0252AA9D0A7EC8558D5ACB73BD14C7BFA913097E65ABEE7455658DB7E35BBDA8AE1
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="nb-no" Language="1044" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Installasjonsprogram</String>.. <String Id="Title">Microsoft .NET Framework kreves for [WixBundleName]-installasjon</String>.. <String Id="ConfirmCancelMessage">Er du sikker p. at du vil avbryte?</String>.. <String Id="HelpHeader">Installasjonshjelp</String>.. <String Id="HelpText">/passive \| /quiet - viser minimalt brukergrensesnitt uten ledetekster, eller.. ikke noe brukergrensesnitt og ingen ledetekster. Som standard vises.. brukergrensesnitt og alle ledetekster...../norestart - undertrykker alle fors.k p. omstart. Som standard sp.r.. brukergrensesnittet f.r omstart.../log log.txt

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1045\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2368
Entropy (8bit):	5.270514043715206
Encrypted:	false
SSDEEP:	48:cxX7Du4OT82gXusarwkfpYrKD8DTNkbNuoN3mjbsNniIPh8ynN1NYd4iYuffAL:8LKTsXgpYr2IyoiiOffpT3L
MD5:	96ACAAA5AEF7798E9048BAFF4C3FA8D3
SHA1:	E76629973F6C1CFC06F60BA64FE9F237B2DB9698
SHA-256:	F4AA983E39FB29C95E3306082F034B3A43E1D26489C997B8E6697B6A3B2F9F3C
SHA-512:	964F73E572BDCB1AD946C770E6A2FB4A1CE54AF4B5BB072F64256083BA27A223F4DAD4A95B9D2A646180806D1F977726147970B06AAC35EED75AEC6CA89ED337
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="pl-pl" Language="1045" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Instalator programu [WixBundleName]</String>.. <String Id="Title">Do zainstalowania programu [WixBundleName] jest wymagany program Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">Czy na pewno chcesz anulowa.?</String>.. <String Id="HelpHeader">Pomoc instalatora</String>.. <String Id="HelpText">/passive \| /quiet - wy.wietla minimalny interfejs u.ytkownika bez monit.w.. lub nie wy.wietla interfejsu u.ytkownika ani monit.w. Domy.lnie jest.. wy.wietlany interfejs u.ytkownika i wszystkie monity...../norestart - pomija wszelkie pr.by ponownego uruchomienia. Domy.lnie.. interf

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1046\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2147
Entropy (8bit):	5.130635342194656
Encrypted:	false
SSDEEP:	48:cxX7DuoT85b0s/4TDoYDj4NF5j2hN3mMNYskPDXKIMaKcP9A5g:8L1TmBHjs59M8r6
MD5:	BD39ADB6B872163FD2D570028E9F3213
SHA1:	688B8A109688D3EA483548F29DE2E57A8A56C868
SHA-256:	ECB5C22E6C2423CAF07AEBE69F4FAF22450164EEE9587B64EF45A2D7F658CA15
SHA-512:	F2826BE203E767D09FF0D7677E1CF5B13113B773D529166DAE02A1F5DB2DC58E0856A34901DF70011EBABB6E964FAB7ACF38590E650BD629D4E4DC4CB36C8D45
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="pt-br" Language="1046" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Instala..o</String>.. <String Id="Title">Microsoft .NET Framework . necess.rio para instala..o do [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Tem certeza de que deseja cancelar?</String>.. <String Id="HelpHeader">Ajuda da Instala..o</String>.. <String Id="HelpText">/passive \| /quiet - exibe UI m.nima sem avisos ou exibe sem UI e.. sem avisos. Por padr.o a UI e todos avisos s.o exibidos...../norestart - suprime qualquer tentativa de reinicializa..o. Por padr.o a UI.. ir. solicitar antes de reiniciar.../log log.txt - logs para um arquivo espec.fico. Por padr.

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1049\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2880
Entropy (8bit):	5.408094213063887
Encrypted:	false
SSDEEP:	48:cxX7DkTT8fjtEeusogrohY2Ar7DHNnjTh53oN3miRMNKrdPin+/uYcbSkuEIcOvG:8LYT8EeHMMJRNi1Ruwi3OwL
MD5:	DAF167AF4031EF47E562056A7D51AA73
SHA1:	0156B230CADD6169AC2820865E3C031ED79785EF
SHA-256:	C91C9E87AB4A6DB078F1991F4A2CDC726B58A40E47BCE49D39168A8F8F151C3B
SHA-512:	5E87EE3838E3595ADBD7EABA6E3E33CDFEA5E15ED716FBCCDBD55235B3E53E1E41EA5A907F425E96C35167543C7F75AC5214B5AEE177D299FC2464A68B22851E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="ru-ru" Language="1049" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">......... [WixBundleName]</String>.. <String Id="Title">... ......... [WixBundleName] ......... Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">.. ............. ...... ........ ........?</String>.. <String Id="HelpHeader">....... .. .........</String>.. <String Id="HelpText">/passive \| /quiet - ........... ............ .. ... ........ ... ...... ... .. .. . ............ .. ......... ............ .. . ... ......

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1051\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2334
Entropy (8bit):	5.397882326481071
Encrypted:	false
SSDEEP:	48:cxX7D+cT8muPusz2qs1u+Vh1TqDINHZJoN3m8fN0vPp3OAwa2ywSODAm:8L1TuPdKNzfifFmcatm
MD5:	016C278E515F87F589AD22C856B201F7
SHA1:	F20C7DB38B3161B143DEC4E578CE71D7F585F436
SHA-256:	4A7FDF4A9033FE05C31F565ED3AE5B8C67D324B7AEADB737CE95DBB416D46868
SHA-512:	310C85B27E1ECF4C6729E88051037150CFBA0234A0138666C26662B3D665FF38B74E95ABCADDEEF6CBEBB23E3357FAC487E6EE5EB8FE158C269D77672191B042
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="sk-sk" Language="1051" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] . in.tal.cia</String>.. <String Id="Title">Na in.tal.ciu aplik.cie [WixBundleName] sa vy.aduje s..as. Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">Naozaj chcete zru.i. oper.ciu?</String>.. <String Id="HelpHeader">Pomocn.k pre in.tal.ciu</String>.. <String Id="HelpText">/passive \| /quiet . zobraz. minim.lne pou..vate.sk. rozhranie bez v.ziev alebo.. nezobraz. .iadne pou..vate.sk. rozhranie ani v.zvy. Predvolene sa.. zobrazuje pou..vate.sk. rozhranie aj v.etky v.zvy...../norestart . zru.. v.etky pokusy o re.tart. Pou..vate

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1053\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2132
Entropy (8bit):	5.1255014007111495
Encrypted:	false
SSDEEP:	48:cxX7DviT8NFLbu9sM2vECjf26axBZYXcqADCNKTbkoN3maT6NWOjEXPauOOKYnhf:8LmTAcRnQXFPK0iHMsfb2Ws3M
MD5:	D95E81164C57B6FD75E7C3022454192E
SHA1:	5D5ACBC56E7078AF4D04C45B78C0FF090C02EE6A
SHA-256:	6DD61CC6B87B53EAF28430068A2A459730FD4B2BCF876CCDF040212D04C4FE7D
SHA-512:	9E4BA81A145574818DD6A1F1D0EC38EA1629C7771919C35923F440E31EA9912E1630D94FCDB82B71104EBD61D0321DCDF935BA20D69988EE6E9B22259186AF0C
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="sv-se" Language="1053" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName]-installation</String>.. <String Id="Title">Microsoft .NET Framework kr.vs f.r installation av [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Vill du avbryta?</String>.. <String Id="HelpHeader">Installationshj.lp</String>.. <String Id="HelpText">/passive \| /quiet - visar ett minimalt anv.ndargr.nssnitt utan prompter,.. alternativt inget anv.ndargr.nssnitt och inga prompter. Som standard visas.. anv.ndargr.nssnitt och samtliga prompter...../norestart - hejdar omstart. Som standard visar anv.ndargr.nssnittet en.. prompt f.re omstart.../log log.txt - skapar logg till

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1055\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2303
Entropy (8bit):	5.2754753523795275
Encrypted:	false
SSDEEP:	48:cxX7DNcYT8anOSMsHEqGpcBztpvrJlrs2ZmNI2+Yo6irN3m22NFcPc+4Trzrdgc7:8LZHTE7APaTI9sq6yEbgg
MD5:	01B200E06BA600A4EF00C00F7AAC5CE4
SHA1:	22234426C42637E069A46217019551E4434A4AB6
SHA-256:	06BFB6DFBC38105C699DEA226A029DF3EF673C33E4B8928DC4EC7FB8F761487D
SHA-512:	8BDCF7533A6BCFA231B42A7EF845A70C7535FBF607D62FF6404928D5941BA6AFBF139450A1A1B58C65FACF88DC0785AEC4ABEFBCC803466A58B1930F7C468CDD
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="tr-tr" Language="1055" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Kurulumu</String>.. <String Id="Title">[WixBundleName] kurulumu i.in Microsoft .NET Framework gerekir</String>.. <String Id="ConfirmCancelMessage">.ptal etmek istedi.inizden emin misiniz?</String>.. <String Id="HelpHeader">Kurulum Yard.m.</String>.. <String Id="HelpText">/passive \| /quiet - komut istemi olmayan olabildi.ince k...k bir UI.. g.r.nt.ler veya komut istemi ve UI g.r.nt.lemez. Varsay.lan olarak UI.. ve t.m komut istemleri g.r.nt.lenir...../norestart - yeniden ba.latma denemelerini engeller. Varsay.lan.. olarak UI yeniden ba.latmadan .nce komut isteyecekt

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1060\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2200
Entropy (8bit):	5.1485120966265
Encrypted:	false
SSDEEP:	48:cxX7DZ0T8obZsw9g5gS56K97D7NCt2VoN3mQXNJPOhP58vqc1qwueo3RAL:8LyTLlS9h9hCtsihdxOh+NL
MD5:	5836F0C655BDD97093F68AAF69AB2BAB
SHA1:	B6842E816F9E0DCC559A5692E4D26101D10B4B16
SHA-256:	C015247D022BDC108B4FFCAE89CB55D1E313034D7E6EED18744C1BB55F108F8C
SHA-512:	640A79D6A756E591AD02DDCCC53BC43F855C5148B8CBB5CE6C1CAF5419CA02F7B2AFF89CCA4C056356814D3899EF79BF038B4E8B4B79EB85138A3CEDCCE93E5B
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="sl-si" Language="1060" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Namestitev</String>.. <String Id="Title">Microsoft .NET Framework, potreben za namestitev paketa [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Ali ste prepri.ani, da .elite preklicati?</String>.. <String Id="HelpHeader">Pomo. za namestitev</String>.. <String Id="HelpText">/passive \| /quiet - prika.e minimalni uporabni.ki vmesnik brez pozivov ali ne prika.e.. uporabni.kega vmesnika in pozivov. Privzeto so prikazani uporabni.ki vmesnik in.. vsi pozivi...../norestart - skrije vse mo.nosti za vnovicni zagon. Privzeto uporabni.ki vmesnik.. prika.e poziv pred ponovnim zag

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\2052\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1980
Entropy (8bit):	6.189594519053644
Encrypted:	false
SSDEEP:	48:cxX7DjQT8tOBousi+zq+frUR2ropNV2rfN3msNUqPPT9T+DwZ9f5wDTAV:8L4TGUGw3V8N3RykV
MD5:	A34DCF7771198C779648B89156483E83
SHA1:	A6E0FA91CD50048511C7BEF1BE3A8D32B42B6D1F
SHA-256:	89C559C6765F8D643469E3C8F4AA93023F09369B0395EA647FAD5AF3C2893EB6
SHA-512:	0F1D7BC4FD64E18EEEC488CDCE01FB6BFA5CD3BFF614A8D03E388D39F569B8341E74302946877EB25BA1EB17AEC137499189605E251FAFB6B20051744CB463B1
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="zh-ch" Language="2052" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] ..</String>.. <String Id="Title">[WixBundleName] .... Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">......</String>.. <String Id="HelpText">/passive \| /quiet - ..... UI .......... UI ... ........... UI ........../norestart - .............. UI ........../log log.txt - .............. %TEMP% ........</String>.. <String Id="HelpCloseButton"

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\2070\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2211
Entropy (8bit):	5.1155097909395035
Encrypted:	false
SSDEEP:	48:cxX7DbT8QGls54nK3znI5zKDj4NLkdoN3mMNYsEPbpK2Aegeu9A5g:8LXTUasJnYdi59som6
MD5:	8A278E519EF81B2847490EFB070219BC
SHA1:	7365EDF6E4F9E66B6CEE47933B6C70FF0B9ECFF8
SHA-256:	E2BFDB2CF3BEAE2E988827C52C58006D7EEAD4ABA5312B5EAE1F6CCF3863C385
SHA-512:	88275C1136FFB15AB04D315E8601BE2DE77387F3E00F17E9807E415A9DFC4A73E2CD3B5710E4CA58006F91E18180D7CFAEEF4E8319C624E1B81397F9CB9ECA92
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="pt-pt" Language="2070" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Configura..o do [WixBundleName]</String>.. <String Id="Title">O Microsoft .NET Framework . necess.rio para a configura..o do [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Tem a certeza de que pretende cancelar?</String>.. <String Id="HelpHeader">Ajuda da Configura..o</String>.. <String Id="HelpText">/passive \| /quiet - apresenta IU m.nima sem mensagens ou n.o apresenta IU nem.. mensagens. Por predefini..o, s.o apresentadas a IU e todas as mensagens...../norestart - suprimir qualquer tentativa de rein.cio. Por predefini..o, a IU.. avisar. antes de reiniciar.../log log.txt - r

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\3082\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2400
Entropy (8bit):	4.992567587099768
Encrypted:	false
SSDEEP:	48:cxX7DLT8/OusS2V8j4Lq+7dKzCLdqaaD6NJaXFoN3mRNLo3PWKWnRcsB9A8:8LfTz+8EPqKqTJiFikUgk8
MD5:	1024AA88AE01BC7BA797193CC6023375
SHA1:	9252A309C1CB32573F4D58A595A78660FDF54B2F
SHA-256:	B884C4ABB8867553C1FFADD6721C2135EC5F9F1455C3F668D711CCEA65363D1A
SHA-512:	77E6DD332104C0461B7C5A08469161AF3F1DC51D3B55585D39DD9FC9E2088DA036BDF2278CFB96CA702FD26CE073C6C6F66611313270700B9E7A76600C1C8E38
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="es-es" Language="3082" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Instalaci.n de [WixBundleName]</String>.. <String Id="Title">La instalaci.n de [WixBundleName] requiere Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">.Est. seguro de que desea cancelar?</String>.. <String Id="HelpHeader">Ayuda del programa de instalaci.n</String>.. <String Id="HelpText">/passive \| /quiet - muestra una interfaz de usuario m.nima y no realiza.. preguntas, o bien no muestra interfaz de usuario y no realiza preguntas... De manera predeterminada se muestra la interfaz de usuario completa y se.. realizan todas las preguntas necesarias...../norestart - suprime cu

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\BootstrapperApplicationData.xml

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (577), with CRLF line terminators
Category:	dropped
Size (bytes):	12472
Entropy (8bit):	3.702686786727086
Encrypted:	false
SSDEEP:	192:XpoHNKHNlH5HuKHulHlnuvoQnYvazuPQjWYrANlPCDv6+tKgc7wOKdlMzZy95h:XnylZQaxZE
MD5:	5A03F074D171553B87EEC4D26CA59396
SHA1:	52C2B730B4B9EFDA59FBF7945105BDE817C90A64
SHA-256:	F5C127201EF26F559C08DCB98E7303DC3217CC485934AAA33B80C1DBA890BAE2
SHA-512:	0BA681CA446EDA7C5BD8C1353FF5C6D982791615A46D3FD0A70C1546928C7C916FA3B74EB64A3D6C9B6ED3569E47C1ADEFE00A1E1E1C1E96B9BB221F08AABC2B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.x./.2.0.1.0./.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a.".>..... . .<.W.i.x.B.u.n.d.l.e.P.r.o.p.e.r.t.i.e.s. .D.i.s.p.l.a.y.N.a.m.e.=."...N.E.T. .M.e.m.o.r.y. .P.r.o.f.i.l.e.r. .5...7.". .L.o.g.P.a.t.h.V.a.r.i.a.b.l.e.=.".W.i.x.B.u.n.d.l.e.L.o.g.". .C.o.m.p.r.e.s.s.e.d.=.".n.o.". .I.d.=.".{.8.a.9.1.4.0.6.1.-.9.8.8.1.-.4.1.3.8.-.8.c.3.e.-.e.5.1.c.c.6.b.a.c.c.8.a.}.". .U.p.g.r.a.d.e.C.o.d.e.=.".{.9.0.0.7.C.2.5.B.-.A.D.2.7.-.4.C.F.0.-.8.4.0.9.-.F.2.8.3.0.2.7.5.F.3.3.D.}.". .P.e.r.M.a.c.h.i.n.e.=.".y.e.s.". ./.>..... . .<.W.i.x.M.b.a.P.r.e.r.e.q.I.n.f.o.r.m.a.t.i.o.n. .P.a.c.k.a.g.e.I.d.=.".N.e.t.f.x.4.F.u.l.l.". .L.i.c.e.n.s.e.U.r.l.=.".N.e.t.f.x.L.i.c.e.n.s.e...r.t.f.". ./.>..... . .<.W.i.x.P.a.c.k.a.g.e.F.e.a.t.u.r.e.I.n.f.o. .P.a.c.k.a.g.e.=.".N.m.p.V.s.i.x.I.

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\BootstrapperCore.config

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	766
Entropy (8bit):	4.832474113654491
Encrypted:	false
SSDEEP:	12:MMHd41Gqt7lzc+TXYr+XF69bWzc+TXYcXIhuGsVymhsSmJ9OT3XWGP7D7XRN+3u4:Jdi7RtYrx9itYxmhKu3GcHG3F
MD5:	65AB82575A0DF87030341A0C0316B3A1
SHA1:	2E2F6083D7DBB4223B082D2DFBAA6A45C708F9A7
SHA-256:	EDF06B61633DCA9D68C658E17C32CFD47A0B85E811C4D8B9DE2DC8E1DBF5317F
SHA-512:	D5F4B29D124794999B3EC3B131765DE9682B7E78E1AF84FAB854CABA9D24ADF657F8C04CC10192D9D8709AC6742779950E854C6BFA6E90AF54D2AE99126AE830
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" ?>..<configuration>.. <configSections>.. <sectionGroup name="wix.bootstrapper" type="Microsoft.Tools.WindowsInstallerXml.Bootstrapper.BootstrapperSectionGroup, BootstrapperCore">.. <section name="host" type="Microsoft.Tools.WindowsInstallerXml.Bootstrapper.HostSection, BootstrapperCore" />.. </sectionGroup>.. </configSections>.. <startup useLegacyV2RuntimeActivationPolicy="true">.. <supportedRuntime version="v4.0" />.. </startup>.. <wix.bootstrapper>.. <host assemblyName="MemProfilerBootstrapper">.. <supportedFramework version="v4\Full" />.. <supportedFramework version="v4\Client" />.. </host>.. </wix.bootstrapper>..</configuration>..

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\BootstrapperCore.dll

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	90032
Entropy (8bit):	5.688550211341784
Encrypted:	false
SSDEEP:	768:9BgPxZlx0MBps+j7ejaab0Y6OwE7v10WHSp5fh06iG27N9k+6ybJ1ErEgtCmYjhm:HHMBp/GRbgi5ofpiG2pq+51EogsmYI
MD5:	B0D10A2A622A322788780E7A3CBB85F3
SHA1:	04D90B16FA7B47A545C1133D5C0CA9E490F54633
SHA-256:	F2C2B3CE2DF70A3206F3111391FFC7B791B32505FA97AEF22C0C2DBF6F3B0426
SHA-512:	62B0AA09234067E67969C5F785736D92CD7907F1F680A07F6B44A1CAF43BFEB2DF96F29034016F3345C4580C6C9BC1B04BEA932D06E53621DA4FCF7B8C0A489F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: TsU2RShnl7.exe, Detection: malicious, Browse Filename: ScreenToGif.2.40.Setup.x64.msi, Detection: malicious, Browse Filename: PDFCreator-5_1_2-Setup.exe, Detection: malicious, Browse Filename: PDFCreator-5_1_2-Setup.exe, Detection: malicious, Browse Filename: PDFCreator-5_1_2-Setup.exe, Detection: malicious, Browse Filename: PDFCreator-5_1_1-Setup.exe, Detection: malicious, Browse Filename: PDFCreator-5_1_1-Setup.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: PDFCreator-5_0_3-Setup.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Mp.].........." ..0...... ........... ...@....... ..............................N.....@.................................`...O....@...............@.......`......(-............................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......0..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\MemProfilerBootstrapper.dll

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	6.627501418487896
Encrypted:	false
SSDEEP:	1536:zWLKWsyhUXecFVP7Ypn1j5gYiX4UMHzI5ek3XSs:eUucglgYiX4W/
MD5:	0466CE9EC4EDA34C7E7C5FEEA5B21044
SHA1:	39779A56FDA53FDE5035F83B44C3E87AF657B896
SHA-256:	529C41FDD2762A26210C02554521FA65F3B862204DD29A1012498DBF079CF5B9
SHA-512:	697B0E0C4A94C75FEC47C53DAE280093BD1FE0CECF559D998CDA1213ABF54F81048BB3501522ADC5B82E34FBEA43D812AFFD616FD0A14AEE72B0909F0C5779FD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....F..........." ..0.................. ... ....... .......................`............@.....................................O.... .......................@..........8............................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H........F...s...............d............................................(......(....^.(.......]...%...}....:.(......}....:.(......}......(.....~...............0..........s......(.....r...po....(....(.....( ......~D......(!........(!....3..o......s........o....}M....,I..{M...o"...........s#...o$....~L...%-.&~K.........s%...%.L...o&....o'...((....(.....o).....(.....(.....s....6.(.....s....6.(+....(.....0..$........{....,...}....r7..p.s,......(-...&...(....f.

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\Microsoft.Deployment.WindowsInstaller.dll

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	184240
Entropy (8bit):	5.876033362692288
Encrypted:	false
SSDEEP:	3072:BGfZS7hUuK3PcbFeRRLxyR69UgoCaf8+aCnfKlRUjW01KymkO:9zMRLkR6joxfRPW
MD5:	1A5CAEA6734FDD07CAA514C3F3FB75DA
SHA1:	F070AC0D91BD337D7952ABD1DDF19A737B94510C
SHA-256:	CF06D4ED4A8BAF88C82D6C9AE0EFC81C469DE6DA8788AB35F373B350A4B4CDCA
SHA-512:	A22DD3B7CF1C2EDCF5B540F3DAA482268D8038D468B8F00CA623D1C254AFFBBC1446E5BD42ADC3D8E274BE3BA776B0034E179FACCD9AC8612CCD75186D1E3BF1
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Honeygain_install.exe.zip, Detection: malicious, Browse Filename: EmbravaConnect.msi, Detection: malicious, Browse Filename: 2503.msi, Detection: malicious, Browse Filename: ProSheets.msi, Detection: malicious, Browse Filename: AdobeAcrobat2.1.2.msi, Detection: malicious, Browse Filename: 440e4d.msi, Detection: malicious, Browse Filename: OPSWAT NetWall OSI-Pi Service (Blue).msi, Detection: malicious, Browse Filename: OPSWAT_OPCDA_RED_Service.msi, Detection: malicious, Browse Filename: digitalform.msi, Detection: malicious, Browse Filename: OPSWAT NetWall OSI-Pi Service (Red).msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....o.].........." ..0...... ......z.... ........... ....................................@.................................(...O................................................................................... ............... ..H............text....w... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\mbahost.dll

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	122288
Entropy (8bit):	6.643662045821993
Encrypted:	false
SSDEEP:	3072:iyjfrCvv4JR5zsemsABCF0TPSLNegl/+b:xrrCYRsehsIX/E
MD5:	C59832217903CE88793A6C40888E3CAE
SHA1:	6D9FACABF41DCF53281897764D467696780623B8
SHA-256:	9DFA1BC5D2AB4C652304976978749141B8C312784B05CB577F338A0AA91330DB
SHA-512:	1B1F4CB2E3FA57CB481E28A967B19A6FEFA74F3C77A3F3214A6B09E11CEB20AE428D036929F000710B4EB24A2C57D5D7DFE39661D5A1F48EE69A02D83381D1A9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........v........................}.......\|..............................o..............2~......2~......2~q.............2~......Rich....................PE..L...Tp.]...........!.....&..........(>.......@.......................................;....@.....................................x......................................T...........................H...@............@...............................text....%.......&.................. ..`.rdata...s...@...t...*..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\mbapreq.dll

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	188848
Entropy (8bit):	6.598346436496911
Encrypted:	false
SSDEEP:	3072:iaVVzf0r2vM357+pwnohBIiv8+2kt2GOTALPN2obXbE7PKPU9+Wxhsz7CMD:iaLzfpIsHhBIqgGOTALFdbz7f
MD5:	FE7E0BD53F52E6630473C31299A49FDD
SHA1:	F706F45768BFB95F4C96DFA0BE36DF57AA863898
SHA-256:	2BEA14D70943A42D344E09B7C9DE5562FA7E109946E1C615DD584DA30D06CC80
SHA-512:	FEED48286B1E182996A3664F0FACDF42AAE3692D3D938EA004350C85764DB7A0BEA996DFDDF7A77149C0D4B8B776FB544E8B1CE5E9944086A5B1ED6A8A239A3C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:v.O~.c.~.c.~.c....t.c......c....f.c.,.g.n.c.,.`.l.c.,.f.a.c.wo..z.c.wo..c.c.~.b.\|.c..~f.g.c..~c...c..~....c.~.....c..~a...c.Rich~.c.........PE..L...Yp.]...........!................................................................1.....@.........................`.......L...................................`.......T...........................H...@...............\............................text............................... ..`.rdata..2...........................@..@.data...............................@....rsrc...............................@..@.reloc..`...........................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\mbapreq.png

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	PNG image data, 63 x 63, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	797
Entropy (8bit):	7.648767094164769
Encrypted:	false
SSDEEP:	12:6v/7rW3M/jDYAlFTzdvhKZ7e/cbp4/82UNb6MjmlKPNXheD1H0oJodqSXaTbutak:lQD1lldv8Z7g04/82Y6+Pxi19mDoqt5
MD5:	A356956FD269567B8F4612A33802637B
SHA1:	75AE41181581FD6376CA9CA88147011E48BF9A30
SHA-256:	A401A225ADDAF89110B4B0F6E8CF94779E7C0640BCDD2D670FFCF05AAB0DAD03
SHA-512:	A0F7836AEFA1747F481C116F6B085F503B5C09B3A1DD97CD2189F7CE4E6E7EA98F1F66503CBA2E6A83E873248CC7507328710DFA670AA5763DF8AEDCC560285E
Malicious:	false
Preview:	.PNG........IHDR...?...?.....W_......sRGB.........gAMA......a.....pHYs..........+......IDAThC./W.0....P(...Db+q8$.........J...-..8.e]._..;........Y... .Y....z\........{W\|..../q..<%.....C5...0....OrU....,..^........).....2.......i.Ge..T9T..}.7..J.......}..b...S.>.%y..Fc..j.X.....y."...e.U..M(ez....4\..C....u.......w..0..J.Wo."...mM.r.h..8..q..X..k!...j..xn...l...W`..r.+.R..J........c.T.}......cz..<43..@.c..rH...\|..V.....K.mN.........k....,..4OL..5..M.tm%=.U.t-7.w....k.R.....c...-].5~..]2..5...GA..[..={.5..].=(.$}.\.9..5...MWu..[#.....F..j.F...d...,..MWu.7..3......$.......G.t.....=;N<_:[......0.,1.y.\.Z.\|..%..>}...q.s....y.#p......!-.;.6!o.KO..E.6...........<..c..9_B....y....im...b...Xn.....)t9Q...........V.WMtP. .P..Z.&..KR.ac......IEND.B`.

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\mbapreq.thm

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3915
Entropy (8bit):	5.15881451198739
Encrypted:	false
SSDEEP:	48:cecHddpXBT2E/zPHWgtpmAPH8TSJmBP+NPHrM/O8YpQbFUuhJ3PK7usPH4Lr:wHdHxS4Z9UG4BmNjCOhpsB3PswP
MD5:	A20778EC90A094A62A6C3A6AB2A6DC7D
SHA1:	74C131B5FD80446FFDF2AFAD723762DD36621309
SHA-256:	F8C3A03F47F0B9B3C20F0522A2481DA28C77FECDBB302F8DD8FBED87758CBAEA
SHA-512:	47F34A9F416D223DCBF071E7292A05554AF3D27CDE67FC8C161C1BED564C6E7FC448C2F482E05F33149C782E09C681BD65730CA00CF9EC68B284128214B75529
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Theme xmlns="http://wixtoolset.org/schemas/thmutil/2010">.. <Window Width="485" Height="300" HexStyle="100a0000" FontId="0">#(loc.Caption)</Window>.. <Font Id="0" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="1" Height="-24" Weight="500" Foreground="000000">Segoe UI</Font>.. <Font Id="2" Height="-22" Weight="500" Foreground="666666">Segoe UI</Font>.. <Font Id="3" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="4" Height="-12" Weight="500" Foreground="ff0000" Background="FFFFFF" Underline="yes">Segoe UI</Font>.... <Image X="11" Y="11" Width="64" Height="64" ImageFile="mbapreq.png" Visible="yes"/>.. <Text X="80" Y="11" Width="-11" Height="96" FontId="1" Visible="yes" DisablePrefix="yes">#(loc.Title)</Text>.... <Page Name="Help">.. <Text X="11" Y="112" Width="-11" Height="30" FontId="2" DisablePrefix="yes">#(loc.HelpHeader

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2464
Entropy (8bit):	5.076345322304751
Encrypted:	false
SSDEEP:	48:cxX7DxMT8dbCsK19Wqq8+JIDxN3Wm2WcN3miNlLPDHXsmkaYXfXQ2BmGA7b1fABP:8LuTY1xmmmTerNR0AT1O
MD5:	4D2C8D10C5DCCA6B938B71C8F02CA8A8
SHA1:	11577021465379E9D1FF4260E607149BA5DFA6B3
SHA-256:	C63DE5F309502F9272402587A6BE22624D1BC2FEACD1BD33FB11E44CD6614B96
SHA-512:	AE791C1F05821167F1D2E1D07DBF95FE7E72B35B3E4B1E22720006C7A672B1330B748414792392B0E806F111AA4EFC1C424F4479EBDE349E3F079792DBB3BF47
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Setup</String>.. <String Id="Title">Microsoft .NET Framework required for [WixBundleName] setup</String>.. <String Id="ConfirmCancelMessage">Are you sure you want to cancel?</String>.. <String Id="HelpHeader">Setup Help</String>.. <String Id="HelpText">/passive \| /quiet - displays minimal UI with no prompts or displays no UI and.. no prompts. By default UI and all prompts are displayed...../norestart - suppress any attempts to restart. By default UI will prompt before restart.../log log.txt - logs to a specific file. By default a log file is created in %TEMP%.</String>.. <String Id="HelpClos

C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe

Download File

Process:	C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	818992
Entropy (8bit):	7.452786775981928
Encrypted:	false
SSDEEP:	24576:sNsfiTdYSuVzZH9tH1v159laeo4gpGwBITFjIic3:YT2pZ19aeo4SBITFjIL
MD5:	B22C2660CB9454592A98077B00CD0DCD
SHA1:	6F62141DBE6C545AC10C70FC254DF5FD8F2B6B31
SHA-256:	EAE780CB1536BADBF43730621F3CB0D311BBB77DBA0D4CE1017998F7888B404D
SHA-512:	9A874F9B8DC4FBE2D75215C9D3022EA9E3CFEFAE82A3EF9B4403AEF4E8FF06A9F73C553C4ECDE49DC2EED95DB180411CE03BC9C50A02A2236761D1503CAF1D1D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.o.}k..}k..}k.....wk......k.....ek../...nk../...ik../...Vk..t...xk..t...lk..}k..(j......6k......\|k..}k...k......\|k..Rich}k..........PE..L...2p.]............................q.............@..................................I....@.............................................4m...........X...'...@...=..0p..T....................p.......j..@...................4\|.......................text............................... ..`.rdata..`...........................@..@.data...............................@....wixburn8...........................@..@.rsrc...4m.......n..................@..@.reloc...=...@...>..................@..B........................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.999529266870029
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	MemProfilerInstaller5_7_28.exe
File size:	101'670'752 bytes
MD5:	7e45c0ea667dcf7b44cc304a0f159d32
SHA1:	d38693fb82dd2132fc314708e8fabb3aebe07668
SHA256:	9c249afa63fee4ecf8feab4512bbefba68949da7083349d26ffa439c06eab3c3
SHA512:	acf49593a8b3d22ee625311be27742c569d07769dc8fa3b5b15dfc3c13f41795ec2271e767228dfac25c24f0296923a8b973118e0534fe07d9cca289e71d4fa7
SSDEEP:	1572864:DXH+AQroM3cJbLH3l8PO5Sd2X3WOMNvDgJm9Byv70bfAdiATZSj2WMLEi55mc9du:DH+r0M3OLVna2XGOYvIDnZ74ivPGWj
TLSH:	3B283322E005DEBEE8730AB5765CB93C5668F13A4B614525D2BCDD99B5A30432F33AC3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.o.}k..}k..}k......wk.......k......ek../...nk../...ik../...Vk..t...xk..t...lk..}k..(j......6k......\|k..}k...k......\|k..Rich}k.

File Icon


Icon Hash:	ac989181db96356a

Static PE Info

General

Entrypoint:	0x42df71
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, REMOVABLE_RUN_FROM_SWAP, NET_RUN_FROM_SWAP
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5D807032 [Tue Sep 17 05:33:38 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	42d651751c1d75ed4fa8fe71751854ff

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	19/01/2023 00:00:00 18/01/2026 23:59:59
Subject Chain	CN=SciTech Software AB, O=SciTech Software AB, S=Stockholms l\xe4n, C=SE
Version:	3
Thumbprint MD5:	259693924889229EA4262599A6C011BB
Thumbprint SHA-1:	9F06CF093CDFEC62664E836C0AEE9D5635AE5A4A
Thumbprint SHA-256:	889B6497CE39CED29A41F95A00C133F0C0457DFE8FC569749827664ECEC2DD4F
Serial:	0DE920DD3C33F07C2BBCDB2E60C69D94

Entrypoint Preview

Instruction
call 00007FBB70C8E28Fh
jmp 00007FBB70C8DBCFh
int3
int3
int3
int3
int3
mov eax, dword ptr [esp+08h]
mov ecx, dword ptr [esp+10h]
or ecx, eax
mov ecx, dword ptr [esp+0Ch]
jne 00007FBB70C8DD5Bh
mov eax, dword ptr [esp+04h]
mul ecx
retn 0010h
push ebx
mul ecx
mov ebx, eax
mov eax, dword ptr [esp+08h]
mul dword ptr [esp+14h]
add ebx, eax
mov eax, dword ptr [esp+08h]
mul ecx
add edx, ebx
pop ebx
retn 0010h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
cmp cl, 00000040h
jnc 00007FBB70C8DD67h
cmp cl, 00000020h
jnc 00007FBB70C8DD58h
shrd eax, edx, cl
shr edx, cl
ret
mov eax, edx
xor edx, edx
and cl, 0000001Fh
shr eax, cl
ret
xor eax, eax
xor edx, edx
ret
push ebp
mov ebp, esp
jmp 00007FBB70C8DD5Fh
push dword ptr [ebp+08h]
call 00007FBB70C94138h
pop ecx
test eax, eax
je 00007FBB70C8DD61h
push dword ptr [ebp+08h]
call 00007FBB70C941C1h
pop ecx
test eax, eax
je 00007FBB70C8DD38h
pop ebp
ret
cmp dword ptr [ebp+08h], FFFFFFFFh
je 00007FBB70C8E654h
jmp 00007FBB70C8E631h
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007FBB70C8E66Dh
pop ecx
pop ebp
ret
push ebp
mov ebp, esp
test byte ptr [ebp+08h], 00000001h
push esi
mov esi, ecx
mov dword ptr [esi], 0046030Ch
je 00007FBB70C8DD5Ch
push 0000000Ch
push esi
call 00007FBB70C8DD2Dh
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x680b4	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6d000	0x6d34	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x60f3848	0x2718
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x74000	0x3dd0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x67030	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x67084	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x66a10	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x4a000	0x3e0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x67c34	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x48ff7	0x49000	c66f549d5fc7d10a5f63350701c6b3f9	False	0.5367883133561644	data	6.572059575788497	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x4a000	0x1f760	0x1f800	5a2f02dbbbda51cfac50fb52cea6d11b	False	0.30963231646825395	data	5.137524712720983	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x6a000	0x16fc	0xa00	8fe8ba25b04a7beb04c2ab2d5e9ea736	False	0.27265625	data	3.1551613029957557	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.wixburn	0x6c000	0x38	0x200	fc4d4b8681e865973e79444753e603d0	False	0.130859375	data	0.7538687744532455	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x6d000	0x6d34	0x6e00	ffd9bd44404fd70fbf0c3837cc77b887	False	0.409375	data	5.983028682993427	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x74000	0x3dd0	0x3e00	7cc10e0060080262550138057fd6b87d	False	0.8069556451612904	data	6.788270717274864	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x6d1d8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.46815352697095436
RT_ICON	0x6f780	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.5138367729831145
RT_ICON	0x70828	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.5957446808510638
RT_MESSAGETABLE	0x70c90	0x2840	data	English	United States	0.28823757763975155
RT_GROUP_ICON	0x734d0	0x30	data	English	United States	0.8541666666666666
RT_VERSION	0x73500	0x360	data	English	United States	0.4525462962962963
RT_MANIFEST	0x73860	0x4d2	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1174), with CRLF line terminators	English	United States	0.47568881685575365

Imports

DLL	Import
ADVAPI32.dll	RegCloseKey, RegOpenKeyExW, OpenProcessToken, AdjustTokenPrivileges, LookupPrivilegeValueW, InitiateSystemShutdownExW, GetUserNameW, RegQueryValueExW, RegDeleteValueW, CloseEventLog, OpenEventLogW, ReportEventW, ConvertStringSecurityDescriptorToSecurityDescriptorW, DecryptFileW, CreateWellKnownSid, InitializeAcl, SetEntriesInAclW, ChangeServiceConfigW, CloseServiceHandle, ControlService, OpenSCManagerW, OpenServiceW, QueryServiceStatus, SetNamedSecurityInfoW, CheckTokenMembership, AllocateAndInitializeSid, SetEntriesInAclA, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, RegSetValueExW, RegQueryInfoKeyW, RegEnumValueW, RegEnumKeyExW, RegDeleteKeyW, RegCreateKeyExW, GetTokenInformation, CryptDestroyHash, CryptHashData, CryptCreateHash, CryptGetHashParam, CryptReleaseContext, CryptAcquireContextW, QueryServiceConfigW
USER32.dll	PeekMessageW, PostMessageW, IsWindow, WaitForInputIdle, PostQuitMessage, GetMessageW, TranslateMessage, MsgWaitForMultipleObjects, PostThreadMessageW, GetMonitorInfoW, MonitorFromPoint, IsDialogMessageW, LoadCursorW, LoadBitmapW, SetWindowLongW, GetWindowLongW, GetCursorPos, MessageBoxW, CreateWindowExW, UnregisterClassW, RegisterClassW, DefWindowProcW, DispatchMessageW
OLEAUT32.dll	VariantInit, SysAllocString, VariantClear, SysFreeString
GDI32.dll	DeleteDC, DeleteObject, SelectObject, StretchBlt, GetObjectW, CreateCompatibleDC
SHELL32.dll	CommandLineToArgvW, SHGetFolderPathW, ShellExecuteExW
ole32.dll	CoUninitialize, CoInitializeEx, CoInitialize, StringFromGUID2, CoCreateInstance, CoTaskMemFree, CLSIDFromProgID, CoInitializeSecurity
KERNEL32.dll	GetCPInfo, GetOEMCP, IsValidCodePage, CloseHandle, CreateFileW, GetProcAddress, LocalFree, HeapSetInformation, GetLastError, GetModuleHandleW, FormatMessageW, lstrlenA, lstrlenW, MultiByteToWideChar, WideCharToMultiByte, LCMapStringW, Sleep, GetLocalTime, GetModuleFileNameW, ExpandEnvironmentStringsW, GetTempPathW, GetTempFileNameW, CreateDirectoryW, GetFullPathNameW, CompareStringW, GetCurrentProcessId, WriteFile, SetFilePointer, LoadLibraryW, GetSystemDirectoryW, CreateFileA, HeapAlloc, HeapReAlloc, HeapFree, HeapSize, GetProcessHeap, FindClose, GetCommandLineA, GetCurrentDirectoryW, RemoveDirectoryW, SetFileAttributesW, GetFileAttributesW, DeleteFileW, FindFirstFileW, FindNextFileW, MoveFileExW, GetCurrentProcess, GetCurrentThreadId, InitializeCriticalSection, DeleteCriticalSection, ReleaseMutex, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, CreateProcessW, GetVersionExW, VerSetConditionMask, FreeLibrary, EnterCriticalSection, LeaveCriticalSection, GetSystemTime, GetNativeSystemInfo, GetModuleHandleExW, GetWindowsDirectoryW, GetSystemWow64DirectoryW, GetCommandLineW, VerifyVersionInfoW, GetVolumePathNameW, GetDateFormatW, GetUserDefaultUILanguage, GetSystemDefaultLangID, GetUserDefaultLangID, GetStringTypeW, ReadFile, SetFilePointerEx, DuplicateHandle, InterlockedExchange, InterlockedCompareExchange, LoadLibraryExW, CreateEventW, ProcessIdToSessionId, OpenProcess, GetProcessId, WaitForSingleObject, ConnectNamedPipe, SetNamedPipeHandleState, CreateNamedPipeW, CreateThread, GetExitCodeThread, SetEvent, WaitForMultipleObjects, InterlockedIncrement, InterlockedDecrement, ResetEvent, SetEndOfFile, SetFileTime, LocalFileTimeToFileTime, DosDateTimeToFileTime, CompareStringA, GetExitCodeProcess, SetThreadExecutionState, CopyFileExW, MapViewOfFile, UnmapViewOfFile, CreateMutexW, CreateFileMappingW, GetThreadLocale, FindFirstFileExW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetConsoleCP, GetConsoleMode, FlushFileBuffers, DecodePointer, WriteConsoleW, GetModuleHandleA, GlobalAlloc, GlobalFree, GetFileSizeEx, CopyFileW, VirtualAlloc, VirtualFree, SystemTimeToTzSpecificLocalTime, GetTimeZoneInformation, SystemTimeToFileTime, GetSystemInfo, VirtualProtect, VirtualQuery, GetComputerNameW, SetCurrentDirectoryW, GetFileType, GetACP, ExitProcess, GetStdHandle, InitializeCriticalSectionAndSpinCount, SetLastError, RtlUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, RaiseException, LoadLibraryExA
RPCRT4.dll	UuidCreate

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	00:21:20
Start date:	24/05/2024
Path:	C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe"
Imagebase:	0x560000
File size:	101'670'752 bytes
MD5 hash:	7E45C0EA667DCF7B44CC304A0F159D32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	00:21:20
Start date:	24/05/2024
Path:	C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Temp\{E6BCEB9A-789C-4B61-A31A-88AF3D699066}\.cr\MemProfilerInstaller5_7_28.exe" -burn.clean.room="C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe" -burn.filehandle.attached=544 -burn.filehandle.self=536
Imagebase:	0x120000
File size:	818'992 bytes
MD5 hash:	B22C2660CB9454592A98077B00CD0DCD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Function 005651D2 Relevance: 38.8, APIs: 5, Strings: 17, Instructions: 314
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?), ref: 00565254

Part of subcall function 0059FDC4: InitializeCriticalSection.KERNEL32(005CB5D4,?,00565260,00000000,?,?,?,?,?,?), ref: 0059FDDB

Part of subcall function 00561206: CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,0056527C,00000000,?), ref: 00561244
Part of subcall function 00561206: GetLastError.KERNEL32(?,?,?,0056527C,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 0056124E

CoInitializeEx.OLE32(00000000,00000000,?,?,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 005652C2

Part of subcall function 005A06C0: GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 005A06E1

GetVersionExW.KERNEL32(?,?,?,?,?,?,?), ref: 00565354
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 0056535E
CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 005655CB

Strings

Invalid run mode., xrefs: 00565436
Failed to parse command line., xrefs: 00565282
Failed to get OS info., xrefs: 0056538C
Failed to run RunOnce mode., xrefs: 00565459
Failed to initialize COM., xrefs: 005652CE
Failed to initialize Cryputil., xrefs: 005652E3
Failed to initialize core., xrefs: 00565400
Failed to run untrusted mode., xrefs: 005654F3
c:\agent\_work\66\s\src\burn\engine\engine.cpp, xrefs: 00565382
Failed to initialize XML util., xrefs: 00565336
Failed to run embedded mode., xrefs: 00565481
Failed to run per-user mode., xrefs: 005654D1
Failed to initialize Wiutil., xrefs: 0056531E
Failed to run per-machine mode., xrefs: 005654A9
Failed to initialize Regutil., xrefs: 00565306
3.11.2.4516, xrefs: 005653C1
Failed to initialize engine state., xrefs: 005652A9

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorInitializeLast$AddressArgvCommandCriticalHandleLineModuleProcSectionUninitializeVersion
String ID: 3.11.2.4516$Failed to get OS info.$Failed to initialize COM.$Failed to initialize Cryputil.$Failed to initialize Regutil.$Failed to initialize Wiutil.$Failed to initialize XML util.$Failed to initialize core.$Failed to initialize engine state.$Failed to parse command line.$Failed to run RunOnce mode.$Failed to run embedded mode.$Failed to run per-machine mode.$Failed to run per-user mode.$Failed to run untrusted mode.$Invalid run mode.$c:\agent\_work\66\s\src\burn\engine\engine.cpp
API String ID: 3262001429-313893568
Opcode ID: 49ce0530e79245866b901cf208791c8d4fa84f310447b30ff8f0250b13eccace
Instruction ID: 38cf6b8617ce50ce596d458b9b69adc6bcda79f739fb1680c3a70ede8329f023
Opcode Fuzzy Hash: 49ce0530e79245866b901cf208791c8d4fa84f310447b30ff8f0250b13eccace
Instruction Fuzzy Hash: 48B19F71D80A2A9BDB32AF64CC49BAD7EA4BB55711F0001E5F909B7241EB309E80DF91

Function 005A28BD Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 152
libraryloadercomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,005A2E6B,00000000,?,00000000), ref: 005A28D7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,BTV,0058BD14,005AA518,BTV,?,00000000,?), ref: 005A28E3
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 005A2923
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 005A292F
GetProcAddress.KERNEL32(00000000,Wow64EnableWow64FsRedirection), ref: 005A293A
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 005A2944
CoCreateInstance.OLE32(005CB688,00000000,00000001,005AA878,?,?,?,?,?,?,?,?,?,?,BTV,0058BD14), ref: 005A297F
ExitProcess.KERNEL32 ref: 005A2A2E

Strings

Wow64DisableWow64FsRedirection, xrefs: 005A2929
kernel32.dll, xrefs: 005A28C7
c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp, xrefs: 005A2907
Wow64EnableWow64FsRedirection, xrefs: 005A2931
Wow64RevertWow64FsRedirection, xrefs: 005A293C
IsWow64Process, xrefs: 005A291D

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AddressProc$CreateErrorExitHandleInstanceLastModuleProcess
String ID: IsWow64Process$Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp$kernel32.dll
API String ID: 2124981135-3734847636
Opcode ID: 923df970528d6582e15b2ca8ffdc9090344b426f9b0cfa1dd346251e8cb8ad08
Instruction ID: e4027ee1ccdbd240773fd14169ef709079462d5ae75b4c0546ceb0ec16caa1e3
Opcode Fuzzy Hash: 923df970528d6582e15b2ca8ffdc9090344b426f9b0cfa1dd346251e8cb8ad08
Instruction Fuzzy Hash: 0741AF35A01316AFDB259BACC846FAEBFE4FF56B10F114068E901EB241D7B5DD809B90

Function 00561070 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 77fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005634C4: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,005610DD,?,00000000), ref: 005634E5

CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000080,00000000,?,00000000), ref: 005610F6

Part of subcall function 00561173: HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,0056111A,cabinet.dll,00000009,?,?,00000000), ref: 00561184
Part of subcall function 00561173: GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,0056111A,cabinet.dll,00000009,?,?,00000000), ref: 0056118F
Part of subcall function 00561173: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0056119D
Part of subcall function 00561173: GetLastError.KERNEL32(?,?,?,?,?,0056111A,cabinet.dll,00000009,?,?,00000000), ref: 005611B8
Part of subcall function 00561173: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 005611C0
Part of subcall function 00561173: GetLastError.KERNEL32(?,?,?,?,?,0056111A,cabinet.dll,00000009,?,?,00000000), ref: 005611D5

CloseHandle.KERNEL32(?,?,?,?,005AA4D0,?,cabinet.dll,00000009,?,?,00000000), ref: 00561131

Strings

msasn1.dll, xrefs: 005610C3
clbcatq.dll, xrefs: 005610BC
version.dll, xrefs: 005610A7
wininet.dll, xrefs: 005610AE
crypt32.dll, xrefs: 005610CA
comres.dll, xrefs: 005610B5
feclient.dll, xrefs: 005610D1
msi.dll, xrefs: 005610A0
cabinet.dll, xrefs: 00561099, 00561114

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AddressErrorFileHandleLastModuleProc$CloseCreateHeapInformationName
String ID: cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$feclient.dll$msasn1.dll$msi.dll$version.dll$wininet.dll
API String ID: 3687706282-3151496603
Opcode ID: 10023542460a09774ca64d98c0b6d3fa66f1850cd0f7cf42179b842cb3aa6727
Instruction ID: d90eb1cc2a183d0a105b3d595bfde77ac3828d8e010bd14070a2cb4c7521db6f
Opcode Fuzzy Hash: 10023542460a09774ca64d98c0b6d3fa66f1850cd0f7cf42179b842cb3aa6727
Instruction Fuzzy Hash: 4D216D71900619ABCF10AFA4DC0DBEEBFF8BB4A714F544115FA11B7281D7B09908DBA5

Function 00579F8F Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 50COMMON

Download Yara Rule

Strings

Failed create working folder., xrefs: 00579FC2
Failed to calculate working folder to ensure it exists., xrefs: 00579FAC
Failed to copy working folder., xrefs: 00579FEA

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CurrentDirectoryErrorLastProcessWindows
String ID: Failed create working folder.$Failed to calculate working folder to ensure it exists.$Failed to copy working folder.
API String ID: 3841436932-2072961686
Opcode ID: 8c9fda463ccfc30e61e350f09391cc7f0078e3aa15131a22f6700e12aa0619fa
Instruction ID: 10ac645c0b6e529a3c1f1ab69379e4e02f764d05f88c53c110cec9f24029be7a
Opcode Fuzzy Hash: 8c9fda463ccfc30e61e350f09391cc7f0078e3aa15131a22f6700e12aa0619fa
Instruction Fuzzy Hash: 65018431904565FB8B236B55ED0ACAEBF76FF91B217118155F804F6254EB319E00F6A0

Function 005639DF Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,000001C7,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F0
RtlAllocateHeap.NTDLL(00000000,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F7

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 5c4d18f19c8be9d6ff553f15b1e22c5ae398945741902475cb77116bbe1fcd32
Instruction ID: d10e207aa9910748a8c6dfc1ab42960ba39bfd2d98ba2ba70ee591fa269af9b4
Opcode Fuzzy Hash: 5c4d18f19c8be9d6ff553f15b1e22c5ae398945741902475cb77116bbe1fcd32
Instruction Fuzzy Hash: 30C012321A420DBB8B406FF8EC0EC9A3BACBB69602B048400B905C2110C738E018EB61

Function 0056DEDC Relevance: 130.1, APIs: 11, Strings: 63, Instructions: 648COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 0056E001
SysFreeString.OLEAUT32(00000000), ref: 0056E6E5

Part of subcall function 005639DF: GetProcessHeap.KERNEL32(?,000001C7,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F0
Part of subcall function 005639DF: RtlAllocateHeap.NTDLL(00000000,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F7

Strings

Failed to select rollback boundary nodes., xrefs: 0056DF12
Failed to parse target product codes., xrefs: 0056E64A
Permanent, xrefs: 0056E1DE
clbcatq.dll, xrefs: 0056E1C2
wininet.dll, xrefs: 0056E203
InstallCondition, xrefs: 0056E265
Failed to parse MSI package., xrefs: 0056E36A
PerMachine, xrefs: 0056E1C3
RollbackBoundaryForward, xrefs: 0056E288
RollbackBoundary, xrefs: 0056DEFF
msi.dll, xrefs: 0056E171
Failed to get rollback bundary node count., xrefs: 0056DF37
Failed to parse payload references., xrefs: 0056E660
Cache, xrefs: 0056E0F4
Failed to allocate memory for rollback boundary structs., xrefs: 0056DF73
RollbackBoundaryBackward, xrefs: 0056E2C2
c:\agent\_work\66\s\src\burn\engine\package.cpp, xrefs: 0056DF67, 0056E08C, 0056E478, 0056E50D
Failed to get @CacheId., xrefs: 0056E68A
BTV, xrefs: 0056DEDC
Failed to find forward transaction boundary: %ls, xrefs: 0056E4AF
Failed to get @RollbackBoundaryForward., xrefs: 0056E4B9
Failed to get @LogPathVariable., xrefs: 0056E48E
Failed to parse MSP package., xrefs: 0056E4DA
Failed to parse MSU package., xrefs: 0056E4E4
Failed to get package node count., xrefs: 0056E05A
Failed to select package nodes., xrefs: 0056E03D
always, xrefs: 0056E150
InstallSize, xrefs: 0056E1A8
RollbackLogPathVariable, xrefs: 0056E242
Failed to get @Permanent., xrefs: 0056E66E
Failed to get @Size., xrefs: 0056E683
Failed to allocate memory for MSP patch sequence information., xrefs: 0056E484
crypt32.dll, xrefs: 0056E264
comres.dll, xrefs: 0056E1DD
cabinet.dll, xrefs: 0056E1A7
msasn1.dll, xrefs: 0056DF45
Chain/ExePackage|Chain/MsiPackage|Chain/MspPackage|Chain/MsuPackage, xrefs: 0056E02A
yes, xrefs: 0056E130
CacheId, xrefs: 0056E172
Size, xrefs: 0056E18D
Failed to get @Id., xrefs: 0056E6B0
Failed to find backward transaction boundary: %ls, xrefs: 0056E4C6
Failed to parse EXE package., xrefs: 0056E332
MspPackage, xrefs: 0056E376
Failed to get next node., xrefs: 0056E6B7
Failed to get @RollbackLogPathVariable., xrefs: 0056E498
MsiPackage, xrefs: 0056E33E
Failed to get @InstallSize., xrefs: 0056E67C
ExePackage, xrefs: 0056E300
feclient.dll, xrefs: 0056E241
Failed to get @PerMachine., xrefs: 0056E675
Failed to allocate memory for package structs., xrefs: 0056E098
Failed to get @RollbackBoundaryBackward., xrefs: 0056E4D0
Failed to get @Vital., xrefs: 0056E667
Failed to get @Cache., xrefs: 0056E6A9
`<u, xrefs: 0056E001, 0056E424, 0056E6E5
Vital, xrefs: 0056DFD0, 0056E204
Invalid cache type: %ls, xrefs: 0056E699
Failed to parse dependency providers., xrefs: 0056E659
Failed to allocate memory for patch sequence information to package lookup., xrefs: 0056E519
LogPathVariable, xrefs: 0056E21F
Failed to get @InstallCondition., xrefs: 0056E4A2
MsuPackage, xrefs: 0056E3AF

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: FreeHeapString$AllocateProcess
String ID: BTV$Cache$CacheId$Chain/ExePackage|Chain/MsiPackage|Chain/MspPackage|Chain/MsuPackage$ExePackage$Failed to allocate memory for MSP patch sequence information.$Failed to allocate memory for package structs.$Failed to allocate memory for patch sequence information to package lookup.$Failed to allocate memory for rollback boundary structs.$Failed to find backward transaction boundary: %ls$Failed to find forward transaction boundary: %ls$Failed to get @Cache.$Failed to get @CacheId.$Failed to get @Id.$Failed to get @InstallCondition.$Failed to get @InstallSize.$Failed to get @LogPathVariable.$Failed to get @PerMachine.$Failed to get @Permanent.$Failed to get @RollbackBoundaryBackward.$Failed to get @RollbackBoundaryForward.$Failed to get @RollbackLogPathVariable.$Failed to get @Size.$Failed to get @Vital.$Failed to get next node.$Failed to get package node count.$Failed to get rollback bundary node count.$Failed to parse EXE package.$Failed to parse MSI package.$Failed to parse MSP package.$Failed to parse MSU package.$Failed to parse dependency providers.$Failed to parse payload references.$Failed to parse target product codes.$Failed to select package nodes.$Failed to select rollback boundary nodes.$InstallCondition$InstallSize$Invalid cache type: %ls$LogPathVariable$MsiPackage$MspPackage$MsuPackage$PerMachine$Permanent$RollbackBoundary$RollbackBoundaryBackward$RollbackBoundaryForward$RollbackLogPathVariable$Size$Vital$`<u$always$c:\agent\_work\66\s\src\burn\engine\package.cpp$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$feclient.dll$msasn1.dll$msi.dll$wininet.dll$yes
API String ID: 336948655-3198475063
Opcode ID: 49678e50ad29f5b8ac716fca095acc3454b82f12413b05d7510e2bbae1272e55
Instruction ID: 984b9c74d1888b98214d16b1a21e423e0a899cd023e4e1967f3789ab4f399b1c
Opcode Fuzzy Hash: 49678e50ad29f5b8ac716fca095acc3454b82f12413b05d7510e2bbae1272e55
Instruction Fuzzy Hash: 7132B235E01226EBCB219B94CC46FAEBFB5BF15B20F244665F811BB291D770AD00DB90

Function 0056F981 Relevance: 117.7, APIs: 3, Strings: 64, Instructions: 445
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to get @DisableModify., xrefs: 0056FD56
Failed to get @DisableRemove., xrefs: 0056FD7E
Failed to get @Department., xrefs: 0056FE2C
ProductFamily, xrefs: 0056FE3A
ParentDisplayName, xrefs: 0056FC1F
Tag, xrefs: 0056F9F5
Failed to set registration paths., xrefs: 0056FEA6
clbcatq.dll, xrefs: 0056F9F4
c:\agent\_work\66\s\src\burn\engine\registration.cpp, xrefs: 0056FD25
ExecutableName, xrefs: 0056FA92
Failed to get @Comments., xrefs: 0056FC5E
PerMachine, xrefs: 0056FAB0
Failed to parse @Version: %ls, xrefs: 0056FA63
Comments, xrefs: 0056FC47
Failed to select registration node., xrefs: 0056F9BA
Failed to get @Version., xrefs: 0056FA42
Failed to get @HelpLink., xrefs: 0056FBA2
DisableModify, xrefs: 0056FC94
Failed to get @Publisher., xrefs: 0056FB7D
Version, xrefs: 0056FA2F
Failed to get @Manufacturer., xrefs: 0056FE04
Failed to parse related bundles, xrefs: 0056FA21
Manufacturer, xrefs: 0056FDF1
Contact, xrefs: 0056FC6F
Failed to get @DisplayName., xrefs: 0056FB33
UpdateUrl, xrefs: 0056FBFA
Update, xrefs: 0056FDBC
Failed to get @ProductFamily., xrefs: 0056FE51
Arp, xrefs: 0056FAD1
Name, xrefs: 0056FE5F
Failed to get @Classification., xrefs: 0056FE93
Failed to get @Name., xrefs: 0056FE72
BTV, xrefs: 0056F981
Failed to get @Tag., xrefs: 0056FA08
Failed to get @Register., xrefs: 0056FB0E
Publisher, xrefs: 0056FB66
AboutUrl, xrefs: 0056FBD5
DisableRemove, xrefs: 0056FD67
button, xrefs: 0056FCB3
Classification, xrefs: 0056FE80
Failed to get @Contact., xrefs: 0056FC86
msasn1.dll, xrefs: 0056F9CC, 0056F9D3
yes, xrefs: 0056FCD4
DisplayVersion, xrefs: 0056FB41
Failed to get @ParentDisplayName., xrefs: 0056FC36
Failed to get @Id., xrefs: 0056F9E7
Register, xrefs: 0056FAFB
Failed to get @HelpTelephone., xrefs: 0056FBC7
Failed to select Update node., xrefs: 0056FDDA
Failed to get @ProviderKey., xrefs: 0056FA84
ProviderKey, xrefs: 0056FA71
Failed to get @DisplayVersion., xrefs: 0056FB58
Department, xrefs: 0056FE15
Failed to select ARP node., xrefs: 0056FAED
Failed to get @ExecutableName., xrefs: 0056FAA5
Invalid modify disabled type: %ls, xrefs: 0056FD32
Failed to parse software tag., xrefs: 0056FDAE
Failed to get @AboutUrl., xrefs: 0056FBEC
Failed to get @PerMachine., xrefs: 0056FAC3
DisplayName, xrefs: 0056FB1C
HelpTelephone, xrefs: 0056FBB0
Registration, xrefs: 0056F99B
Failed to get @UpdateUrl., xrefs: 0056FC11
HelpLink, xrefs: 0056FB8B

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: AboutUrl$Arp$BTV$Classification$Comments$Contact$Department$DisableModify$DisableRemove$DisplayName$DisplayVersion$ExecutableName$Failed to get @AboutUrl.$Failed to get @Classification.$Failed to get @Comments.$Failed to get @Contact.$Failed to get @Department.$Failed to get @DisableModify.$Failed to get @DisableRemove.$Failed to get @DisplayName.$Failed to get @DisplayVersion.$Failed to get @ExecutableName.$Failed to get @HelpLink.$Failed to get @HelpTelephone.$Failed to get @Id.$Failed to get @Manufacturer.$Failed to get @Name.$Failed to get @ParentDisplayName.$Failed to get @PerMachine.$Failed to get @ProductFamily.$Failed to get @ProviderKey.$Failed to get @Publisher.$Failed to get @Register.$Failed to get @Tag.$Failed to get @UpdateUrl.$Failed to get @Version.$Failed to parse @Version: %ls$Failed to parse related bundles$Failed to parse software tag.$Failed to select ARP node.$Failed to select Update node.$Failed to select registration node.$Failed to set registration paths.$HelpLink$HelpTelephone$Invalid modify disabled type: %ls$Manufacturer$Name$ParentDisplayName$PerMachine$ProductFamily$ProviderKey$Publisher$Register$Registration$Tag$Update$UpdateUrl$Version$button$c:\agent\_work\66\s\src\burn\engine\registration.cpp$clbcatq.dll$msasn1.dll$yes
API String ID: 760788290-2781444853
Opcode ID: f9f7338c8f40421d5bbb0df587b18caa48cc891b0e8b7ec4b33dedf295ba6c32
Instruction ID: 5d612ef930bb23d3aff2ccbc7b23734f34e8fdef40eb3cfd51b966461521ebe0
Opcode Fuzzy Hash: f9f7338c8f40421d5bbb0df587b18caa48cc891b0e8b7ec4b33dedf295ba6c32
Instruction Fuzzy Hash: 86E1D932E8062ABBCB619A64EC46EFE7F68BB05B10F110635F921B71E1D771BD015790

Function 0056B45A Relevance: 91.6, APIs: 24, Strings: 28, Instructions: 577
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 0056B4D1
SetFilePointerEx.KERNELBASE(000000FF,00000000,00000000,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0056B51F
GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 0056B525
ReadFile.KERNELBASE(00000000,005644B0,00000040,?,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0056B56D
GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 0056B573
SetFilePointerEx.KERNELBASE(00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0056B5D0
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0056B5D6
ReadFile.KERNELBASE(00000000,?,00000018,00000040,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0056B61F
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0056B625
SetFilePointerEx.KERNELBASE(00000000,-00000098,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0056B696
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0056B69C
ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0056B6E5
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0056B6EB
ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0056B734
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0056B73A
SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0056B786
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0056B78C

Part of subcall function 005639DF: GetProcessHeap.KERNEL32(?,000001C7,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F0
Part of subcall function 005639DF: RtlAllocateHeap.NTDLL(00000000,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F7

ReadFile.KERNEL32(00000000,?,00000028,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0056B7DF
ReadFile.KERNEL32(00000000,?,00000028,00000028,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0056B841
SetFilePointerEx.KERNELBASE(00000000,?,00000000,00000000,00000000,00000034,00000001,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0056B8CB
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0056B8D5

Strings

Failed to read complete section info., xrefs: 0056B994
Failed to find valid DOS image header in buffer., xrefs: 0056BBBA
Failed to seek to section info., xrefs: 0056B6C7, 0056B903
Failed to read section info, unsupported version: %08x, xrefs: 0056B9C4
Failed to read section info., xrefs: 0056B968
Failed to seek to start of file., xrefs: 0056B550
Failed to allocate memory for container sizes., xrefs: 0056BAA2
Failed to read image section header, index: %u, xrefs: 0056BB7B
burn, xrefs: 0056B807
Failed to find Burn section., xrefs: 0056BB01
Failed to seek past optional headers., xrefs: 0056B7BA
Failed to read section info, data to short: %u, xrefs: 0056B879
Failed to get total size of bundle., xrefs: 0056B9F2
4, xrefs: 0056B853
c:\agent\_work\66\s\src\burn\engine\section.cpp, xrefs: 0056B4F2, 0056B546, 0056B594, 0056B5F7, 0056B646, 0056B6BD, 0056B70C, 0056B75B, 0056B7B0, 0056B867, 0056B8A7, 0056B8F9, 0056B95E, 0056B988, 0056B9AF, 0056BA96, 0056BAD6, 0056BAF5, 0056BB32, 0056BB70, 0056BB93, 0056BBAE
PE Header from file didn't match PE Header in memory., xrefs: 0056BAE0
Failed to read signature offset., xrefs: 0056B716
Failed to read signature size., xrefs: 0056B765
Failed to seek to NT header., xrefs: 0056B601
.wix, xrefs: 0056B7FF
Failed to open handle to engine process path., xrefs: 0056B4FC
Failed to read DOS header., xrefs: 0056B59E
Failed to find valid NT image header in buffer., xrefs: 0056BB9F
Failed to read NT header., xrefs: 0056B650
PE, xrefs: 0056B667
Failed to read complete image section header, index: %u, xrefs: 0056BB44
Failed to allocate buffer for section info., xrefs: 0056B8B3
(, xrefs: 0056B7EC

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: File$ErrorLast$Read$Pointer$Heap$AllocateProcess
String ID: ($.wix$4$Failed to allocate buffer for section info.$Failed to allocate memory for container sizes.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get total size of bundle.$Failed to open handle to engine process path.$Failed to read DOS header.$Failed to read NT header.$Failed to read complete image section header, index: %u$Failed to read complete section info.$Failed to read image section header, index: %u$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$Failed to read section info.$Failed to read signature offset.$Failed to read signature size.$Failed to seek past optional headers.$Failed to seek to NT header.$Failed to seek to section info.$Failed to seek to start of file.$PE$PE Header from file didn't match PE Header in memory.$burn$c:\agent\_work\66\s\src\burn\engine\section.cpp
API String ID: 3411815225-1671293494
Opcode ID: 35bc1e8514f48298458bbd4ef773dbd9e689198d679e1bb8b5ede4c101016e7c
Instruction ID: 7882fa18aba2fa4aa4e46e5d850bc6f2e1c65ddc112ba2a07df6f9d051705453
Opcode Fuzzy Hash: 35bc1e8514f48298458bbd4ef773dbd9e689198d679e1bb8b5ede4c101016e7c
Instruction Fuzzy Hash: 4412B572941236ABEB309B54CC4AFAB7EB4BF41710F014195BE06FB281E7759D80DBA1

Function 00580ABB Relevance: 54.6, APIs: 20, Strings: 11, Instructions: 306
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEvent.KERNEL32(?,?,?,?,?,0058066B,?,?), ref: 00580ACA
GetLastError.KERNEL32(?,?,?,?,0058066B,?,?), ref: 00580AD4
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,0058066B,?,?), ref: 00580B19
GetLastError.KERNEL32(?,?,?,?,0058066B,?,?), ref: 00580B24
ResetEvent.KERNEL32(?,?,?,?,?,0058066B,?,?), ref: 00580B5C
GetLastError.KERNEL32(?,?,?,?,0058066B,?,?), ref: 00580B66

Strings

Failed to allocate buffer for stream., xrefs: 00580D38
Failed to create file: %ls, xrefs: 00580DA6
Invalid operation for this state., xrefs: 00580BC2
Failed to wait for begin operation event., xrefs: 00580B52, 00580C8B
Failed to set operation complete event., xrefs: 00580B02, 00580C43
Failed to set file pointer to beginning of file., xrefs: 00580E7D
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 00580AF8, 00580B48, 00580B8A, 00580BB6, 00580C39, 00580C81, 00580CC6, 00580D2E, 00580D99, 00580DEA, 00580E2F, 00580E73
Failed to copy stream name: %ls, xrefs: 00580BF5
Failed to set end of file., xrefs: 00580E39
Failed to set file pointer to end of file., xrefs: 00580DF4
Failed to reset begin operation event., xrefs: 00580B94, 00580CD0

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast$Event$ObjectResetSingleWait
String ID: Failed to allocate buffer for stream.$Failed to copy stream name: %ls$Failed to create file: %ls$Failed to reset begin operation event.$Failed to set end of file.$Failed to set file pointer to beginning of file.$Failed to set file pointer to end of file.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 1865021742-1830388895
Opcode ID: fb7ac1eb87b1bb4914099ae881e38d05c8936055a7b255c416dbd38971d1c6cd
Instruction ID: 2d7f8b5e2f3db8b3da733ee06ba21334669ba12735ed92794c85f6ee9a05b61e
Opcode Fuzzy Hash: fb7ac1eb87b1bb4914099ae881e38d05c8936055a7b255c416dbd38971d1c6cd
Instruction Fuzzy Hash: 2091E637A81633BBE3613B658D0ABAB7D54BF01B21F115620BE01BB2D0D759EC0897D1

Function 00564D7A Relevance: 42.2, APIs: 6, Strings: 18, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005634C4: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,005610DD,?,00000000), ref: 005634E5

CloseHandle.KERNEL32(00000000,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00564F81
CloseHandle.KERNEL32(000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00564F90
CloseHandle.KERNEL32(000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00564F9F
CloseHandle.KERNEL32(?,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00564FAA

Strings

Failed to allocate parameters for unelevated process., xrefs: 00564E3B
%ls %ls, xrefs: 00564E96
Failed to append original command line., xrefs: 00564EAA
Failed to wait for clean room process: %ls, xrefs: 00564F64
"%ls" %ls, xrefs: 00564EBB
TV, xrefs: 00564F8D
Failed to append %ls, xrefs: 00564E5D
burn.filehandle.self, xrefs: 00564E86
-%ls="%ls", xrefs: 00564E27
c:\agent\_work\66\s\src\burn\engine\engine.cpp, xrefs: 00564F2B
Failed to get path for current process., xrefs: 00564DC4
Failed to launch clean room process: %ls, xrefs: 00564F38
burn.clean.room, xrefs: 00564E1F
TV, xrefs: 00564E76, 00564E79
Failed to allocate full command-line., xrefs: 00564ECF
Failed to cache to clean room., xrefs: 00564E03
D, xrefs: 00564EEA
burn.filehandle.attached, xrefs: 00564E58

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseHandle$FileModuleName
String ID: "%ls" %ls$%ls %ls$-%ls="%ls"$D$Failed to allocate full command-line.$Failed to allocate parameters for unelevated process.$Failed to append %ls$Failed to append original command line.$Failed to cache to clean room.$Failed to get path for current process.$Failed to launch clean room process: %ls$Failed to wait for clean room process: %ls$burn.clean.room$burn.filehandle.attached$burn.filehandle.self$c:\agent\_work\66\s\src\burn\engine\engine.cpp$TV$TV
API String ID: 3884789274-554477020
Opcode ID: bdc72ee7b625c8b797ff2a2e37f72ffe0db5ab32cc7695cb3ba164714eee61f2
Instruction ID: a85be1e866aa358834ef4888be152a5fe50d5da91859d57d6e10286edac62f77
Opcode Fuzzy Hash: bdc72ee7b625c8b797ff2a2e37f72ffe0db5ab32cc7695cb3ba164714eee61f2
Instruction Fuzzy Hash: 74718032D4022AABDB219AA4CC45DEFBF78BF45720F114211FA10B7291E7759E41DFA2

Function 0057741D Relevance: 37.0, APIs: 1, Strings: 20, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to initialize variables., xrefs: 00577464
Failed to parse command line., xrefs: 0057755A
Failed to load manifest., xrefs: 005774DB
Failed to open manifest stream., xrefs: 0057749E
Failed to load catalog files., xrefs: 00577702
Failed to set source process path variable., xrefs: 005775FC
WixBundleOriginalSource, xrefs: 0057764C
Failed to set original source variable., xrefs: 0057765D
Failed to get manifest stream from container., xrefs: 005774BF
Failed to extract bootstrapper application payloads., xrefs: 005776E2
Failed to set source process folder variable., xrefs: 00577638
Failed to get source process folder from path., xrefs: 00577618
Failed to open attached UX container., xrefs: 00577481
Failed to overwrite the %ls built-in variable., xrefs: 005775AE
WixBundleSourceProcessFolder, xrefs: 00577627
WixBundleUILevel, xrefs: 005775C9, 005775DA
Failed to get unique temporary folder for bootstrapper application., xrefs: 005776C1
WixBundleElevated, xrefs: 00577598, 005775A9
Failed to initialize internal cache functionality., xrefs: 00577692
WixBundleSourceProcessPath, xrefs: 005775EB

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: Failed to extract bootstrapper application payloads.$Failed to get manifest stream from container.$Failed to get source process folder from path.$Failed to get unique temporary folder for bootstrapper application.$Failed to initialize internal cache functionality.$Failed to initialize variables.$Failed to load catalog files.$Failed to load manifest.$Failed to open attached UX container.$Failed to open manifest stream.$Failed to overwrite the %ls built-in variable.$Failed to parse command line.$Failed to set original source variable.$Failed to set source process folder variable.$Failed to set source process path variable.$WixBundleElevated$WixBundleOriginalSource$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleUILevel
API String ID: 32694325-1564579409
Opcode ID: f9e8414ffe269590c9eba8d575d49137adb727699c5114687e6c734c6a0c8f4f
Instruction ID: 4da986b04cd4d824ac2df90ba8059afd19a2e5607382d5ac90fddd9fdcd8d0ae
Opcode Fuzzy Hash: f9e8414ffe269590c9eba8d575d49137adb727699c5114687e6c734c6a0c8f4f
Instruction Fuzzy Hash: 1FA15572E44A1ABADB169AA4EC45EFEBF6CBB08700F104626F509F7141D770E944D7D0

Function 005785B1 Relevance: 35.2, APIs: 9, Strings: 11, Instructions: 208
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,40000000,00000005,00000000,00000002,08000080,00000000,?,00000000,00000000,00564DFD,?,?,00000000,00564DFD,00000000), ref: 005785F4
GetLastError.KERNEL32 ref: 00578601

Part of subcall function 005A3709: ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 005A379F

SetFilePointerEx.KERNELBASE(00000000,005AA4B8,00000000,00000000,00000000,?,00000000,005AA500,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005786AE
GetLastError.KERNEL32 ref: 005786B8
FindCloseChangeNotification.KERNELBASE(00000000,?,00000000,005AA500,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005787E3

Strings

Failed to update signature offset., xrefs: 00578702
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 00578625, 005786DC, 00578743, 005787B2
Failed to create engine file at path: %ls, xrefs: 00578632
Failed to copy engine from: %ls to: %ls, xrefs: 00578689
Failed to seek to signature table in exe header., xrefs: 0057874D
Failed to zero out original data offset., xrefs: 005787D5
Failed to seek to original data in exe burn section header., xrefs: 005787BC
msi.dll, xrefs: 005786F5
cabinet.dll, xrefs: 0057875C
Failed to seek to beginning of engine file: %ls, xrefs: 0057865A
Failed to seek to checksum in exe header., xrefs: 005786E6

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: File$ErrorLast$ChangeCloseCreateFindNotificationPointerRead
String ID: Failed to copy engine from: %ls to: %ls$Failed to create engine file at path: %ls$Failed to seek to beginning of engine file: %ls$Failed to seek to checksum in exe header.$Failed to seek to original data in exe burn section header.$Failed to seek to signature table in exe header.$Failed to update signature offset.$Failed to zero out original data offset.$c:\agent\_work\66\s\src\burn\engine\cache.cpp$cabinet.dll$msi.dll
API String ID: 3608016165-3887126093
Opcode ID: f409cd2beb0edf9ca8fe29e27b418e8061e25f1acbd9c96f8d5dc4337db599b8
Instruction ID: 24fe7dc20c483b553d6de2b61ebdce6bb60c51386b8062d41dc6f192cb2d2bed
Opcode Fuzzy Hash: f409cd2beb0edf9ca8fe29e27b418e8061e25f1acbd9c96f8d5dc4337db599b8
Instruction Fuzzy Hash: C151F572A815327BE7255B649C0EFBF3E68FB55B10F118114FE06FB281EB559C00A6E2

Function 0056762D Relevance: 34.9, APIs: 1, Strings: 22, Instructions: 419
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(0057745E,005653FA,00000000,00565482), ref: 0056764D

Strings

WixBundleAction, xrefs: 00567D77
$, xrefs: 00567D4A
InstallerName, xrefs: 00567813
Date, xrefs: 00567771
LogonUser, xrefs: 00567883
#, xrefs: 005676CC
InstallerVersion, xrefs: 00567834
WixBundleTag, xrefs: 00567EAF
WixBundleExecutePackageAction, xrefs: 00567DF9
0, xrefs: 00567664
WixBundleProviderKey, xrefs: 00567E7F
WixBundleForcedRestartPackage, xrefs: 00567E15
Failed to add built-in variable: %ls., xrefs: 00567F1A
', xrefs: 005678EC
WixBundleVersion, xrefs: 00567ECF
WixBundleInstalled, xrefs: 00567E2B
WixBundleExecutePackageCacheFolder, xrefs: 00567D99
WixBundleSourceProcessFolder, xrefs: 00567E9F
WixBundleUILevel, xrefs: 00567EBF
WixBundleActiveParent, xrefs: 00567E63
WixBundleElevated, xrefs: 00567E47
WixBundleSourceProcessPath, xrefs: 00567E8F

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: #$$$'$0$Date$Failed to add built-in variable: %ls.$InstallerName$InstallerVersion$LogonUser$WixBundleAction$WixBundleActiveParent$WixBundleElevated$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$WixBundleForcedRestartPackage$WixBundleInstalled$WixBundleProviderKey$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleTag$WixBundleUILevel$WixBundleVersion
API String ID: 32694325-3635313340
Opcode ID: c3461ae0dc25f8f4e04d8b90bf9d80762e71d618d53761bcad96228f78dc2482
Instruction ID: 4bdd9af29a8119d48d18e20265440772e50f4b1d28230fad2d4fc34f27a973a2
Opcode Fuzzy Hash: c3461ae0dc25f8f4e04d8b90bf9d80762e71d618d53761bcad96228f78dc2482
Instruction Fuzzy Hash: 533237B0D116699FEB658F5AC9887CDFEF4BB49304F5085EED20CA7211D7B10A888F85

Function 0057819F Relevance: 31.7, APIs: 7, Strings: 11, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,00000000,00000000,005654C6), ref: 005781F5

Part of subcall function 005A0141: OpenProcessToken.ADVAPI32(?,00000008,?,005653FA,00000000,?,?,?,?,?,?,?,00577590,00000000), ref: 005A015F
Part of subcall function 005A0141: GetLastError.KERNEL32(?,?,?,?,?,?,?,00577590,00000000), ref: 005A0169
Part of subcall function 005A0141: FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,00577590,00000000), ref: 005A01F3

GetWindowsDirectoryW.KERNEL32(?,00000104,00000000), ref: 0057821B
GetLastError.KERNEL32 ref: 00578225
GetTempPathW.KERNEL32(00000104,?,00000000), ref: 005782A2
GetLastError.KERNEL32 ref: 005782AC
UuidCreate.RPCRT4(?), ref: 005782EB

Strings

Failed to get temp path for working folder., xrefs: 005782DA
Failed to append bundle id on to temp path for working folder., xrefs: 00578355
Failed to copy working folder path., xrefs: 00578370
Failed to ensure windows path for working folder ended in backslash., xrefs: 00578270
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 00578249, 005782D0, 00578321
Failed to concat Temp directory on windows path for working folder., xrefs: 00578292
Temp\, xrefs: 0057827A
Failed to get windows path for working folder., xrefs: 00578253
Failed to convert working folder guid into string., xrefs: 0057832B
Failed to create working folder guid., xrefs: 005782F8
%ls%ls\, xrefs: 0057833D

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast$Process$ChangeCloseCreateCurrentDirectoryFindNotificationOpenPathTempTokenUuidWindows
String ID: %ls%ls\$Failed to append bundle id on to temp path for working folder.$Failed to concat Temp directory on windows path for working folder.$Failed to convert working folder guid into string.$Failed to copy working folder path.$Failed to create working folder guid.$Failed to ensure windows path for working folder ended in backslash.$Failed to get temp path for working folder.$Failed to get windows path for working folder.$Temp\$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 2898636500-2821718772
Opcode ID: 21c167d7da5dffa048cafcd3cf1b0afc9690417ec41181add5b90df8b86fac59
Instruction ID: 568474b067a17bb28f22127e1db5ece502d598acba17fd01e6cead29a7b0b6f0
Opcode Fuzzy Hash: 21c167d7da5dffa048cafcd3cf1b0afc9690417ec41181add5b90df8b86fac59
Instruction Fuzzy Hash: 8E411A76A80A25BBD72096F49C4DFEA7F68BB00B11F008551BA09F7141EA78DD04E691

Function 00580EA0 Relevance: 30.0, APIs: 8, Strings: 9, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 00580EC2
CoUninitialize.OLE32 ref: 0058113D

Strings

Failed to extract all files from container, erf: %d:%X:%d, xrefs: 0058101E
<the>.cab, xrefs: 00580F62
Invalid operation for this state., xrefs: 00581121
Failed to wait for begin operation event., xrefs: 005810B6
Failed to set operation complete event., xrefs: 00581069
Failed to initialize COM., xrefs: 00580ECE
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 00580F38, 0058105F, 005810AC, 005810EB, 00581117
Failed to initialize cabinet.dll., xrefs: 00580F44
Failed to reset begin operation event., xrefs: 005810F5

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: InitializeUninitialize
String ID: <the>.cab$Failed to extract all files from container, erf: %d:%X:%d$Failed to initialize COM.$Failed to initialize cabinet.dll.$Failed to reset begin operation event.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 3442037557-964446333
Opcode ID: 6ee75d892c26a2a9f74ec2a3fd72ff281f31519b8f754205844d6aa19965b8e8
Instruction ID: e7529c79f2f1c2e2ef5fcd464c7ce5bc4dad54d8835e64f5bfe8ed11f047cb6e
Opcode Fuzzy Hash: 6ee75d892c26a2a9f74ec2a3fd72ff281f31519b8f754205844d6aa19965b8e8
Instruction Fuzzy Hash: 4C515F77E41A62E7972077A59C0DEBB7E1CBB41720B250225FD01BB2C0D62D9C42E7D9

Function 00564326 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 157
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(00000000,?,00000000,00000000,?,?,005652A3,?,?,00000000,?,?), ref: 00564352
InitializeCriticalSection.KERNEL32(000000D0,?,?,005652A3,?,?,00000000,?,?), ref: 0056435B
lstrlenW.KERNEL32(burn.filehandle.attached,000004B8,000004A0,?,?,005652A3,?,?,00000000,?,?), ref: 005643A1
lstrlenW.KERNEL32(burn.filehandle.attached,burn.filehandle.attached,00000000,?,?,005652A3,?,?,00000000,?,?), ref: 005643AB
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,005652A3,?,?,00000000,?,?), ref: 005643BF
lstrlenW.KERNEL32(burn.filehandle.attached,?,?,005652A3,?,?,00000000,?,?), ref: 005643CF
lstrlenW.KERNEL32(burn.filehandle.self,?,?,005652A3,?,?,00000000,?,?), ref: 0056441F
lstrlenW.KERNEL32(burn.filehandle.self,burn.filehandle.self,00000000,?,?,005652A3,?,?,00000000,?,?), ref: 00564429
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,005652A3,?,?,00000000,?,?), ref: 0056443D
lstrlenW.KERNEL32(burn.filehandle.self,?,?,005652A3,?,?,00000000,?,?), ref: 0056444D

Strings

Failed to initialize engine section., xrefs: 005644B6
Missing required parameter for switch: %ls, xrefs: 005644F1
burn.filehandle.self, xrefs: 0056441A, 00564422, 00564427, 00564428, 00564448, 00564518
Failed to parse file handle: '%ls', xrefs: 005644CF
c:\agent\_work\66\s\src\burn\engine\engine.cpp, xrefs: 005644E2, 0056450E
burn.filehandle.attached, xrefs: 0056439C, 005643A4, 005643A9, 005643AA, 005643CA, 005644EC

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: lstrlen$CompareCriticalInitializeSectionString
String ID: Failed to initialize engine section.$Failed to parse file handle: '%ls'$Missing required parameter for switch: %ls$burn.filehandle.attached$burn.filehandle.self$c:\agent\_work\66\s\src\burn\engine\engine.cpp
API String ID: 3039292287-2540856168
Opcode ID: 3194d565d26ab9e4dbd9c4e67a94487a31ad4c1ec7823bd7f13536af4dd45721
Instruction ID: bba334275510737554ecfa743d6b241cdabbd79eb11824ca3e808ea22f46bd38
Opcode Fuzzy Hash: 3194d565d26ab9e4dbd9c4e67a94487a31ad4c1ec7823bd7f13536af4dd45721
Instruction Fuzzy Hash: BF51E471A40216BFCB20AF68DC46F9EBFA9FF51721F004115F619D7290DBB4A950CBA1

Function 0056C252 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 131
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,08000080,00000000,?,00000000,00000000,BTV,0056C442,BTV,?,?,00565482), ref: 0056C299
GetLastError.KERNEL32 ref: 0056C2AA
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,?,00000000,00000000,BTV,0056C442,BTV,?,?,00565482,00565482,00000000,?), ref: 0056C2F9
GetCurrentProcess.KERNEL32(000000FF,00000000), ref: 0056C2FF
DuplicateHandle.KERNELBASE(00000000), ref: 0056C302
GetLastError.KERNEL32 ref: 0056C30C
SetFilePointerEx.KERNELBASE(?,00000000,00000000,00000000,00000000), ref: 0056C35E
GetLastError.KERNEL32 ref: 0056C368

Strings

Failed to open file: %ls, xrefs: 0056C2DB
c:\agent\_work\66\s\src\burn\engine\container.cpp, xrefs: 0056C2CE, 0056C330, 0056C38C
crypt32.dll, xrefs: 0056C35A
Failed to duplicate handle to container: %ls, xrefs: 0056C33D
BTV, xrefs: 0056C252
feclient.dll, xrefs: 0056C35B
Failed to move file pointer to container offset., xrefs: 0056C396
Failed to open container., xrefs: 0056C3B4

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast$CurrentFileProcess$CreateDuplicateHandlePointer
String ID: BTV$Failed to duplicate handle to container: %ls$Failed to move file pointer to container offset.$Failed to open container.$Failed to open file: %ls$c:\agent\_work\66\s\src\burn\engine\container.cpp$crypt32.dll$feclient.dll
API String ID: 2619879409-4087432923
Opcode ID: a1f4f0d073ed585f4710143065a38c200cccff18d29cbf9671fa1ce65cec70e8
Instruction ID: 471292c0811e2d6317646b27dc701531bbc18dd8e64151207209ed92be813c40
Opcode Fuzzy Hash: a1f4f0d073ed585f4710143065a38c200cccff18d29cbf9671fa1ce65cec70e8
Instruction Fuzzy Hash: 1F41B636240201ABDB209F59DC4AE2B3FB5BBD6720F218419FD55EB341E775D801DB61

Function 005A2368 Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 78
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005638D1: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00563910
Part of subcall function 005638D1: GetLastError.KERNEL32 ref: 0056391A

Part of subcall function 005A4289: GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 005A42BA

GetProcAddress.KERNEL32(MsiDeterminePatchSequenceW,00000000), ref: 005A23B2
GetProcAddress.KERNEL32(MsiDetermineApplicablePatchesW), ref: 005A23D2
GetProcAddress.KERNEL32(MsiEnumProductsExW), ref: 005A23F2
GetProcAddress.KERNEL32(MsiGetPatchInfoExW), ref: 005A2412
GetProcAddress.KERNEL32(MsiGetProductInfoExW), ref: 005A2432
GetProcAddress.KERNEL32(MsiSetExternalUIRecord), ref: 005A2452
GetProcAddress.KERNEL32(MsiSourceListAddSourceExW), ref: 005A2472

Strings

MsiSourceListAddSourceExW, xrefs: 005A2467
MsiGetProductInfoExW, xrefs: 005A2427
MsiDetermineApplicablePatchesW, xrefs: 005A23C7
MsiSetExternalUIRecord, xrefs: 005A2447
MsiDeterminePatchSequenceW, xrefs: 005A23A7
Msi.dll, xrefs: 005A237A
MsiEnumProductsExW, xrefs: 005A23E7
MsiGetPatchInfoExW, xrefs: 005A2407

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AddressProc$ErrorLast$DirectorySystem
String ID: Msi.dll$MsiDetermineApplicablePatchesW$MsiDeterminePatchSequenceW$MsiEnumProductsExW$MsiGetPatchInfoExW$MsiGetProductInfoExW$MsiSetExternalUIRecord$MsiSourceListAddSourceExW
API String ID: 2510051996-1735120554
Opcode ID: 43fdf9cd6c83795129baaa5a7530d1fd4e3b8d13fbcce52320b118e2997c8a4a
Instruction ID: 72ec07e524e91689dd2a278e083f2f64e6c25aa44ba70038a8c248f41075591e
Opcode Fuzzy Hash: 43fdf9cd6c83795129baaa5a7530d1fd4e3b8d13fbcce52320b118e2997c8a4a
Instruction Fuzzy Hash: 2931ADB0901E48EEEB119FA4EC07F6A7FA5F725709F10412AE001A6670E7B51ADCEF41

Function 0059F58A Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 76libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNELBASE(SystemFunction040,AdvApi32.dll), ref: 0059F5B2
GetProcAddress.KERNEL32(SystemFunction041), ref: 0059F5C4
GetProcAddress.KERNEL32(CryptProtectMemory,Crypt32.dll), ref: 0059F607
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 0059F61B
GetProcAddress.KERNEL32(CryptUnprotectMemory), ref: 0059F653
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 0059F667

Strings

`+?s, xrefs: 0059F5C6, 0059F5CD, 0059F655
c:\agent\_work\66\s\src\libs\dutil\cryputil.cpp, xrefs: 0059F63C
Crypt32.dll, xrefs: 0059F5E8
AdvApi32.dll, xrefs: 0059F591
SystemFunction041, xrefs: 0059F5B4
CryptProtectMemory, xrefs: 0059F5FC
SystemFunction040, xrefs: 0059F5A7
CryptUnprotectMemory, xrefs: 0059F648

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AddressProc$ErrorLast
String ID: AdvApi32.dll$Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory$SystemFunction040$SystemFunction041$`+?s$c:\agent\_work\66\s\src\libs\dutil\cryputil.cpp
API String ID: 4214558900-323720281
Opcode ID: cb213c85cc2574b5aa66288101254807a5b7e7987e45a3e4f224999066d48352
Instruction ID: 80ed58f16cef57f840b764bb786e26d8af59a2b6676bf7ee00745d22527f1014
Opcode Fuzzy Hash: cb213c85cc2574b5aa66288101254807a5b7e7987e45a3e4f224999066d48352
Instruction Fuzzy Hash: F3213572941B226FEB215B95EC06F563DA0BB61751F020139EC01F7160F7B49C49AF94

Function 005814E3 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 106COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,wininet.dll,?,00000000,00000000,00000000,?,?,0056C3AE,?,?), ref: 0058151A
GetLastError.KERNEL32(?,0056C3AE,?,?), ref: 00581523

Strings

wininet.dll, xrefs: 005814F9
Failed to create extraction thread., xrefs: 005815E3
Failed to create operation complete event., xrefs: 00581597
Failed to wait for operation complete., xrefs: 005815F6
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 00581547, 0058158D, 005815D9
Failed to create begin operation event., xrefs: 00581551
Failed to copy file name., xrefs: 00581505

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CreateErrorEventLast
String ID: Failed to copy file name.$Failed to create begin operation event.$Failed to create extraction thread.$Failed to create operation complete event.$Failed to wait for operation complete.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp$wininet.dll
API String ID: 545576003-1014644744
Opcode ID: 7b0fe91a2a60c1b8a271e5b50375dbbe1cce9e651032ae1e4cca07c7125c041f
Instruction ID: 1208ed31ed955d9dbda6b0b26977a259acbe8b8f367856cbb2b7c1a7040c03b8
Opcode Fuzzy Hash: 7b0fe91a2a60c1b8a271e5b50375dbbe1cce9e651032ae1e4cca07c7125c041f
Instruction Fuzzy Hash: 9321EB77E41A377BE32127658C46EA76D5CBF817A0B010121BD42BB180EB54EC019BE9

Function 00580671 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CompareStringA.KERNELBASE(00000000,00000000,<the>.cab,?,?), ref: 005806A1
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 005806B9
GetCurrentProcess.KERNEL32(?,00000000,?,?), ref: 005806BE
DuplicateHandle.KERNELBASE(00000000,?,?), ref: 005806C1
GetLastError.KERNEL32(?,?), ref: 005806CB
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,08000080,00000000,?,?), ref: 0058073A
GetLastError.KERNEL32(?,?), ref: 00580747

Strings

Failed to add virtual file pointer for cab container., xrefs: 00580720
Failed to open cabinet file: %hs, xrefs: 00580778
<the>.cab, xrefs: 0058069A
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 005806EF, 0058076B
Failed to duplicate handle to cab container., xrefs: 005806F9

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CurrentErrorLastProcess$CompareCreateDuplicateFileHandleString
String ID: <the>.cab$Failed to add virtual file pointer for cab container.$Failed to duplicate handle to cab container.$Failed to open cabinet file: %hs$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 3030546534-886985619
Opcode ID: cd994c6ace01d9833752e6487448be31892f22178cf96a136ecb6a59a58e4e03
Instruction ID: 3dd46bc525760ba47ee07c192cba80b119f35902bdb7ed0798310898c25c2302
Opcode Fuzzy Hash: cd994c6ace01d9833752e6487448be31892f22178cf96a136ecb6a59a58e4e03
Instruction Fuzzy Hash: 3831BE76901636BBD7216BA98C49E9F7E68FF05760F110111FE05B7290E724AD04DBE0

Function 00576955 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 68COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(000000FF,00000000,00000001,00000002,?,00000000,?,?,00564E52,?,?), ref: 00576975
GetCurrentProcess.KERNEL32(?,00000000,?,?,00564E52,?,?), ref: 0057697B
DuplicateHandle.KERNELBASE(00000000,?,?,00564E52,?,?), ref: 0057697E
GetLastError.KERNEL32(?,?,00564E52,?,?), ref: 00576988
CloseHandle.KERNEL32(000000FF,?,00564E52,?,?), ref: 00576A01

Strings

%ls -%ls=%u, xrefs: 005769D5
RNV, xrefs: 005769CB, 005769D3, 005769DA
c:\agent\_work\66\s\src\burn\engine\core.cpp, xrefs: 005769AC
Failed to append the file handle to the command line., xrefs: 005769E9
Failed to duplicate file handle for attached container., xrefs: 005769B6
burn.filehandle.attached, xrefs: 005769CE

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CurrentHandleProcess$CloseDuplicateErrorLast
String ID: %ls -%ls=%u$Failed to append the file handle to the command line.$Failed to duplicate file handle for attached container.$RNV$burn.filehandle.attached$c:\agent\_work\66\s\src\burn\engine\core.cpp
API String ID: 4224961946-3223781525
Opcode ID: ca0245adad43ebc55112323ef739a657ec1492229e760973a2058bfc5bd14af7
Instruction ID: d8437bafe4e01faa932da7743de37bbf2776cf8e08d31adf8640a7bd5af29564
Opcode Fuzzy Hash: ca0245adad43ebc55112323ef739a657ec1492229e760973a2058bfc5bd14af7
Instruction Fuzzy Hash: F711E972941626FBCB209BA49D09E8EBFA8BF01B30F118311F915F72D1D7749E01EA90

Function 005A2B5D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(005AA594), ref: 005A2B73
SysAllocString.OLEAUT32(?), ref: 005A2B8F
VariantClear.OLEAUT32(?), ref: 005A2C16
SysFreeString.OLEAUT32(00000000), ref: 005A2C21

Strings

`<u, xrefs: 005A2C21
c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp, xrefs: 005A2BA6

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: `<u$c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp
API String ID: 760788290-1301604586
Opcode ID: b55ff968bddcc9fde9610b33ee1663af09a83c9fb7f89598caaf29756feeb48b
Instruction ID: 19479442f1e1d69a655efed1b19f14f786d70b991b789c5b7d1edcbb09ece16d
Opcode Fuzzy Hash: b55ff968bddcc9fde9610b33ee1663af09a83c9fb7f89598caaf29756feeb48b
Instruction Fuzzy Hash: 9F21A336900219EFCB11DF98C84AEAEBFB9BF86711F154458F805AB210DB30DD05EBA0

Function 005A0141 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32(?,00000008,?,005653FA,00000000,?,?,?,?,?,?,?,00577590,00000000), ref: 005A015F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00577590,00000000), ref: 005A0169
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?,?,?,?,?,?,?,?,00577590,00000000), ref: 005A019B
GetLastError.KERNEL32(?,?,?,?,?,?,?,00577590,00000000), ref: 005A01B4
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,00577590,00000000), ref: 005A01F3

Strings

c:\agent\_work\66\s\src\libs\dutil\procutil.cpp, xrefs: 005A01E1

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLastToken$ChangeCloseFindInformationNotificationOpenProcess
String ID: c:\agent\_work\66\s\src\libs\dutil\procutil.cpp
API String ID: 3650908616-2457365779
Opcode ID: 40dc30dccc320f2a695bae1a392cdf0b76b8191c1f932d55e894b14f5009638e
Instruction ID: aece4f9b1dd6c4fbd6ad87c0a59f3562d042edbbe159ceedb426b9ec3d231cee
Opcode Fuzzy Hash: 40dc30dccc320f2a695bae1a392cdf0b76b8191c1f932d55e894b14f5009638e
Instruction Fuzzy Hash: 0B21A176D51225EBCB219B958C48AEEBFB8BF52750F014056ED05BB290E3708E04EAD0

Function 00576A0F Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 68fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000005,?,00000003,00000080,00000000,?,00000000,?,?,?), ref: 00576A43
CloseHandle.KERNEL32(00000000), ref: 00576AB3

Strings

%ls -%ls=%u, xrefs: 00576A5B, 00576A8D
Failed to append the file handle to the obfuscated command line., xrefs: 00576AA1
burn.filehandle.self, xrefs: 00576A54, 00576A86
Failed to append the file handle to the command line., xrefs: 00576A6F

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: %ls -%ls=%u$Failed to append the file handle to the command line.$Failed to append the file handle to the obfuscated command line.$burn.filehandle.self
API String ID: 3498533004-3263533295
Opcode ID: 7f0bdf2736efccf3351c8ca62b50875e26c3027a32d6d8ff4f18ce17c4b9accf
Instruction ID: 0c5e7e27d729799973a728513d06eba36485ffa2efb8b25dc59df283583b6927
Opcode Fuzzy Hash: 7f0bdf2736efccf3351c8ca62b50875e26c3027a32d6d8ff4f18ce17c4b9accf
Instruction Fuzzy Hash: 5F11B631A41614BFCB219AA9AC49E9F3FA8BB42B30F118215F924B72D2D37059119B91

Function 005A2DC7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 005A2DD6
InterlockedIncrement.KERNEL32(005CB69C), ref: 005A2DF3
CLSIDFromProgID.OLE32(Msxml2.DOMDocument,005CB688,?,?,?,?,?,?), ref: 005A2E0E
CLSIDFromProgID.OLE32(MSXML.DOMDocument,005CB688,?,?,?,?,?,?), ref: 005A2E1A

Strings

Msxml2.DOMDocument, xrefs: 005A2E09
MSXML.DOMDocument, xrefs: 005A2E15

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: FromProg$IncrementInitializeInterlocked
String ID: MSXML.DOMDocument$Msxml2.DOMDocument
API String ID: 2109125048-2356320334
Opcode ID: faf5c1ef919bdb211cb4e9cfc2de66ad931b28500d014bc78d63b1a87338341e
Instruction ID: b21a05066a45201f2fe6aab93440f4b9b4419a9d6ecd17fe2abf5ee85575b467
Opcode Fuzzy Hash: faf5c1ef919bdb211cb4e9cfc2de66ad931b28500d014bc78d63b1a87338341e
Instruction Fuzzy Hash: 1CF0A030B40135AFEB210BE9EC0AF2F2E6DB7A2B55F500419E801C5050E3A498C5DBB1

Function 005A4289 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 005A42BA
GlobalAlloc.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000001), ref: 005A42E7
GetLastError.KERNEL32(?,00000000,?,00000000), ref: 005A4313
GetLastError.KERNEL32(00000000,005AA800,?,00000000,?,00000000,?,00000000), ref: 005A4351
GlobalFree.KERNEL32(00000000), ref: 005A4382

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 005A42D5, 005A432E

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast$Global$AllocFree
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 1145190524-1688708105
Opcode ID: 6270e95057b8ef549b3a7169c06d9465c43bd8b124ff17c603cae806c70bc790
Instruction ID: 43d75981c507d734a282f2d0a3f1c629f858e63dbbbbb68fdbfdd87eee64b846
Opcode Fuzzy Hash: 6270e95057b8ef549b3a7169c06d9465c43bd8b124ff17c603cae806c70bc790
Instruction Fuzzy Hash: B831A236D4022AABCB219BD98C05FAFBEA8BFD6750F114556FD04E7240D7B0DD409AE0

Function 0058082C Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 005808D2
GetLastError.KERNEL32(?,?,?), ref: 005808DC

Strings

Failed to move file pointer 0x%x bytes., xrefs: 0058090D
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 00580900
Invalid seek type., xrefs: 00580868

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move file pointer 0x%x bytes.$Invalid seek type.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 2976181284-424406494
Opcode ID: 3c2d6c30720e2d0309f7c6d3ba73d888c25d1da4c371fc5b3a05ff1225aa1e22
Instruction ID: afe44587eb39bd07ad7d61cb8dfc1c5c47591801711be13e372c26c6ec897e7d
Opcode Fuzzy Hash: 3c2d6c30720e2d0309f7c6d3ba73d888c25d1da4c371fc5b3a05ff1225aa1e22
Instruction Fuzzy Hash: F5319C72A0051AAFDB40EFA8D845EADBBA8FF44764B048125FD15A7291E374EA14CBD0

Function 0056415F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,840F01E8,00000000,00000000,?,00579FBC,00000000,00000000,?,00000000,005653FA,00000000,?,?,0056D567,?), ref: 0056416D
GetLastError.KERNEL32(?,00579FBC,00000000,00000000,?,00000000,005653FA,00000000,?,?,0056D567,?,00000000,00000000), ref: 0056417B
CreateDirectoryW.KERNEL32(?,840F01E8,005654C6,?,00579FBC,00000000,00000000,?,00000000,005653FA,00000000,?,?,0056D567,?,00000000), ref: 005641EB
GetLastError.KERNEL32(?,00579FBC,00000000,00000000,?,00000000,005653FA,00000000,?,?,0056D567,?,00000000,00000000), ref: 005641F5

Strings

c:\agent\_work\66\s\src\libs\dutil\dirutil.cpp, xrefs: 00564225

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: c:\agent\_work\66\s\src\libs\dutil\dirutil.cpp
API String ID: 1375471231-2061300336
Opcode ID: fcd79ed4206f3ea90871722e0bd0181d5e2e92a62e50515121be067f164fd177
Instruction ID: 63894142f2c76ff2f07e2610d2c55fc7ecb33c42d62d1b08d9e6ae21423cbb76
Opcode Fuzzy Hash: fcd79ed4206f3ea90871722e0bd0181d5e2e92a62e50515121be067f164fd177
Instruction Fuzzy Hash: 7B21DB3A640231E7DB311AA59C54B7F7E56FF66B61F214025FD44EB240D7348C41EAD1

Function 005656E2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

CompareStringW.KERNELBASE(0000007F,00001000,?,000000FF,version.dll,000000FF,?,?,00000000,005665B1,005665B1,?,00565678,?,?,00000000), ref: 0056571E
GetLastError.KERNEL32(?,00565678,?,?,00000000,?,?,005665B1,?,00567F03,?,?,?,?,?), ref: 0056574D

Strings

c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00565771
version.dll, xrefs: 00565710
Failed to compare strings., xrefs: 0056577B

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CompareErrorLastString
String ID: Failed to compare strings.$c:\agent\_work\66\s\src\burn\engine\variable.cpp$version.dll
API String ID: 1733990998-1548471634
Opcode ID: e3280ba63f2a1d23168397b8e1163ee4590eb6c368ee61b4fe8d203a391c3e84
Instruction ID: 6562054b9d64de8fd17909cf0dd82941a92d48d1e546f5496a30acc49971447d
Opcode Fuzzy Hash: e3280ba63f2a1d23168397b8e1163ee4590eb6c368ee61b4fe8d203a391c3e84
Instruction Fuzzy Hash: 5021D436680925EB8B158FA8CD45A59BFA4FB467B0F250318F911AB3C0F630EE01D6A0

Function 00580797 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005811B1: SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,005807C6,?,?,?), ref: 005811D9
Part of subcall function 005811B1: GetLastError.KERNEL32(?,005807C6,?,?,?), ref: 005811E3

ReadFile.KERNELBASE(?,?,?,?,00000000,?,?,?), ref: 005807D4
GetLastError.KERNEL32 ref: 005807DE

Strings

c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 00580802
Failed to read during cabinet extraction., xrefs: 0058080C

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorFileLast$PointerRead
String ID: Failed to read during cabinet extraction.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 2170121939-3499834177
Opcode ID: 952cb58954b578b38ddf3c470b29cc2e67b4cfc969a17a706bb33e71975c9c45
Instruction ID: 3107b97e55b3716751613e8b7581a673efe74d9f6d129f7fcf62ebad28bafc49
Opcode Fuzzy Hash: 952cb58954b578b38ddf3c470b29cc2e67b4cfc969a17a706bb33e71975c9c45
Instruction Fuzzy Hash: BA018E36A4166AABCB11AFA9DD08D8A7FA8FF45764B010124FE04E7290D734E901DBD4

Function 005811B1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,005807C6,?,?,?), ref: 005811D9
GetLastError.KERNEL32(?,005807C6,?,?,?), ref: 005811E3

Strings

Failed to move to virtual file pointer., xrefs: 00581211
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 00581207

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move to virtual file pointer.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 2976181284-1387633737
Opcode ID: ba9908263beef09f1c5f40e800d1fb7ebc1bfc7a80da34d006b5dca3bfdefa2a
Instruction ID: cda58a89413510b2f2d5ce4a9e7cd68a0404548456e0d300edd6d5a28b930de9
Opcode Fuzzy Hash: ba9908263beef09f1c5f40e800d1fb7ebc1bfc7a80da34d006b5dca3bfdefa2a
Instruction Fuzzy Hash: 1B01843A901936B787212A96AC0998BFF19FF417717118125FE19BA110D725DC11D7D4

Function 005A3709 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 005A379F
GetLastError.KERNEL32 ref: 005A3802

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 005A3826

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 1948546556-1688708105
Opcode ID: 684fbae01d1ab6d6f5c9405e51749dbb5e8bcc3fbbe96dc79f40f53c53a7eb7d
Instruction ID: 5484379a6e2b2e61eaaa5d4dc2c42a320d32435621a1a95e315e893e59bac6c8
Opcode Fuzzy Hash: 684fbae01d1ab6d6f5c9405e51749dbb5e8bcc3fbbe96dc79f40f53c53a7eb7d
Instruction Fuzzy Hash: 14318DB1E002AA9BDB218F54CC40BDEBBA4FB49755F0040AAB949E7240D7B49FC4DB90

Function 005A4650 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000000,?,00000000,00000000,00000000,?,?,?,005A37C6,?,?,?), ref: 005A4674
GetLastError.KERNEL32(?,?,005A37C6,?,?,?), ref: 005A467E

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 005A46A7

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 442123175-1688708105
Opcode ID: 3573471a17ff26e90333561115eb31fdfe9c9130a9a5773809208e1ba71b29fb
Instruction ID: ec7b11c88d98cafb08cfc3448fd552cade97c895212c8b8e2caf92cacf758c52
Opcode Fuzzy Hash: 3573471a17ff26e90333561115eb31fdfe9c9130a9a5773809208e1ba71b29fb
Instruction Fuzzy Hash: FAF06D33A00129BBD7118EDACD45EDFBFA9BB82761F010125B904EB141D7B0AA00DAE0

Function 005A412E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00000000,?,?,?,00578651,00000000,00000000,00000000,00000000,00000000), ref: 005A4146
GetLastError.KERNEL32(?,?,?,00578651,00000000,00000000,00000000,00000000,00000000), ref: 005A4150

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 005A4174

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 2976181284-1688708105
Opcode ID: de0f4e3d63d480f34f91b6321d205a882c89938567a5f9f026493ff7011edbd8
Instruction ID: 35dd10968b28509c38204b2d3a65e21ead95ce64fc897b326f235d8f3122b1a1
Opcode Fuzzy Hash: de0f4e3d63d480f34f91b6321d205a882c89938567a5f9f026493ff7011edbd8
Instruction Fuzzy Hash: 9BF08C76A0022AABDB208F85CC09E9F7FA9FF56750B018018FD05AB251E370DD50DAA0

Function 005638D1 Relevance: 4.6, APIs: 3, Instructions: 79libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00563910
GetLastError.KERNEL32 ref: 0056391A
LoadLibraryW.KERNELBASE(?,?,00000104,?), ref: 00563983

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: DirectoryErrorLastLibraryLoadSystem
String ID:
API String ID: 1230559179-0
Opcode ID: 8362e5ac31a86e1b115be5562aa944289041d77097f86591d2c098caa818e1be
Instruction ID: 464cd47f6840adea8073b765eaf5de453d86da6ef8437324895c1fe86cea793e
Opcode Fuzzy Hash: 8362e5ac31a86e1b115be5562aa944289041d77097f86591d2c098caa818e1be
Instruction Fuzzy Hash: 1721C5B6D0133967DB209FA4CC49F9A7BA8BB44750F110261AE04F7281EA74DE44CB91

Function 00563AA4 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,0059FB87,00000000,8007139F,?,00000000,00000000,8007139F,?,?,?,0059FB1B,000001C7), ref: 00563AAE
RtlFreeHeap.NTDLL(00000000,?,0059FB87,00000000,8007139F,?,00000000,00000000,8007139F,?,?,?,0059FB1B,000001C7,?,?), ref: 00563AB5
GetLastError.KERNEL32(?,0059FB87,00000000,8007139F,?,00000000,00000000,8007139F,?,?,?,0059FB1B,000001C7,?,?), ref: 00563ABF

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Heap$ErrorFreeLastProcess
String ID:
API String ID: 406640338-0
Opcode ID: b652c1434ab58c2127d367833efc311f67743fc4ed0c2f7f2c2985a4b55116d5
Instruction ID: 8b5043afe9a8aec93a47bc5df25032bef536a0fc1045d1e5919e17665811a655
Opcode Fuzzy Hash: b652c1434ab58c2127d367833efc311f67743fc4ed0c2f7f2c2985a4b55116d5
Instruction Fuzzy Hash: C7D01273A0013A67872117E59C0C95BBE58FF156A1B014121FD44E7210DB25CD00F7E5

Function 005A2E25 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 005A2E5A

Part of subcall function 005A28BD: GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,005A2E6B,00000000,?,00000000), ref: 005A28D7
Part of subcall function 005A28BD: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,BTV,0058BD14,005AA518,BTV,?,00000000,?), ref: 005A28E3

Strings

BTV, xrefs: 005A2E25

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorHandleInitLastModuleVariant
String ID: BTV
API String ID: 52713655-3498109997
Opcode ID: 3b647d50959679828ccba5248a642a28f466322c4fa121f2c64972a8713507fd
Instruction ID: b23e1074b1bf287e44bc79daa2c0bf76f90048c4ab5bda65d6d73dfed7194959
Opcode Fuzzy Hash: 3b647d50959679828ccba5248a642a28f466322c4fa121f2c64972a8713507fd
Instruction Fuzzy Hash: 69311E76D006299FCB11DFA8C885ADEBBB8BF09710F01456AE915BB311D6749D448BA0

Function 005A0823 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,005CAA7C,00000000,?,005A4FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 005A0837

Strings

c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 005A0874

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Open
String ID: c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 71445658-3237223240
Opcode ID: ffccef8eb9e8eb6abe31d7f8c1f831a604f92cbc4f77b81d95371f4aab43fa66
Instruction ID: 1c1915168722a6941dddde8aaa8f4ac58d7682671a41864e3c6d405e7f0d12d4
Opcode Fuzzy Hash: ffccef8eb9e8eb6abe31d7f8c1f831a604f92cbc4f77b81d95371f4aab43fa66
Instruction Fuzzy Hash: 01F05932F01223A7873009969C05BAF7E45BB827B0F154025BD0DEB2A0E629CC5093E8

Function 0059ED5A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0059ED51

Part of subcall function 005A90AE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005A9121
Part of subcall function 005A90AE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005A9132

Strings

PA<n, xrefs: 0059ED4B

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: PA<n
API String ID: 1269201914-1122501353
Opcode ID: 2661f2d526f70624a334c4d7dc55367e1d06699757b205dd624efdb59b204ec7
Instruction ID: 6568bf8f75e380833f7fcd05eb1ee91001b9f7896139780492a4c6dcd2c72019
Opcode Fuzzy Hash: 2661f2d526f70624a334c4d7dc55367e1d06699757b205dd624efdb59b204ec7
Instruction Fuzzy Hash: 37B0129525E10B6D310491962E0BE3A0D4CF2D6B20331545EB000C9480E4850D010073

Function 0059ED6A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0059ED51

Part of subcall function 005A90AE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005A9121
Part of subcall function 005A90AE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005A9132

Strings

PA<n, xrefs: 0059ED4B

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: PA<n
API String ID: 1269201914-1122501353
Opcode ID: f35539367cf2781f87644fd420f9a3afc0030a961825ad1586d2c330db252adf
Instruction ID: 873a332b638878f85f1fd8dfed00084db1720a36b093494610bddfc554b7cf95
Opcode Fuzzy Hash: f35539367cf2781f87644fd420f9a3afc0030a961825ad1586d2c330db252adf
Instruction Fuzzy Hash: 74B0129525E20B6C310491962D0FE3A0D4CF2D6B20331955EF000C9480E4900D400073

Function 0059ED39 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0059ED51

Part of subcall function 005A90AE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005A9121
Part of subcall function 005A90AE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005A9132

Strings

PA<n, xrefs: 0059ED39, 0059ED4B

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: PA<n
API String ID: 1269201914-1122501353
Opcode ID: ca9ebc445a80f3a4963ce7ca64b3bdf4d243a43568744dd036e4d383ec1a6d0b
Instruction ID: 4368f80469495226a58da22d0e7e3fd62bcc092bbd7becbc1aa2ebbc03f5a967
Opcode Fuzzy Hash: ca9ebc445a80f3a4963ce7ca64b3bdf4d243a43568744dd036e4d383ec1a6d0b
Instruction Fuzzy Hash: 52B0129A25E10B7C310451922D0BD3A0D0CF2D2B20331945EB400C8480A4800D0000B3

Function 005A506B Relevance: 1.6, APIs: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(80070490,00000000,80070490,005CAA7C,00000000,80070490,?,?,005789F4,WiX\Burn,PackageCache,00000000,005CAA7C,00000000,00000000,80070490), ref: 005A50C5

Part of subcall function 005A095E: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 005A09D4
Part of subcall function 005A095E: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 005A0A0C

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: QueryValue$Close
String ID:
API String ID: 1979452859-0
Opcode ID: e8e378572b83aa74063a8753454a6fb15a41c2d590286fd9156484debaabe56a
Instruction ID: 3ef5cf16498335cc705bfd9fac89caae211f3a32ef27f69ea51c2e3616d6f5db
Opcode Fuzzy Hash: e8e378572b83aa74063a8753454a6fb15a41c2d590286fd9156484debaabe56a
Instruction Fuzzy Hash: CA11823680162AEFCB226E94898DDAEBF65FB46360B154139FD4167110E7324E50EAD1

Function 005635A8 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,00000104,00000000,?,00578AAE,0000001C,80070490,00000000,00000000,80070490), ref: 005635C8

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 367885dbbc03f34022072f9eacd8fb263a822f500cdb459802cd853cdbf4c16e
Instruction ID: 0f7355a65d7061a9b87ce3d51b482f1f8b5aca80a0d08e42050d986faf724f39
Opcode Fuzzy Hash: 367885dbbc03f34022072f9eacd8fb263a822f500cdb459802cd853cdbf4c16e
Instruction Fuzzy Hash: 58E017723416257BAB012AA59C05DBB7F9CFF263A1B004411FE41E7010DB61EA10A7BA

Function 005A8DC8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005A8DE0

Part of subcall function 005A90AE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005A9121
Part of subcall function 005A90AE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005A9132

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4d3a863fb69a53fda259d836209ed1534e48a41f1bb1895e5dfe173cb04cd448
Instruction ID: e3555d9600f98b56aff9970d0805623a1c06aa7c45258da82b806e75580f5824
Opcode Fuzzy Hash: 4d3a863fb69a53fda259d836209ed1534e48a41f1bb1895e5dfe173cb04cd448
Instruction Fuzzy Hash: 21B012C129E10B7C350411802D4BD3F0D0CFAF1B11332881EF400F088098940D000233

Function 005A8DF9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005A8DE0

Part of subcall function 005A90AE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005A9121
Part of subcall function 005A90AE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005A9132

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: bff5031b4dab97924cb25f9eef99f9930dac4fb72b7f604177fe4d0297878bfb
Instruction ID: 943a5a606aeb5ac1a611d04332a8f6cc69d5258e7837ac5ec38600748b228670
Opcode Fuzzy Hash: bff5031b4dab97924cb25f9eef99f9930dac4fb72b7f604177fe4d0297878bfb
Instruction Fuzzy Hash: 12B012C125E2076C354451C43F0BE3F0D4CFAE5B10332481EF400E1480D8990D010133

Function 005A8DE9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 005A8DE0

Part of subcall function 005A90AE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005A9121
Part of subcall function 005A90AE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005A9132

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 69e3713773d913798e060bdd5a3a325a41d90e04db65d97f0f4841886adb56d8
Instruction ID: 3e687dec70f9e0a97730f9079751303cf9a2f37d82359c39dbec926ec82e65cd
Opcode Fuzzy Hash: 69e3713773d913798e060bdd5a3a325a41d90e04db65d97f0f4841886adb56d8
Instruction Fuzzy Hash: 3DB012C125E0076C310451842D0BE3F0D4CF6E5B10332C91FF800D1480D8940D040133

Function 005614AC Relevance: 1.3, APIs: 1, Instructions: 52stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00000000,00000000,?,?,005622B1,?,00000000,?,00000000,?,005639A5,00000000,?,00000104), ref: 005614DC

Part of subcall function 00563C5F: GetProcessHeap.KERNEL32(00000000,000001C7,?,005622D5,000001C7,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 00563C67
Part of subcall function 00563C5F: HeapSize.KERNEL32(00000000,?,005622D5,000001C7,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 00563C6E

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Heap$ProcessSizelstrlen
String ID:
API String ID: 3492610842-0
Opcode ID: 438fe36cec244a4b333eb7af2159904fb595ebc423a681809e966dfb65504db4
Instruction ID: d4a43a4679a9ea53368f17bfcc35384aa138b47f3616f327f92c397a63deadd5
Opcode Fuzzy Hash: 438fe36cec244a4b333eb7af2159904fb595ebc423a681809e966dfb65504db4
Instruction Fuzzy Hash: 88012832100524BBCF216E25CC85FEABFA9BF917A1F184111FE15AB191C770AC009AA8

Non-executed Functions

Function 00563D4E Relevance: 45.8, APIs: 23, Strings: 3, Instructions: 309fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,?,?,00000001,00000000,?), ref: 00563DAD
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00563DC0
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,00000001,00000000,?), ref: 00563E0C
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00563E16
GetTempPathW.KERNEL32(00000104,?,?,?,?,00000001,00000000,?), ref: 00563E5D
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00563E67
FindFirstFileW.KERNEL32(?,?,?,*.*,?,?,?,?,00000001,00000000,?), ref: 00563EB5
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00563EC6
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,?,00000001,00000000,?), ref: 00563F98
DeleteFileW.KERNEL32(?,?,?,?,?,?,?,00000001,00000000,?), ref: 00563FAC
GetTempFileNameW.KERNEL32(?,DEL,00000000,?,?,?,?,00000001,00000000,?), ref: 00563FD5
MoveFileExW.KERNEL32(?,?,00000001,?,?,?,00000001,00000000,?), ref: 00563FF8
MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000001,00000000,?), ref: 00564011
FindNextFileW.KERNEL32(000000FF,?,?,?,?,?,?,?,00000001,00000000,?), ref: 00564021
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00564036
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00564065
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00564087
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 005640A9
RemoveDirectoryW.KERNEL32(?,?,?,?,00000001,00000000,?), ref: 005640B3
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 005640BD
MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000001,00000000,?), ref: 005640E1
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 005640FC
FindClose.KERNEL32(000000FF,?,?,?,00000001,00000000,?), ref: 00564132

Strings

c:\agent\_work\66\s\src\libs\dutil\dirutil.cpp, xrefs: 00563DE3, 00564056
*.*, xrefs: 00563E93
DEL, xrefs: 00563FC9

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorFileLast$AttributesFindMove$Temp$CloseDeleteDirectoryFirstNameNextPathRemove
String ID: *.*$DEL$c:\agent\_work\66\s\src\libs\dutil\dirutil.cpp
API String ID: 1544372074-2145791747
Opcode ID: 058df4efbe929292a968cb1c324cfc593913ae459e9e2b7a8d2f418b81db3013
Instruction ID: 1c896629e720012df0c2d853750640239958e50541c8fcf30733d342ce83ad5c
Opcode Fuzzy Hash: 058df4efbe929292a968cb1c324cfc593913ae459e9e2b7a8d2f418b81db3013
Instruction Fuzzy Hash: E5A10872D01239A7DB3196658C09BAABE78BF50760F014291EE04FB191DB76CE80DFE0

Function 00583F71 Relevance: 43.0, Strings: 34, Instructions: 497COMMON

Download Yara Rule

Strings

REBOOT=ReallySuppress, xrefs: 00584327, 005844F3
crypt32.dll, xrefs: 00584191
ACTION=ADMIN, xrefs: 00584490
REINSTALL=ALL, xrefs: 0058435A, 005843D4
WixBundleExecutePackageAction, xrefs: 0058413E, 0058463B
Failed to install MSI package., xrefs: 005844CD
Failed to initialize external UI handler., xrefs: 0058417B
Failed to add properties to argument string., xrefs: 005841EA
Failed to add feature action properties to obfuscated argument string., xrefs: 00584262
msasn1.dll, xrefs: 00584192
Failed to run maintanance mode for MSI package., xrefs: 0058447D
Failed to add ADMIN property on admin install., xrefs: 005844A5
%ls%ls REINSTALLMODE="cmus%ls" REBOOT=ReallySuppress, xrefs: 0058440E
Failed to add reinstall mode and reboot suppression properties on minor upgrade., xrefs: 00584393
WixBundleExecutePackageCacheFolder, xrefs: 005840F1, 0058462B
Failed to perform minor upgrade of MSI package., xrefs: 005843BF
REINSTALLMODE="vomus" REBOOT=ReallySuppress, xrefs: 0058437C
%ls %ls=ALL, xrefs: 0058443D, 0058451C
Failed to add reboot suppression property on uninstall., xrefs: 00584504
Failed to add reinstall mode and reboot suppression properties on repair., xrefs: 00584422
VersionString, xrefs: 00584015, 00584076
Failed to enable logging for package: %ls to: %ls, xrefs: 005841A6
feclient.dll, xrefs: 0058404C, 005840D4, 005841A4, 005842D2, 0058455F
Failed to build MSI path., xrefs: 00584124
Failed to get cached path for package: %ls, xrefs: 005840D6
Failed to uninstall MSI package., xrefs: 00584576
Failed to add patch properties to obfuscated argument string., xrefs: 005842A6
Failed to add obfuscated properties to argument string., xrefs: 0058421E
Failed to add the list of dependencies to ignore to the properties., xrefs: 00584451
Failed to add patch properties to argument string., xrefs: 00584284
IGNOREDEPENDENCIES, xrefs: 0058442C, 0058450B
Failed to add feature action properties to argument string., xrefs: 00584240
Failed to add reinstall all property on minor upgrade., xrefs: 00584371
Failed to add reboot suppression property on install., xrefs: 00584342

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID:
String ID: ACTION=ADMIN$ REBOOT=ReallySuppress$ REINSTALL=ALL$ REINSTALLMODE="vomus" REBOOT=ReallySuppress$%ls %ls=ALL$%ls%ls REINSTALLMODE="cmus%ls" REBOOT=ReallySuppress$Failed to add ADMIN property on admin install.$Failed to add feature action properties to argument string.$Failed to add feature action properties to obfuscated argument string.$Failed to add obfuscated properties to argument string.$Failed to add patch properties to argument string.$Failed to add patch properties to obfuscated argument string.$Failed to add properties to argument string.$Failed to add reboot suppression property on install.$Failed to add reboot suppression property on uninstall.$Failed to add reinstall all property on minor upgrade.$Failed to add reinstall mode and reboot suppression properties on minor upgrade.$Failed to add reinstall mode and reboot suppression properties on repair.$Failed to add the list of dependencies to ignore to the properties.$Failed to build MSI path.$Failed to enable logging for package: %ls to: %ls$Failed to get cached path for package: %ls$Failed to initialize external UI handler.$Failed to install MSI package.$Failed to perform minor upgrade of MSI package.$Failed to run maintanance mode for MSI package.$Failed to uninstall MSI package.$IGNOREDEPENDENCIES$VersionString$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$crypt32.dll$feclient.dll$msasn1.dll
API String ID: 0-2033600224
Opcode ID: 76b0ee7ef6218cdf0674bf44fc7a21209c9ddf1e8c13298b706a361cbfa995f3
Instruction ID: adbd1624508f38ecdcc653b0ad679f7f5fc848a892a8564884e5ef2e2ab524ae
Opcode Fuzzy Hash: 76b0ee7ef6218cdf0674bf44fc7a21209c9ddf1e8c13298b706a361cbfa995f3
Instruction Fuzzy Hash: 64029271900626AFDB21AE54CC45EAABFBABF54710F0041A5FD08B7151D772EEA0DF90

Function 005A0FA6 Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 336COMMON

Download Yara Rule

APIs

InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 005A103E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005A1048
CreateWellKnownSid.ADVAPI32(0000001A,00000000,?,?), ref: 005A1095
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005A109B
CreateWellKnownSid.ADVAPI32(00000017,00000000,?,?), ref: 005A10D5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005A10DB
CreateWellKnownSid.ADVAPI32(00000018,00000000,?,?), ref: 005A111B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005A1121
CreateWellKnownSid.ADVAPI32(00000010,00000000,?,?), ref: 005A1161
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005A1167
CreateWellKnownSid.ADVAPI32(00000016,00000000,?,?), ref: 005A11A7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005A11AD
SetEntriesInAclA.ADVAPI32(00000005,?,00000000,?), ref: 005A129E
SetSecurityDescriptorOwner.ADVAPI32(?,?,00000000), ref: 005A12D8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005A12E2
SetSecurityDescriptorGroup.ADVAPI32(?,?,00000000), ref: 005A131A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005A1324
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 005A135D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005A1367
CoInitializeSecurity.OLE32(?,000000FF,00000000,00000000,00000006,00000002,00000000,00003000,00000000), ref: 005A13A5
LocalFree.KERNEL32(?), ref: 005A13BB

Strings

c:\agent\_work\66\s\src\libs\dutil\srputil.cpp, xrefs: 005A1069

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast$CreateKnownSecurityWell$Descriptor$Initialize$DaclEntriesFreeGroupLocalOwner
String ID: c:\agent\_work\66\s\src\libs\dutil\srputil.cpp
API String ID: 267631441-212431265
Opcode ID: be8b814a6517837b47eb5f5faf65b0482533aa4c98cfcfd421779d9e552334d7
Instruction ID: fe083d970a982fe8d264a8f2d3f4217ee29e1cba7b89a66f399a44c208811544
Opcode Fuzzy Hash: be8b814a6517837b47eb5f5faf65b0482533aa4c98cfcfd421779d9e552334d7
Instruction Fuzzy Hash: DCC18376C41639ABDB308F958C48BDEBEBCBF45710F0105AAA905F7240E7749E84CEA5

Function 0058C01F Relevance: 37.1, APIs: 1, Strings: 20, Instructions: 375COMMON

Download Yara Rule

Strings

Failed to copy filename for pseudo bundle., xrefs: 0058C103
Failed to allocate memory for dependency providers., xrefs: 0058C3CA
Failed to allocate memory for pseudo bundle payload hash., xrefs: 0058C199
Failed to copy display name for pseudo bundle., xrefs: 0058C43B
Failed to copy key for pseudo bundle payload., xrefs: 0058C0DF
Failed to copy repair arguments for related bundle package, xrefs: 0058C2BC
Failed to allocate space for burn payload inside of related bundle struct, xrefs: 0058C0AA
Failed to copy version for pseudo bundle., xrefs: 0058C419
Failed to copy local source path for pseudo bundle., xrefs: 0058C127
Failed to copy download source for pseudo bundle., xrefs: 0058C155
Failed to append relation type to install arguments for related bundle package, xrefs: 0058C294
Failed to copy key for pseudo bundle., xrefs: 0058C22C
-%ls, xrefs: 0058C03C
Failed to copy uninstall arguments for related bundle package, xrefs: 0058C30F
Failed to allocate space for burn package payload inside of related bundle struct, xrefs: 0058C071
c:\agent\_work\66\s\src\burn\engine\pseudobundle.cpp, xrefs: 0058C065, 0058C09E, 0058C18D, 0058C3BE
Failed to copy install arguments for related bundle package, xrefs: 0058C273
Failed to copy cache id for pseudo bundle., xrefs: 0058C24B
Failed to append relation type to repair arguments for related bundle package, xrefs: 0058C2DD
Failed to append relation type to uninstall arguments for related bundle package, xrefs: 0058C330

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: -%ls$Failed to allocate memory for dependency providers.$Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of related bundle struct$Failed to allocate space for burn payload inside of related bundle struct$Failed to append relation type to install arguments for related bundle package$Failed to append relation type to repair arguments for related bundle package$Failed to append relation type to uninstall arguments for related bundle package$Failed to copy cache id for pseudo bundle.$Failed to copy display name for pseudo bundle.$Failed to copy download source for pseudo bundle.$Failed to copy filename for pseudo bundle.$Failed to copy install arguments for related bundle package$Failed to copy key for pseudo bundle payload.$Failed to copy key for pseudo bundle.$Failed to copy local source path for pseudo bundle.$Failed to copy repair arguments for related bundle package$Failed to copy uninstall arguments for related bundle package$Failed to copy version for pseudo bundle.$c:\agent\_work\66\s\src\burn\engine\pseudobundle.cpp
API String ID: 1357844191-3959581252
Opcode ID: f6157e1abecc44dca4bda38cca025914246a930490f24af9e1faeecd34429f4c
Instruction ID: 79bd7d7aa233c240e9b38a6faa228327e0ca57f1d7f1a2b9bc77b573c3dbd8bf
Opcode Fuzzy Hash: f6157e1abecc44dca4bda38cca025914246a930490f24af9e1faeecd34429f4c
Instruction Fuzzy Hash: 6EC1C171A00A56ABDB25AF78CC56EBA7F98BF04710F048526FC16FB251D770EC509BA0

Function 00564639 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 140sleepshutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000020,?,00000001,00000000,?,?,?,?,?,?,?), ref: 00564662
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00564669
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00564673
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 005646C3
GetLastError.KERNEL32 ref: 005646CD
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 00564711
GetLastError.KERNEL32 ref: 0056471B
Sleep.KERNEL32(000003E8), ref: 00564757
InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,80040002), ref: 00564768
GetLastError.KERNEL32 ref: 00564772
CloseHandle.KERNEL32(?), ref: 005647C8

Strings

SeShutdownPrivilege, xrefs: 005646B6
Failed to get process token., xrefs: 005646A1
Failed to get shutdown privilege LUID., xrefs: 005646FB
Failed to schedule restart., xrefs: 005647B3
c:\agent\_work\66\s\src\burn\engine\engine.cpp, xrefs: 00564697, 005646F1, 0056473F, 005647A9
Failed to adjust token to add shutdown privileges., xrefs: 00564749

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast$ProcessToken$AdjustCloseCurrentHandleInitiateLookupOpenPrivilegePrivilegesShutdownSleepSystemValue
String ID: Failed to adjust token to add shutdown privileges.$Failed to get process token.$Failed to get shutdown privilege LUID.$Failed to schedule restart.$SeShutdownPrivilege$c:\agent\_work\66\s\src\burn\engine\engine.cpp
API String ID: 2241679041-3136258258
Opcode ID: 434802cc6183d59cfe7978c5a868cff5946b567274b70b3aed7840d863731ce2
Instruction ID: 64ec1dfe1fc21d60321862fc01dfeedb64ff70ba34beff974f28e41d9f3c6062
Opcode Fuzzy Hash: 434802cc6183d59cfe7978c5a868cff5946b567274b70b3aed7840d863731ce2
Instruction Fuzzy Hash: C1412D73A406366BE7215BE48D4EB6F7EA8FB02750F020124FE01FB181D7688D05D9E1

Function 00574E6A Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 164pipeCOMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD),00000001,?,00000000), ref: 00574E98
GetLastError.KERNEL32(?,00000000,?,?,0056457C,?), ref: 00574EA1
CreateNamedPipeW.KERNEL32(000000FF,00080003,00000000,00000001,00010000,00010000,00000001,?,?,00000000,?,?,0056457C,?), ref: 00574F43
GetLastError.KERNEL32(?,0056457C,?), ref: 00574F50
CreateNamedPipeW.KERNEL32(000000FF,00080003,00000000,00000001,00010000,00010000,00000001,00000000,?,?,?,?,?,?,?,0056457C), ref: 00574FCB
GetLastError.KERNEL32(?,?,?,?,?,?,?,0056457C,?), ref: 00574FD6
CloseHandle.KERNEL32(00000000,c:\agent\_work\66\s\src\burn\engine\pipe.cpp,00000132,00000000,?,?,?,?,?,?,?,0056457C,?), ref: 00575016
LocalFree.KERNEL32(00000000,?,0056457C,?), ref: 00575044

Strings

Failed to create the security descriptor for the connection event and pipe., xrefs: 00574ECF
Failed to allocate full name of cache pipe: %ls, xrefs: 00574FAD
c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 00574EC5, 00574F74, 00574FFA
Failed to create pipe: %ls, xrefs: 00574F81, 00575007
\\.\pipe\%ls.Cache, xrefs: 00574F97
\\.\pipe\%ls, xrefs: 00574EF9
D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD), xrefs: 00574E93
Failed to allocate full name of pipe: %ls, xrefs: 00574F0F

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast$CreateDescriptorNamedPipeSecurity$CloseConvertFreeHandleLocalString
String ID: D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD)$Failed to allocate full name of cache pipe: %ls$Failed to allocate full name of pipe: %ls$Failed to create pipe: %ls$Failed to create the security descriptor for the connection event and pipe.$\\.\pipe\%ls$\\.\pipe\%ls.Cache$c:\agent\_work\66\s\src\burn\engine\pipe.cpp
API String ID: 1214480349-1710103387
Opcode ID: 83c94dad1580d1337293b3b1e5633ad209260d6f5e60ba0c5a8cb2c0f8c32e48
Instruction ID: f83c09c6390af38f0b6e790206ac907e8b43e41cbd746620258764d461f4c450
Opcode Fuzzy Hash: 83c94dad1580d1337293b3b1e5633ad209260d6f5e60ba0c5a8cb2c0f8c32e48
Instruction Fuzzy Hash: 3951B272D40626BBDB219BA4DC4AFDEBF64BF04720F118121FD04B6290E3B56E44EA91

Function 0059F340 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 172encryptionfileCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000003,F0000040,00000003,00000000,00000000,00579DDA,00000003,000007D0,00000003,?,000007D0,?,000007D0), ref: 0059F3A5
GetLastError.KERNEL32 ref: 0059F3AF
CryptCreateHash.ADVAPI32(?,?,00000000,00000000,?), ref: 0059F3EC
GetLastError.KERNEL32 ref: 0059F3F6
CryptHashData.ADVAPI32(?,?,?,00000000), ref: 0059F43D
ReadFile.KERNEL32(00000000,?,00001000,?,00000000), ref: 0059F461
GetLastError.KERNEL32 ref: 0059F46B
CryptDestroyHash.ADVAPI32(00000000), ref: 0059F4A8
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0059F4BF
GetLastError.KERNEL32 ref: 0059F4D8
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000), ref: 0059F510
GetLastError.KERNEL32 ref: 0059F51A
SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00008004,00000001), ref: 0059F553
GetLastError.KERNEL32 ref: 0059F561

Strings

c:\agent\_work\66\s\src\libs\dutil\cryputil.cpp, xrefs: 0059F48F

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CryptErrorLast$Hash$ContextFile$AcquireCreateDataDestroyParamPointerReadRelease
String ID: c:\agent\_work\66\s\src\libs\dutil\cryputil.cpp
API String ID: 3955742341-1443093764
Opcode ID: 360b40dd92e75d9f04a472cf12c8cf52a4867784654c0451da2d23a3dbbf514b
Instruction ID: 85a796e2c5d568ad76392f4175d665a2b0f9b744e8ddc5fcf31682ca262ca596
Opcode Fuzzy Hash: 360b40dd92e75d9f04a472cf12c8cf52a4867784654c0451da2d23a3dbbf514b
Instruction Fuzzy Hash: 4C51C437D40235ABDF318A559D08BEB7EA4BB04751F0140B5BE48FA190E3B89D84DBE1

Function 00579D74 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 180COMMON

Download Yara Rule

Strings

Failed to reset permissions on unverified cached payload: %ls, xrefs: 00579EC7
Failed to move verified file to complete payload path: %ls, xrefs: 00579F42
Failed to transfer working path to unverified path for payload: %ls., xrefs: 00579E7A
Failed to find payload: %ls in working path: %ls and unverified path: %ls, xrefs: 00579EA1
Failed to create unverified path., xrefs: 00579E44
copying, xrefs: 00579F06, 00579F0E
Failed to get cached path for package with cache id: %ls, xrefs: 00579D9E
moving, xrefs: 00579EFF
Failed to concat complete cached path., xrefs: 00579DCA

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID:
String ID: Failed to concat complete cached path.$Failed to create unverified path.$Failed to find payload: %ls in working path: %ls and unverified path: %ls$Failed to get cached path for package with cache id: %ls$Failed to move verified file to complete payload path: %ls$Failed to reset permissions on unverified cached payload: %ls$Failed to transfer working path to unverified path for payload: %ls.$copying$moving
API String ID: 0-1289240508
Opcode ID: f4381d01560f39cf7ec8924e0bc62a1d7fbaec8724e3a0b293f75868104e076c
Instruction ID: d1e9fce71aaedd4f045fa1e2ecce617a50b97bee34ba1d5b67894c03b6bdcb86
Opcode Fuzzy Hash: f4381d01560f39cf7ec8924e0bc62a1d7fbaec8724e3a0b293f75868104e076c
Instruction Fuzzy Hash: 90516D31940516BADF13AEA0DC46FAEBF76BF44710F108061F908B5161E7729E60BBA1

Function 005662CC Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 143COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C), ref: 0056631A
GetLastError.KERNEL32 ref: 00566324

Strings

Failed to set variant value., xrefs: 00566445
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00566348
Failed to get OS info., xrefs: 00566352

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLastVersion
String ID: Failed to get OS info.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 305913169-1157376746
Opcode ID: 4ef994a7be0960c23922a312beb075399bb4d40ece615bd087687e2c01bbe75c
Instruction ID: 829e31a8215b94eec75e697c8f0c6725bcf78cc0b7919cc271ed4325883e2336
Opcode Fuzzy Hash: 4ef994a7be0960c23922a312beb075399bb4d40ece615bd087687e2c01bbe75c
Instruction Fuzzy Hash: 8041B971A11228ABDB20DB69CC49EEF7FB8FB85710F104959F545E7240EA30DE41DB90

Function 0056605F Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 106timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0056608A
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,00000000,00000000), ref: 0056609E
GetLastError.KERNEL32 ref: 005660B0
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,?,00000000,?,00000000), ref: 00566104
GetLastError.KERNEL32 ref: 0056610E

Strings

Failed to set variant value., xrefs: 0056614C
Failed to allocate the buffer for the Date., xrefs: 005660EC
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 005660CB, 00566129
Failed to get the required buffer length for the Date., xrefs: 005660D5
Failed to get the Date., xrefs: 00566133

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: DateErrorFormatLast$SystemTime
String ID: Failed to allocate the buffer for the Date.$Failed to get the Date.$Failed to get the required buffer length for the Date.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 2700948981-3414009094
Opcode ID: 7a37fc2914496c2a8e52b9586cb9a68e677e2d6723ccb3a1c008be0f377c85d5
Instruction ID: 6c6114ca4efa0db6fb5d3e8cbd14fdd93c9264093b0b870e85a6ed8db261e588
Opcode Fuzzy Hash: 7a37fc2914496c2a8e52b9586cb9a68e677e2d6723ccb3a1c008be0f377c85d5
Instruction Fuzzy Hash: 5F31C772A4022A7BDB219AA4CC46FBFBFB8BB45750F110025FA01F7281DA719D04D7E1

Function 0059F79E Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 131threadtimeCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(005CB5D4,00000000,?,?,?,?,00581074,8007139F,Invalid operation for this state.,c:\agent\_work\66\s\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 0059F7CC
GetCurrentProcessId.KERNEL32(00000000,?,00581074,8007139F,Invalid operation for this state.,c:\agent\_work\66\s\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 0059F7DC
GetCurrentThreadId.KERNEL32 ref: 0059F7E5
GetLocalTime.KERNEL32(8007139F,?,00581074,8007139F,Invalid operation for this state.,c:\agent\_work\66\s\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 0059F7FB
LeaveCriticalSection.KERNEL32(005CB5D4,00581074,?,00000000,0000FDE9,?,00581074,8007139F,Invalid operation for this state.,c:\agent\_work\66\s\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 0059F8F2

Strings

%ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls, xrefs: 0059F898
[\, xrefs: 0059F848
[\, xrefs: 0059F82B

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CriticalCurrentSection$EnterLeaveLocalProcessThreadTime
String ID: %ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls$[\$[\
API String ID: 296830338-1242623729
Opcode ID: ec512ed0380fd5fa35a966109e1ba348ec5e925f7f300474fdb10bef2ee0cd2e
Instruction ID: 9af65982882d5266a1e4e0c88019ccce250d9eb93c34a7afc6ed57fd0469c530
Opcode Fuzzy Hash: ec512ed0380fd5fa35a966109e1ba348ec5e925f7f300474fdb10bef2ee0cd2e
Instruction Fuzzy Hash: 90417C32E00519AFDF619FA4D805ABEBBB8FB18705F100029F901E6160E7389D85DBA1

Function 00579A1D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 107filestringCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,00000000,?,*.*,?,?,?,00000000,.unverified,?), ref: 00579ACC
lstrlenW.KERNEL32(?), ref: 00579AF3
FindNextFileW.KERNEL32(00000000,00000010), ref: 00579B53
FindClose.KERNEL32(00000000), ref: 00579B5E

Part of subcall function 00563D4E: GetFileAttributesW.KERNEL32(?,?,?,?,00000001,00000000,?), ref: 00563DAD
Part of subcall function 00563D4E: GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00563DC0

Strings

*.*, xrefs: 00579AA6
.unverified, xrefs: 00579A60

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: FileFind$AttributesCloseErrorFirstLastNextlstrlen
String ID: *.*$.unverified
API String ID: 457978746-2528915496
Opcode ID: ef7e65fdcb51720786be2ba6746702e4d983c34fb05a27ca77f9c744af03ac6f
Instruction ID: fb5814006aa200fffc6c063230c99b2e97a7a4ec4255ee4898601c1d0a013ec8
Opcode Fuzzy Hash: ef7e65fdcb51720786be2ba6746702e4d983c34fb05a27ca77f9c744af03ac6f
Instruction Fuzzy Hash: 0041417190466DAECB61AB60EC4DBEEBBB8FF84301F1041A1E50CA10A0E7759EC4EF14

Function 005A8039 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 76timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000001,00000000), ref: 005A808E
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 005A80A0

Strings

crypt32.dll, xrefs: 005A805E
%04hu-%02hu-%02huT%02hu:%02hu:%02huZ, xrefs: 005A8077
feclient.dll, xrefs: 005A8068
%04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u, xrefs: 005A80EB

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Time$InformationLocalSpecificSystemZone
String ID: %04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u$%04hu-%02hu-%02huT%02hu:%02hu:%02huZ$crypt32.dll$feclient.dll
API String ID: 1772835396-1985132828
Opcode ID: 5bfe6a756be734b73f4d7c5bc3d82374ef7280ec5c07fdace01271d7cb920d14
Instruction ID: 648724ccc4072803f9f47bf58101e9849866709e9a7779b859b71ac6e81006af
Opcode Fuzzy Hash: 5bfe6a756be734b73f4d7c5bc3d82374ef7280ec5c07fdace01271d7cb920d14
Instruction Fuzzy Hash: CD210CA6901128AEDB20DF99CC09FBFB7FCFB5D711F004456B945E2080E638AA84D771

Function 0059A28E Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0059A3D4

Strings

1#QNAN, xrefs: 0059B5DA
1#IND, xrefs: 0059B5CC
1#INF, xrefs: 0059B5E1
1#SNAN, xrefs: 0059B5D3

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: e83535d72c9e4d3f02b8bacb4fc5b762a42b3794da744ed764dcf7e24c5691c5
Instruction ID: 6deda2f21714fd76595b5f6b9c1c2e2f79f063d8988b11e63c56b0e38b2f23d3
Opcode Fuzzy Hash: e83535d72c9e4d3f02b8bacb4fc5b762a42b3794da744ed764dcf7e24c5691c5
Instruction Fuzzy Hash: 8CC23971E086288FEF25CE289D447E9BBB5FB84304F1545EAD80DE7240E774AE818F91

Function 00566203 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 52COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00566233
GetLastError.KERNEL32 ref: 0056623D

Strings

Failed to set variant value., xrefs: 00566282
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 0056625C
Failed to get the user name., xrefs: 00566266

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLastNameUser
String ID: Failed to get the user name.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 2054405381-2744047247
Opcode ID: 8ba981272c68d0ddddef7fad446b54522426806817c01eb2c55d28a3a81b10af
Instruction ID: 083a7d00785b7f3edfdde234510a378be2fc0cfde4a3d45ab6a860c07e2f45ab
Opcode Fuzzy Hash: 8ba981272c68d0ddddef7fad446b54522426806817c01eb2c55d28a3a81b10af
Instruction Fuzzy Hash: ED01D636A012296BD721AB659C19EAFBFA8BB41710F110155FC04F7281EA249D4897D1

Function 00562078 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(005642CC,005654CB,?,00000000,00000000,00000000,?,80070656,?,?,?,0057E5B6,00000000,005654CB,00000000,80070656), ref: 005620A9
GetLastError.KERNEL32(?,?,?,0057E5B6,00000000,005654CB,00000000,80070656,?,?,00574042,005654CB,?,80070656,00000001,crypt32.dll), ref: 005620B6
LocalFree.KERNEL32(00000000,?,00000000,00000000,?,?,?,0057E5B6,00000000,005654CB,00000000,80070656,?,?,00574042,005654CB), ref: 005620FD

Strings

c:\agent\_work\66\s\src\libs\dutil\strutil.cpp, xrefs: 005620DA

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: c:\agent\_work\66\s\src\libs\dutil\strutil.cpp
API String ID: 1365068426-792799584
Opcode ID: 5b9ef7c38e952766d22c4ca51155307a82b6fe8244817697306581b379ca3bc5
Instruction ID: 22ab60b3c34a9efd4260a8305902962747f6b693c543642720ed3831b2d9ec7b
Opcode Fuzzy Hash: 5b9ef7c38e952766d22c4ca51155307a82b6fe8244817697306581b379ca3bc5
Instruction Fuzzy Hash: 4B016DB694152AFBDB219B94DD09ADEBEACFB05760F014161BE01F7240E6348F40EBE1

Function 005868EE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000003,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0058689A,00000000,00000003), ref: 00586905
GetLastError.KERNEL32(?,0058689A,00000000,00000003,00000000,?,?,?,?,?,?,?,?,?,00586C89,?), ref: 0058690F

Strings

c:\agent\_work\66\s\src\burn\engine\msuengine.cpp, xrefs: 00586933
Failed to set service start type., xrefs: 0058693D

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ChangeConfigErrorLastService
String ID: Failed to set service start type.$c:\agent\_work\66\s\src\burn\engine\msuengine.cpp
API String ID: 1456623077-3535627199
Opcode ID: 4616ff27c503315cb08c51bd02c89d5405bcb23738aee7a557b95a10437559ae
Instruction ID: f1614bed5b5a64c1d9fca490ebc0353ed1f5687979de90510c39d851bb0e3886
Opcode Fuzzy Hash: 4616ff27c503315cb08c51bd02c89d5405bcb23738aee7a557b95a10437559ae
Instruction Fuzzy Hash: A8F0EC376451363387212695AC09E8B7E48BF127717110310FE28B62D0AA259C00D3E4

Function 005934A2 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0059359A
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 005935A4
UnhandledExceptionFilter.KERNEL32(80003CDD,?,?,?,?,?,?), ref: 005935B1

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: ea1edd2dc12d65287c11bbd03cbcd1fc95f8e6b36cc1119f6c1196d52521cf38
Instruction ID: 413f772b566a0ea1f0d0afda2587b88909d1c53ea9602bb7d9774d629bdb0da5
Opcode Fuzzy Hash: ea1edd2dc12d65287c11bbd03cbcd1fc95f8e6b36cc1119f6c1196d52521cf38
Instruction Fuzzy Hash: A031B275901219ABCF21EF65D889798BBB8BF58310F5041EAE80CA7261EB309B85CF45

Function 00594104 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,005940DA,00000000,005C7908,0000000C,00594231,00000000,00000002,00000000), ref: 00594125
TerminateProcess.KERNEL32(00000000,?,005940DA,00000000,005C7908,0000000C,00594231,00000000,00000002,00000000), ref: 0059412C
ExitProcess.KERNEL32 ref: 0059413E

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: b9a0256241039091a043aa429e96cd8cd7002c3df0a0b2ddb91fe0fca83006f0
Instruction ID: fa061020a07212c3420d98500fbfd201e6336ba6d3043a1c38a0ea75eaf11f0e
Opcode Fuzzy Hash: b9a0256241039091a043aa429e96cd8cd7002c3df0a0b2ddb91fe0fca83006f0
Instruction Fuzzy Hash: E0E0B631410208AFCF126F54DD09E583F6AFFA6795F404414F9058A222CB39DD97EF81

Function 00599DE0 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec680d27deb718a11d472c7d97f77035e2e58be53863390314485049f65bb1ad
Instruction ID: b686a9e47e58108d8e66237f404d7117e9d2eb10d57acfaa433717013493bef5
Opcode Fuzzy Hash: ec680d27deb718a11d472c7d97f77035e2e58be53863390314485049f65bb1ad
Instruction Fuzzy Hash: FB020B71E012199FDF14CFA9C8846AEBBF1FF88314F25826AD819E7344D731AA41CB91

Function 005A32B9 Relevance: 3.1, APIs: 2, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 005A3448: RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,00000000,?,?,?,?,?,005A32E8,?), ref: 005A34B9

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 005A330C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 005A331D

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AllocateCheckCloseInitializeMembershipToken
String ID:
API String ID: 2114926846-0
Opcode ID: c1bde4dc70e2ea09506d0f5d0214a9251626a41b1d95226549d5b04ae2998a0c
Instruction ID: ad845477e6454ea5b2e48e9e62f0242f749c663800d5c30fe9aeff3aff67bd40
Opcode Fuzzy Hash: c1bde4dc70e2ea09506d0f5d0214a9251626a41b1d95226549d5b04ae2998a0c
Instruction Fuzzy Hash: A1111E7190021AEFDF10DFE5DD89BAEBBF8FF19348F50482AA541E6141EB709A44CB51

Function 005A3C72 Relevance: 3.0, APIs: 2, Instructions: 43fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00588F6B,?,00000100,00000000,00000000), ref: 005A3CAD
FindClose.KERNEL32(00000000), ref: 005A3CB9

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f23289323398c32d220dcc5aac203353ccc86e68de84d9edfb7f7c4d34e7330a
Instruction ID: f677bc3453f5c595966f9e9eeb81e804bfb814375d724fa08a516b648d03eceb
Opcode Fuzzy Hash: f23289323398c32d220dcc5aac203353ccc86e68de84d9edfb7f7c4d34e7330a
Instruction Fuzzy Hash: 500162716006086BDB10EF65DD8999ABBACFFD6329F000065F915E3180EA349E4DC764

Function 00592413 Relevance: 2.7, Strings: 2, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00592583
comres.dll, xrefs: 005925BA, 005925D3, 005925FB, 00592626

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID:
String ID: 0$comres.dll
API String ID: 0-3030269839
Opcode ID: f7a880ec5967ec64a90054ca813bf1243ddeae79b496adee3d9f08ad155e7dd2
Instruction ID: aa2c32b2f9ee9a533f3f9e4188895d06f758d3949326cfa1e4e2f34f240c2af6
Opcode Fuzzy Hash: f7a880ec5967ec64a90054ca813bf1243ddeae79b496adee3d9f08ad155e7dd2
Instruction Fuzzy Hash: 0451AC70600B0A77DF38853C856A7FF2F98BB52304F184919E88EDB283C605DD4A83A6

Function 0059E73C Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0059E737,?,?,00000008,?,?,0059E3D7,00000000), ref: 0059E969

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: c7b808af59e5817ada33297f2ff70f80210e9902f69f0e6dd9ad82ffc41722f6
Instruction ID: 3012726789755e49c31128bf8c7a0eb6612fd025838580fa44d95c42ddcd7d96
Opcode Fuzzy Hash: c7b808af59e5817ada33297f2ff70f80210e9902f69f0e6dd9ad82ffc41722f6
Instruction Fuzzy Hash: B8B12B31610609DFDB19CF28C48AB657FE0FF45365F298658E89ACF2A1C735E992CB40

Function 0058E707 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002E713,0058DDE8), ref: 0058E70C

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 20669bcee1c76a2c25baca02ab295cb1289fb913e98288bda3bc6f61dcda2a9b
Instruction ID: 0226fa0890f57dd42029d538d8235a3a1cc594e0ec72b2187e456c36586ca1a4
Opcode Fuzzy Hash: 20669bcee1c76a2c25baca02ab295cb1289fb913e98288bda3bc6f61dcda2a9b
Instruction Fuzzy Hash:

Function 005901A6 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 9cd88b4abd83b3428373fb88de538b41eb3d9fa68136d6d1c5114d50b8092553
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: EC9162722090A34EDF69473E857843EFFE16A523A131A1FADD8F2CA5C5EE24C554E620

Function 00590461 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: bfda483499801b71fc48153a740f89113942ae6ee871a7fc6bda91e5374200a5
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: C89178721090A34EDF69463E857403EFFE16A913A131A1FAED4F2CB5C5EE24D564EA20

Function 0058FEDF Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: e0c26b50b5c4c60c577fb1a20962d6c6ab24a54455661d45afab11a17f2a2203
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: 7D9182322080E34EDF6D563E857803EFFE16A523A131A1BADE8F2DA5D1EE14D554E720

Function 00592642 Relevance: .2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85ac8e8acc64ee73f300f4b18ad8c05ad751b967ba1306b08cc6c1f77f5a8d0a
Instruction ID: 69b3341cc871d82266849c1b051093af32dfe334a5b1266277d979e124341cd0
Opcode Fuzzy Hash: 85ac8e8acc64ee73f300f4b18ad8c05ad751b967ba1306b08cc6c1f77f5a8d0a
Instruction Fuzzy Hash: 5D618B7120070A76DF389BA8CD99BBE7F98FF91700F24091AE843EF681CA15ED458355

Function 0058FC35 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 4e07375c19d9eb4f08a6f90c35d8726add4dd024d8fcc78f5f84b9dbdb67d7a3
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: 4481943220D0A34EDB69663D857403EFFE16A553A131A07BDDCF2DA5D2EE24CA64D720

Function 0056FF35 Relevance: 86.2, APIs: 1, Strings: 48, Instructions: 482registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000101,?,?,00020006,00000000), ref: 0057052B

Strings

URLUpdateInfo, xrefs: 00570265, 00570278
"%ls" %ls, xrefs: 0057041D
crypt32.dll, xrefs: 0057017A, 005701BB, 00570452, 00570471
BundleCachePath, xrefs: 0056FFD8, 0056FFDD
BundleAddonCode, xrefs: 00570011, 00570019
BundleProviderKey, xrefs: 005700F3, 005700F8
BundleVersion, xrefs: 0057006B, 0057008E
ParentKeyName, xrefs: 005702AB, 005702BE
BundlePatchCode, xrefs: 0057004D, 00570055
ParentDisplayName, xrefs: 0057028B, 0057029E
BundleUpgradeCode, xrefs: 0056FFF3, 0056FFFB
%hs, xrefs: 00570131
SystemComponent, xrefs: 005703C1, 005703D4
DisplayVersion, xrefs: 0057019A, 005701AD
QuietUninstallString, xrefs: 005703E6, 005703FC
Comments, xrefs: 005702D3, 005702E6
%s,0, xrefs: 00570159
ModifyPath, xrefs: 0057034E, 00570364
VersionMajor, xrefs: 005700A8, 005700AE
NoElevateOnModify, xrefs: 00570370, 00570383
UninstallString, xrefs: 00570422, 00570438
3.11.2.4516, xrefs: 0057012C
NoRemove, xrefs: 0057039C, 005703AF
BundleDetectCode, xrefs: 0057002F, 00570037
EngineVersion, xrefs: 00570136, 0057013B
Contact, xrefs: 005702FB, 0057030E
Failed to register the bundle dependency key., xrefs: 005704EC
Failed to write %ls value., xrefs: 005704CA
Failed to update resume mode., xrefs: 00570506
BundleTag, xrefs: 00570114, 00570119
Failed to create registration key., xrefs: 0056FFB8
/modify, xrefs: 0057040D
NoModify, xrefs: 00570324, 00570337
Failed to cache bundle from path: %ls, xrefs: 0056FF8B
/uninstall, xrefs: 00570414, 00570419
Failed to update name and publisher., xrefs: 00570187
URLInfoAbout, xrefs: 0057023F, 00570252
"%ls" /uninstall /quiet, xrefs: 005703E1
%hu.%hu.%hu.%hu, xrefs: 00570089
EstimatedSize, xrefs: 005704B5, 005704BA, 005704C9
Failed to write software tags., xrefs: 0057045E
HelpTelephone, xrefs: 00570219, 0057022C
DisplayIcon, xrefs: 00570154, 0057015E
"%ls" /modify, xrefs: 00570349
Publisher, xrefs: 005701CD, 005701E0
VersionMinor, xrefs: 005700D1, 005700D7
HelpLink, xrefs: 005701F3, 00570206
Failed to write update registration., xrefs: 0057047E

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Close
String ID: /uninstall$"%ls" %ls$"%ls" /modify$"%ls" /uninstall /quiet$%hs$%hu.%hu.%hu.%hu$%s,0$/modify$3.11.2.4516$BundleAddonCode$BundleCachePath$BundleDetectCode$BundlePatchCode$BundleProviderKey$BundleTag$BundleUpgradeCode$BundleVersion$Comments$Contact$DisplayIcon$DisplayVersion$EngineVersion$EstimatedSize$Failed to cache bundle from path: %ls$Failed to create registration key.$Failed to register the bundle dependency key.$Failed to update name and publisher.$Failed to update resume mode.$Failed to write %ls value.$Failed to write software tags.$Failed to write update registration.$HelpLink$HelpTelephone$ModifyPath$NoElevateOnModify$NoModify$NoRemove$ParentDisplayName$ParentKeyName$Publisher$QuietUninstallString$SystemComponent$URLInfoAbout$URLUpdateInfo$UninstallString$VersionMajor$VersionMinor$crypt32.dll
API String ID: 3535843008-3218910351
Opcode ID: 09af806b6b58611ff8969eaf041de8664f0aad11c03165be01241a103703884a
Instruction ID: 68d74e89fde760a04ef15dc278f65dc27031d6c9d4afc21221b449738a9e0424
Opcode Fuzzy Hash: 09af806b6b58611ff8969eaf041de8664f0aad11c03165be01241a103703884a
Instruction Fuzzy Hash: 0FF1A132941B26FBDF226A64DC06BAE7EA5BB00754F10A560F908B62D1D761ED20F7D0

Function 0056CD76 Relevance: 86.1, APIs: 3, Strings: 46, Instructions: 365COMMON

Download Yara Rule

APIs

Part of subcall function 005639DF: GetProcessHeap.KERNEL32(?,000001C7,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F0
Part of subcall function 005639DF: RtlAllocateHeap.NTDLL(00000000,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F7

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,download,000000FF,00000000,Packaging,00000000,00000000,FilePath,comres.dll,00000000,005ABB64,?,00000000), ref: 0056CEAC

Strings

Failed to find catalog., xrefs: 0056D185
download, xrefs: 0056CE9E
Failed to get @Hash., xrefs: 0056D19A
Failed to parse @FileSize., xrefs: 0056D158
LayoutOnly, xrefs: 0056CF46
comres.dll, xrefs: 0056CE63
Hash, xrefs: 0056D070
Failed to get @SourcePath., xrefs: 0056D1A8
cabinet.dll, xrefs: 0056D059
Failed to get @FilePath., xrefs: 0056D1D1
c:\agent\_work\66\s\src\burn\engine\payload.cpp, xrefs: 0056CDF8
msasn1.dll, xrefs: 0056CFDD
DownloadUrl, xrefs: 0056CF92
Packaging, xrefs: 0056CE7F
wininet.dll, xrefs: 0056D0C7
Failed to get @LayoutOnly., xrefs: 0056D14E
Failed to get @Id., xrefs: 0056D1D8
Failed to hex decode @CertificateRootPublicKeyIdentifier., xrefs: 0056D169
embedded, xrefs: 0056CEBE
Container, xrefs: 0056CF04
msi.dll, xrefs: 0056D018
Failed to get next node., xrefs: 0056D1DF
Failed to hex decode @CertificateRootThumbprint., xrefs: 0056D177
CertificateRootThumbprint, xrefs: 0056D033
Failed to get @Catalog., xrefs: 0056D18C
Failed to to find container: %ls, xrefs: 0056D13D
Failed to select payload nodes., xrefs: 0056CDA4
FilePath, xrefs: 0056CE64
SourcePath, xrefs: 0056CF69
Catalog, xrefs: 0056D0A5
CertificateRootPublicKeyIdentifier, xrefs: 0056CFF6
Failed to get @Packaging., xrefs: 0056D1CA
feclient.dll, xrefs: 0056CF45
FileSize, xrefs: 0056CFBB
Failed to hex decode the Payload/@Hash., xrefs: 0056D193
Failed to get @CertificateRootPublicKeyIdentifier., xrefs: 0056D170
Failed to get @Container., xrefs: 0056D144
external, xrefs: 0056CEDA
version.dll, xrefs: 0056D01C
Payload, xrefs: 0056CD91
Failed to allocate memory for payload structs., xrefs: 0056CE02
Failed to get @FileSize., xrefs: 0056D162
Failed to get payload node count., xrefs: 0056CDC9
Failed to get @DownloadUrl., xrefs: 0056D1A1
Invalid value for @Packaging: %ls, xrefs: 0056D1B7
Failed to get @CertificateRootThumbprint., xrefs: 0056D17E

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Heap$AllocateCompareProcessString
String ID: Catalog$CertificateRootPublicKeyIdentifier$CertificateRootThumbprint$Container$DownloadUrl$Failed to allocate memory for payload structs.$Failed to find catalog.$Failed to get @Catalog.$Failed to get @CertificateRootPublicKeyIdentifier.$Failed to get @CertificateRootThumbprint.$Failed to get @Container.$Failed to get @DownloadUrl.$Failed to get @FilePath.$Failed to get @FileSize.$Failed to get @Hash.$Failed to get @Id.$Failed to get @LayoutOnly.$Failed to get @Packaging.$Failed to get @SourcePath.$Failed to get next node.$Failed to get payload node count.$Failed to hex decode @CertificateRootPublicKeyIdentifier.$Failed to hex decode @CertificateRootThumbprint.$Failed to hex decode the Payload/@Hash.$Failed to parse @FileSize.$Failed to select payload nodes.$Failed to to find container: %ls$FilePath$FileSize$Hash$Invalid value for @Packaging: %ls$LayoutOnly$Packaging$Payload$SourcePath$c:\agent\_work\66\s\src\burn\engine\payload.cpp$cabinet.dll$comres.dll$download$embedded$external$feclient.dll$msasn1.dll$msi.dll$version.dll$wininet.dll
API String ID: 1171520630-3125196775
Opcode ID: 63c6a48b60cb3afbe0de5a4e22a1191544ab621f186bbea7f86ba92b326fb9bf
Instruction ID: a9a071d0c273e914445bbf3b9e51744788818831dcc09c2dbfe4539948f2eea3
Opcode Fuzzy Hash: 63c6a48b60cb3afbe0de5a4e22a1191544ab621f186bbea7f86ba92b326fb9bf
Instruction Fuzzy Hash: 54C1D472E4162AFBDB119A90CC06EADBF74BF06720F104A65F911BB190D7B1EE41D7A0

Function 00568463 Relevance: 63.3, APIs: 5, Strings: 31, Instructions: 331COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,msasn1.dll,00000000,80070490,?,?,?,?,?,?,?,BTV,0058BEAE,005AA570,?,005AA594), ref: 00568494
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,BTV,0058BEAE,005AA570,?,005AA594,?,?,Chain), ref: 005687F7

Strings

Failed to insert variable '%ls'., xrefs: 00568789
Failed to set variant value., xrefs: 00568778
Variable, xrefs: 0056849E
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 005687AC
Failed to get @Persisted., xrefs: 005687D4
Failed to get variable node count., xrefs: 005684CE
string, xrefs: 005685E4
numeric, xrefs: 005685A9
Initializing string variable '%ls' to value '%ls', xrefs: 00568607
Failed to set variant encryption, xrefs: 00568790
msasn1.dll, xrefs: 00568470
Attempt to set built-in variable value: %ls, xrefs: 005687BB
version, xrefs: 00568619
Failed to find variable value '%ls'., xrefs: 005687C5
Failed to get @Id., xrefs: 005687E2
Type, xrefs: 00568590
Failed to get next node., xrefs: 005687E9
Failed to change variant type., xrefs: 005687CD
Value, xrefs: 00568552
Initializing hidden variable '%ls', xrefs: 0056865E
Persisted, xrefs: 00568537
Failed to get @Hidden., xrefs: 005687DB
Initializing version variable '%ls' to value '%ls', xrefs: 00568640
Hidden, xrefs: 0056851C
Failed to get @Value., xrefs: 0056877F
Failed to set value of variable: %ls, xrefs: 0056879A
Failed to select variable nodes., xrefs: 005684B1
Initializing numeric variable '%ls' to value '%ls', xrefs: 005685CF
Failed to get @Type., xrefs: 00568771
BTV, xrefs: 00568463
Invalid value for @Type: %ls, xrefs: 0056875E

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Attempt to set built-in variable value: %ls$BTV$Failed to change variant type.$Failed to find variable value '%ls'.$Failed to get @Hidden.$Failed to get @Id.$Failed to get @Persisted.$Failed to get @Type.$Failed to get @Value.$Failed to get next node.$Failed to get variable node count.$Failed to insert variable '%ls'.$Failed to select variable nodes.$Failed to set value of variable: %ls$Failed to set variant encryption$Failed to set variant value.$Hidden$Initializing hidden variable '%ls'$Initializing numeric variable '%ls' to value '%ls'$Initializing string variable '%ls' to value '%ls'$Initializing version variable '%ls' to value '%ls'$Invalid value for @Type: %ls$Persisted$Type$Value$Variable$c:\agent\_work\66\s\src\burn\engine\variable.cpp$msasn1.dll$numeric$string$version
API String ID: 3168844106-225104275
Opcode ID: 12aecc44486c98e50a96e30699a8404edd696c2e2138c93a9f7b156a5ddb5fec
Instruction ID: 9d7b280cec973432643dc0a55af71ef4266c42103611fe1ed99cfdc01a30d14a
Opcode Fuzzy Hash: 12aecc44486c98e50a96e30699a8404edd696c2e2138c93a9f7b156a5ddb5fec
Instruction Fuzzy Hash: 25B19A72D0022ABBDF11AA94CC49EBEBF75FB45720F204665F910B7291CB729A40DB90

Function 00586A2D Relevance: 58.1, APIs: 7, Strings: 26, Instructions: 378COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,0057BC99,00000007,?,?,?), ref: 00586A81

Part of subcall function 005A038A: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00565EE0,00000000), ref: 005A039E
Part of subcall function 005A038A: GetProcAddress.KERNEL32(00000000), ref: 005A03A5
Part of subcall function 005A038A: GetLastError.KERNEL32(?,?,?,00565EE0,00000000), ref: 005A03BC

CloseHandle.KERNEL32(00000000,?,000001F4,?,?,?,?,?,?,?,?,?,?,wusa.exe,?,00000025), ref: 00586E70
CloseHandle.KERNEL32(00000000,?,000001F4,?,?,?,?,?,?,?,?,?,?,wusa.exe,?,00000025), ref: 00586E84

Strings

"%ls" "%ls" /quiet /norestart, xrefs: 00586BA9
Failed to determine WOW64 status., xrefs: 00586A93
Failed to find System32 directory., xrefs: 00586AF6
Failed to CreateProcess on path: %ls, xrefs: 00586CFB
Failed to ensure WU service was enabled to install MSU package., xrefs: 00586C8F
/log:, xrefs: 00586C03
"%ls" /uninstall /kb:%ls /quiet /norestart, xrefs: 00586BD6
Bootstrapper application aborted during MSU progress., xrefs: 00586DB5
WixBundleExecutePackageCacheFolder, xrefs: 00586B6C, 00586E9C
Failed to get process exit code., xrefs: 00586D8D
Failed to build MSU path., xrefs: 00586B96
Failed to wait for executable to complete: %ls, xrefs: 00586DFF
2, xrefs: 00586D14
Failed to allocate WUSA.exe path., xrefs: 00586B14
Failed to format MSU install command., xrefs: 00586BBD
Failed to get action arguments for MSU package., xrefs: 00586B37
Failed to get cached path for package: %ls, xrefs: 00586B5D
Failed to append SysNative directory., xrefs: 00586ADE
Failed to append log path to MSU command-line., xrefs: 00586C35
Failed to format MSU uninstall command., xrefs: 00586BEA
c:\agent\_work\66\s\src\burn\engine\msuengine.cpp, xrefs: 00586CEE, 00586D83, 00586DAB
wusa.exe, xrefs: 00586B01
SysNative\, xrefs: 00586ACB
D, xrefs: 00586C9C
Failed to find Windows directory., xrefs: 00586AC0
Failed to append log switch to MSU command-line., xrefs: 00586C17

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Handle$Close$AddressCurrentErrorLastModuleProcProcess
String ID: /log:$"%ls" "%ls" /quiet /norestart$"%ls" /uninstall /kb:%ls /quiet /norestart$2$Bootstrapper application aborted during MSU progress.$D$Failed to CreateProcess on path: %ls$Failed to allocate WUSA.exe path.$Failed to append SysNative directory.$Failed to append log path to MSU command-line.$Failed to append log switch to MSU command-line.$Failed to build MSU path.$Failed to determine WOW64 status.$Failed to ensure WU service was enabled to install MSU package.$Failed to find System32 directory.$Failed to find Windows directory.$Failed to format MSU install command.$Failed to format MSU uninstall command.$Failed to get action arguments for MSU package.$Failed to get cached path for package: %ls$Failed to get process exit code.$Failed to wait for executable to complete: %ls$SysNative\$WixBundleExecutePackageCacheFolder$c:\agent\_work\66\s\src\burn\engine\msuengine.cpp$wusa.exe
API String ID: 1400713077-2603125353
Opcode ID: 7cdb7d28f8c18cbff4ebec0fb8827670cdda224db7981a624c831654ce3bb753
Instruction ID: f1c3e0dbcee8daf5084e4746d214a582d36eb45ecd29bf68187bbb9c2aa8a832
Opcode Fuzzy Hash: 7cdb7d28f8c18cbff4ebec0fb8827670cdda224db7981a624c831654ce3bb753
Instruction Fuzzy Hash: 50D17C70A0031AEBDB11AFE4CD8AEEEBEB8BF18704F104425FA11B6151D7B5AE44DB51

Function 0057545D Relevance: 52.7, APIs: 17, Strings: 13, Instructions: 228filepipesleepCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,?,005AA500,?,00000000,?,0056457C,?,005AA500), ref: 0057547E
GetCurrentProcessId.KERNEL32(?,0056457C,?,005AA500), ref: 00575489
SetNamedPipeHandleState.KERNEL32(?,000000FF,00000000,00000000,?,0056457C,?,005AA500), ref: 005754C0
ConnectNamedPipe.KERNEL32(?,00000000,?,0056457C,?,005AA500), ref: 005754D5
GetLastError.KERNEL32(?,0056457C,?,005AA500), ref: 005754DF
Sleep.KERNEL32(00000064,?,0056457C,?,005AA500), ref: 00575514
SetNamedPipeHandleState.KERNEL32(?,00000000,00000000,00000000,?,0056457C,?,005AA500), ref: 00575537
WriteFile.KERNEL32(?,crypt32.dll,00000004,00000000,00000000,?,0056457C,?,005AA500), ref: 00575552
WriteFile.KERNEL32(?,|EV,005AA500,00000000,00000000,?,0056457C,?,005AA500), ref: 0057556D
WriteFile.KERNEL32(?,comres.dll,00000004,feclient.dll,00000000,?,0056457C,?,005AA500), ref: 00575588
ReadFile.KERNEL32(?,wininet.dll,00000004,feclient.dll,00000000,?,0056457C,?,005AA500), ref: 005755A3
GetLastError.KERNEL32(?,0056457C,?,005AA500), ref: 005755FE
GetLastError.KERNEL32(?,0056457C,?,005AA500), ref: 00575632
GetLastError.KERNEL32(?,0056457C,?,005AA500), ref: 00575666
GetLastError.KERNEL32(?,0056457C,?,005AA500), ref: 0057569A
GetLastError.KERNEL32(?,0056457C,?,005AA500), ref: 005756CB
GetLastError.KERNEL32(?,0056457C,?,005AA500), ref: 005756FC

Strings

Failed to write our process id to pipe., xrefs: 0057565C
crypt32.dll, xrefs: 00575550
Failed to write secret to pipe., xrefs: 00575690
comres.dll, xrefs: 00575586
feclient.dll, xrefs: 00575580, 0057559B
Failed to set pipe to non-blocking., xrefs: 00575726
Failed to read ACK from pipe., xrefs: 00575628
wininet.dll, xrefs: 005755A1
Failed to reset pipe to blocking., xrefs: 005756F5
c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 005755EA, 0057561E, 00575652, 00575686, 005756BA, 005756EB, 0057571C
|EV, xrefs: 00575569
Failed to write secret length to pipe., xrefs: 005756C4
Failed to wait for child to connect to pipe., xrefs: 005755F4

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast$File$NamedPipeWrite$HandleState$ConnectCurrentProcessReadSleeplstrlen
String ID: Failed to read ACK from pipe.$Failed to reset pipe to blocking.$Failed to set pipe to non-blocking.$Failed to wait for child to connect to pipe.$Failed to write our process id to pipe.$Failed to write secret length to pipe.$Failed to write secret to pipe.$c:\agent\_work\66\s\src\burn\engine\pipe.cpp$comres.dll$crypt32.dll$feclient.dll$wininet.dll$|EV
API String ID: 2944378912-1430349064
Opcode ID: 54f29fa6a181dec369ff16ccce48d9fe154988cd5fe6aabc89fe04eeec2c43e0
Instruction ID: d9d4c7dd695970520bc0941c72138dd3e80d702160e25f8135c8e656fd3b19ff
Opcode Fuzzy Hash: 54f29fa6a181dec369ff16ccce48d9fe154988cd5fe6aabc89fe04eeec2c43e0
Instruction Fuzzy Hash: 1E61E872D81636ABD7209AA49C49F9EBEA8BF00750F118525BD09FB180F7B4DD00E6E1

Function 0058D10E Relevance: 49.3, APIs: 12, Strings: 16, Instructions: 283synchronizationprocessCOMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0058D183
StringFromGUID2.OLE32(?,?,00000027), ref: 0058D1AC
CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?,?,?,?,?), ref: 0058D295
GetLastError.KERNEL32(?,?,?,?), ref: 0058D29F
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,00000064,?,?,?,?), ref: 0058D338
WaitForSingleObject.KERNEL32(005AA500,000000FF,?,?,?,?), ref: 0058D343
ReleaseMutex.KERNEL32(005AA500,?,?,?,?), ref: 0058D36D
GetExitCodeProcess.KERNEL32(?,?), ref: 0058D38E
GetLastError.KERNEL32(?,?,?,?), ref: 0058D39C
GetLastError.KERNEL32(?,?,?,?), ref: 0058D3D4

Part of subcall function 0058D016: WaitForSingleObject.KERNEL32(?,000000FF,74DF30B0,00000000,?,?,?,0058D312,?), ref: 0058D035
Part of subcall function 0058D016: ReleaseMutex.KERNEL32(?,?,?,0058D312,?), ref: 0058D049
Part of subcall function 0058D016: WaitForSingleObject.KERNEL32(?,000000FF), ref: 0058D08E
Part of subcall function 0058D016: ReleaseMutex.KERNEL32(?), ref: 0058D0A1
Part of subcall function 0058D016: SetEvent.KERNEL32(?), ref: 0058D0AA

CloseHandle.KERNEL32(00000000,?,?,?,?,?,?), ref: 0058D47D
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?), ref: 0058D495

Strings

Failed to convert netfx chainer guid into string., xrefs: 0058D1CB
Failed to process netfx chainer message., xrefs: 0058D318
%ls /pipe %ls, xrefs: 0058D24F
Failed to allocate netfx chainer arguments., xrefs: 0058D263
Failed to create netfx chainer guid., xrefs: 0058D190
Failed to create netfx chainer., xrefs: 0058D22E
Failed to CreateProcess on path: %ls, xrefs: 0058D2CE
Failed to get netfx return code., xrefs: 0058D3CA
!X, xrefs: 0058D13D
NetFxSection.%ls, xrefs: 0058D1D9
c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp, xrefs: 0058D1C1, 0058D2C3, 0058D3C0, 0058D3F8
Failed to allocate section name., xrefs: 0058D1ED
D, xrefs: 0058D27A
Failed to allocate event name., xrefs: 0058D20F
Failed to wait for netfx chainer process to complete, xrefs: 0058D402
NetFxEvent.%ls, xrefs: 0058D1FB

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Wait$ErrorLastMutexObjectReleaseSingle$CloseCreateHandleProcess$CodeEventExitFromMultipleObjectsStringUuid
String ID: %ls /pipe %ls$D$Failed to CreateProcess on path: %ls$Failed to allocate event name.$Failed to allocate netfx chainer arguments.$Failed to allocate section name.$Failed to convert netfx chainer guid into string.$Failed to create netfx chainer guid.$Failed to create netfx chainer.$Failed to get netfx return code.$Failed to process netfx chainer message.$Failed to wait for netfx chainer process to complete$NetFxEvent.%ls$NetFxSection.%ls$c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp$!X
API String ID: 1533322865-2309027501
Opcode ID: e90df68b87fef76a8aeddf5c3cc12bc6e65dc52fe8dfdd23796a811368b90a74
Instruction ID: a4b30096772cccb4751cd01365d3a871eaaf1c191d72cfb87c237a0b2e4a02fc
Opcode Fuzzy Hash: e90df68b87fef76a8aeddf5c3cc12bc6e65dc52fe8dfdd23796a811368b90a74
Instruction Fuzzy Hash: 35A16D32D40229ABDB21ABA4CC49B9EBFF8BF04310F104565ED09FB291D775AD44DBA1

Function 005A6C19 Relevance: 47.6, APIs: 13, Strings: 14, Instructions: 339COMMON

Download Yara Rule

APIs

Part of subcall function 005639DF: GetProcessHeap.KERNEL32(?,000001C7,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F0
Part of subcall function 005639DF: RtlAllocateHeap.NTDLL(00000000,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F7

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,generator,000000FF,?,?,?), ref: 005A6D2C
SysFreeString.OLEAUT32(00000000), ref: 005A6EF5
SysFreeString.OLEAUT32(00000000), ref: 005A6F92

Strings

category, xrefs: 005A6C87, 005A6E34
icon, xrefs: 005A6D43
logo, xrefs: 005A6D7F
(, xrefs: 005A6ED0
title, xrefs: 005A6DB7
author, xrefs: 005A6C6A, 005A6DFB
link, xrefs: 005A6CC1, 005A6EA3
subtitle, xrefs: 005A6D9B
`<u, xrefs: 005A6EF5, 005A6F92
generator, xrefs: 005A6D1F
@, xrefs: 005A6E9B
updated, xrefs: 005A6DD3
entry, xrefs: 005A6CA4, 005A6E6D
c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp, xrefs: 005A6C46, 005A6F7C

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: String$FreeHeap$AllocateCompareProcess
String ID: ($@$`<u$author$c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp$category$entry$generator$icon$link$logo$subtitle$title$updated
API String ID: 1555028553-2833164091
Opcode ID: 7fcd8d90fe8052953812abd239f9045b0f72464c35e9507a34b66f3d6975174c
Instruction ID: d42bad032258e3a85eb8ddc4c70e2d995cee10bd1d34125d95471bd73b4f9543
Opcode Fuzzy Hash: 7fcd8d90fe8052953812abd239f9045b0f72464c35e9507a34b66f3d6975174c
Instruction Fuzzy Hash: 4AB16C75A44216BFCF119BA4CC81FAEBE78BF06720F284754F521AA1D1DB70EA40DB90

Function 005A68DE Relevance: 47.5, APIs: 11, Strings: 16, Instructions: 297COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,005C6470,000000FF,?,?,?), ref: 005A69A5
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,summary,000000FF), ref: 005A69CA
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,title,000000FF), ref: 005A69EA
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,published,000000FF), ref: 005A6A06
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,updated,000000FF), ref: 005A6A2E
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,author,000000FF), ref: 005A6A4A
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,category,000000FF), ref: 005A6A83
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,content,000000FF), ref: 005A6ABC

Part of subcall function 005A6527: SysFreeString.OLEAUT32(00000000), ref: 005A6660
Part of subcall function 005A6527: SysFreeString.OLEAUT32(00000000), ref: 005A669F

SysFreeString.OLEAUT32(00000000), ref: 005A6B40
SysFreeString.OLEAUT32(00000000), ref: 005A6BF0

Strings

category, xrefs: 005A6926, 005A6A75
(, xrefs: 005A6B1B
title, xrefs: 005A69DC
feclient.dll, xrefs: 005A69D7
cabinet.dll, xrefs: 005A6921
author, xrefs: 005A6909, 005A6A3C
link, xrefs: 005A6943, 005A6AEE
clbcatq.dll, xrefs: 005A6A13
version.dll, xrefs: 005A6904
content, xrefs: 005A6AAE
`<u, xrefs: 005A6B40, 005A6BF0
published, xrefs: 005A69F8
updated, xrefs: 005A6A20
msi.dll, xrefs: 005A6908
c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp, xrefs: 005A6BDD
summary, xrefs: 005A69BC

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: String$Compare$Free
String ID: ($`<u$author$c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp$cabinet.dll$category$clbcatq.dll$content$feclient.dll$link$msi.dll$published$summary$title$updated$version.dll
API String ID: 318886736-1823403471
Opcode ID: b12f7698e1aaa549d735a695eda1a1ccb96c25109272a6daedf4b440a88bf77b
Instruction ID: 9f6dba2b780dd24b6bc9fbc79e7760907503062a619646563847390185b194e2
Opcode Fuzzy Hash: b12f7698e1aaa549d735a695eda1a1ccb96c25109272a6daedf4b440a88bf77b
Instruction Fuzzy Hash: CFA17E7190422AFFDB219B94CC81FAE7E64BF06720F284365F521EA1D1D770EA50DBA0

Function 0056A3D4 Relevance: 44.1, APIs: 8, Strings: 17, Instructions: 311registryCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 0056A418
_MREFOpen@16.MSPDB140-MSVCRT ref: 0056A440
RegCloseKey.ADVAPI32(00000000,?,00000000,?,?,?,?,?), ref: 0056A73F

Strings

Failed to read registry value., xrefs: 0056A6C8
c:\agent\_work\66\s\src\burn\engine\search.cpp, xrefs: 0056A510, 0056A545, 0056A598, 0056A6A1
Failed to format value string., xrefs: 0056A44D
Failed to open registry key., xrefs: 0056A4B3
Unsupported registry key value type. Type = '%u', xrefs: 0056A5D2
Failed to query registry key value size., xrefs: 0056A51C
Failed to allocate string buffer., xrefs: 0056A633
Failed to format key string., xrefs: 0056A425
Registry value not found. Key = '%ls', Value = '%ls', xrefs: 0056A4E2
Failed to get expand environment string., xrefs: 0056A6AD
Failed to set variable., xrefs: 0056A701
Registry key not found. Key = '%ls', xrefs: 0056A478
RegistrySearchValue failed: ID '%ls', HRESULT 0x%x, xrefs: 0056A717
Failed to change value type., xrefs: 0056A6E3, 0056A706
Failed to clear variable., xrefs: 0056A49E
Failed to allocate memory registry value., xrefs: 0056A54F
Failed to query registry key value., xrefs: 0056A5A4

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Open@16$Close
String ID: Failed to allocate memory registry value.$Failed to allocate string buffer.$Failed to change value type.$Failed to clear variable.$Failed to format key string.$Failed to format value string.$Failed to get expand environment string.$Failed to open registry key.$Failed to query registry key value size.$Failed to query registry key value.$Failed to read registry value.$Failed to set variable.$Registry key not found. Key = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchValue failed: ID '%ls', HRESULT 0x%x$Unsupported registry key value type. Type = '%u'$c:\agent\_work\66\s\src\burn\engine\search.cpp
API String ID: 2348241696-2754605460
Opcode ID: 3af8808509f7b10e723775d88927a1a5c8443f4aa1d9795120b7524a20a55e1f
Instruction ID: 19458332274271c8efba2166e1db214ff261abff2e104e0ea3c6109150f6f5a7
Opcode Fuzzy Hash: 3af8808509f7b10e723775d88927a1a5c8443f4aa1d9795120b7524a20a55e1f
Instruction Fuzzy Hash: 6BA1A672E00126BBCF11AAA4CC49AAEBEB9FB45710F158521F906F7250D7719E00DFA2

Function 005657A7 Relevance: 42.5, APIs: 5, Strings: 19, Instructions: 477stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000100,00000100,00000100,00000000,00000100,00000000,?,0056A889,00000100,000002C0,000002C0,00000100), ref: 005657CC
lstrlenW.KERNEL32(000002C0,?,0056A889,00000100,000002C0,000002C0,00000100), ref: 005657D6
_wcschr.LIBVCRUNTIME ref: 005659DB
LeaveCriticalSection.KERNEL32(00000100,00000000,000002C0,000002C0,00000000,000002C0,00000001,?,0056A889,00000100,000002C0,000002C0,00000100), ref: 00565C7E

Strings

[%d], xrefs: 00565996
Failed to allocate record., xrefs: 00565A3F
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00565A32, 00565A53, 00565AAC, 00565AFE, 00565B8A, 00565BBC, 00565C38
Failed to set record format string., xrefs: 00565B08
*****, xrefs: 0056594D
Failed to append placeholder., xrefs: 00565A81
Failed to set record string., xrefs: 00565B94
Failed to format placeholder string., xrefs: 00565A8B
Failed to allocate variable array., xrefs: 00565AB9
Failed to allocate string., xrefs: 00565BF5
Failed to get variable name., xrefs: 00565AC0
Failed to allocate buffer for format string., xrefs: 005657F4
Failed to append string., xrefs: 00565852
Failed to determine variable visibility: '%ls'., xrefs: 00565A6E
Failed to format record., xrefs: 00565C42
Failed to reallocate variable array., xrefs: 00565A60
Failed to set variable value., xrefs: 00565A95
Failed to copy string., xrefs: 00565C62
Failed to get formatted length., xrefs: 00565BC6

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CriticalSection$EnterLeave_wcschrlstrlen
String ID: *****$Failed to allocate buffer for format string.$Failed to allocate record.$Failed to allocate string.$Failed to allocate variable array.$Failed to append placeholder.$Failed to append string.$Failed to copy string.$Failed to determine variable visibility: '%ls'.$Failed to format placeholder string.$Failed to format record.$Failed to get formatted length.$Failed to get variable name.$Failed to reallocate variable array.$Failed to set record format string.$Failed to set record string.$Failed to set variable value.$[%d]$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 1026845265-1173883696
Opcode ID: 147d15c529f734a0b9c6cd3ad1dbd3670929309bd3661ceed940d43b9a327565
Instruction ID: a0492cbda1af71754e4fdfe080c536a41e870541575e99f26e062123d58ee93e
Opcode Fuzzy Hash: 147d15c529f734a0b9c6cd3ad1dbd3670929309bd3661ceed940d43b9a327565
Instruction Fuzzy Hash: 1DF19072D8062AEBDF109FA48C45EAF7FB4FB44B50F148529B915AB240E7349E01DBA0

Function 0058CB5D Relevance: 40.5, APIs: 12, Strings: 11, Instructions: 239synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 005639DF: GetProcessHeap.KERNEL32(?,000001C7,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F0
Part of subcall function 005639DF: RtlAllocateHeap.NTDLL(00000000,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F7

CreateEventW.KERNEL32(00000000,00000000,00000000,?,00000000,00000018,00000001,?,00000000,?,?,0058D228,?,?,?), ref: 0058CBA3
GetLastError.KERNEL32(?,?,0058D228,?,?,?), ref: 0058CBB0
ReleaseMutex.KERNEL32(?), ref: 0058CE18

Strings

failed to allocate memory for event name, xrefs: 0058CBF6
Failed to memory map cabinet file: %ls, xrefs: 0058CD04
c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp, xrefs: 0058CB7F, 0058CBD1, 0058CC36, 0058CCA5, 0058CCF7, 0058CD3F
Failed to create event: %ls, xrefs: 0058CC43
%ls_mutex, xrefs: 0058CC51
Failed to allocate memory for NetFxChainer struct., xrefs: 0058CB89
%ls_send, xrefs: 0058CBE2
Failed to create mutex: %ls, xrefs: 0058CCB2
failed to allocate memory for mutex name, xrefs: 0058CC65
Failed to MapViewOfFile for %ls., xrefs: 0058CD4C
failed to copy event name to shared memory structure., xrefs: 0058CD76

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Heap$AllocateCreateErrorEventLastMutexProcessRelease
String ID: %ls_mutex$%ls_send$Failed to MapViewOfFile for %ls.$Failed to allocate memory for NetFxChainer struct.$Failed to create event: %ls$Failed to create mutex: %ls$Failed to memory map cabinet file: %ls$c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp$failed to allocate memory for event name$failed to allocate memory for mutex name$failed to copy event name to shared memory structure.
API String ID: 3944734951-2874813099
Opcode ID: 218e32df2e7cf0acff8889d0a0df76a688cb7734fbcd34517e1bd0e1fb2716cc
Instruction ID: d56101a4f0bd779604ea0f1e36bc9fb3f529c94643c18ebd5f378b73ee09831b
Opcode Fuzzy Hash: 218e32df2e7cf0acff8889d0a0df76a688cb7734fbcd34517e1bd0e1fb2716cc
Instruction Fuzzy Hash: 218102B6A42722BBD322AB688C49F9ABEA4BF15750F014164FD08BB251D774ED00D7F0

Function 0056E9FC Relevance: 40.5, APIs: 4, Strings: 19, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 005A2B5D: VariantInit.OLEAUT32(005AA594), ref: 005A2B73
Part of subcall function 005A2B5D: SysAllocString.OLEAUT32(?), ref: 005A2B8F
Part of subcall function 005A2B5D: VariantClear.OLEAUT32(?), ref: 005A2C16
Part of subcall function 005A2B5D: SysFreeString.OLEAUT32(00000000), ref: 005A2C21

CompareStringW.KERNEL32(0000007F,00000000,000000FF,000000FF,Detect,000000FF,?,005ABB64,?,?,Action,?,?,?,00000000,?), ref: 0056EACD
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,Upgrade,000000FF), ref: 0056EB17

Strings

Failed to resize Upgrade code array in registration, xrefs: 0056EBEF
Failed to get RelatedBundle nodes, xrefs: 0056EA2C
Detect, xrefs: 0056EABE
Invalid value for @Action: %ls, xrefs: 0056EC0C
Failed to get RelatedBundle element count., xrefs: 0056EA51
comres.dll, xrefs: 0056EAE0
Failed to get @Action., xrefs: 0056EC23
cabinet.dll, xrefs: 0056EB74
Action, xrefs: 0056EA8A
Failed to resize Detect code array in registration, xrefs: 0056EBE8
RelatedBundle, xrefs: 0056EA0A
Patch, xrefs: 0056EB97
version.dll, xrefs: 0056EB2A
Addon, xrefs: 0056EB54
Failed to get @Id., xrefs: 0056EC1C
Failed to get next RelatedBundle element., xrefs: 0056EC2A
Failed to resize Addon code array in registration, xrefs: 0056EBF6
Failed to resize Patch code array in registration, xrefs: 0056EBFD
Upgrade, xrefs: 0056EB0A

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: String$CompareVariant$AllocClearFreeInit
String ID: Action$Addon$Detect$Failed to get @Action.$Failed to get @Id.$Failed to get RelatedBundle element count.$Failed to get RelatedBundle nodes$Failed to get next RelatedBundle element.$Failed to resize Addon code array in registration$Failed to resize Detect code array in registration$Failed to resize Patch code array in registration$Failed to resize Upgrade code array in registration$Invalid value for @Action: %ls$Patch$RelatedBundle$Upgrade$cabinet.dll$comres.dll$version.dll
API String ID: 702752599-259800149
Opcode ID: 37784d81e7f386edcb7a97f8adadb170608f02d66dac2adf48d1b00509d6f26d
Instruction ID: 3f01074579f88c30f0784e5e8a45cf0ec16123217723fecd50981c717ca4a9bc
Opcode Fuzzy Hash: 37784d81e7f386edcb7a97f8adadb170608f02d66dac2adf48d1b00509d6f26d
Instruction Fuzzy Hash: 8271A039A4661ABFDB209E54CD46EAEBFB4FB05724F204254F911A76C0D730AE41DB90

Function 00574668 Relevance: 36.9, APIs: 10, Strings: 11, Instructions: 184fileCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,8000FFFF,feclient.dll,?,00574B7B,005AA4E8,?,feclient.dll,00000000,?,?), ref: 0057467F
ReadFile.KERNEL32(feclient.dll,feclient.dll,00000004,?,00000000,?,00574B7B,005AA4E8,?,feclient.dll,00000000,?,?), ref: 005746A0
GetLastError.KERNEL32(?,00574B7B,005AA4E8,?,feclient.dll,00000000,?,?), ref: 005746A6
ReadFile.KERNEL32(feclient.dll,00000000,005AA518,?,00000000,00000000,005AA519,?,00574B7B,005AA4E8,?,feclient.dll,00000000,?,?), ref: 00574734
GetLastError.KERNEL32(?,00574B7B,005AA4E8,?,feclient.dll,00000000,?,?), ref: 0057473A

Strings

msasn1.dll, xrefs: 005747B7
Verification secret from parent is too big., xrefs: 00574701
Failed to read verification secret from parent pipe., xrefs: 00574768
Verification secret from parent does not match., xrefs: 005747A2
c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 005746CA, 005746F5, 0057475E, 00574796, 005747E3, 0057483D, 0057487B
Failed to allocate buffer for verification secret., xrefs: 0057471D
feclient.dll, xrefs: 0057466E, 0057469E, 0057469F, 00574733, 005747B8, 0057480E
Failed to inform parent process that child is running., xrefs: 00574847
Verification process id from parent does not match., xrefs: 00574887
Failed to read size of verification secret from parent pipe., xrefs: 005746D4
Failed to read verification process id from parent pipe., xrefs: 005747ED

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorFileLastRead$CurrentProcess
String ID: Failed to allocate buffer for verification secret.$Failed to inform parent process that child is running.$Failed to read size of verification secret from parent pipe.$Failed to read verification process id from parent pipe.$Failed to read verification secret from parent pipe.$Verification process id from parent does not match.$Verification secret from parent does not match.$Verification secret from parent is too big.$c:\agent\_work\66\s\src\burn\engine\pipe.cpp$feclient.dll$msasn1.dll
API String ID: 1233551569-1273669510
Opcode ID: 62afd87f58494767b2fe00e07ba4ad7082f3e6b86230412b169d44fb3b966585
Instruction ID: d76a2d322939a8e8be0512782b35cd13955553e03bad1da206b5703c6fd433de
Opcode Fuzzy Hash: 62afd87f58494767b2fe00e07ba4ad7082f3e6b86230412b169d44fb3b966585
Instruction Fuzzy Hash: B751E936D80226B7D7119A949C46FAFBE68FF41B10F118125FE15FB280D7749E01EAE2

Function 00582596 Relevance: 36.9, APIs: 3, Strings: 18, Instructions: 144COMMON

Download Yara Rule

Strings

Protocol, xrefs: 0058265D
InstallArguments, xrefs: 005825D0
none, xrefs: 005826D0
UninstallArguments, xrefs: 005825F2
netfx4, xrefs: 005826AF
Failed to parse exit codes., xrefs: 005826A6
Failed to get @RepairArguments., xrefs: 00582625
Failed to parse command lines., xrefs: 00582722
RepairArguments, xrefs: 00582614
Failed to get @Protocol., xrefs: 0058270E
Failed to get @Repairable., xrefs: 0058264F
Failed to get @InstallArguments., xrefs: 005825E1
DetectCondition, xrefs: 005825AE
Repairable, xrefs: 00582636
Failed to get @UninstallArguments., xrefs: 00582603
burn, xrefs: 0058267A
Invalid protocol type: %ls, xrefs: 005826F6
Failed to get @DetectCondition., xrefs: 005825BF

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: DetectCondition$Failed to get @DetectCondition.$Failed to get @InstallArguments.$Failed to get @Protocol.$Failed to get @RepairArguments.$Failed to get @Repairable.$Failed to get @UninstallArguments.$Failed to parse command lines.$Failed to parse exit codes.$InstallArguments$Invalid protocol type: %ls$Protocol$RepairArguments$Repairable$UninstallArguments$burn$netfx4$none
API String ID: 760788290-1911311241
Opcode ID: b26a7c39e807104ef6f1156aaa52053a9b9fdd8d89ed0931b512e699a807c483
Instruction ID: 4dc6276ec34612f90a8c8f947d94884a680644d067dbc68d80d46d7efe05ce91
Opcode Fuzzy Hash: b26a7c39e807104ef6f1156aaa52053a9b9fdd8d89ed0931b512e699a807c483
Instruction Fuzzy Hash: C441C872A84727B7CB1275658D46FAA7E58FB01B30F200715FD25FB2C1EB64B90057A2

Function 00568F3F Relevance: 35.4, APIs: 8, Strings: 12, Instructions: 430COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,56005ACC,00000001,?,0056990B,?,00000000,00000000,?,?,005698F3,?,?,00000000,?), ref: 00568F7D

Strings

Failed to parse condition "%ls". Unexpected character at position %d., xrefs: 0056912F
Failed to parse condition "%ls". Unexpected '~' operator at position %d., xrefs: 005693D5
-, xrefs: 005690E5
NOT, xrefs: 005692A8
AND, xrefs: 00569289
Failed to parse condition "%ls". Constant too big, at position %d., xrefs: 0056934D
Failed to parse condition "%ls". Unterminated literal at position %d., xrefs: 00569065
Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d., xrefs: 00569391
Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d., xrefs: 005691AB
Failed to parse condition "%ls". Invalid version format, at position %d., xrefs: 0056920F
Failed to set symbol value., xrefs: 0056902D
c:\agent\_work\66\s\src\burn\engine\condition.cpp, xrefs: 00569051, 0056911B, 00569197, 005691FB, 00569339, 0056937D, 005693C1

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: StringType
String ID: -$AND$Failed to parse condition "%ls". Constant too big, at position %d.$Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d.$Failed to parse condition "%ls". Invalid version format, at position %d.$Failed to parse condition "%ls". Unexpected '~' operator at position %d.$Failed to parse condition "%ls". Unexpected character at position %d.$Failed to parse condition "%ls". Unterminated literal at position %d.$Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d.$Failed to set symbol value.$NOT$c:\agent\_work\66\s\src\burn\engine\condition.cpp
API String ID: 4177115715-1494984065
Opcode ID: b17560cdb342161d699741e5616a323304d15d168b60a8abc779f93bbbb50f4b
Instruction ID: ff4864d69b2bd8dac65e2e67ab96d694b1a146f5c23b001ec81584b03d552676
Opcode Fuzzy Hash: b17560cdb342161d699741e5616a323304d15d168b60a8abc779f93bbbb50f4b
Instruction Fuzzy Hash: 1AF1F2B1600202FBDB24CF54C899BBA7FACFF05710F108545F9019B285DBB6DA96DB91

Function 00576AC2 Relevance: 35.4, APIs: 6, Strings: 14, Instructions: 355synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0056D461: EnterCriticalSection.KERNEL32(000000D0,?,000000B8,00000000,?,00576F37,000000B8,00000000,?,00000000,75C0B390), ref: 0056D470
Part of subcall function 0056D461: InterlockedCompareExchange.KERNEL32(000000E8,00000001,00000000), ref: 0056D47F
Part of subcall function 0056D461: LeaveCriticalSection.KERNEL32(000000D0,?,00576F37,000000B8,00000000,?,00000000,75C0B390), ref: 0056D494

ReleaseMutex.KERNEL32(00000000,?,00000000,crypt32.dll,00000000,00000001,00000000), ref: 00576E86
CloseHandle.KERNEL32(00000000), ref: 00576E8F
CloseHandle.KERNEL32(?,?,00000000,crypt32.dll,00000000,00000001,00000000), ref: 00576EAF

Part of subcall function 0058B9F8: SetThreadExecutionState.KERNEL32(80000001), ref: 0058B9FD

Strings

Failed to create cache thread., xrefs: 00576D65
Failed while caching, aborting execution., xrefs: 00576D8D
c:\agent\_work\66\s\src\burn\engine\core.cpp, xrefs: 00576B8A, 00576D5B
crypt32.dll, xrefs: 00576BC6
UX aborted apply begin., xrefs: 00576B94
comres.dll, xrefs: 00576ED5
Failed to register bundle., xrefs: 00576CEB
Failed to set initial apply variables., xrefs: 00576BFE
Another per-user setup is already executing., xrefs: 00576BD4
Engine cannot start apply because it is busy with another action., xrefs: 00576B23
Failed to elevate., xrefs: 00576C8E
Another per-machine setup is already executing., xrefs: 00576CC8
Failed to cache engine to working directory., xrefs: 00576C68
oEV, xrefs: 00576DC2, 00576D0E, 00576DC5

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseCriticalHandleSection$CompareEnterExchangeExecutionInterlockedLeaveMutexReleaseStateThread
String ID: Another per-machine setup is already executing.$Another per-user setup is already executing.$Engine cannot start apply because it is busy with another action.$Failed to cache engine to working directory.$Failed to create cache thread.$Failed to elevate.$Failed to register bundle.$Failed to set initial apply variables.$Failed while caching, aborting execution.$UX aborted apply begin.$c:\agent\_work\66\s\src\burn\engine\core.cpp$comres.dll$crypt32.dll$oEV
API String ID: 1740103319-1840021917
Opcode ID: db1fc508a75bf640a4c037dbdd60045e6378e81e9760b373b4fcbcecd9943410
Instruction ID: 1c2046b6983d0fc4ba0c1c894d0b998e16184400f30cb802ea17554786d9955c
Opcode Fuzzy Hash: db1fc508a75bf640a4c037dbdd60045e6378e81e9760b373b4fcbcecd9943410
Instruction Fuzzy Hash: B4C18271901616AFDF259F60D889FEE3FA8BF04301F048579FD0DAA142DB309944EBA5

Function 00581951 Relevance: 35.2, APIs: 4, Strings: 16, Instructions: 211COMMON

Download Yara Rule

APIs

Part of subcall function 005639DF: GetProcessHeap.KERNEL32(?,000001C7,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F0
Part of subcall function 005639DF: RtlAllocateHeap.NTDLL(00000000,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F7

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,success,000000FF,?,Type,00000000,?,?,00000000,?,00000001,?), ref: 00581A58
CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,error,000000FF), ref: 00581A76

Strings

error, xrefs: 00581A69
forceReboot, xrefs: 00581AA3
scheduleReboot, xrefs: 00581A85
ExitCode, xrefs: 0058195F
Failed to get @Code., xrefs: 00581B38
Failed to get @Type., xrefs: 00581B57
c:\agent\_work\66\s\src\burn\engine\exeengine.cpp, xrefs: 005819D9
Failed to select exit code nodes., xrefs: 0058197E
Failed to get exit code node count., xrefs: 005819A3
Code, xrefs: 00581AC5
Type, xrefs: 00581A30
Invalid exit code type: %ls, xrefs: 00581B47
success, xrefs: 00581A49
Failed to allocate memory for exit code structs., xrefs: 005819E3
Failed to get next node., xrefs: 00581B5E
Failed to parse @Code value: %ls, xrefs: 00581B31

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CompareHeapString$AllocateProcess
String ID: Code$ExitCode$Failed to allocate memory for exit code structs.$Failed to get @Code.$Failed to get @Type.$Failed to get exit code node count.$Failed to get next node.$Failed to parse @Code value: %ls$Failed to select exit code nodes.$Invalid exit code type: %ls$Type$c:\agent\_work\66\s\src\burn\engine\exeengine.cpp$error$forceReboot$scheduleReboot$success
API String ID: 2664528157-2974551199
Opcode ID: 353bb1279cc457d4db1485ef73dbaa6d7ec4e4b849881b62e3e2d11287a44b1f
Instruction ID: a7d2bcf3cfd3e5ca92a15d6858da5720a424a294fc68a91f2883ab93200bfce2
Opcode Fuzzy Hash: 353bb1279cc457d4db1485ef73dbaa6d7ec4e4b849881b62e3e2d11287a44b1f
Instruction Fuzzy Hash: 5A610330A04616BBCB10AB64CC45EAEBFA9FF41721F204255F825BB2D0EB70DE42D795

Function 005A6FC4 Relevance: 33.5, APIs: 8, Strings: 11, Instructions: 205COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,rel,000000FF,?,?,?,00000000), ref: 005A7024
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,href,000000FF), ref: 005A7049
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,length,000000FF), ref: 005A7069
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,title,000000FF), ref: 005A709C
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,type,000000FF), ref: 005A70B8
SysFreeString.OLEAUT32(00000000), ref: 005A70E3
SysFreeString.OLEAUT32(00000000), ref: 005A715A
SysFreeString.OLEAUT32(00000000), ref: 005A71A6

Strings

msasn1.dll, xrefs: 005A7194
`<u, xrefs: 005A70E3, 005A715A, 005A71A6
version.dll, xrefs: 005A70C7
href, xrefs: 005A703B
comres.dll, xrefs: 005A7073
title, xrefs: 005A708E
feclient.dll, xrefs: 005A7056
type, xrefs: 005A70AA
length, xrefs: 005A705B
msi.dll, xrefs: 005A7142
rel, xrefs: 005A7017

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: String$Compare$Free
String ID: `<u$comres.dll$feclient.dll$href$length$msasn1.dll$msi.dll$rel$title$type$version.dll
API String ID: 318886736-782967201
Opcode ID: d495b43a96a797358bc4c9713d3776c4823f6aa17118580fb7aeb269c068c3f4
Instruction ID: 350ddf492823ebb5c2bb334b0e5794da1b2f16b9a31bafc20fd5a377b798ba33
Opcode Fuzzy Hash: d495b43a96a797358bc4c9713d3776c4823f6aa17118580fb7aeb269c068c3f4
Instruction Fuzzy Hash: C4613036908219FBCB15DB94CC49FAEBFB8BF0A320F2046A5E521A7191D731AE45DB50

Function 005A78F7 Relevance: 31.8, APIs: 9, Strings: 9, Instructions: 308COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000000,00000000,000002C0,00000410), ref: 005A7924
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,application,000000FF), ref: 005A793F
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,upgrade,000000FF), ref: 005A79E2
CompareStringW.KERNEL32(0000007F,00000000,00700079,000000FF,version,000000FF,000002D8,005AA518,00000000), ref: 005A7A21
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exclusive,000000FF), ref: 005A7A74
CompareStringW.KERNEL32(0000007F,00000000,005AA518,000000FF,true,000000FF), ref: 005A7A92
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,version,000000FF), ref: 005A7ACA
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,enclosure,000000FF), ref: 005A7C0E

Strings

exclusive, xrefs: 005A7A66
enclosure, xrefs: 005A7BFC
version, xrefs: 005A7A13, 005A7ABC
c:\agent\_work\66\s\src\libs\dutil\apuputil.cpp, xrefs: 005A7B31
application, xrefs: 005A7931
upgrade, xrefs: 005A79D4
type, xrefs: 005A796A
true, xrefs: 005A7A84
http://appsyndication.org/2006/appsyn, xrefs: 005A7917

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CompareString
String ID: application$c:\agent\_work\66\s\src\libs\dutil\apuputil.cpp$enclosure$exclusive$http://appsyndication.org/2006/appsyn$true$type$upgrade$version
API String ID: 1825529933-3624447555
Opcode ID: afd0b80f34214cc3df1c9dc6467a06f17883649d16eaf2124b70e6b8cb1b4f90
Instruction ID: f081ae63e4c6824eb1fe65e9c8b36aeef72942afade6532cb80efc095db5452a
Opcode Fuzzy Hash: afd0b80f34214cc3df1c9dc6467a06f17883649d16eaf2124b70e6b8cb1b4f90
Instruction Fuzzy Hash: 25B1CE71A0860AAFDB208F54CC85F5E7FA5BF4A730F208659F924AB2D5D770E940DB14

Function 0057E226 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 145registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0057E10F: LoadBitmapW.USER32(?,00000001), ref: 0057E145
Part of subcall function 0057E10F: GetLastError.KERNEL32 ref: 0057E151

LoadCursorW.USER32(00000000,00007F00), ref: 0057E287
RegisterClassW.USER32(?), ref: 0057E29B
GetLastError.KERNEL32 ref: 0057E2A6
UnregisterClassW.USER32(WixBurnSplashScreen,?), ref: 0057E3AB
DeleteObject.GDI32(00000000), ref: 0057E3BA

Strings

Unexpected return value from message pump., xrefs: 0057E395
c:\agent\_work\66\s\src\burn\engine\splashscreen.cpp, xrefs: 0057E2CA, 0057E333
Failed to load splash screen., xrefs: 0057E25F
Failed to create window., xrefs: 0057E33D
Failed to register window., xrefs: 0057E2D4
WixBurnSplashScreen, xrefs: 0057E294, 0057E3A6

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ClassErrorLastLoad$BitmapCursorDeleteObjectRegisterUnregister
String ID: Failed to create window.$Failed to load splash screen.$Failed to register window.$Unexpected return value from message pump.$WixBurnSplashScreen$c:\agent\_work\66\s\src\burn\engine\splashscreen.cpp
API String ID: 164797020-1158544062
Opcode ID: 65acb9372dd5ae681ecf12786b11d1a5c18e0b3467d6005366c2fc9246af0600
Instruction ID: c13e316e4056962129627888f4f5a17b1a11d5154ee91b7d0c19a57a214c64e8
Opcode Fuzzy Hash: 65acb9372dd5ae681ecf12786b11d1a5c18e0b3467d6005366c2fc9246af0600
Instruction Fuzzy Hash: CE41B27690022ABFDB119BE4ED4AEAEBF79BF09300B104525FA04B7190D734AD04E791

Function 00589B0F Relevance: 30.0, APIs: 4, Strings: 13, Instructions: 232threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000001,0058B978,00000000,000000FF,00000001,00000000,00000000,0058B978,00000001,?), ref: 00589B74
GetLastError.KERNEL32 ref: 00589CE4
GetExitCodeThread.KERNEL32(?,00000001), ref: 00589D24
GetLastError.KERNEL32 ref: 00589D2E

Strings

Failed to execute MSI package., xrefs: 00589BD4
Failed to execute package provider registration action., xrefs: 00589C45
Invalid execute action., xrefs: 00589D84
Failed to execute dependency action., xrefs: 00589C64
Failed to load compatible package on per-machine package., xrefs: 00589C8A
Failed to execute MSP package., xrefs: 00589BF9
Failed to execute EXE package., xrefs: 00589BAB
Failed to execute compatible package action., xrefs: 00589CA1
Cache thread exited unexpectedly., xrefs: 00589D75
Failed to wait for cache check-point., xrefs: 00589D15
Failed to execute MSU package., xrefs: 00589C29
Failed to get cache thread exit code., xrefs: 00589D5F
c:\agent\_work\66\s\src\burn\engine\apply.cpp, xrefs: 00589D0B, 00589D55

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast$CodeExitMultipleObjectsThreadWait
String ID: Cache thread exited unexpectedly.$Failed to execute EXE package.$Failed to execute MSI package.$Failed to execute MSP package.$Failed to execute MSU package.$Failed to execute compatible package action.$Failed to execute dependency action.$Failed to execute package provider registration action.$Failed to get cache thread exit code.$Failed to load compatible package on per-machine package.$Failed to wait for cache check-point.$Invalid execute action.$c:\agent\_work\66\s\src\burn\engine\apply.cpp
API String ID: 3703294532-2335230991
Opcode ID: 1b32aa4c2b2dbfd1afe1f80e2220db06cc5d819d42c5c5e452494363618b5c14
Instruction ID: e5958f46119bc02ffce0f0e4cbf42cc33022b7a7033419803ab3d52e1c09f628
Opcode Fuzzy Hash: 1b32aa4c2b2dbfd1afe1f80e2220db06cc5d819d42c5c5e452494363618b5c14
Instruction Fuzzy Hash: C4713C71A0121AEBEB11EF64C945ABE7FB8FB44710F2445A6FD05F7240E675AE009BA0

Function 0056F1BA Relevance: 29.9, APIs: 3, Strings: 14, Instructions: 182registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005A3349: GetVersionExW.KERNEL32(?,?,?,00000000), ref: 005A3398

RegCloseKey.ADVAPI32(00000000,?,005AFF38,00020006,00000000,?,00000000,00000000,00000000,?,00000000,00000001,00000000,00000000), ref: 0056F3EA

Part of subcall function 005A0D39: RegSetValueExW.ADVAPI32(?,00000005,00000000,00000004,?,00000004,00000001,?,0056F237,005AFF38,Resume,00000005,?,00000000,00000000,00000000), ref: 005A0D4E

Strings

Failed to write run key value., xrefs: 0056F2E5
Failed to delete resume command line value., xrefs: 0056F3C6
Failed to write Resume value., xrefs: 0056F23D
BundleResumeCommandLine, xrefs: 0056F2F2, 0056F385
Failed to delete run key value., xrefs: 0056F378
"%ls" /%ls, xrefs: 0056F28F
Failed to create run key., xrefs: 0056F2C7
Installed, xrefs: 0056F24F
c:\agent\_work\66\s\src\burn\engine\registration.cpp, xrefs: 0056F36E, 0056F3BC
Resume, xrefs: 0056F22C
Failed to format resume command line for RunOnce., xrefs: 0056F2A3
burn.runonce, xrefs: 0056F284
Failed to write Installed value., xrefs: 0056F260
Failed to write resume command line value., xrefs: 0056F307

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseValueVersion
String ID: "%ls" /%ls$BundleResumeCommandLine$Failed to create run key.$Failed to delete resume command line value.$Failed to delete run key value.$Failed to format resume command line for RunOnce.$Failed to write Installed value.$Failed to write Resume value.$Failed to write resume command line value.$Failed to write run key value.$Installed$Resume$burn.runonce$c:\agent\_work\66\s\src\burn\engine\registration.cpp
API String ID: 2348918689-1350441746
Opcode ID: 72fb743c79dde7b6d7bc1689782d8cdef39dbe18926dff017aed286e2115573c
Instruction ID: 41ab55727ebe2736fa383d23c56274782d55e78bc90798dd11d6e1c6f669c6ca
Opcode Fuzzy Hash: 72fb743c79dde7b6d7bc1689782d8cdef39dbe18926dff017aed286e2115573c
Instruction Fuzzy Hash: D051E332E40726FBCF219AA4EC0AAAFBE64BF10714F141935F901B7291D774AD40EB90

Function 0058C96F Relevance: 29.9, APIs: 7, Strings: 10, Instructions: 173processCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(74DE8FB0,00000000,00000000), ref: 0058C97B

Part of subcall function 00574D1A: UuidCreate.RPCRT4(?), ref: 00574D4D

CreateProcessW.KERNEL32(?,?,00000000,00000000,00000001,08000000,00000000,00000000,?,0058219D,?,?,00000000,?,?,?), ref: 0058CA59
GetLastError.KERNEL32(?,?,00000000,?,?,?,?), ref: 0058CA63
GetProcessId.KERNEL32(0058219D,?,?,00000000,?,?,?,?), ref: 0058CA9B

Part of subcall function 0057545D: lstrlenW.KERNEL32(?,?,00000000,?,005AA500,?,00000000,?,0056457C,?,005AA500), ref: 0057547E
Part of subcall function 0057545D: GetCurrentProcessId.KERNEL32(?,0056457C,?,005AA500), ref: 00575489
Part of subcall function 0057545D: SetNamedPipeHandleState.KERNEL32(?,000000FF,00000000,00000000,?,0056457C,?,005AA500), ref: 005754C0
Part of subcall function 0057545D: ConnectNamedPipe.KERNEL32(?,00000000,?,0056457C,?,005AA500), ref: 005754D5
Part of subcall function 0057545D: GetLastError.KERNEL32(?,0056457C,?,005AA500), ref: 005754DF
Part of subcall function 0057545D: Sleep.KERNEL32(00000064,?,0056457C,?,005AA500), ref: 00575514
Part of subcall function 0057545D: SetNamedPipeHandleState.KERNEL32(?,00000000,00000000,00000000,?,0056457C,?,005AA500), ref: 00575537
Part of subcall function 0057545D: WriteFile.KERNEL32(?,crypt32.dll,00000004,00000000,00000000,?,0056457C,?,005AA500), ref: 00575552
Part of subcall function 0057545D: WriteFile.KERNEL32(?,|EV,005AA500,00000000,00000000,?,0056457C,?,005AA500), ref: 0057556D
Part of subcall function 0057545D: WriteFile.KERNEL32(?,comres.dll,00000004,feclient.dll,00000000,?,0056457C,?,005AA500), ref: 00575588

Part of subcall function 005A02EC: WaitForSingleObject.KERNEL32(000000FF,?,00000000,?,00564F5D,?,000000FF,?,?,?,?,?,00000000,?,?,?), ref: 005A02F8
Part of subcall function 005A02EC: GetLastError.KERNEL32(?,00564F5D,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 005A0306

CloseHandle.KERNEL32(00000000,?,000000FF,00000000,?,0058C8CF,?,?,?,?,?,00000000,?,?,?,?), ref: 0058CB1F
CloseHandle.KERNEL32(00000000,?,000000FF,00000000,?,0058C8CF,?,?,?,?,?,00000000,?,?,?,?), ref: 0058CB2E
CloseHandle.KERNEL32(00000000,?,?,000000FF,00000000,?,0058C8CF,?,?,?,?,?,00000000,?,?,?), ref: 0058CB45

Strings

Failed to wait for embedded process to connect to pipe., xrefs: 0058CABD
Failed to wait for embedded executable: %ls, xrefs: 0058CB02
Failed to create embedded pipe name and client token., xrefs: 0058C9DE
Failed to allocate embedded command., xrefs: 0058CA32
Failed to create embedded pipe., xrefs: 0058CA05
burn.embedded, xrefs: 0058CA16
Failed to process messages from embedded message., xrefs: 0058CAE2
Failed to create embedded process at path: %ls, xrefs: 0058CA91
c:\agent\_work\66\s\src\burn\engine\embedded.cpp, xrefs: 0058CA84
%ls -%ls %ls %ls %u, xrefs: 0058CA1E

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Handle$Process$CloseErrorFileLastNamedPipeWrite$CreateCurrentState$ConnectObjectSingleSleepUuidWaitlstrlen
String ID: %ls -%ls %ls %ls %u$Failed to allocate embedded command.$Failed to create embedded pipe name and client token.$Failed to create embedded pipe.$Failed to create embedded process at path: %ls$Failed to process messages from embedded message.$Failed to wait for embedded executable: %ls$Failed to wait for embedded process to connect to pipe.$burn.embedded$c:\agent\_work\66\s\src\burn\engine\embedded.cpp
API String ID: 875070380-1877421928
Opcode ID: daf0260aee457de11a4101b4897d23cf690e491876398ec4e65fd8c712870cc0
Instruction ID: 4845ff17fe5ea985f6438a9bbb615bd18c9866da46af3f33aa62c9cffea18382
Opcode Fuzzy Hash: daf0260aee457de11a4101b4897d23cf690e491876398ec4e65fd8c712870cc0
Instruction Fuzzy Hash: A4515D72D4062ABBDF11EBA4DC06FEEBFB8BF04710F104161FA04B6190D775AA449BA1

Function 0056EC76 Relevance: 29.9, APIs: 2, Strings: 15, Instructions: 172COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 0056EE04

Part of subcall function 005639DF: GetProcessHeap.KERNEL32(?,000001C7,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F0
Part of subcall function 005639DF: RtlAllocateHeap.NTDLL(00000000,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F7

SysFreeString.OLEAUT32(?), ref: 0056EDBC

Strings

SoftwareTag, xrefs: 0056EC85
Failed to get @Regid., xrefs: 0056EE55
Failed to convert SoftwareTag text to UTF-8, xrefs: 0056EE37
Failed to get SoftwareTag text., xrefs: 0056EE41
Failed to select software tag nodes., xrefs: 0056ECA6
Filename, xrefs: 0056ED37
Failed to get @Path., xrefs: 0056EE4B
c:\agent\_work\66\s\src\burn\engine\registration.cpp, xrefs: 0056ECF9
`<u, xrefs: 0056EDBC, 0056EE04
Failed to get @Filename., xrefs: 0056EE5F
Failed to allocate memory for software tag structs., xrefs: 0056ED03
Regid, xrefs: 0056ED52
Path, xrefs: 0056ED6A
Failed to get software tag count., xrefs: 0056ECCB
Failed to get next node., xrefs: 0056EE69

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: FreeHeapString$AllocateProcess
String ID: Failed to allocate memory for software tag structs.$Failed to convert SoftwareTag text to UTF-8$Failed to get @Filename.$Failed to get @Path.$Failed to get @Regid.$Failed to get SoftwareTag text.$Failed to get next node.$Failed to get software tag count.$Failed to select software tag nodes.$Filename$Path$Regid$SoftwareTag$`<u$c:\agent\_work\66\s\src\burn\engine\registration.cpp
API String ID: 336948655-2390364300
Opcode ID: 5cbcc62240761c777fa8136230b7abda787c3e14fcf8b5c9cac8ce7ac148da12
Instruction ID: 9c9ee9489ecc73153bc8437f432ee1227d636ab017d8859ac7e4f94d4977b765
Opcode Fuzzy Hash: 5cbcc62240761c777fa8136230b7abda787c3e14fcf8b5c9cac8ce7ac148da12
Instruction Fuzzy Hash: 8C517539A0221AEBDB11DF58C897EAEBFB8BF44750F144569F805AB290DB71DD00D750

Function 005A7741 Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 153stringCOMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,msi.dll,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000000,00000000,000002C0,?,005A7C2B,00000001,?), ref: 005A7761
CompareStringW.KERNEL32(0000007F,00000000,digest,000000FF,002E0069,000000FF,?,005A7C2B,00000001,?), ref: 005A777C
CompareStringW.KERNEL32(0000007F,00000000,name,000000FF,002E0069,000000FF,?,005A7C2B,00000001,?), ref: 005A7797
CompareStringW.KERNEL32(0000007F,00000000,algorithm,000000FF,?,000000FF,?,005A7C2B,00000001,?), ref: 005A7803
CompareStringW.KERNEL32(0000007F,00000001,md5,000000FF,?,000000FF,?,005A7C2B,00000001,?), ref: 005A7827
CompareStringW.KERNEL32(0000007F,00000001,sha1,000000FF,?,000000FF,?,005A7C2B,00000001,?), ref: 005A784B
CompareStringW.KERNEL32(0000007F,00000001,sha256,000000FF,?,000000FF,?,005A7C2B,00000001,?), ref: 005A786B
lstrlenW.KERNEL32(006C0064,?,005A7C2B,00000001,?), ref: 005A7886

Strings

c:\agent\_work\66\s\src\libs\dutil\apuputil.cpp, xrefs: 005A789E
name, xrefs: 005A778E
algorithm, xrefs: 005A77FA
digest, xrefs: 005A7773
sha1, xrefs: 005A7842
md5, xrefs: 005A781E
msi.dll, xrefs: 005A775B
sha256, xrefs: 005A7862
http://appsyndication.org/2006/appsyn, xrefs: 005A7754

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CompareString$lstrlen
String ID: algorithm$c:\agent\_work\66\s\src\libs\dutil\apuputil.cpp$digest$http://appsyndication.org/2006/appsyn$md5$msi.dll$name$sha1$sha256
API String ID: 1657112622-124732866
Opcode ID: 13d721cd64296bee430aa89dedc33b566b6931732a21a0ac027d0e81c6c3626d
Instruction ID: 67eb760435ca2f9be29d9358cd585bdd0a1d4ef52635e3c9a11854a6055f5aff
Opcode Fuzzy Hash: 13d721cd64296bee430aa89dedc33b566b6931732a21a0ac027d0e81c6c3626d
Instruction Fuzzy Hash: 97518231A48616BBDB205F54CC86F197E62FB16730F204715FA35AA2D5C7A5E840D7A0

Function 00569FFE Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 214COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 0056A076

Strings

Language, xrefs: 0056A05F
VersionString, xrefs: 0056A066, 0056A0F1, 0056A107, 0056A11B, 0056A134, 0056A148
Failed to get product info., xrefs: 0056A1A3
Product or related product not found: %ls, xrefs: 0056A161
Unsupported product search type: %u, xrefs: 0056A03E
Failed to copy upgrade code., xrefs: 0056A0D6
AssignmentType, xrefs: 0056A051
Failed to enumerate related products for upgrade code., xrefs: 0056A0B1
Trying per-user extended info for property '%ls' for product: %ls, xrefs: 0056A135
Failed to set variable., xrefs: 0056A1FC
Failed to change value type., xrefs: 0056A1DD
Trying per-machine extended info for property '%ls' for product: %ls, xrefs: 0056A108
MsiProductSearch failed: ID '%ls', HRESULT 0x%x, xrefs: 0056A20F
Failed to format GUID string., xrefs: 0056A081
State, xrefs: 0056A058

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Open@16
String ID: AssignmentType$Failed to change value type.$Failed to copy upgrade code.$Failed to enumerate related products for upgrade code.$Failed to format GUID string.$Failed to get product info.$Failed to set variable.$Language$MsiProductSearch failed: ID '%ls', HRESULT 0x%x$Product or related product not found: %ls$State$Trying per-machine extended info for property '%ls' for product: %ls$Trying per-user extended info for property '%ls' for product: %ls$Unsupported product search type: %u$VersionString
API String ID: 3613110473-2134270738
Opcode ID: 5155e72c1486a366deaeea82a88db6305fd3eeeb5c686540752a436de7c238e7
Instruction ID: 91548a737df1f796831e5d7b21813d1a70eff8b8710d2c57625f35a9671f9685
Opcode Fuzzy Hash: 5155e72c1486a366deaeea82a88db6305fd3eeeb5c686540752a436de7c238e7
Instruction Fuzzy Hash: A9610532D80119BBCF12AE98C949DEE7F78BB46714F204165F505BB241C332DE40DBA2

Function 00574AB0 Relevance: 28.2, APIs: 7, Strings: 9, Instructions: 157sleepfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?), ref: 00574B0A
GetLastError.KERNEL32 ref: 00574B18
Sleep.KERNEL32(00000064), ref: 00574B3C

Strings

Failed to allocate name of parent cache pipe., xrefs: 00574BB1
Failed to allocate name of parent pipe., xrefs: 00574AD6
Failed to verify parent pipe: %ls, xrefs: 00574B84
c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 00574B55, 00574C58
Failed to open parent pipe: %ls, xrefs: 00574B62
\\.\pipe\%ls.Cache, xrefs: 00574B9D
feclient.dll, xrefs: 00574B6F, 00574C0A, 00574C1E, 00574C62
\\.\pipe\%ls, xrefs: 00574AC2
Failed to open companion process with PID: %u, xrefs: 00574C64

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CreateErrorFileLastSleep
String ID: Failed to allocate name of parent cache pipe.$Failed to allocate name of parent pipe.$Failed to open companion process with PID: %u$Failed to open parent pipe: %ls$Failed to verify parent pipe: %ls$\\.\pipe\%ls$\\.\pipe\%ls.Cache$c:\agent\_work\66\s\src\burn\engine\pipe.cpp$feclient.dll
API String ID: 408151869-2029237024
Opcode ID: abae24ab6c50a01123f59abfa4d92b09d7e8d27f49e455f886cb1214fb9abee8
Instruction ID: 7b58904fa3928a15064449ce6ff39767577df72024dbe94e1f2d06f22cc616a9
Opcode Fuzzy Hash: abae24ab6c50a01123f59abfa4d92b09d7e8d27f49e455f886cb1214fb9abee8
Instruction Fuzzy Hash: AF411C36D81632BBDB225AA4AD0AF5EBE58BF11720F118211FD08B7190D765EE00FED1

Function 0056F52B Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 151registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,00570478,InstallerVersion,InstallerVersion,00000000,00570478,InstallerName,InstallerName,00000000,00570478,Date,InstalledDate,00000000,00570478,LogonUser), ref: 0056F6D9

Part of subcall function 005A0D87: RegSetValueExW.ADVAPI32(00020006,005AFF38,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,0056F2DF,00000000,?,00020006), ref: 005A0DBA

Strings

Failed to get the formatted key path for update registration., xrefs: 0056F54D
InstalledDate, xrefs: 0056F66A, 0056F683
InstallerName, xrefs: 0056F68A, 0056F68F, 0056F690, 0056F6A0
PublishingGroup, xrefs: 0056F60D, 0056F620
Date, xrefs: 0056F66F
Failed to write %ls value., xrefs: 0056F6C2
LogonUser, xrefs: 0056F64F
InstalledBy, xrefs: 0056F64A, 0056F663
InstallerVersion, xrefs: 0056F6A7, 0056F6AC, 0056F6AD, 0056F6BD
PackageVersion, xrefs: 0056F5C5, 0056F5D8
Failed to create the key for update registration., xrefs: 0056F579
PackageName, xrefs: 0056F5A5, 0056F5B8
ReleaseType, xrefs: 0056F630, 0056F635, 0056F644
ThisVersionInstalled, xrefs: 0056F585, 0056F598
Publisher, xrefs: 0056F5E5, 0056F5F8

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseValue
String ID: Date$Failed to create the key for update registration.$Failed to get the formatted key path for update registration.$Failed to write %ls value.$InstalledBy$InstalledDate$InstallerName$InstallerVersion$LogonUser$PackageName$PackageVersion$Publisher$PublishingGroup$ReleaseType$ThisVersionInstalled
API String ID: 3132538880-2703781546
Opcode ID: 273cfa4eef5540b0777cb066fbc7f4b92a993335f6478c50648297b4d722926a
Instruction ID: 13073a3f37b981e9e3066d78925c755d3aec05b161e494dcb4ad8fdbd5d15ba7
Opcode Fuzzy Hash: 273cfa4eef5540b0777cb066fbc7f4b92a993335f6478c50648297b4d722926a
Instruction Fuzzy Hash: 3C41E332E40A26B7CF626A50DC17EAE7EA8BF51B50F500571F801B72B1D761AE10A3D8

Function 0057E60C Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 134registryCOMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,?), ref: 0057E652
RegisterClassW.USER32(?), ref: 0057E67E
GetLastError.KERNEL32 ref: 0057E689
CreateWindowExW.USER32(00000080,005B91B4,00000000,90000000,80000000,00000008,00000000,00000000,00000000,00000000,?,?), ref: 0057E6F0
GetLastError.KERNEL32 ref: 0057E6FA
UnregisterClassW.USER32(WixBurnMessageWindow,?), ref: 0057E798

Strings

WixBurnMessageWindow, xrefs: 0057E677, 0057E793
Unexpected return value from message pump., xrefs: 0057E783
c:\agent\_work\66\s\src\burn\engine\uithread.cpp, xrefs: 0057E6AD, 0057E71E
Failed to create window., xrefs: 0057E728
Failed to register window., xrefs: 0057E6B7

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ClassErrorLast$CreateRegisterUnregisterValueWindow
String ID: Failed to create window.$Failed to register window.$Unexpected return value from message pump.$WixBurnMessageWindow$c:\agent\_work\66\s\src\burn\engine\uithread.cpp
API String ID: 213125376-1202977178
Opcode ID: 804b6424032a584ea9a4864924003a6a1ff34f7119d1a8d4711664797ea6fe4a
Instruction ID: da95d933bf36935eb6bbce29e67260282f2315d9552f4f336576f486c667300b
Opcode Fuzzy Hash: 804b6424032a584ea9a4864924003a6a1ff34f7119d1a8d4711664797ea6fe4a
Instruction Fuzzy Hash: A841B476900325BBDB148FA4EC4AADEBFB8FF19750F108165F909BB150D731A904EBA1

Function 0058C45E Relevance: 26.5, APIs: 1, Strings: 14, Instructions: 271COMMON

Download Yara Rule

Strings

Failed to copy filename for passthrough pseudo bundle., xrefs: 0058C6A8
Failed to copy cache id for passthrough pseudo bundle., xrefs: 0058C6EF
Failed to copy local source path for passthrough pseudo bundle., xrefs: 0058C6A1
Failed to allocate memory for pseudo bundle payload hash., xrefs: 0058C697
Failed to copy key for passthrough pseudo bundle payload., xrefs: 0058C6AF
Failed to copy uninstall arguments for passthrough bundle package, xrefs: 0058C796
Failed to copy key for passthrough pseudo bundle., xrefs: 0058C672
Failed to copy install arguments for passthrough bundle package, xrefs: 0058C74C
Failed to allocate space for burn package payload inside of passthrough bundle., xrefs: 0058C49E
Failed to recreate command-line arguments., xrefs: 0058C72D
Failed to allocate space for burn payload inside of related bundle struct, xrefs: 0058C6D1
Failed to copy download source for passthrough pseudo bundle., xrefs: 0058C679
Failed to copy related arguments for passthrough bundle package, xrefs: 0058C76C
c:\agent\_work\66\s\src\burn\engine\pseudobundle.cpp, xrefs: 0058C492, 0058C68B, 0058C6C5

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of passthrough bundle.$Failed to allocate space for burn payload inside of related bundle struct$Failed to copy cache id for passthrough pseudo bundle.$Failed to copy download source for passthrough pseudo bundle.$Failed to copy filename for passthrough pseudo bundle.$Failed to copy install arguments for passthrough bundle package$Failed to copy key for passthrough pseudo bundle payload.$Failed to copy key for passthrough pseudo bundle.$Failed to copy local source path for passthrough pseudo bundle.$Failed to copy related arguments for passthrough bundle package$Failed to copy uninstall arguments for passthrough bundle package$Failed to recreate command-line arguments.$c:\agent\_work\66\s\src\burn\engine\pseudobundle.cpp
API String ID: 1357844191-1911474293
Opcode ID: 1549e755e9e5756eea4f668cd723ab63f1113d6692486147859c8f687a749f06
Instruction ID: 9fb977a76196d14060f1e890e45af843a8fae986880b9c87171e00fe46e16730
Opcode Fuzzy Hash: 1549e755e9e5756eea4f668cd723ab63f1113d6692486147859c8f687a749f06
Instruction Fuzzy Hash: AFB15875A00616EFDB21EF68C881FA5BFA1BF48310F11816AFD14AB361D731E851DBA0

Function 0058DAF8 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 203stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,00000000,00000000,?), ref: 0058DB13

Strings

Failed to create BITS job., xrefs: 0058DBA2
Failed to set callback interface for BITS job., xrefs: 0058DC4B
Failed to complete BITS job., xrefs: 0058DCBD
c:\agent\_work\66\s\src\burn\engine\bitsengine.cpp, xrefs: 0058DB29, 0058DC1C
Failed to add file to BITS job., xrefs: 0058DBE0
Failed to initialize BITS job callback., xrefs: 0058DC34
Failed to copy download URL., xrefs: 0058DB5A
Failed to set credentials for BITS job., xrefs: 0058DBC1
Failed to download BITS job., xrefs: 0058DCAA
Failed while waiting for BITS download., xrefs: 0058DCC4
Invalid BITS engine URL: %ls, xrefs: 0058DB35
Failed to create BITS job callback., xrefs: 0058DC26
Falied to start BITS job., xrefs: 0058DCCB

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: lstrlen
String ID: Failed to add file to BITS job.$Failed to complete BITS job.$Failed to copy download URL.$Failed to create BITS job callback.$Failed to create BITS job.$Failed to download BITS job.$Failed to initialize BITS job callback.$Failed to set callback interface for BITS job.$Failed to set credentials for BITS job.$Failed while waiting for BITS download.$Falied to start BITS job.$Invalid BITS engine URL: %ls$c:\agent\_work\66\s\src\burn\engine\bitsengine.cpp
API String ID: 1659193697-397540975
Opcode ID: bb7ec932b53b4c5ef09a0e084d728724d0e3e6cdb361786207b67340963eb9ee
Instruction ID: d06b21576358bfeb333aea5e6f22519d93692d662096cd39dc0a5d227020cc01
Opcode Fuzzy Hash: bb7ec932b53b4c5ef09a0e084d728724d0e3e6cdb361786207b67340963eb9ee
Instruction Fuzzy Hash: DE517E31A41225EBCB12AB94C98AE6EBFF4BF55B50B124155FC05BB291D7B0DD00EBA0

Function 0056BC5E Relevance: 26.4, APIs: 6, Strings: 9, Instructions: 189processCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 0056BCB0
CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,00000200,00000000,?,00000044,?,?,?,?,?), ref: 0056BDBD
GetLastError.KERNEL32(?,?,?,?), ref: 0056BDC7
WaitForInputIdle.USER32(?,?), ref: 0056BE1B
CloseHandle.KERNEL32(?,?,?), ref: 0056BE66
CloseHandle.KERNEL32(?,?,?), ref: 0056BE73

Strings

Failed to create executable command., xrefs: 0056BCEA
"%ls", xrefs: 0056BD2D, 0056BD47
D, xrefs: 0056BD9C
c:\agent\_work\66\s\src\burn\engine\approvedexe.cpp, xrefs: 0056BDEB
Failed to create obfuscated executable command., xrefs: 0056BD5B
Failed to format argument string., xrefs: 0056BCBB
Failed to format obfuscated argument string., xrefs: 0056BD07
Failed to CreateProcess on path: %ls, xrefs: 0056BDF8
"%ls" %s, xrefs: 0056BCD6, 0056BD17

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseHandle$CreateErrorIdleInputLastOpen@16ProcessWait
String ID: "%ls"$"%ls" %s$D$Failed to CreateProcess on path: %ls$Failed to create executable command.$Failed to create obfuscated executable command.$Failed to format argument string.$Failed to format obfuscated argument string.$c:\agent\_work\66\s\src\burn\engine\approvedexe.cpp
API String ID: 155678114-3058035682
Opcode ID: c1ed0803ce808544984de06c014141eede494fbf756593d86d6c330492402b09
Instruction ID: 7e235eb0c8ce46cd1498945fd55f877045407db05d81b6abc78922582374b14a
Opcode Fuzzy Hash: c1ed0803ce808544984de06c014141eede494fbf756593d86d6c330492402b09
Instruction Fuzzy Hash: 02512A72D0061ABBEF129FE0CC469AEBF79BF58704F144565EA04B7110E7329E90DB91

Function 0058673A Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 152serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,?,00000000,?,?,?,?,?,?,?,?,00586C89,?), ref: 00586773
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00586C89,?,?,?), ref: 00586780
OpenServiceW.ADVAPI32(00000000,wuauserv,00000027,?,?,?,?,?,?,?,?,00586C89,?,?,?), ref: 005867C8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00586C89,?,?,?), ref: 005867D4
QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,00586C89,?,?,?), ref: 0058680E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00586C89,?,?,?), ref: 00586818
CloseServiceHandle.ADVAPI32(00000000), ref: 005868CF
CloseServiceHandle.ADVAPI32(?), ref: 005868D9

Strings

wuauserv, xrefs: 005867C2
Failed to query status of WU service., xrefs: 00586846
c:\agent\_work\66\s\src\burn\engine\msuengine.cpp, xrefs: 005867A4, 005867F8, 0058683C
Failed to open service control manager., xrefs: 005867AE
Failed to open WU service., xrefs: 00586802
Failed to read configuration for WU service., xrefs: 0058687F
Failed to mark WU service to start on demand., xrefs: 005868A0

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Service$ErrorLast$CloseHandleOpen$ManagerQueryStatus
String ID: Failed to mark WU service to start on demand.$Failed to open WU service.$Failed to open service control manager.$Failed to query status of WU service.$Failed to read configuration for WU service.$c:\agent\_work\66\s\src\burn\engine\msuengine.cpp$wuauserv
API String ID: 971853308-110228879
Opcode ID: 0fd6f9aee89f577e2aabb437173681a2e86d0b185ac0144d3af9e393a4856e8c
Instruction ID: 44aa92cd2e2e9c0b63b63733219e12c5746eea1e4f80785ebec3c2dafafaa3d2
Opcode Fuzzy Hash: 0fd6f9aee89f577e2aabb437173681a2e86d0b185ac0144d3af9e393a4856e8c
Instruction Fuzzy Hash: E5419376E402269BD721EBA88D49AAEBFE8BF44710F114425FD05FB241DB74DC049BA0

Function 0056B1D7 Relevance: 24.6, APIs: 3, Strings: 11, Instructions: 137COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,?,0056BACA,00000008,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0056B1DF
GetLastError.KERNEL32(?,0056BACA,00000008,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0056B1EB
_memcmp.LIBVCRUNTIME ref: 0056B293

Strings

.wixburn, xrefs: 0056B28D
Failed to find valid DOS image header in buffer., xrefs: 0056B24C
Failed to find valid NT image header in buffer., xrefs: 0056B277
.wix, xrefs: 0056B2B2
c:\agent\_work\66\s\src\burn\engine\section.cpp, xrefs: 0056B20F, 0056B240, 0056B26B, 0056B2D4, 0056B2F5, 0056B31E, 0056B35E
Failed to read section info, unsupported version: %08x, xrefs: 0056B32D
Bundle guid didn't match the guid in the PE Header in memory., xrefs: 0056B36A
Failed to find Burn section., xrefs: 0056B301
Failed to get module handle to process., xrefs: 0056B219
burn, xrefs: 0056B2BA
Failed to read section info, data to short: %u, xrefs: 0056B2E3

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorHandleLastModule_memcmp
String ID: .wix$.wixburn$Bundle guid didn't match the guid in the PE Header in memory.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get module handle to process.$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$burn$c:\agent\_work\66\s\src\burn\engine\section.cpp
API String ID: 3888311042-3868660166
Opcode ID: e864934773d24f1af78991725b295dd0d625c3e94930ca0f45af465fdf83be92
Instruction ID: 299b4da2c96c494792c7c856c5545979288662df85f0d27d71e3fc477ff30d9d
Opcode Fuzzy Hash: e864934773d24f1af78991725b295dd0d625c3e94930ca0f45af465fdf83be92
Instruction Fuzzy Hash: 5C413D36380321ABE7206A519C57F7F2E51BFD2B21B254425F907EF281D7B9C982C3A5

Function 0056A249 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 140registryCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 0056A271
RegCloseKey.ADVAPI32(00000000,00000100,00000000,000002C0,?,00000001,00000000,00000000,?,00000000,?,000002C0,000002C0,?,00000000,00000000), ref: 0056A3C5

Strings

Registry value not found. Key = '%ls', Value = '%ls', xrefs: 0056A360
c:\agent\_work\66\s\src\burn\engine\search.cpp, xrefs: 0056A349
RegistrySearchExists failed: ID '%ls', HRESULT 0x%x, xrefs: 0056A39D
Failed to set variable., xrefs: 0056A388
Registry key not found. Key = '%ls', xrefs: 0056A2B2
Failed to format value string., xrefs: 0056A2FD
Failed to open registry key. Key = '%ls', xrefs: 0056A2C6
Failed to query registry key value., xrefs: 0056A353
Failed to format key string., xrefs: 0056A27C

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseOpen@16
String ID: Failed to format key string.$Failed to format value string.$Failed to open registry key. Key = '%ls'$Failed to query registry key value.$Failed to set variable.$Registry key not found. Key = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchExists failed: ID '%ls', HRESULT 0x%x$c:\agent\_work\66\s\src\burn\engine\search.cpp
API String ID: 1561904661-635686934
Opcode ID: 78d73a29ac993c211cff3ff46013864ce5fb54591557f6cc1cd3dbaf51965ab4
Instruction ID: d6e650d778449b8562621bc48510bf55f1997494074271f294abac1592209131
Opcode Fuzzy Hash: 78d73a29ac993c211cff3ff46013864ce5fb54591557f6cc1cd3dbaf51965ab4
Instruction Fuzzy Hash: 8341EF36E40125BBCF126AA4CC0AEAE7F79FB45710F104661FC05B7252E7719E10ABA1

Function 0056695F Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 132libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,ntdll,?), ref: 005669AF
GetLastError.KERNEL32 ref: 005669B9
GetProcAddress.KERNEL32(?,RtlGetVersion), ref: 005669FC
GetLastError.KERNEL32 ref: 00566A06
FreeLibrary.KERNEL32(00000000,00000000,?), ref: 00566B17

Strings

Failed to set variant value., xrefs: 00566AFB
RtlGetVersion, xrefs: 005669F1
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 005669DD, 00566A2A
Failed to get OS info., xrefs: 00566A57
Failed to locate NTDLL., xrefs: 005669E7
Failed to locate RtlGetVersion., xrefs: 00566A34
ntdll, xrefs: 005669A9

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast$AddressFreeHandleLibraryModuleProc
String ID: Failed to get OS info.$Failed to locate NTDLL.$Failed to locate RtlGetVersion.$Failed to set variant value.$RtlGetVersion$c:\agent\_work\66\s\src\burn\engine\variable.cpp$ntdll
API String ID: 3057421322-3993976954
Opcode ID: bdf18f5f0914439cf9b1c214230220361fdb8ed105477c7fa3b56e38d79db5a8
Instruction ID: e3ec34321db6de9641bae056cc284c68d31f43e9b30e2884b3a258a21041fe6a
Opcode Fuzzy Hash: bdf18f5f0914439cf9b1c214230220361fdb8ed105477c7fa3b56e38d79db5a8
Instruction Fuzzy Hash: 0D41B472941239ABDB219B648C09BEEBEB4BB09710F0041A5F948F7191DB74CE84DBD0

Function 00564936 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 129memorysynchronizationCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32(?,00000001,00000001,00000000,00000000,?,?,?,005654A3,?,?,?,?), ref: 00564967
GetLastError.KERNEL32(?,?,?,005654A3,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00564978
ReleaseMutex.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00564AB5
CloseHandle.KERNEL32(?,?,?,?,005654A3,?,?,?,?,?,?,?,?,?,?,?), ref: 00564ABE

Strings

Failed to create the message window., xrefs: 00564A13
comres.dll, xrefs: 00564A24
Failed to connect to unelevated process., xrefs: 0056495D
Failed to set elevated pipe into thread local storage for logging., xrefs: 005649EF
Failed to pump messages from parent process., xrefs: 00564A89
Failed to allocate thread local storage for logging., xrefs: 005649A6
c:\agent\_work\66\s\src\burn\engine\engine.cpp, xrefs: 0056499C, 005649E5

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AllocCloseErrorHandleLastMutexRelease
String ID: Failed to allocate thread local storage for logging.$Failed to connect to unelevated process.$Failed to create the message window.$Failed to pump messages from parent process.$Failed to set elevated pipe into thread local storage for logging.$c:\agent\_work\66\s\src\burn\engine\engine.cpp$comres.dll
API String ID: 687263955-55126310
Opcode ID: e9dcf4237fbb4be0743c5217d37ff7ddfd736f96431c252c1cc042f60dcc4518
Instruction ID: 7eeab6290cdf22434a1812eac318c51240fd52f58b9a7b9b5320f4784e26a0b7
Opcode Fuzzy Hash: e9dcf4237fbb4be0743c5217d37ff7ddfd736f96431c252c1cc042f60dcc4518
Instruction Fuzzy Hash: A741967394062ABBC7129BE09C49EDFBF6DBF45710F000226BA15E3151DB30A954EBE5

Function 00573AD7 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 129COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,?,00000000,crypt32.dll), ref: 00573B2B
GetLastError.KERNEL32(?,00000000,crypt32.dll), ref: 00573B35
GetCurrentProcessId.KERNEL32(?,?,?,00000104,?,?,00000000,crypt32.dll), ref: 00573B9E
ProcessIdToSessionId.KERNEL32(00000000,?,00000000,crypt32.dll), ref: 00573BA5
CompareStringW.KERNEL32(00000000,00000000,?,?,?,?,?,7FFFFFFF,?,?,?,?,?,00000000,crypt32.dll), ref: 00573C2F

Strings

Failed to get length of session id string., xrefs: 00573BFA
Failed to get length of temp folder., xrefs: 00573B8F
crypt32.dll, xrefs: 00573AEA
%u\, xrefs: 00573BBF
Failed to copy temp folder., xrefs: 00573C58
Failed to format session id as a string., xrefs: 00573BD3
Failed to get temp folder., xrefs: 00573B63
c:\agent\_work\66\s\src\burn\engine\logging.cpp, xrefs: 00573B59

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Process$CompareCurrentErrorLastPathSessionStringTemp
String ID: %u\$Failed to copy temp folder.$Failed to format session id as a string.$Failed to get length of session id string.$Failed to get length of temp folder.$Failed to get temp folder.$c:\agent\_work\66\s\src\burn\engine\logging.cpp$crypt32.dll
API String ID: 2407829081-4120445549
Opcode ID: 9b7b8a730688e1d84e766f496cf8733772045052eb5d1488beac4860f3fbefc9
Instruction ID: b107e59dd5d660e71efa0a8f4a89ebab286b92f998f05a7375ae696b54ac7813
Opcode Fuzzy Hash: 9b7b8a730688e1d84e766f496cf8733772045052eb5d1488beac4860f3fbefc9
Instruction Fuzzy Hash: 2A416376D8123DABCB219B609C4DED9BF68BF14720F1041A1A90DB7140E6709F84EB90

Function 00567FA2 Relevance: 21.2, APIs: 2, Strings: 12, Instructions: 215COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 00567FBF
LeaveCriticalSection.KERNEL32(?), ref: 005681E7

Strings

Failed to get numeric., xrefs: 005681B9
Failed to write variable value as string., xrefs: 005681AB
Failed to write variable count., xrefs: 00567FDA
Failed to get version., xrefs: 00568198
Failed to write included flag., xrefs: 005681D5
Failed to write variable value as number., xrefs: 00568191
Failed to write variable name., xrefs: 005681CE
feclient.dll, xrefs: 0056809A, 005680F0, 00568131
Failed to write variable value type., xrefs: 005681C7
Failed to get string., xrefs: 005681B2
Failed to write literal flag., xrefs: 005681C0
Unsupported variable type., xrefs: 005681A4

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get numeric.$Failed to get string.$Failed to get version.$Failed to write included flag.$Failed to write literal flag.$Failed to write variable count.$Failed to write variable name.$Failed to write variable value as number.$Failed to write variable value as string.$Failed to write variable value type.$Unsupported variable type.$feclient.dll
API String ID: 3168844106-2118673349
Opcode ID: 6f1ebae892b9a13475c489e177bb7daa2a6b2dd85e9fabe79f015a65c3e6a046
Instruction ID: 0f5348e849ea356c475fa0a132e23837791190bb9c4d270c8d3488925ad4e1d9
Opcode Fuzzy Hash: 6f1ebae892b9a13475c489e177bb7daa2a6b2dd85e9fabe79f015a65c3e6a046
Instruction Fuzzy Hash: 9C718D3290061AEFCF129EA4CD49BBE7FA9BB06320F114661F911B7251DB30DD56EB90

Function 00579692 Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 123fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,?,00000000,?,0057A724,?,00000000,00000000,00000000,?), ref: 005796AD
GetLastError.KERNEL32(?,0057A724,?,00000000,00000000,00000000,?,?,00000000,00000000,00000000), ref: 005796BD

Part of subcall function 005A3933: Sleep.KERNEL32(?,00000000,?,005784D1,?,?,00000001,00000003,000007D0,?,?,?,?,?,?,00564DFD), ref: 005A394A

CloseHandle.KERNEL32(00000000,?,00000001,00000003,000007D0,00000000,00000000), ref: 005797C9

Strings

%ls payload from working path '%ls' to path '%ls', xrefs: 00579774
Failed to copy %ls to %ls, xrefs: 005797B7
Failed to verify payload hash: %ls, xrefs: 00579755
Failed to move %ls to %ls, xrefs: 005797A1
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 005796E1
Failed to open payload in working path: %ls, xrefs: 005796EC
Failed to verify payload signature: %ls, xrefs: 00579718
Copying, xrefs: 00579768, 00579773
Moving, xrefs: 0057975F

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLastSleep
String ID: %ls payload from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open payload in working path: %ls$Failed to verify payload hash: %ls$Failed to verify payload signature: %ls$Moving$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 1275171361-540362316
Opcode ID: 685e80eb207d463e748fcf04eeb0010456e1548d9b18856b51009f6cc30bfbe2
Instruction ID: a02cd49ff8f011687f407014ecee5f79d0cb192873e673c8dd5cc36fd03ec662
Opcode Fuzzy Hash: 685e80eb207d463e748fcf04eeb0010456e1548d9b18856b51009f6cc30bfbe2
Instruction Fuzzy Hash: 4B3104729516717BDB222E15AC4AFAF2E1CFF93F60F058115BD08BB281E2659D00A6F1

Function 005665DC Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 117COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000), ref: 00566618

Part of subcall function 005A038A: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00565EE0,00000000), ref: 005A039E
Part of subcall function 005A038A: GetProcAddress.KERNEL32(00000000), ref: 005A03A5
Part of subcall function 005A038A: GetLastError.KERNEL32(?,?,?,00565EE0,00000000), ref: 005A03BC

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00566644
GetLastError.KERNEL32 ref: 00566652
GetSystemWow64DirectoryW.KERNEL32(?,00000104,00000000), ref: 0056668A
GetLastError.KERNEL32 ref: 00566694
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 005666D7
GetLastError.KERNEL32 ref: 005666E1

Strings

Failed to backslash terminate system folder., xrefs: 00566724
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00566676, 005666B8
Failed to set system folder variant value., xrefs: 00566740
Failed to get 32-bit system folder., xrefs: 005666C2
Failed to get 64-bit system folder., xrefs: 00566680

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast$DirectorySystem$AddressCurrentHandleModuleProcProcessWow64
String ID: Failed to backslash terminate system folder.$Failed to get 32-bit system folder.$Failed to get 64-bit system folder.$Failed to set system folder variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 325818893-3341528362
Opcode ID: f228ce1bb38ab5ae7640afbf13b9429b13fc27aa63d3d36c9fb85f04994953f0
Instruction ID: d9d0dd36f13f67dee548d0e8b1ca986845054649bc0f33c96e1a94787f303bd8
Opcode Fuzzy Hash: f228ce1bb38ab5ae7640afbf13b9429b13fc27aa63d3d36c9fb85f04994953f0
Instruction Fuzzy Hash: 583124B2D41236ABDB20A764DC4DB9E7EA8BB01754F014265BD04F7180EB789E44CAE1

Function 00573F22 Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 225sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00573A2C: RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000000,?,?,?,?,00573F3C,feclient.dll,?,00000000,?,?,?,00564B57), ref: 00573ACD

Sleep.KERNEL32(000007D0,00000001,feclient.dll,?,00000000,?,?,?,00564B57,?,?,005AA488,?,00000001,00000000,00000000), ref: 00573FD3

Strings

msasn1.dll, xrefs: 005740EF, 00574130
Failed to copy full log path to prefix., xrefs: 0057413C
clbcatq.dll, xrefs: 00574112
Failed to get non-session specific TEMP folder., xrefs: 00574081
Failed to copy log path to prefix., xrefs: 005740FB
Setup, xrefs: 00573F80
log, xrefs: 00573F7A
crypt32.dll, xrefs: 00573F79, 00573FDE, 00573FE6, 00574049, 0057408B, 005740CE, 005740ED, 0057412B, 00574155
Failed to open log: %ls, xrefs: 0057404B
feclient.dll, xrefs: 00573F36, 00573FE3
Failed to copy log extension to extension., xrefs: 0057411E
Failed to get current directory., xrefs: 00573FB5

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseSleep
String ID: Failed to copy full log path to prefix.$Failed to copy log extension to extension.$Failed to copy log path to prefix.$Failed to get current directory.$Failed to get non-session specific TEMP folder.$Failed to open log: %ls$Setup$clbcatq.dll$crypt32.dll$feclient.dll$log$msasn1.dll
API String ID: 2834455192-2673269691
Opcode ID: 3855893a32b3b93f73f8c806a81c16c9a8fd6a09fa355ce8957b15a796544665
Instruction ID: b87c49be95dda518877ba089e9c53ad35cc0ddfbebfe654a30db702d0ff8cffe
Opcode Fuzzy Hash: 3855893a32b3b93f73f8c806a81c16c9a8fd6a09fa355ce8957b15a796544665
Instruction Fuzzy Hash: 5561AF71A00216AADB16AF24D84AA7A7FA8FF40350F158625F809DB140E774ED50FBA1

Function 00566DCB Relevance: 19.7, APIs: 2, Strings: 11, Instructions: 164COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,005653FA,00000000,00565482,00000000,?,005682B1,?,?,?,00000000,00000000), ref: 00566DDA

Part of subcall function 005656E2: CompareStringW.KERNELBASE(0000007F,00001000,?,000000FF,version.dll,000000FF,?,?,00000000,005665B1,005665B1,?,00565678,?,?,00000000), ref: 0056571E
Part of subcall function 005656E2: GetLastError.KERNEL32(?,00565678,?,?,00000000,?,?,005665B1,?,00567F03,?,?,?,?,?), ref: 0056574D

LeaveCriticalSection.KERNEL32(00000000,?,?,00000000,00000000,00000000), ref: 00566F6A

Strings

Setting variable failed: ID '%ls', HRESULT 0x%x, xrefs: 00566F7C
Attempt to set built-in variable value: %ls, xrefs: 00566E68
Failed to insert variable '%ls'., xrefs: 00566E1F
Setting version variable '%ls' to value '%hu.%hu.%hu.%hu', xrefs: 00566EDF
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00566E5D
Setting hidden variable '%ls', xrefs: 00566E98
Setting string variable '%ls' to value '%ls', xrefs: 00566EFA, 00566F02
Failed to find variable value '%ls'., xrefs: 00566DF5
Setting numeric variable '%ls' to value %lld, xrefs: 00566F0B
Failed to set value of variable: %ls, xrefs: 00566F52
Unsetting variable '%ls', xrefs: 00566EF3, 00566F26

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CriticalSection$CompareEnterErrorLastLeaveString
String ID: Attempt to set built-in variable value: %ls$Failed to find variable value '%ls'.$Failed to insert variable '%ls'.$Failed to set value of variable: %ls$Setting hidden variable '%ls'$Setting numeric variable '%ls' to value %lld$Setting string variable '%ls' to value '%ls'$Setting variable failed: ID '%ls', HRESULT 0x%x$Setting version variable '%ls' to value '%hu.%hu.%hu.%hu'$Unsetting variable '%ls'$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 2716280545-3393465121
Opcode ID: 92328acd3081009128332103a79bd7de2fa369ca228b0a41b69afaad0609cc43
Instruction ID: 5569fb181aea172c584a2157b4920d082a4391946b3176d8417b25c8dae6865c
Opcode Fuzzy Hash: 92328acd3081009128332103a79bd7de2fa369ca228b0a41b69afaad0609cc43
Instruction Fuzzy Hash: 9B51B471640216ABDB309E14DC4AF6B7FACFB96704F140529F845AB286C375DD41CBE1

Function 00598C92 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00598CD6

Part of subcall function 0059880C: _free.LIBCMT ref: 00598829
Part of subcall function 0059880C: _free.LIBCMT ref: 0059883B
Part of subcall function 0059880C: _free.LIBCMT ref: 0059884D
Part of subcall function 0059880C: _free.LIBCMT ref: 0059885F
Part of subcall function 0059880C: _free.LIBCMT ref: 00598871
Part of subcall function 0059880C: _free.LIBCMT ref: 00598883
Part of subcall function 0059880C: _free.LIBCMT ref: 00598895
Part of subcall function 0059880C: _free.LIBCMT ref: 005988A7
Part of subcall function 0059880C: _free.LIBCMT ref: 005988B9
Part of subcall function 0059880C: _free.LIBCMT ref: 005988CB
Part of subcall function 0059880C: _free.LIBCMT ref: 005988DD
Part of subcall function 0059880C: _free.LIBCMT ref: 005988EF
Part of subcall function 0059880C: _free.LIBCMT ref: 00598901

_free.LIBCMT ref: 00598CCB

Part of subcall function 00595CE8: HeapFree.KERNEL32(00000000,00000000,?,005989A1,?,00000000,?,00000000,?,005989C8,?,00000007,?,?,00598E2A,?), ref: 00595CFE
Part of subcall function 00595CE8: GetLastError.KERNEL32(?,?,005989A1,?,00000000,?,00000000,?,005989C8,?,00000007,?,?,00598E2A,?,?), ref: 00595D10

_free.LIBCMT ref: 00598CED
_free.LIBCMT ref: 00598D02
_free.LIBCMT ref: 00598D0D
_free.LIBCMT ref: 00598D2F
_free.LIBCMT ref: 00598D42
_free.LIBCMT ref: 00598D50
_free.LIBCMT ref: 00598D5B
_free.LIBCMT ref: 00598D93
_free.LIBCMT ref: 00598D9A
_free.LIBCMT ref: 00598DB7
_free.LIBCMT ref: 00598DCF

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 5d92e5ae0128766ae003c97e14098d6d5d13fb8cd81785dbf9e2cc6da583e52b
Instruction ID: eb78ba043c3ea7bac27ebdd9b6eb6d0a2d18d129928bce8952306122719c4a4c
Opcode Fuzzy Hash: 5d92e5ae0128766ae003c97e14098d6d5d13fb8cd81785dbf9e2cc6da583e52b
Instruction Fuzzy Hash: 3F315E316407069FEF25AA78E949B6A7BE9FF52310F24442AF449E7191EF31EC54CB20

Function 00572C15 Relevance: 19.5, APIs: 1, Strings: 10, Instructions: 298COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000001,006C0064,000000FF,00007070,000000FF,?,00000000,?,wininet.dll,?,crypt32.dll,?,?,?,00000000), ref: 00572C83

Strings

Failed to create the string dictionary., xrefs: 00572CBC
wininet.dll, xrefs: 00572ED0
crypt32.dll, xrefs: 00572CCE, 00572DC8, 00572EBD, 00572F32
Failed to add registration action for dependent related bundle., xrefs: 00572F85
Failed to add dependents ignored from command-line., xrefs: 00572D38
Failed to allocate registration action., xrefs: 00572CEC
Failed to add self-dependent to ignore dependents., xrefs: 00572D07
Failed to check for remaining dependents during planning., xrefs: 00572E29
Failed to add dependent bundle provider key to ignore dependents., xrefs: 00572DED
Failed to add registration action for self dependent., xrefs: 00572F50

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CompareString
String ID: Failed to add dependent bundle provider key to ignore dependents.$Failed to add dependents ignored from command-line.$Failed to add registration action for dependent related bundle.$Failed to add registration action for self dependent.$Failed to add self-dependent to ignore dependents.$Failed to allocate registration action.$Failed to check for remaining dependents during planning.$Failed to create the string dictionary.$crypt32.dll$wininet.dll
API String ID: 1825529933-1705955799
Opcode ID: aa69516bc6fbea5d2cd4fd55d63a870a7fa5b6d5d78c962f6c6ef4dfa2c0620a
Instruction ID: 67e5c6bdc84ddcd15d4e96b38dd71b2630304ed98afd0f98b54955463f2a307a
Opcode Fuzzy Hash: aa69516bc6fbea5d2cd4fd55d63a870a7fa5b6d5d78c962f6c6ef4dfa2c0620a
Instruction Fuzzy Hash: ACB18B70A00616EFCF299F65E886AAE7FB5BF44310F10C16AF818AA251D730D951EBD1

Function 0057F748 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 186COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0057F784
UuidCreate.RPCRT4(?), ref: 0057F867
StringFromGUID2.OLE32(?,?,00000027), ref: 0057F888
LeaveCriticalSection.KERNEL32(?,?), ref: 0057F931

Strings

Failed to create bundle update guid., xrefs: 0057F874
Failed to default local update source, xrefs: 0057F7F4
Failed to recreate command-line for update bundle., xrefs: 0057F84F
Failed to convert bundle update guid into string., xrefs: 0057F8A7
c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp, xrefs: 0057F89D
update\%ls, xrefs: 0057F7E0
Failed to set update bundle., xrefs: 0057F90B

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CriticalSection$CreateEnterFromLeaveStringUuid
String ID: Failed to convert bundle update guid into string.$Failed to create bundle update guid.$Failed to default local update source$Failed to recreate command-line for update bundle.$Failed to set update bundle.$c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp$update\%ls
API String ID: 171215650-494903540
Opcode ID: 4f941d52dbb4ad539a396b5e11b3eb488c83da6af0f2918c712e5b408e2dc927
Instruction ID: d59b04a52114963a21db964e5396ccd7e25fb7d358e93a4add09af5a47c2cbe4
Opcode Fuzzy Hash: 4f941d52dbb4ad539a396b5e11b3eb488c83da6af0f2918c712e5b408e2dc927
Instruction Fuzzy Hash: A7518C31940215ABDF21DFA4E849EAEBFB4FF48710F158179F909AB251D7309C41EB91

Function 00564B2A Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 143windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00564CA9
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00564CBA

Strings

Failed to set registration variables., xrefs: 00564C23
Failed to set layout directory variable to value provided from command-line., xrefs: 00564C4B
Failed to check global conditions, xrefs: 00564B8E
Failed to create the message window., xrefs: 00564BDD
Failed to set action variables., xrefs: 00564C09
WixBundleLayoutDirectory, xrefs: 00564C3A
Failed while running , xrefs: 00564C6F
Failed to open log., xrefs: 00564B5D
Failed to query registration., xrefs: 00564BF3

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: MessagePostWindow
String ID: Failed to check global conditions$Failed to create the message window.$Failed to open log.$Failed to query registration.$Failed to set action variables.$Failed to set layout directory variable to value provided from command-line.$Failed to set registration variables.$Failed while running $WixBundleLayoutDirectory
API String ID: 3618638489-3051724725
Opcode ID: 0a477d47966495c569461e44b2932c65dd8c12574135f4e9b007efabd4cc02da
Instruction ID: ee5352cf17216b018940a5c9e8e030d85b5cd91a331580efeb7258ec15312319
Opcode Fuzzy Hash: 0a477d47966495c569461e44b2932c65dd8c12574135f4e9b007efabd4cc02da
Instruction Fuzzy Hash: 7541D571601617BBEF265A20CC4AFBBBE6CBB45750F004625B405A7250EB60ED54EF91

Function 0057EE9A Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 005639DF: GetProcessHeap.KERNEL32(?,000001C7,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F0
Part of subcall function 005639DF: RtlAllocateHeap.NTDLL(00000000,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F7

EnterCriticalSection.KERNEL32(?,00000014,00000001), ref: 0057EEB7
LeaveCriticalSection.KERNEL32(?), ref: 0057EFE4

Strings

Engine is active, cannot change engine state., xrefs: 0057EED2
Failed to post launch approved exe message., xrefs: 0057EFCF
Failed to copy the arguments., xrefs: 0057EF76
c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp, xrefs: 0057EFC5
UX requested unknown approved exe with id: %ls, xrefs: 0057EF17
Failed to copy the id., xrefs: 0057EF49

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CriticalHeapSection$AllocateEnterLeaveProcess
String ID: Engine is active, cannot change engine state.$Failed to copy the arguments.$Failed to copy the id.$Failed to post launch approved exe message.$UX requested unknown approved exe with id: %ls$c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp
API String ID: 1367039788-2920183924
Opcode ID: a52e1062165c6564e7da7bd6168c3ef91df3046ce9033dd0c086546144dbb53e
Instruction ID: 5f6b4657d7c12cc6d3c01d2a1f2e998041a55b1e8f217f9a1da98744b0a87b4e
Opcode Fuzzy Hash: a52e1062165c6564e7da7bd6168c3ef91df3046ce9033dd0c086546144dbb53e
Instruction Fuzzy Hash: FE31F832A00726AFDB219F74EC0AE9A7F98BF45720B018461FD09EB250E730ED00E790

Function 0057957D Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 102fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,?,00000000,?,0057A6B7,?,00000000,00000000,00000000,?), ref: 00579598
GetLastError.KERNEL32(?,0057A6B7,?,00000000,00000000,00000000,?,?,00000000,00000000,00000000), ref: 005795A6

Part of subcall function 005A3933: Sleep.KERNEL32(?,00000000,?,005784D1,?,?,00000001,00000003,000007D0,?,?,?,?,?,?,00564DFD), ref: 005A394A

CloseHandle.KERNEL32(00000000,?,00000001,00000003,000007D0,00000000,00000000), ref: 00579684

Strings

%ls container from working path '%ls' to path '%ls', xrefs: 0057962F
Failed to verify container hash: %ls, xrefs: 00579607
Failed to copy %ls to %ls, xrefs: 00579672
Failed to move %ls to %ls, xrefs: 0057965C
Failed to open container in working path: %ls, xrefs: 005795D5
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 005795CA
Copying, xrefs: 00579623, 0057962E
Moving, xrefs: 0057961A

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLastSleep
String ID: %ls container from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open container in working path: %ls$Failed to verify container hash: %ls$Moving$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 1275171361-3604842143
Opcode ID: 85283b60652fb13d67e3a9ef8d1b9fa55ec5489ef6b61931d6822df8c4dc55be
Instruction ID: 73ecf009c2ff1409c11089921416ca62edfeeb8ef4730c13370e6173e22b0988
Opcode Fuzzy Hash: 85283b60652fb13d67e3a9ef8d1b9fa55ec5489ef6b61931d6822df8c4dc55be
Instruction Fuzzy Hash: C9212B72A802317BDB321A149C4AFEF2E1CBF91B10F514114FD08BA2C1D395AD10E2F5

Function 00574177 Relevance: 19.3, APIs: 4, Strings: 7, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 0059FDEF: EnterCriticalSection.KERNEL32(005CB5D4,00000000,?,?,?,00574192,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00565537,?), ref: 0059FDFF
Part of subcall function 0059FDEF: LeaveCriticalSection.KERNEL32(005CB5D4,?,?,005CB5CC,?,00574192,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00565537,?), ref: 0059FF46

OpenEventLogW.ADVAPI32(00000000,Application), ref: 0057419D
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 005741A9
ReportEventW.ADVAPI32(00000000,00000001,00000001,00000001,00000000,00000001,00000000,H,[,00000000), ref: 005741F6
CloseEventLog.ADVAPI32(00000000), ref: 005741FD

Strings

Failed to open Application event log, xrefs: 005741D7
Application, xrefs: 00574197
Setup, xrefs: 00574187
_Failed, xrefs: 00574182
H,[, xrefs: 005741E7
txt, xrefs: 0057417D
c:\agent\_work\66\s\src\burn\engine\logging.cpp, xrefs: 005741CD

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Event$CriticalSection$CloseEnterErrorLastLeaveOpenReport
String ID: Application$Failed to open Application event log$H,[$Setup$_Failed$c:\agent\_work\66\s\src\burn\engine\logging.cpp$txt
API String ID: 1844635321-2465509951
Opcode ID: dcf24b37b4eae2d74672ec9d7afd277d2ef36bbdf57a3fe8da2b063e34741cd7
Instruction ID: 2d231bd651cd930c7a9557398f2965b198b9a852ddb94ebc10e5fd1de111b611
Opcode Fuzzy Hash: dcf24b37b4eae2d74672ec9d7afd277d2ef36bbdf57a3fe8da2b063e34741cd7
Instruction Fuzzy Hash: FCF081369816327E53352622AD0EDBB2D6CFAD3F71B414118FD05F6140E744AD46E5B1

Function 00566F94 Relevance: 18.2, APIs: 2, Strings: 10, Instructions: 226COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00566FC1
LeaveCriticalSection.KERNEL32(?), ref: 005671CD

Strings

Failed to read variable literal flag., xrefs: 005671A8
Failed to read variable count., xrefs: 00566FE1
Failed to read variable included flag., xrefs: 005671BD
Failed to set variable., xrefs: 005671A1
Failed to read variable value type., xrefs: 005671AF
Failed to set variable value., xrefs: 00567180
Failed to read variable value as number., xrefs: 00567187
Failed to read variable name., xrefs: 005671B6
Failed to read variable value as string., xrefs: 0056719A
Unsupported variable type., xrefs: 00567193

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to read variable count.$Failed to read variable included flag.$Failed to read variable literal flag.$Failed to read variable name.$Failed to read variable value as number.$Failed to read variable value as string.$Failed to read variable value type.$Failed to set variable value.$Failed to set variable.$Unsupported variable type.
API String ID: 3168844106-528957463
Opcode ID: 7d7f467a8dbf59f92e36fe1e0f0dcc2fe6d1493a689c39de978a18d2de1c0c11
Instruction ID: ce264667c0a3ea5cf19764906d88e15416d7e17e1f7430ecc52f88d8543555bf
Opcode Fuzzy Hash: 7d7f467a8dbf59f92e36fe1e0f0dcc2fe6d1493a689c39de978a18d2de1c0c11
Instruction Fuzzy Hash: 2D715832D0561EBBDF12DEA4CC49EAEBFB9FB4A714F104522F900A7190D6359E05DBA0

Function 005A3D01 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 251fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000080,00000000,?,?,00000000,?,00000000,?,?,?), ref: 005A3D7E
GetLastError.KERNEL32 ref: 005A3D94
GetFileSizeEx.KERNEL32(00000000,?), ref: 005A3DE4
GetLastError.KERNEL32 ref: 005A3DEE
SetFilePointer.KERNEL32(00000000,?,?,00000001), ref: 005A3E42
GetLastError.KERNEL32 ref: 005A3E4D
ReadFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,00000001), ref: 005A3F3C
CloseHandle.KERNEL32(?), ref: 005A3FAF

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 005A3D21, 005A3DCD, 005A3E0E, 005A3F92

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: File$ErrorLast$CloseCreateHandlePointerReadSize
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 3286166115-1688708105
Opcode ID: 5609f5adfea2c0163df44ac6c15d0684fc01132b5ee63ae88f6c86e01dfdce7a
Instruction ID: ff05c54e9724a2566f58b1e8e489d4d079d166cf84b9af704e67a2e98231396f
Opcode Fuzzy Hash: 5609f5adfea2c0163df44ac6c15d0684fc01132b5ee63ae88f6c86e01dfdce7a
Instruction Fuzzy Hash: 1B81D272E40216EFDB218F698C45B6E7EA8BF42768F154529FD05EB280D778CF009B91

Function 00562EBC Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 202sleepfiletimeCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000000,00000000,00000000), ref: 00562F5C
GetLastError.KERNEL32 ref: 00562F66
GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 00563006
CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000001,00000080,00000000), ref: 00563093
GetLastError.KERNEL32 ref: 005630A0
Sleep.KERNEL32(00000064), ref: 005630B4
CloseHandle.KERNEL32(?), ref: 0056311C

Strings

7UV, xrefs: 00562EBC
%ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls, xrefs: 00563063
c:\agent\_work\66\s\src\libs\dutil\pathutil.cpp, xrefs: 00562F8A

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast$CloseCreateFileHandleLocalPathSleepTempTime
String ID: %ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls$7UV$c:\agent\_work\66\s\src\libs\dutil\pathutil.cpp
API String ID: 3480017824-163801053
Opcode ID: bfc18f5e0d744cf496132e263c704607f35e03d4b6a78ab9785b50eb47f650bc
Instruction ID: fc7dd6602a0321fff486eb845757b8aa93b2b47ab5b90c0ef0f1d17faf8a0bd8
Opcode Fuzzy Hash: bfc18f5e0d744cf496132e263c704607f35e03d4b6a78ab9785b50eb47f650bc
Instruction Fuzzy Hash: 50717272D01239ABDB309B64DC4DBADBBB8BB19710F1001A5F905B7290D7749E85DF60

Function 005A6527 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 164COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,label,000000FF,?,?,?,74DEDFD0,?,005A6A99,?,?), ref: 005A657D
SysFreeString.OLEAUT32(00000000), ref: 005A65E8
SysFreeString.OLEAUT32(00000000), ref: 005A6660
SysFreeString.OLEAUT32(00000000), ref: 005A669F

Strings

label, xrefs: 005A656F
`<u, xrefs: 005A65E8, 005A6660, 005A669F
scheme, xrefs: 005A6590
term, xrefs: 005A65B0

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: String$Free$Compare
String ID: `<u$label$scheme$term
API String ID: 1324494773-4028212031
Opcode ID: 5d73ea9a3f73af5c45dcbc8c62942e4f80b2b713ac9db92477e47259c6044a9e
Instruction ID: 47d4d7403bee3988c99145eafac86a4a4e3be2c5fcbc16e201164b63fab73507
Opcode Fuzzy Hash: 5d73ea9a3f73af5c45dcbc8c62942e4f80b2b713ac9db92477e47259c6044a9e
Instruction Fuzzy Hash: 49513C35D01219EFCB15DB94C888FAEBFB8BF05715F284295E511AB1A0D731AE04EB50

Function 00574D1A Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 121COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 00574D4D
StringFromGUID2.OLE32(?,?,00000027), ref: 00574D7C
UuidCreate.RPCRT4(?), ref: 00574DC7
StringFromGUID2.OLE32(?,?,00000027), ref: 00574DF3

Strings

Failed to create pipe guid., xrefs: 00574D5A
BurnPipe.%s, xrefs: 00574DA8
c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 00574D8D, 00574DDA
Failed to allocate pipe name., xrefs: 00574DBC
Failed to convert pipe guid into string., xrefs: 00574D99
Failed to allocate pipe secret., xrefs: 00574E1C

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CreateFromStringUuid
String ID: BurnPipe.%s$Failed to allocate pipe name.$Failed to allocate pipe secret.$Failed to convert pipe guid into string.$Failed to create pipe guid.$c:\agent\_work\66\s\src\burn\engine\pipe.cpp
API String ID: 4041566446-1070039060
Opcode ID: 82d120a890888e05804935e1b3adac72bba17cc2d2ce44d14024c41f9e341851
Instruction ID: 387f0a156c25ceee85c8d3f3b3afaf2c2601430eb9ce09c3bbd6dba60b22d780
Opcode Fuzzy Hash: 82d120a890888e05804935e1b3adac72bba17cc2d2ce44d14024c41f9e341851
Instruction Fuzzy Hash: B4417F32D00309ABDB21DBE4D949EDEBBB8BB54710F208526E909BB250D774AA08DF51

Function 005A6402 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 113COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,name,000000FF,00000000,00000000,00000000,?,74DEDFD0), ref: 005A6461
CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,email,000000FF), ref: 005A647E
SysFreeString.OLEAUT32(00000000), ref: 005A64BC
SysFreeString.OLEAUT32(00000000), ref: 005A6500

Strings

`<u, xrefs: 005A64BC, 005A6500
name, xrefs: 005A6453
uri, xrefs: 005A648C
email, xrefs: 005A6470
`jZ, xrefs: 005A640B, 005A641D

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: String$CompareFree
String ID: `jZ$`<u$email$name$uri
API String ID: 3589242889-168236207
Opcode ID: 3d8457f1283c24fa9d46a73f3998968dfc8fb3a29385f73bd03c6236b2d737d3
Instruction ID: e72aa4f2f229e3384c1a3342290ba2311134c00320ae6407784ad1bb7521f0ab
Opcode Fuzzy Hash: 3d8457f1283c24fa9d46a73f3998968dfc8fb3a29385f73bd03c6236b2d737d3
Instruction Fuzzy Hash: 6C415E35D04219BFCF159B94CC85FAEBB74BF0A725F2482A4E921AB1D0C7759E04DB50

Function 0057E8CE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 100threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,?,005654CB,?,?), ref: 0057E8EE
GetLastError.KERNEL32(?,005654CB,?,?), ref: 0057E8FB
CreateThread.KERNEL32(00000000,00000000,0057E60C,?,00000000,00000000), ref: 0057E954
GetLastError.KERNEL32(?,005654CB,?,?), ref: 0057E961
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,005654CB,?,?), ref: 0057E99C
CloseHandle.KERNEL32(00000000,?,005654CB,?,?), ref: 0057E9BB
CloseHandle.KERNEL32(?,?,005654CB,?,?), ref: 0057E9C8

Strings

Failed to create the UI thread., xrefs: 0057E98C
c:\agent\_work\66\s\src\burn\engine\uithread.cpp, xrefs: 0057E91C, 0057E982
Failed to create initialization event., xrefs: 0057E926

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
String ID: Failed to create initialization event.$Failed to create the UI thread.$c:\agent\_work\66\s\src\burn\engine\uithread.cpp
API String ID: 2351989216-1290259148
Opcode ID: 76fcd5f32ac3c1d3b1d124d85bfa61f9199d7a4def9149ed4f83170867dd3535
Instruction ID: 92daae9bef959389b39d425749d65a6b0d111cd3547d12cd2befa7c41124a69e
Opcode Fuzzy Hash: 76fcd5f32ac3c1d3b1d124d85bfa61f9199d7a4def9149ed4f83170867dd3535
Instruction Fuzzy Hash: 8931C777D0122ABBD7109FA99C45ADFBEB8BF18750F114065FA05F7280E7309E00E6A1

Function 0057E4A1 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 96threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,00000000,?,?,005654CB,?,?), ref: 0057E4C2
GetLastError.KERNEL32(?,?,005654CB,?,?), ref: 0057E4CF
CreateThread.KERNEL32(00000000,00000000,0057E226,00000000,00000000,00000000), ref: 0057E52E
GetLastError.KERNEL32(?,?,005654CB,?,?), ref: 0057E53B
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,005654CB,?,?), ref: 0057E576
CloseHandle.KERNEL32(?,?,?,005654CB,?,?), ref: 0057E58A
CloseHandle.KERNEL32(?,?,?,005654CB,?,?), ref: 0057E597

Strings

c:\agent\_work\66\s\src\burn\engine\splashscreen.cpp, xrefs: 0057E4F0, 0057E55C
Failed to create modal event., xrefs: 0057E4FA
Failed to create UI thread., xrefs: 0057E566

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
String ID: Failed to create UI thread.$Failed to create modal event.$c:\agent\_work\66\s\src\burn\engine\splashscreen.cpp
API String ID: 2351989216-1795443032
Opcode ID: 75cb94c51821feda2678e92f30c901a769946cadf077a297a7a0319e89e697a5
Instruction ID: f24befc78ec6210f9e1c684ee097468960d3d5a87d1c019a05be71b1771e2bec
Opcode Fuzzy Hash: 75cb94c51821feda2678e92f30c901a769946cadf077a297a7a0319e89e697a5
Instruction Fuzzy Hash: 80318676D0032ABBDB219F99DC05AAEBFB8BF49710F108165FD15F7240E7349A00DAA1

Function 00581286 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 87threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,74DF2F60,?,?), ref: 005812AA
GetLastError.KERNEL32 ref: 005812BD
GetExitCodeThread.KERNEL32(005AA488,00000000), ref: 005812FF
GetLastError.KERNEL32 ref: 0058130D
ResetEvent.KERNEL32(005AA460), ref: 00581348
GetLastError.KERNEL32 ref: 00581352

Strings

Failed to wait for operation complete event., xrefs: 005812EE
Failed to get extraction thread exit code., xrefs: 0058133E
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 005812E4, 00581334, 00581379
Failed to reset operation complete event., xrefs: 00581383

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast$CodeEventExitMultipleObjectsResetThreadWait
String ID: Failed to get extraction thread exit code.$Failed to reset operation complete event.$Failed to wait for operation complete event.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 2979751695-3513947302
Opcode ID: 8e3f286fd6728823505158bbba080b7a3ab54dc53de2645cfc89ac9cb866a71b
Instruction ID: b002b1e0717607113055d9f34ba7d8207cd9de92b94b3d664661a05b721eabfc
Opcode Fuzzy Hash: 8e3f286fd6728823505158bbba080b7a3ab54dc53de2645cfc89ac9cb866a71b
Instruction Fuzzy Hash: 24318474A40706EBE710AB658D05BAE7EECBF11701F104565FD06FA1A0EB35DA019B15

Function 005813A0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 82synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(005AA478,?,00000000,?,0056C198,?,005653FA,00000000,?,00577740,?,005656AA,005654B6,005654B6,00000000,?), ref: 005813BD
GetLastError.KERNEL32(?,0056C198,?,005653FA,00000000,?,00577740,?,005656AA,005654B6,005654B6,00000000,?,005654C6,FFF9E89D,005654C6), ref: 005813C7
WaitForSingleObject.KERNEL32(005AA488,000000FF,?,0056C198,?,005653FA,00000000,?,00577740,?,005656AA,005654B6,005654B6,00000000,?,005654C6), ref: 00581401
GetLastError.KERNEL32(?,0056C198,?,005653FA,00000000,?,00577740,?,005656AA,005654B6,005654B6,00000000,?,005654C6,FFF9E89D,005654C6), ref: 0058140B
CloseHandle.KERNEL32(00000000,005654C6,?,00000000,?,0056C198,?,005653FA,00000000,?,00577740,?,005656AA,005654B6,005654B6,00000000), ref: 00581456
CloseHandle.KERNEL32(00000000,005654C6,?,00000000,?,0056C198,?,005653FA,00000000,?,00577740,?,005656AA,005654B6,005654B6,00000000), ref: 00581465
CloseHandle.KERNEL32(00000000,005654C6,?,00000000,?,0056C198,?,005653FA,00000000,?,00577740,?,005656AA,005654B6,005654B6,00000000), ref: 00581474

Strings

Failed to wait for thread to terminate., xrefs: 00581439
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 005813EB, 0058142F
Failed to set begin operation event., xrefs: 005813F5

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseHandle$ErrorLast$EventObjectSingleWait
String ID: Failed to set begin operation event.$Failed to wait for thread to terminate.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 1206859064-3195532870
Opcode ID: 9221be010292877bfda90e01247c70310c8ad53c28998f31ba78873868a45220
Instruction ID: 3ccccd95979ed3440790dca112ba3d8293c44a66a00f2394eaa36b866023dd02
Opcode Fuzzy Hash: 9221be010292877bfda90e01247c70310c8ad53c28998f31ba78873868a45220
Instruction Fuzzy Hash: A3210532501E22BBDB216B65DC09B95FEA8BF04721F004224ED0876DA0E779E865DBD9

Function 005792CD Relevance: 16.7, APIs: 2, Strings: 9, Instructions: 232COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(000007D0,000007D0,00000000,00000000,?,00000000,00000000,00000003,00000000,00000000), ref: 00579380
GetLastError.KERNEL32(000007D0,000007D0,00000000,00000000,000007D0,00000001), ref: 005793A8

Strings

$, xrefs: 0057947F
Could not verify file %ls., xrefs: 005794E9
Failed to encode file hash., xrefs: 00579433
Failed to allocate string., xrefs: 00579416
Failed to allocate memory, xrefs: 0057933E
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 005793C8, 005794DC, 0057952D
Could not close verify handle., xrefs: 00579537
0, xrefs: 00579440
Failed to get file hash., xrefs: 005793D2

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast
String ID: $$0$Could not close verify handle.$Could not verify file %ls.$Failed to allocate memory$Failed to allocate string.$Failed to encode file hash.$Failed to get file hash.$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 1452528299-3123085469
Opcode ID: a2718c2bdcd96df35c9d11d82855285425d4673c95c5fd1669dedb9327a38fc3
Instruction ID: ab9b920b678e8cfc9b6102f79c82eb584a45689ba5f68ad3c5989a7ccd46b455
Opcode Fuzzy Hash: a2718c2bdcd96df35c9d11d82855285425d4673c95c5fd1669dedb9327a38fc3
Instruction Fuzzy Hash: F1819076D00229ABDF21DBA4D845BEEBFB8BF48710F154125E908BB281E7349D41DBB0

Function 0057E3C8 Relevance: 16.6, APIs: 11, Instructions: 86windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0057E3D3
DefWindowProcW.USER32(?,00000082,?,?), ref: 0057E411
SetWindowLongW.USER32(?,000000EB,00000000), ref: 0057E41E
SetWindowLongW.USER32(?,000000EB,?), ref: 0057E42D
DefWindowProcW.USER32(?,?,?,?), ref: 0057E43B
CreateCompatibleDC.GDI32(?), ref: 0057E447
SelectObject.GDI32(00000000,00000000), ref: 0057E458
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0057E47A
SelectObject.GDI32(00000000,00000000), ref: 0057E482
DeleteDC.GDI32(00000000), ref: 0057E485
PostQuitMessage.USER32(00000000), ref: 0057E493

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Window$Long$ObjectProcSelect$CompatibleCreateDeleteMessagePostQuitStretch
String ID:
API String ID: 409979828-0
Opcode ID: 94ef8cc1cbf3ce1cd38e248ed1ce2e412ec7c31e47b756844e8b036c5fe53873
Instruction ID: a4124a99e337772c41559de58990a0dbef2106af83de3debb705ab5940223b04
Opcode Fuzzy Hash: 94ef8cc1cbf3ce1cd38e248ed1ce2e412ec7c31e47b756844e8b036c5fe53873
Instruction Fuzzy Hash: 11218932100204BFDF159FA8EC1DD7B3FAAFB4A360B058959F61A961A0C7718810FB61

Function 0057A00C Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 226COMMON

Download Yara Rule

Strings

Failed to get current process directory., xrefs: 0057A0CF
Failed to combine last source with source., xrefs: 0057A0EE
WixBundleLayoutDirectory, xrefs: 0057A149
Failed to copy source path., xrefs: 0057A1FD
Failed to combine layout source with source., xrefs: 0057A183
WixBundleOriginalSource, xrefs: 0057A090
Failed to get bundle layout directory property., xrefs: 0057A164
WixBundleLastUsedSource, xrefs: 0057A075

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Find$CloseFileFirstlstrlen
String ID: Failed to combine last source with source.$Failed to combine layout source with source.$Failed to copy source path.$Failed to get bundle layout directory property.$Failed to get current process directory.$WixBundleLastUsedSource$WixBundleLayoutDirectory$WixBundleOriginalSource
API String ID: 2767606509-3003062821
Opcode ID: 80de484fcc5a819d8548d04f269f0a67c1e921dfaff6ae68334061c0cab49241
Instruction ID: ca62e2dcaecb629054f29bb8bc33e24e1b5848770ab686b4ae414fa166c66fe6
Opcode Fuzzy Hash: 80de484fcc5a819d8548d04f269f0a67c1e921dfaff6ae68334061c0cab49241
Instruction Fuzzy Hash: A6817A71D0021AAFDF15DFA8E845AAEBFB5BF88310F508529F915B3250D731AD40EB62

Function 00563171 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 209COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(00000040,00000000,00000040,00000000,00000040,00000000,00000000), ref: 005631BC
GetLastError.KERNEL32 ref: 005631C2
ExpandEnvironmentStringsW.KERNEL32(00000040,00000000,00000040,00000000,00000000), ref: 0056321C
GetLastError.KERNEL32 ref: 00563222
GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005632D6
GetLastError.KERNEL32 ref: 005632E0
GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00563336
GetLastError.KERNEL32 ref: 00563340

Strings

c:\agent\_work\66\s\src\libs\dutil\pathutil.cpp, xrefs: 005631E6

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast$EnvironmentExpandFullNamePathStrings
String ID: c:\agent\_work\66\s\src\libs\dutil\pathutil.cpp
API String ID: 1547313835-4168559387
Opcode ID: 67ca05329c0f9c4cb37c8f050d4c09952b9fdaf94ff64f8f0bb94e97e6ebb072
Instruction ID: c593443030e0e1176c6233cec4d122d721dea0abd9e8a7c540f56b6e2b2ef07c
Opcode Fuzzy Hash: 67ca05329c0f9c4cb37c8f050d4c09952b9fdaf94ff64f8f0bb94e97e6ebb072
Instruction Fuzzy Hash: F661A276E0022AABDB219B94C848B9EBEB4BB00750F154565EE01BB250EB359F44D7D0

Function 0056CB82 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 143COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,FFFEB88D,000000FF,00000001,000000FF,?,00000001,005653FA,00000000,005654C6,00565482,WixBundleUILevel,840F01E8,?,00000001), ref: 0056CBD9

Strings

Failed to get directory portion of local file path, xrefs: 0056CCB2
Failed to get next stream., xrefs: 0056CCC0
Failed to ensure directory exists, xrefs: 0056CCAB
Payload was not found in container: %ls, xrefs: 0056CCE6
Failed to extract file., xrefs: 0056CCA4
Failed to concat file paths., xrefs: 0056CCB9
c:\agent\_work\66\s\src\burn\engine\payload.cpp, xrefs: 0056CCDA
Failed to find embedded payload: %ls, xrefs: 0056CC05

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CompareString
String ID: Failed to concat file paths.$Failed to ensure directory exists$Failed to extract file.$Failed to find embedded payload: %ls$Failed to get directory portion of local file path$Failed to get next stream.$Payload was not found in container: %ls$c:\agent\_work\66\s\src\burn\engine\payload.cpp
API String ID: 1825529933-3317369491
Opcode ID: b7c34336fcd72af74efed550bc88211c21122a4c7feb1c6a59dd56d0309631d7
Instruction ID: 9e5a8b5de2ebbea3ce0b0e114c5b4168d006b80874aa1a2c82b92c7750c1bf80
Opcode Fuzzy Hash: b7c34336fcd72af74efed550bc88211c21122a4c7feb1c6a59dd56d0309631d7
Instruction Fuzzy Hash: F741BD31900216EFDF25DF94CD469BEBFB5BF81710B10816AE8AAAB391C7719D40DB90

Function 005647DF Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 127windowthreadCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(00000000,00000000,00000400,00000400,00000000), ref: 00564804
GetCurrentThreadId.KERNEL32 ref: 0056480A
GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00564898

Strings

Unexpected return value from message pump., xrefs: 005648EE
wininet.dll, xrefs: 00564837
Failed to start bootstrapper application., xrefs: 00564866
Failed to load UX., xrefs: 0056484D
Failed to create engine for UX., xrefs: 00564824
c:\agent\_work\66\s\src\burn\engine\engine.cpp, xrefs: 005648E4

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Message$CurrentPeekThread
String ID: Failed to create engine for UX.$Failed to load UX.$Failed to start bootstrapper application.$Unexpected return value from message pump.$c:\agent\_work\66\s\src\burn\engine\engine.cpp$wininet.dll
API String ID: 673430819-1140212773
Opcode ID: ddecbf792477f4caab87fa221bf562558bab1d6770e4fcfe6f1303f0c68d8aa7
Instruction ID: 5acc3a878742d620116b39f23134fff1903441816c956a4eb20f955f5ae313e8
Opcode Fuzzy Hash: ddecbf792477f4caab87fa221bf562558bab1d6770e4fcfe6f1303f0c68d8aa7
Instruction Fuzzy Hash: 3441AF72A00616BFEB159BA4CC89EBF7BACFF45314F100525F515E7280EB30AD459BA1

Function 005899B4 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 127COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,?,?,0058AD39,?,00000001,00000000), ref: 00589A3F
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,0058AD39,?,00000001,00000000,00000000,00000000,00000001,00000000), ref: 00589A49
CopyFileExW.KERNEL32(00000000,00000000,0058988D,?,?,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 00589A97
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,0058AD39,?,00000001,00000000,00000000,00000000,00000001,00000000), ref: 00589AC6

Strings

BA aborted copy of payload from: '%ls' to: %ls., xrefs: 00589ABF
Failed to clear readonly bit on payload destination path: %ls, xrefs: 00589A78
c:\agent\_work\66\s\src\burn\engine\apply.cpp, xrefs: 00589A6D, 00589AB1, 00589AEA
copy, xrefs: 00589A0D
Failed attempt to copy payload from: '%ls' to: %ls., xrefs: 00589AF8

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorFileLast$AttributesCopy
String ID: BA aborted copy of payload from: '%ls' to: %ls.$Failed attempt to copy payload from: '%ls' to: %ls.$Failed to clear readonly bit on payload destination path: %ls$c:\agent\_work\66\s\src\burn\engine\apply.cpp$copy
API String ID: 1969131206-3140072123
Opcode ID: b5934eba657518d326e8953e6e98e65c9a4144f00de4395cda3a45e0659e70fb
Instruction ID: f5053d9db4d82d71a1e585fc56322223e4b36b92a149aef88fc5224aa4315106
Opcode Fuzzy Hash: b5934eba657518d326e8953e6e98e65c9a4144f00de4395cda3a45e0659e70fb
Instruction Fuzzy Hash: D7311372B01126A7DB24AE55CC4AEFB7F68BF91B51B1C8119BC09FB241E368DD01C7A0

Function 00578D91 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 125COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000,?,00000001,80000005,?,00000000,00000000,00000000,00000003,000007D0), ref: 00578EDC

Strings

Failed to allocate access for SYSTEM group to path: %ls, xrefs: 00578E05
Failed to allocate access for Administrators group to path: %ls, xrefs: 00578DE4
Failed to allocate access for Users group to path: %ls, xrefs: 00578E47
Failed to create ACL to secure cache path: %ls, xrefs: 00578E90
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 00578E85
Failed to secure cache path: %ls, xrefs: 00578EBF
Failed to allocate access for Everyone group to path: %ls, xrefs: 00578E26

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: FreeLocal
String ID: Failed to allocate access for Administrators group to path: %ls$Failed to allocate access for Everyone group to path: %ls$Failed to allocate access for SYSTEM group to path: %ls$Failed to allocate access for Users group to path: %ls$Failed to create ACL to secure cache path: %ls$Failed to secure cache path: %ls$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 2826327444-3220527011
Opcode ID: d0436bedbda5e1e1e2e817457186454018b99c2258029e04e33bc95456bd1aef
Instruction ID: dc448971a99bbe3f3567447e8e72f42c738ade94d108618f1215fa45bf992d99
Opcode Fuzzy Hash: d0436bedbda5e1e1e2e817457186454018b99c2258029e04e33bc95456bd1aef
Instruction Fuzzy Hash: A931B672E8022A77EB3196509C0EFFE7E6CBB40B50F518165BE08B61C0DF71AD44A791

Function 0056F3F9 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 108stringCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 0056F432

Part of subcall function 0056415F: CreateDirectoryW.KERNELBASE(?,840F01E8,00000000,00000000,?,00579FBC,00000000,00000000,?,00000000,005653FA,00000000,?,?,0056D567,?), ref: 0056416D
Part of subcall function 0056415F: GetLastError.KERNEL32(?,00579FBC,00000000,00000000,?,00000000,005653FA,00000000,?,?,0056D567,?,00000000,00000000), ref: 0056417B

lstrlenA.KERNEL32(002E0032,00000000,00000094,00000000,00000094,crypt32.dll,crypt32.dll,00570458,swidtag,00000094,005AA500,00330074,00570458,00000000,crypt32.dll,00000000), ref: 0056F485

Part of subcall function 005A45C9: CreateFileW.KERNEL32(002E0032,40000000,00000001,00000000,00000002,00000080,00000000,00570458,00000000,?,0056F49C,005AA500,00000080,002E0032,00000000), ref: 005A45E1
Part of subcall function 005A45C9: GetLastError.KERNEL32(?,0056F49C,005AA500,00000080,002E0032,00000000,?,00570458,crypt32.dll,00000094,?,?,?,?,?,00000000), ref: 005A45EE

Strings

swidtag, xrefs: 0056F445
Failed to write tag xml to file: %ls, xrefs: 0056F4C3
Failed to create regid folder: %ls, xrefs: 0056F4CD
crypt32.dll, xrefs: 0056F422, 0056F45F, 0056F460
Failed to allocate regid folder path., xrefs: 0056F4E4
Failed to allocate regid file path., xrefs: 0056F4DD
Failed to format tag folder path., xrefs: 0056F4EB

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CreateErrorLast$DirectoryFileOpen@16lstrlen
String ID: Failed to allocate regid file path.$Failed to allocate regid folder path.$Failed to create regid folder: %ls$Failed to format tag folder path.$Failed to write tag xml to file: %ls$crypt32.dll$swidtag
API String ID: 904508749-2959304021
Opcode ID: 4bde7c6c8e34e5828964af478c5f29c80f8c3b2cb5bb13ec9b0d6626a516d5a3
Instruction ID: 8af0259daa737dfbf7f2182c2e037809fe8a15cc492de3cfa9904c0f21642bcd
Opcode Fuzzy Hash: 4bde7c6c8e34e5828964af478c5f29c80f8c3b2cb5bb13ec9b0d6626a516d5a3
Instruction Fuzzy Hash: 4731AD35D00616BBCF11AEA4EC01B9EBFB5FF44710F208176E914AB251DB71AE50DB90

Function 0057E10F Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(?,00000001), ref: 0057E145
GetLastError.KERNEL32 ref: 0057E151
GetObjectW.GDI32(00000000,00000018,?), ref: 0057E198
GetCursorPos.USER32(?), ref: 0057E1B9
MonitorFromPoint.USER32(?,?,00000002), ref: 0057E1CB
GetMonitorInfoW.USER32(00000000,?), ref: 0057E1E1

Strings

(, xrefs: 0057E1D8
c:\agent\_work\66\s\src\burn\engine\splashscreen.cpp, xrefs: 0057E175
Failed to load splash screen bitmap., xrefs: 0057E17F

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Monitor$BitmapCursorErrorFromInfoLastLoadObjectPoint
String ID: ($Failed to load splash screen bitmap.$c:\agent\_work\66\s\src\burn\engine\splashscreen.cpp
API String ID: 2342928100-3540601290
Opcode ID: 3b6a6f406125ce965def18c2927e3a43e3dece252aaefb6bbd631142d57a5639
Instruction ID: f127293cbc0ffe02123511ee064f9b6611920703a847fbdf7f6ee2a5197e516e
Opcode Fuzzy Hash: 3b6a6f406125ce965def18c2927e3a43e3dece252aaefb6bbd631142d57a5639
Instruction Fuzzy Hash: 83315E75A00215AFDB10DFA8DD4AA9EBFF5FB08710F158055E908EB281EB70E904DBA0

Function 00575053 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 83COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,?,?,005AA500), ref: 0057505C
GetProcessId.KERNEL32(000000FF,?,?,open,00000000,00000000,?,000000FF,?,?), ref: 005750FA
CloseHandle.KERNEL32(00000000), ref: 00575113

Strings

runas, xrefs: 005750BA
Failed to launch elevated child process: %ls, xrefs: 005750E7
open, xrefs: 005750C4, 005750D2
-q -%ls %ls %ls %u, xrefs: 00575081
burn.elevated, xrefs: 0057507C
Failed to allocate parameters for elevated process., xrefs: 00575095

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Process$CloseCurrentHandle
String ID: -q -%ls %ls %ls %u$Failed to allocate parameters for elevated process.$Failed to launch elevated child process: %ls$burn.elevated$open$runas
API String ID: 2815245435-1352204306
Opcode ID: e4c85238aec4569f7f1ad9ef96b5342cca4a2b7aa2c13bdfddaf994db54594a6
Instruction ID: cdd203cde5d48f48fbb799e8ee258c6fa48368446e5496b11de5533cced61932
Opcode Fuzzy Hash: e4c85238aec4569f7f1ad9ef96b5342cca4a2b7aa2c13bdfddaf994db54594a6
Instruction Fuzzy Hash: 64214BB590060AFFCF119F94D8498EEBFB8FF05355B10846AF405A2211EB71AF50EB90

Function 00566898 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(msi,DllGetVersion), ref: 005668C2
GetProcAddress.KERNEL32(00000000), ref: 005668C9
GetLastError.KERNEL32 ref: 005668D3

Strings

DllGetVersion, xrefs: 005668B4
Failed to set variant value., xrefs: 0056693F
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 005668F7
msi, xrefs: 005668B9
Failed to get msi.dll version info., xrefs: 0056691B
Failed to find DllGetVersion entry point in msi.dll., xrefs: 00566901

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: DllGetVersion$Failed to find DllGetVersion entry point in msi.dll.$Failed to get msi.dll version info.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp$msi
API String ID: 4275029093-3573271201
Opcode ID: e5b9b308dd10a7952d80f1e1c7ec7c3b798573c36ecbebae6e884bf4eb8c573c
Instruction ID: 84c12f47ae5d950a3a800622d883b006eb77b07441c16e77e827802a1dd88ea1
Opcode Fuzzy Hash: e5b9b308dd10a7952d80f1e1c7ec7c3b798573c36ecbebae6e884bf4eb8c573c
Instruction Fuzzy Hash: 6111D372A4063666E710AB788C0AABFBFA4FB05B10B110529FE01F7281DA34DD08D2E1

Function 0056D679 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000008,00000000,?,00564847,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,005654CB,?), ref: 0056D68A
GetLastError.KERNEL32(?,00564847,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,005654CB,?,?), ref: 0056D697
GetProcAddress.KERNEL32(00000000,BootstrapperApplicationCreate), ref: 0056D6CF
GetLastError.KERNEL32(?,00564847,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,005654CB,?,?), ref: 0056D6DB

Strings

BootstrapperApplicationCreate, xrefs: 0056D6C9
Failed to get BootstrapperApplicationCreate entry-point, xrefs: 0056D706
Failed to create UX., xrefs: 0056D71F
Failed to load UX DLL., xrefs: 0056D6C2
c:\agent\_work\66\s\src\burn\engine\userexperience.cpp, xrefs: 0056D6B8, 0056D6FC

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID: BootstrapperApplicationCreate$Failed to create UX.$Failed to get BootstrapperApplicationCreate entry-point$Failed to load UX DLL.$c:\agent\_work\66\s\src\burn\engine\userexperience.cpp
API String ID: 1866314245-3967977479
Opcode ID: 93ff7baa854e0c85ce337bad7526c227c216118da77e0e7ecc520f26872a6b76
Instruction ID: 3953abaa2f4129f6bbdc0574d02bfd573fdc41822924ff481902db9d8ed05517
Opcode Fuzzy Hash: 93ff7baa854e0c85ce337bad7526c227c216118da77e0e7ecc520f26872a6b76
Instruction Fuzzy Hash: 9E118237F81B32A7D7315A94DC09B5F7EA4BB16B61F014825FE45FB280DA15DC009AE1

Function 00561173 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 52libraryloadermemoryCOMMON

Download Yara Rule

APIs

HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,0056111A,cabinet.dll,00000009,?,?,00000000), ref: 00561184
GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,0056111A,cabinet.dll,00000009,?,?,00000000), ref: 0056118F
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0056119D
GetLastError.KERNEL32(?,?,?,?,?,0056111A,cabinet.dll,00000009,?,?,00000000), ref: 005611B8
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 005611C0
GetLastError.KERNEL32(?,?,?,?,?,0056111A,cabinet.dll,00000009,?,?,00000000), ref: 005611D5

Strings

SetDllDirectoryW, xrefs: 005611BA
kernel32, xrefs: 0056118A
SetDefaultDllDirectories, xrefs: 00561197

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AddressErrorLastProc$HandleHeapInformationModule
String ID: SetDefaultDllDirectories$SetDllDirectoryW$kernel32
API String ID: 3104334766-1824683568
Opcode ID: 398d6ea0f5f69674cb8f59262c24410d04cbcdd8573211b9ce5fa29e19bb8f6c
Instruction ID: 567846b86cc60e3e5ffe5ee0fc92732bfc890a89d09c2e28d0a2ecfe8dc77559
Opcode Fuzzy Hash: 398d6ea0f5f69674cb8f59262c24410d04cbcdd8573211b9ce5fa29e19bb8f6c
Instruction Fuzzy Hash: 5801D431600616BBDB206BA69C09DBF3F6CFF977A1B044011FA05A3041E770DA49DBB6

Function 0057F47A Relevance: 15.2, APIs: 2, Strings: 8, Instructions: 154COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0057F48F
LeaveCriticalSection.KERNEL32(?), ref: 0057F60A

Strings

UX requested unknown container with id: %ls, xrefs: 0057F534
UX requested unknown payload with id: %ls, xrefs: 0057F4E4
Engine is active, cannot change engine state., xrefs: 0057F4A9
Failed to set download password., xrefs: 0057F5B8
UX did not provide container or payload id., xrefs: 0057F5F9
Failed to set download user., xrefs: 0057F592
UX denied while trying to set download URL on embedded payload: %ls, xrefs: 0057F4FA
Failed to set download URL., xrefs: 0057F569

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Engine is active, cannot change engine state.$Failed to set download URL.$Failed to set download password.$Failed to set download user.$UX denied while trying to set download URL on embedded payload: %ls$UX did not provide container or payload id.$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
API String ID: 3168844106-2615595102
Opcode ID: 8b6b12b5f1c4056282d562960b2e14ac79e7ec02564f64f414d32f1b14a9ab0f
Instruction ID: 94c355af89c577624e2a99eaede8ffd00cd617c3d289d0709df51a4d163cf102
Opcode Fuzzy Hash: 8b6b12b5f1c4056282d562960b2e14ac79e7ec02564f64f414d32f1b14a9ab0f
Instruction Fuzzy Hash: B241D672A00612ABCB21DF24E845E6A7FA8FF51710F25C576F809A7240E774ED40E7A0

Function 00595835 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00595849

Part of subcall function 00595CE8: HeapFree.KERNEL32(00000000,00000000,?,005989A1,?,00000000,?,00000000,?,005989C8,?,00000007,?,?,00598E2A,?), ref: 00595CFE
Part of subcall function 00595CE8: GetLastError.KERNEL32(?,?,005989A1,?,00000000,?,00000000,?,005989C8,?,00000007,?,?,00598E2A,?,?), ref: 00595D10

_free.LIBCMT ref: 00595855
_free.LIBCMT ref: 00595860
_free.LIBCMT ref: 0059586B
_free.LIBCMT ref: 00595876
_free.LIBCMT ref: 00595881
_free.LIBCMT ref: 0059588C
_free.LIBCMT ref: 00595897
_free.LIBCMT ref: 005958A2
_free.LIBCMT ref: 005958B0

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 86474f663edc48f2d02752bca02637d7e48c3a9c4cf5baa477fba490264ddfbc
Instruction ID: ca3fc718143a8e430a599bb96b136ef397e4c54e9031c1d16815b7f1e2f252cc
Opcode Fuzzy Hash: 86474f663edc48f2d02752bca02637d7e48c3a9c4cf5baa477fba490264ddfbc
Instruction Fuzzy Hash: 4311A476540609AFCF02EF94D946CDD3FA5FF45350B9140A5BA08AF222EA31DE64DB80

Function 005A5253 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 195filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(000000FF,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,00000000,00000000,00000078,00000410,000000FF,?,00000000,00000000), ref: 005A5290
GetLastError.KERNEL32 ref: 005A529E
VirtualAlloc.KERNEL32(00000000,00010000,00003000,00000004), ref: 005A52DF
GetLastError.KERNEL32 ref: 005A52EC
VirtualFree.KERNEL32(?,00000000,00008000), ref: 005A545F
CloseHandle.KERNEL32(?), ref: 005A546E

Strings

c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp, xrefs: 005A52C2
GET, xrefs: 005A5393

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLastVirtual$AllocCloseCreateFileFreeHandle
String ID: GET$c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp
API String ID: 2028584396-547604341
Opcode ID: f304bc54a23956730131766f6d55c118fa31bc84b6273ed1785de691ed094b9f
Instruction ID: 5f7175c6327f4c6f801c665caa8297c18d42027e79cad3694c5f9e4fca9f4701
Opcode Fuzzy Hash: f304bc54a23956730131766f6d55c118fa31bc84b6273ed1785de691ed094b9f
Instruction Fuzzy Hash: 41616876A00A1AABDF11CFA4C845FEEBFB8BF89355F114519FE04B7240E7B499409B90

Function 00570BE7 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 00570FB3: CompareStringW.KERNEL32(00000000,00000000,feclient.dll,000000FF,00000000,000000FF,00000000,00000000,?,?,00570C06,?,00000000,?,00000000,00000000), ref: 00570FE2

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,00000000,?,00000000,00000001,?,?,00000000,?,00000000), ref: 00570D8A
GetLastError.KERNEL32 ref: 00570D97

Strings

Failed to append cache action., xrefs: 00570CE1
Failed to append payload cache action., xrefs: 00570D41
Failed to append rollback cache action., xrefs: 00570C66
c:\agent\_work\66\s\src\burn\engine\plan.cpp, xrefs: 00570DBB
Failed to append package start action., xrefs: 00570C2C
Failed to create syncpoint event., xrefs: 00570DC5

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CompareCreateErrorEventLastString
String ID: Failed to append cache action.$Failed to append package start action.$Failed to append payload cache action.$Failed to append rollback cache action.$Failed to create syncpoint event.$c:\agent\_work\66\s\src\burn\engine\plan.cpp
API String ID: 801187047-574661624
Opcode ID: 9a5090a38c7e96f1ca02a88d800e54cd6ba9f4db474d355dee1fc9b46e9288c6
Instruction ID: 57129329a39b4cb3e275431f4dc7bea13832eddf08087fb47d65e7e9484f7e10
Opcode Fuzzy Hash: 9a5090a38c7e96f1ca02a88d800e54cd6ba9f4db474d355dee1fc9b46e9288c6
Instruction Fuzzy Hash: 04615975500605EFCB16DF68D984AAEBBF9FF84310B21945AE8099B341EB31EE41EB50

Function 005A66D4 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 158COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,74DEDFD0,000000FF,type,000000FF,?,74DEDFD0,74DEDFD0,74DEDFD0), ref: 005A672A
SysFreeString.OLEAUT32(00000000), ref: 005A6775
SysFreeString.OLEAUT32(00000000), ref: 005A67F1
SysFreeString.OLEAUT32(00000000), ref: 005A683D

Strings

url, xrefs: 005A673D
`<u, xrefs: 005A6775, 005A67F1, 005A683D
type, xrefs: 005A671C

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: String$Free$Compare
String ID: `<u$type$url
API String ID: 1324494773-1686489133
Opcode ID: 73d746c78eae1bb6199de3798c65b000fe2b9fe256c8c90413ec6629375151bc
Instruction ID: 25eee01b91e6c4dbcd9c6354a37e512d9329094d306914c43c4681b83d369099
Opcode Fuzzy Hash: 73d746c78eae1bb6199de3798c65b000fe2b9fe256c8c90413ec6629375151bc
Instruction Fuzzy Hash: 91514C35D0111AEFCF15DBA4C888EAEBFB8FF06715F1842A9E811AB1A0D7359E04DB50

Function 00569E89 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 146COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00569EAF
_MREFOpen@16.MSPDB140-MSVCRT ref: 00569ED4

Strings

MsiComponentSearch failed: ID '%ls', HRESULT 0x%x, xrefs: 00569FC8
Failed to set variable., xrefs: 00569FB8
Failed to get component path: %d, xrefs: 00569F38
Failed to format product code string., xrefs: 00569EDF
Failed to format component id string., xrefs: 00569EBA

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Open@16
String ID: Failed to format component id string.$Failed to format product code string.$Failed to get component path: %d$Failed to set variable.$MsiComponentSearch failed: ID '%ls', HRESULT 0x%x
API String ID: 3613110473-1671347822
Opcode ID: bacefc69b8d0a16363af68294369080fc24fd526686c72d94432a546f5478993
Instruction ID: 9a2828db97280df9549f67be143b7d60769739248eaf772902ace3eb4596aecf
Opcode Fuzzy Hash: bacefc69b8d0a16363af68294369080fc24fd526686c72d94432a546f5478993
Instruction Fuzzy Hash: 0841E372904206BACF23AA688C4AABEFE7DFF45320F264616F500E3191E731DD50D791

Function 0059FBC6 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 122COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,00000000,00000000), ref: 0059FC0A
GetComputerNameW.KERNEL32(?,?), ref: 0059FC62

Strings

Z\, xrefs: 0059FD03
--- logging level: %hs ---, xrefs: 0059FD22
Executable: %ls v%d.%d.%d.%d, xrefs: 0059FCBE
=== Logging started: %ls ===, xrefs: 0059FC8D
Computer : %ls, xrefs: 0059FCD0
Z\, xrefs: 0059FCFB

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Name$ComputerFileModule
String ID: --- logging level: %hs ---$=== Logging started: %ls ===$Computer : %ls$Executable: %ls v%d.%d.%d.%d$Z\$Z\
API String ID: 2577110986-2501426998
Opcode ID: 309d5ec4be337e7d05fcaa02da41cf7f0242c43baa90dabec87e330801f1758e
Instruction ID: e6c59c5a07fa2b540b2d5f724c93abcaba8a88ea280853ff1f443f2ed5b2aaa3
Opcode Fuzzy Hash: 309d5ec4be337e7d05fcaa02da41cf7f0242c43baa90dabec87e330801f1758e
Instruction Fuzzy Hash: 6D413FB290021CABCF219BA4DD89EEA7BBCFB55304F5481B9F905E3141D630AE849B65

Function 005748B9 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 116fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000001,00000008,?,00000000,?,00000000,00000000,00000001,00000000,?,?,?,00000000,crypt32.dll,00000000), ref: 005748E4
GetLastError.KERNEL32 ref: 005748F1
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,00000000), ref: 0057499C
GetLastError.KERNEL32 ref: 005749A6

Strings

Failed to read data for message., xrefs: 005749D4
Failed to read message from pipe., xrefs: 00574971
c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 00574950, 00574967, 005749CA
Failed to allocate data for message., xrefs: 0057495A

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: Failed to allocate data for message.$Failed to read data for message.$Failed to read message from pipe.$c:\agent\_work\66\s\src\burn\engine\pipe.cpp
API String ID: 1948546556-3469126999
Opcode ID: cd9c6972127c9850220deddd1a657a64f45f6878b22d37e34951903a14aa56da
Instruction ID: 2563917b224acd0bc0a2de164e9c80548bd59815bf39670ae391ee7ebb31f5cf
Opcode Fuzzy Hash: cd9c6972127c9850220deddd1a657a64f45f6878b22d37e34951903a14aa56da
Instruction Fuzzy Hash: 4131A232A4022ABBD7119AA5EC05BAFBE68BB00751F11C125BA49B6180E7749E00EFD1

Function 005A0E2F Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 116stringregistryCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,00000000,BundleUpgradeCode), ref: 005A0E6B
lstrlenW.KERNEL32(?,00000002,00000001,?,00000002,00000001,00000000,00000000,BundleUpgradeCode), ref: 005A0ECD
lstrlenW.KERNEL32(?), ref: 005A0ED9
RegSetValueExW.ADVAPI32(?,?,00000000,00000007,?,?,00000001,?,?,00000002,00000001,00000000,00000000,BundleUpgradeCode), ref: 005A0F1C

Strings

<]\, xrefs: 005A0E49
<]\, xrefs: 005A0EC4, 005A0EAD
c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 005A0F44
BundleUpgradeCode, xrefs: 005A0E38

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: lstrlen$Value
String ID: <]\$<]\$BundleUpgradeCode$c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 198323757-3632661037
Opcode ID: 82752e37c11b09582e0c4185ea0c245b3acbad348952cd72e955b95c0091cdf0
Instruction ID: c351f4da843b1cdb8e37e0f44b4e54c11fed3445afc9d87aa69f625922e741ea
Opcode Fuzzy Hash: 82752e37c11b09582e0c4185ea0c245b3acbad348952cd72e955b95c0091cdf0
Instruction Fuzzy Hash: EC318F7291062AAFDB219F98CC85AAEBFB8FF45750F054465FD01BB250C770ED11ABA0

Function 00575365 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 90synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0002BF20,?,F0000003,00000000,00000000,?,00000000,00000000,00000000,005654CB,00000000,00000000,?,00000000), ref: 0057540E
GetLastError.KERNEL32(?,?,?,00564CA6,?,?,00000000,?,?,?,?,?,?,005AA4A0,?,?), ref: 00575419

Strings

Failed to post terminate message to child process cache thread., xrefs: 005753DD
Failed to post terminate message to child process., xrefs: 005753F9
c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 0057543D
Failed to wait for child process exit., xrefs: 00575447
Failed to write restart to message buffer., xrefs: 005753B1
Failed to write exit code to message buffer., xrefs: 00575389

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: Failed to post terminate message to child process cache thread.$Failed to post terminate message to child process.$Failed to wait for child process exit.$Failed to write exit code to message buffer.$Failed to write restart to message buffer.$c:\agent\_work\66\s\src\burn\engine\pipe.cpp
API String ID: 1211598281-389050287
Opcode ID: 7edad7d509057ceff634805c8e2e2616a4531e994b178496be967eca429ede9e
Instruction ID: f35f8d9e5c809cd77ea70be1d156eca375501bd85775c097a39e1bc91fe2c7ce
Opcode Fuzzy Hash: 7edad7d509057ceff634805c8e2e2616a4531e994b178496be967eca429ede9e
Instruction Fuzzy Hash: A621D532941A26BBDF125B50EC05E9E7F69BF00365F108211F908B6190F7B4AE40B7D1

Function 00578F6B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 89fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,00000000,00000101,?,00579DDA,00000003,000007D0,00000003,?,000007D0), ref: 00578F85
GetLastError.KERNEL32(?,00579DDA,00000003,000007D0,00000003,?,000007D0,?,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001,?), ref: 00578F92
CloseHandle.KERNEL32(00000000,?,00579DDA,00000003,000007D0,00000003,?,000007D0,?,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001), ref: 0057905A

Strings

Failed to verify catalog signature of payload: %ls, xrefs: 00579021
Failed to verify hash of payload: %ls, xrefs: 00579045
Failed to verify signature of payload: %ls, xrefs: 00579002
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 00578FC9
Failed to open payload at path: %ls, xrefs: 00578FD6

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: Failed to open payload at path: %ls$Failed to verify catalog signature of payload: %ls$Failed to verify hash of payload: %ls$Failed to verify signature of payload: %ls$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 2528220319-1480445316
Opcode ID: 6140c3619c45eba2717da4c3695af5821a2b99a29e55d880d2e180688f99ab22
Instruction ID: 3e6920907049dfd27f6e741c99a335130887ed2302ecd66091e0d4be2fe1b440
Opcode Fuzzy Hash: 6140c3619c45eba2717da4c3695af5821a2b99a29e55d880d2e180688f99ab22
Instruction Fuzzy Hash: F8214432580526F7CB321A65EC4DFAA3F29BF01774F10C211FD08661A0E729AC60F6E1

Function 00566B30 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00566B7B
GetLastError.KERNEL32 ref: 00566B85
GetVolumePathNameW.KERNEL32(?,?,00000104), ref: 00566BC9
GetLastError.KERNEL32 ref: 00566BD3

Strings

Failed to set variant value., xrefs: 00566C1D
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00566BA9, 00566BF7
Failed to get volume path name., xrefs: 00566C01
Failed to get windows directory., xrefs: 00566BB3

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast$DirectoryNamePathVolumeWindows
String ID: Failed to get volume path name.$Failed to get windows directory.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 124030351-26183806
Opcode ID: 9fd52e0b564cffa65f416fba4eaef2908b78cb00b4f8bc853fcc919e6c9c059c
Instruction ID: cae498e8909259c9b6dd2bf7de99c4c1f4474a05b6bff68539ef17485c31fa63
Opcode Fuzzy Hash: 9fd52e0b564cffa65f416fba4eaef2908b78cb00b4f8bc853fcc919e6c9c059c
Instruction Fuzzy Hash: 9221E573E4123967E720A6648C09F9E7FACBB81B10F114165BD04F7181EA389E0486E5

Function 00569C2D Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 82COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00569C46
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,?,0056A86A,00000100,000002C0,000002C0,?,000002C0,00000100), ref: 00569C5E
GetLastError.KERNEL32(?,0056A86A,00000100,000002C0,000002C0,?,000002C0,00000100,000002C0,000002C0,00000100), ref: 00569C6B

Strings

Failed to format variable string., xrefs: 00569C51
File search: %ls, did not find path: %ls, xrefs: 00569CBD
c:\agent\_work\66\s\src\burn\engine\search.cpp, xrefs: 00569C9B
Failed to set variable., xrefs: 00569CF4
Failed get to file attributes. '%ls', xrefs: 00569CA8

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed get to file attributes. '%ls'$Failed to format variable string.$Failed to set variable.$File search: %ls, did not find path: %ls$c:\agent\_work\66\s\src\burn\engine\search.cpp
API String ID: 1811509786-3902182656
Opcode ID: c489aeb2538c9bfce543983a4d63f8322063265219ee5081396c0b7eb8e24a02
Instruction ID: 324cea6838f4201e5d298c6b7680e67b2a328c8855f11a6dd51f2679146fa589
Opcode Fuzzy Hash: c489aeb2538c9bfce543983a4d63f8322063265219ee5081396c0b7eb8e24a02
Instruction Fuzzy Hash: 8421D433900122BAEF116A649D0BFAEBFA9BF41720F114625FD01B7191E7719D10E6E1

Function 0057AC12 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,?), ref: 0057AC29
GetLastError.KERNEL32 ref: 0057AC33
CoInitializeEx.OLE32(00000000,00000000), ref: 0057AC72
CoUninitialize.OLE32(?,0057C5CA,?,?), ref: 0057ACAF

Strings

Failed to set elevated cache pipe into thread local storage for logging., xrefs: 0057AC61
Failed to pump messages in child process., xrefs: 0057AC9D
Failed to initialize COM., xrefs: 0057AC7E
c:\agent\_work\66\s\src\burn\engine\elevation.cpp, xrefs: 0057AC57

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorInitializeLastUninitializeValue
String ID: Failed to initialize COM.$Failed to pump messages in child process.$Failed to set elevated cache pipe into thread local storage for logging.$c:\agent\_work\66\s\src\burn\engine\elevation.cpp
API String ID: 876858697-588708458
Opcode ID: 563c35e482b3608eb502075d15c77a08f70ccea21acec02eb7e32ef31c4c162e
Instruction ID: 28d1359d25023a3880ddd3c67a0b42936b053ed9f9187090494e42580e35ba9e
Opcode Fuzzy Hash: 563c35e482b3608eb502075d15c77a08f70ccea21acec02eb7e32ef31c4c162e
Instruction Fuzzy Hash: D611E073941236BF97221B64AC0A89FBF6CFF95B607118126FD09B7240E760AD00E6D2

Function 00565D14 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 53registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,?,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 00565D9A

Part of subcall function 005A095E: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 005A09D4
Part of subcall function 005A095E: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 005A0A0C

Strings

Failed to open Windows folder key., xrefs: 00565D4C
ProgramFilesDir, xrefs: 00565D29
Failed to ensure path was backslash terminated., xrefs: 00565D84
CommonFilesDir, xrefs: 00565D22, 00565D56, 00565D65
+, xrefs: 00565D1C
Failed to read folder path for '%ls'., xrefs: 00565D66
SOFTWARE\Microsoft\Windows\CurrentVersion, xrefs: 00565D37

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: QueryValue$Close
String ID: +$CommonFilesDir$Failed to ensure path was backslash terminated.$Failed to open Windows folder key.$Failed to read folder path for '%ls'.$ProgramFilesDir$SOFTWARE\Microsoft\Windows\CurrentVersion
API String ID: 1979452859-3209209246
Opcode ID: f756fc02e66ba6f3a212409ba31c39c5f4e7e622735480d1e79a0adc037377fc
Instruction ID: 9c503b2ee1598a148572ca9e287bcd2427aed1493c1e72a9ea016c50ae06aebe
Opcode Fuzzy Hash: f756fc02e66ba6f3a212409ba31c39c5f4e7e622735480d1e79a0adc037377fc
Instruction Fuzzy Hash: E8018D32940529BBCB215A54EC1FE5E7F78FB52760F144115F809B7291E7719F00D2D4

Function 00599A87 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 216COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,t,Y,00592C74,?,?,?,00599CD8,00000001,00000001,BCE85006), ref: 00599AE1
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00599CD8,00000001,00000001,BCE85006,?,?,?), ref: 00599B67
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,BCE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00599C61
__freea.LIBCMT ref: 00599C6E

Part of subcall function 00595D22: HeapAlloc.KERNEL32(00000000,?,?,?,00591782,?,0000015D,?,?,?,?,00592BDB,000000FF,00000000,?,?), ref: 00595D54

__freea.LIBCMT ref: 00599C77
__freea.LIBCMT ref: 00599C9C

Strings

t,Y, xrefs: 00599A99

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocHeap
String ID: t,Y
API String ID: 3147120248-2269092704
Opcode ID: 0a1919456d911c13ff44018b80f61c0487d2cde686dd816aeaad6dd3cdd0ac85
Instruction ID: 72667838aade6a3d2b85148f90cc9cd49264032f2722f27feaff4b575429fb87
Opcode Fuzzy Hash: 0a1919456d911c13ff44018b80f61c0487d2cde686dd816aeaad6dd3cdd0ac85
Instruction Fuzzy Hash: 2151AD72600216ABEF259F68CC85EBE7FAAFB85750F19462CFD05D6180EB34DC40D6A0

Function 00589FA3 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 173COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,00000000,?,00000000,?,?,?,00000000,00000000,?), ref: 0058A070
GetLastError.KERNEL32(?,?,?,00000000,00000000,?), ref: 0058A07A

Strings

Failed to clear readonly bit on payload destination path: %ls, xrefs: 0058A0A9
Failed attempt to download URL: '%ls' to: '%ls', xrefs: 0058A157
:, xrefs: 0058A0F3
c:\agent\_work\66\s\src\burn\engine\apply.cpp, xrefs: 0058A09E
download, xrefs: 0058A03A

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: :$Failed attempt to download URL: '%ls' to: '%ls'$Failed to clear readonly bit on payload destination path: %ls$c:\agent\_work\66\s\src\burn\engine\apply.cpp$download
API String ID: 1799206407-2514864748
Opcode ID: e49a56f9ac24086323c4e3014a42ee215b1977ae99efda1951700132e43ebb28
Instruction ID: 0869ebdaede5c310b6f499ed00c9c9139272331bc082f083f1dc50b7ff057132
Opcode Fuzzy Hash: e49a56f9ac24086323c4e3014a42ee215b1977ae99efda1951700132e43ebb28
Instruction Fuzzy Hash: DC51A371A0021AEBEB11EFA4C849AEEBBB5FF44710F14845AF905FB241E375DA40CB91

Function 005A7C88 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 157COMMON

Download Yara Rule

APIs

Part of subcall function 005639DF: GetProcessHeap.KERNEL32(?,000001C7,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F0
Part of subcall function 005639DF: RtlAllocateHeap.NTDLL(00000000,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F7

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000010,00000001,00000000,00000000,00000410,?,?,00588D9E,000002C0,00000100), ref: 005A7CB6
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,application,000000FF,?,?,00588D9E,000002C0,00000100,000002C0,000002C0,00000100,000002C0,00000410), ref: 005A7CD1

Strings

c:\agent\_work\66\s\src\libs\dutil\apuputil.cpp, xrefs: 005A7D6C
application, xrefs: 005A7CC3
type, xrefs: 005A7CF8
http://appsyndication.org/2006/appsyn, xrefs: 005A7CA9

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CompareHeapString$AllocateProcess
String ID: application$c:\agent\_work\66\s\src\libs\dutil\apuputil.cpp$http://appsyndication.org/2006/appsyn$type
API String ID: 2664528157-536847345
Opcode ID: db62e3a978ff3f3cd7c9b08a56d794d198ac30f145636128a225f5d9774d236c
Instruction ID: 00e3fd4dc0635324673e4dedce6805f8c3bf24d556552e5a44591f1ca3f1f978
Opcode Fuzzy Hash: db62e3a978ff3f3cd7c9b08a56d794d198ac30f145636128a225f5d9774d236c
Instruction Fuzzy Hash: FD519F3160860AABDB209F64CC85F2E7FA5BF49724F208558F9259B2D1D774ED40CB50

Function 005A5C9E Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 153fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 005A5CFA
DeleteFileW.KERNEL32(00000410,00000000,00000000,?,?,00000078,000000FF,00000410,?,?,?,00000078,000000FF,?,?,00000078), ref: 005A5DF1
CloseHandle.KERNEL32(000000FF,00000000,00000000,?,?,00000078,000000FF,00000410,?,?,?,00000078,000000FF,?,?,00000078), ref: 005A5E00

Strings

WiX\Burn, xrefs: 005A5D38
c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp, xrefs: 005A5D1E
DownloadTimeout, xrefs: 005A5D33
Burn, xrefs: 005A5CE9

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseDeleteErrorFileHandleLast
String ID: Burn$DownloadTimeout$WiX\Burn$c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp
API String ID: 3522763407-1474791565
Opcode ID: ec754fd3abcafe425407d74a75ef82413f455e12f7b0e2ebdefbf5464f9f93f5
Instruction ID: c1de0dfd8a4214578f566ffd1323bcbe82da04bd0c62dc04f030848ffa608806
Opcode Fuzzy Hash: ec754fd3abcafe425407d74a75ef82413f455e12f7b0e2ebdefbf5464f9f93f5
Instruction Fuzzy Hash: 28512676D0061ABFDB129FA48C49EEEBFB9FB49710F004165FA14E6190E7358A14DBA0

Function 00579158 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 138COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 005791E6

Part of subcall function 005A4ED0: GetLastError.KERNEL32(?,?,0057920B,?,00000003,005654C6,?), ref: 005A4EEF

_memcmp.LIBVCRUNTIME ref: 00579220
GetLastError.KERNEL32 ref: 00579298

Strings

Failed to read certificate thumbprint., xrefs: 0057928C
Failed to get certificate public key identifier., xrefs: 005792C6
Failed to find expected public key in certificate chain., xrefs: 0057925B
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 005792BC

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast_memcmp
String ID: Failed to find expected public key in certificate chain.$Failed to get certificate public key identifier.$Failed to read certificate thumbprint.$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 3428363238-3038490147
Opcode ID: 186e4e305a69418b4df57d8c5bcea3afdb9c1c32c401660a1784a4703c8e212e
Instruction ID: b924e820d993e8b6bc6bb9a71c5328742035db4791c0f3b5394eb83691e9c99f
Opcode Fuzzy Hash: 186e4e305a69418b4df57d8c5bcea3afdb9c1c32c401660a1784a4703c8e212e
Instruction Fuzzy Hash: CA415176A00216ABDB10EFA5D845EDEBBB8BF48710F108125F908F7242DA34ED04DBB0

Function 00570539 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 132registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,?,00000001,00000000,?), ref: 0057066A
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,?,00000001,00000000,?), ref: 00570679

Part of subcall function 005A04A5: RegCreateKeyExW.ADVAPI32(00000001,00000000,00000000,00000000,00000000,00000001,00000000,?,00000000,00000001,?,?,005705B1,?,00000000,00020006), ref: 005A04CA

Strings

Failed to delete registration key: %ls, xrefs: 00570618
%ls.RebootRequired, xrefs: 00570587
Failed to update resume mode., xrefs: 0057064E
Failed to open registration key., xrefs: 005706AF
Failed to write volatile reboot required registry key., xrefs: 005705B5

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Close$Create
String ID: %ls.RebootRequired$Failed to delete registration key: %ls$Failed to open registration key.$Failed to update resume mode.$Failed to write volatile reboot required registry key.
API String ID: 359002179-2517785395
Opcode ID: 4711aee8e193862113b7a786daa5245f0a33d740fb32751308af551f26ea310e
Instruction ID: c72fce00237af705ec7e3afedfb878899c76f27b935dbe44f07989c20cdb4588
Opcode Fuzzy Hash: 4711aee8e193862113b7a786daa5245f0a33d740fb32751308af551f26ea310e
Instruction Fuzzy Hash: AD416131900215FFDF22AE60EC1AEAF7FB5BFC0714F109419F54962191E7719A50EB51

Function 0056F7B4 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 116registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 0056F8E4
RegCloseKey.ADVAPI32(00000000,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 0056F8F1

Strings

%ls.RebootRequired, xrefs: 0056F7D1
Resume, xrefs: 0056F858
Failed to open registration key., xrefs: 0056F84D
Failed to read Resume value., xrefs: 0056F87A
Failed to format pending restart registry key to read., xrefs: 0056F7E8

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Close
String ID: %ls.RebootRequired$Failed to format pending restart registry key to read.$Failed to open registration key.$Failed to read Resume value.$Resume
API String ID: 3535843008-3890505273
Opcode ID: deaaf652b515cb9aa9cfcfd8788ab9a587184954d36e233269c0b0e128375654
Instruction ID: 275edf00ab3abe62412bc5c8a6899439e036c863b5a01e42007214941f47af0a
Opcode Fuzzy Hash: deaaf652b515cb9aa9cfcfd8788ab9a587184954d36e233269c0b0e128375654
Instruction Fuzzy Hash: 1F417032D00219FFDB119F98E981AADBFB4FF55310F1581B6E815AB251D371AE40DB90

Function 0059FDEF Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 116fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(005CB5D4,00000000,?,?,?,00574192,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00565537,?), ref: 0059FDFF
CreateFileW.KERNEL32(40000000,00000001,00000000,00000000,00000080,00000000,?,00000000,?,?,?,005CB5CC,?,00574192,00000000,Setup), ref: 0059FEA3
GetLastError.KERNEL32(?,00574192,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00565537,?,?,?), ref: 0059FEB3
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00574192,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00565537,?), ref: 0059FEED

Part of subcall function 00562EBC: GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 00563006

LeaveCriticalSection.KERNEL32(005CB5D4,?,?,005CB5CC,?,00574192,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00565537,?), ref: 0059FF46

Strings

c:\agent\_work\66\s\src\libs\dutil\logutil.cpp, xrefs: 0059FED2
7UV, xrefs: 0059FE1C

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CriticalFileSection$CreateEnterErrorLastLeaveLocalPointerTime
String ID: 7UV$c:\agent\_work\66\s\src\libs\dutil\logutil.cpp
API String ID: 4111229724-2547149025
Opcode ID: f8ddb4aa1912eca18ca0f735389a9c6cce568c07a2142a0cf8d497ed53f2f86a
Instruction ID: bafbc5fdbfbecbd2710169aee3919fc2307012fca1fcdf9644b00ab31f67bc77
Opcode Fuzzy Hash: f8ddb4aa1912eca18ca0f735389a9c6cce568c07a2142a0cf8d497ed53f2f86a
Instruction Fuzzy Hash: 2C319E7190162AAFEF229FA4DD4AE6A3E69FB14754F004235F900E7161EB75CD40EBA0

Function 00583727 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 111COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 0058378E

Strings

Failed to escape string., xrefs: 00583810
Failed to append property string part., xrefs: 00583802
%s%="%s", xrefs: 005837C1
Failed to format property string part., xrefs: 00583809
Failed to format property value., xrefs: 00583817
feclient.dll, xrefs: 00583769, 0058378A

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Open@16
String ID: %s%="%s"$Failed to append property string part.$Failed to escape string.$Failed to format property string part.$Failed to format property value.$feclient.dll
API String ID: 3613110473-656185529
Opcode ID: 62b6401345bc327c7258101dc2b88fda1306713fc8b56da8cdc24c6ea7f606c0
Instruction ID: 43fad0706b1da1d2dacb2c6a1ad1e3f57430d1767efd0dcd5f01306aa493827f
Opcode Fuzzy Hash: 62b6401345bc327c7258101dc2b88fda1306713fc8b56da8cdc24c6ea7f606c0
Instruction Fuzzy Hash: 773159B290521AABDB15BE94CC42AAEBF68FF00B14F104569FD11B7251E7B0EF10DB94

Function 0057A8DD Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 110COMMON

Download Yara Rule

Strings

Failed to determine length of source path., xrefs: 0057A90D
Failed to trim source folder., xrefs: 0057A972
Failed to determine length of relative path., xrefs: 0057A92A
Failed to set last source., xrefs: 0057A9CD
WixBundleLastUsedSource, xrefs: 0057A97C, 0057A982, 0057A9BE

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID:
String ID: Failed to determine length of relative path.$Failed to determine length of source path.$Failed to set last source.$Failed to trim source folder.$WixBundleLastUsedSource
API String ID: 0-660234312
Opcode ID: 33616e3136cd9b33b79749c127d2c21206f410a59122fafb69529557be3c31d6
Instruction ID: 40e62b4d242ac1789f30562b2240752c2cb7d7c6b30515b5bab7028424aba4c8
Opcode Fuzzy Hash: 33616e3136cd9b33b79749c127d2c21206f410a59122fafb69529557be3c31d6
Instruction Fuzzy Hash: C831B632D00669BBCF129AA4DC45FAEBF79FB80720F218662F614B71D0D7319D50E691

Function 0058D572 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 105comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(005C01A0,00000000,00000017,005C01B0,?,?,00000000,00000000,?,?,?,?,?,0058DB99,00000000,00000000), ref: 0058D5AA

Strings

Failed to create IBackgroundCopyManager., xrefs: 0058D5B6
Failed to create BITS job., xrefs: 0058D5E4
WixBurn, xrefs: 0058D5D5
Failed to set notification flags for BITS job., xrefs: 0058D5FC
Failed to set BITS job to foreground., xrefs: 0058D62B
Failed to set progress timeout., xrefs: 0058D614

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CreateInstance
String ID: Failed to create BITS job.$Failed to create IBackgroundCopyManager.$Failed to set BITS job to foreground.$Failed to set notification flags for BITS job.$Failed to set progress timeout.$WixBurn
API String ID: 542301482-468763447
Opcode ID: d1ec94a0641443e73d02b28a2cfff0ab7535b61244e7c60e764eb18874792dfd
Instruction ID: 65f2f6a27cc2a42bbefecd07d95cad1e0a740296615e7e4336353a5adca0e3fa
Opcode Fuzzy Hash: d1ec94a0641443e73d02b28a2cfff0ab7535b61244e7c60e764eb18874792dfd
Instruction Fuzzy Hash: 73319031A4061AAF9B15EBA9C855E6EBFF4BF49714B104059ED05FB3D0DA70EC05CBA0

Function 005A559F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 99fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,?,?,?,?,?,WiX\Burn,DownloadTimeout,00000078), ref: 005A55E9
GetLastError.KERNEL32 ref: 005A55F6
ReadFile.KERNEL32(00000000,00000008,00000008,?,00000000), ref: 005A563D
GetLastError.KERNEL32 ref: 005A5671
CloseHandle.KERNEL32(00000000,c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp,000000C8,00000000), ref: 005A56A5

Strings

%ls.R, xrefs: 005A55BD
c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp, xrefs: 005A561A, 005A5695

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleRead
String ID: %ls.R$c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp
API String ID: 3160720760-260802336
Opcode ID: 7e7342c466ef375782f2a5b404759700a807fde906c8480408028d8feb788949
Instruction ID: dd3c39d8f1437838b84df9e4c2bd6803941a2ec176b72c6ac92027010c1463eb
Opcode Fuzzy Hash: 7e7342c466ef375782f2a5b404759700a807fde906c8480408028d8feb788949
Instruction Fuzzy Hash: 5331F476941621AFEB318B54CD49FAE7FA4BF42720F514215FE01EB2D0E7749D00DAA1

Function 0056C8A5 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 97fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0056CD19: CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,0056E3ED,000000FF,00000000,00000000,0056E3ED,?,?,0056DB97,?,?,?,?), ref: 0056CD44

CreateFileW.KERNEL32(E9005AAA,80000000,00000005,00000000,00000003,08000000,00000000,00565402,?,00000000,840F01E8,E0680A79,00000001,005653FA,00000000,005654C6), ref: 0056C915
GetLastError.KERNEL32(?,?,?,005776FC,005656AA,005654B6,005654B6,00000000,?,005654C6,FFF9E89D,005654C6,005654FA,00565482,?,00565482), ref: 0056C95A

Strings

Failed to find payload for catalog file., xrefs: 0056C99F
Failed to get catalog local file path, xrefs: 0056C998
Failed to verify catalog signature: %ls, xrefs: 0056C953
c:\agent\_work\66\s\src\burn\engine\catalog.cpp, xrefs: 0056C97B
Failed to open catalog in working path: %ls, xrefs: 0056C988

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CompareCreateErrorFileLastString
String ID: Failed to find payload for catalog file.$Failed to get catalog local file path$Failed to open catalog in working path: %ls$Failed to verify catalog signature: %ls$c:\agent\_work\66\s\src\burn\engine\catalog.cpp
API String ID: 1774366664-749786727
Opcode ID: ee94dbe52541fe7ca87f13d0c0cbdab4cb508a1eebe7491accfd9669db7a1b1a
Instruction ID: 66257cda207ba39beed386c6ddb1c73457f3759870c7f9db2c86e0c934b7a860
Opcode Fuzzy Hash: ee94dbe52541fe7ca87f13d0c0cbdab4cb508a1eebe7491accfd9669db7a1b1a
Instruction Fuzzy Hash: 0231F432900626BFD7119BA4CC06F6EBFA4BF05750F208526F949BB280E771F9409BA4

Function 005A0201 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 91processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,00000000), ref: 005A0271
GetLastError.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 005A027B
CloseHandle.KERNEL32(?,?,?,?,?,00000000,00000000,00000000), ref: 005A02C4
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000,00000000), ref: 005A02D1

Strings

"%ls" %ls, xrefs: 005A023A
c:\agent\_work\66\s\src\libs\dutil\procutil.cpp, xrefs: 005A029F
D, xrefs: 005A0259

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseHandle$CreateErrorLastProcess
String ID: "%ls" %ls$D$c:\agent\_work\66\s\src\libs\dutil\procutil.cpp
API String ID: 161867955-1799623275
Opcode ID: 600be7640308ddafda458a8fb245e9a551f6b5c4e90930068cc2770edd00b995
Instruction ID: c486f8db6053583f422b80f7d939de7d1c55a24ed46c91164a4268f5fdaeb99f
Opcode Fuzzy Hash: 600be7640308ddafda458a8fb245e9a551f6b5c4e90930068cc2770edd00b995
Instruction Fuzzy Hash: 46216B76D0021AABDB11EFE4DD49AAEBFB8FF05350F104026EA01B7250E3709E04DAA1

Function 0058D016 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 86synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,74DF30B0,00000000,?,?,?,0058D312,?), ref: 0058D035
ReleaseMutex.KERNEL32(?,?,?,0058D312,?), ref: 0058D049
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0058D08E
ReleaseMutex.KERNEL32(?), ref: 0058D0A1
SetEvent.KERNEL32(?), ref: 0058D0AA

Strings

Failed to send files in use message from netfx chainer., xrefs: 0058D0EE
Failed to get message from netfx chainer., xrefs: 0058D0CB

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: MutexObjectReleaseSingleWait$Event
String ID: Failed to get message from netfx chainer.$Failed to send files in use message from netfx chainer.
API String ID: 2608678126-3424578679
Opcode ID: 21c8a5c52ea1d108c25cfc7f70935a1131ecfc44d2d7be5f2e263e60152327cd
Instruction ID: 5e66ab1df55a83bf20202f6cf08f1c70dedcddc9996bcaeefec13b6ee37edb4c
Opcode Fuzzy Hash: 21c8a5c52ea1d108c25cfc7f70935a1131ecfc44d2d7be5f2e263e60152327cd
Instruction Fuzzy Hash: FF31933250061ABFCB029F64CC49EEDBFB8BF55320F148265F910A2291DB74AA55DBA0

Function 00569B5C Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00569B75
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,00000000,?,0056A880,00000100,000002C0,000002C0,00000100), ref: 00569B95
GetLastError.KERNEL32(?,0056A880,00000100,000002C0,000002C0,00000100), ref: 00569BA0

Strings

Failed to set directory search path variable., xrefs: 00569BD1
Failed to format variable string., xrefs: 00569B80
Failed while searching directory search: %ls, for path: %ls, xrefs: 00569BF6
Directory search: %ls, did not find path: %ls, reason: 0x%x, xrefs: 00569C0C

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Directory search: %ls, did not find path: %ls, reason: 0x%x$Failed to format variable string.$Failed to set directory search path variable.$Failed while searching directory search: %ls, for path: %ls
API String ID: 1811509786-2966038646
Opcode ID: 58d5a46b15c762230601c85196fd6d1d8f7f846b2d9f2cb429b83e93af34c436
Instruction ID: 322ad8a2d2e2b6b7837c8e057677e7841f51f878408925f17b260ff8abe6d4af
Opcode Fuzzy Hash: 58d5a46b15c762230601c85196fd6d1d8f7f846b2d9f2cb429b83e93af34c436
Instruction Fuzzy Hash: D5110833844126B7DF122A94AD06F9D7F69BF41720F204211F805B71A1D7399D50EBD1

Function 00569D11 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00569D2A
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,?,0056A858,00000100,000002C0,000002C0,?,000002C0,00000100), ref: 00569D4A
GetLastError.KERNEL32(?,0056A858,00000100,000002C0,000002C0,?,000002C0,00000100,000002C0,000002C0,00000100), ref: 00569D55

Strings

Failed to format variable string., xrefs: 00569D35
File search: %ls, did not find path: %ls, xrefs: 00569DB9
Failed to set variable to file search path., xrefs: 00569DAD
Failed while searching file search: %ls, for path: %ls, xrefs: 00569D83

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed to format variable string.$Failed to set variable to file search path.$Failed while searching file search: %ls, for path: %ls$File search: %ls, did not find path: %ls
API String ID: 1811509786-3425311760
Opcode ID: c04eb0e2c0308197eb619b1f074ebb7676ac07bf300677130265c8dd528173fb
Instruction ID: 631ef4bcf35f5f6d2e0336b1c6588b9f93bac9156c5767cb786f8a09118afb35
Opcode Fuzzy Hash: c04eb0e2c0308197eb619b1f074ebb7676ac07bf300677130265c8dd528173fb
Instruction Fuzzy Hash: 1311AC37940126BACF226AA8CD06BADBE39BF12720F204221F945B71A197759E50A7D1

Function 00569A0E Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 56COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 00569A85

Strings

`<u, xrefs: 00569A85
Failed to copy condition string from BSTR, xrefs: 00569A6F
Condition, xrefs: 00569A20
Failed to select condition node., xrefs: 00569A3C
BTV, xrefs: 00569A0E
Failed to get Condition inner text., xrefs: 00569A55

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: FreeString
String ID: BTV$Condition$Failed to copy condition string from BSTR$Failed to get Condition inner text.$Failed to select condition node.$`<u
API String ID: 3341692771-1976856963
Opcode ID: fc7659c4f177eac7ea4c3cbdf037cd14a655883236dd8dd762e2828b9bb63c9b
Instruction ID: 462fd08326ed0919401fae9e54d6c33292a292bcf8d2ad479caf2e7e752b1229
Opcode Fuzzy Hash: fc7659c4f177eac7ea4c3cbdf037cd14a655883236dd8dd762e2828b9bb63c9b
Instruction Fuzzy Hash: 4E115E35940225BBDF16ABA4CD06BAEBFA9BF01710F200165F801BB251D7719E00E790

Function 0057CDC8 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 54synchronizationthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000493E0,00000000,?,?,0057D1EC,00000000,?,?,0057C672,?,?,?,?,?,005654A3), ref: 0057CDDA
GetLastError.KERNEL32(?,?,0057D1EC,00000000,?,?,0057C672,?,?,?,?,?,005654A3,?,?,?), ref: 0057CDE4
GetExitCodeThread.KERNEL32(?,?,?,?,0057D1EC,00000000,?,?,0057C672,?,?,?,?,?,005654A3,?), ref: 0057CE20
GetLastError.KERNEL32(?,?,0057D1EC,00000000,?,?,0057C672,?,?,?,?,?,005654A3,?,?,?), ref: 0057CE2A

Strings

Failed to get cache thread exit code., xrefs: 0057CE58
c:\agent\_work\66\s\src\burn\engine\elevation.cpp, xrefs: 0057CE08, 0057CE4E
Failed to wait for cache thread to terminate., xrefs: 0057CE12

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectSingleThreadWait
String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$c:\agent\_work\66\s\src\burn\engine\elevation.cpp
API String ID: 3686190907-1009398494
Opcode ID: 989583a84fe9d05dfe0d0ac2b5be70657ebe2273a3dbd08e681c0cd71f012108
Instruction ID: 76c258db94581eae7bf9eb5845adf5f7939c0b7df703317b389b3a9d053b79e6
Opcode Fuzzy Hash: 989583a84fe9d05dfe0d0ac2b5be70657ebe2273a3dbd08e681c0cd71f012108
Instruction Fuzzy Hash: 40012D779416327797225B54AC0AB8F7E9CBF01B90B018129FE05FB180E768EE00E2E5

Function 005768AE Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 53synchronizationthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000001,000000FF,00000000,?,00576DE9,?,?,00000000,crypt32.dll,00000000,00000001), ref: 005768BB
GetLastError.KERNEL32(?,00576DE9,?,?,00000000,crypt32.dll,00000000,00000001), ref: 005768C5
GetExitCodeThread.KERNEL32(00000001,00000000,?,00576DE9,?,?,00000000,crypt32.dll,00000000,00000001), ref: 00576904
GetLastError.KERNEL32(?,00576DE9,?,?,00000000,crypt32.dll,00000000,00000001), ref: 0057690E

Strings

c:\agent\_work\66\s\src\burn\engine\core.cpp, xrefs: 005768EC, 00576935
Failed to get cache thread exit code., xrefs: 0057693F
Failed to wait for cache thread to terminate., xrefs: 005768F6

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectSingleThreadWait
String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$c:\agent\_work\66\s\src\burn\engine\core.cpp
API String ID: 3686190907-4004332966
Opcode ID: 34a0a0859797ffd20fdbfc879cf17fbbc66c3530f463dad85ab57ab5fcb138bb
Instruction ID: 804dd0fbda83a87406f40cd66b19f736f27ecaa0a4128113efc25978a65f4731
Opcode Fuzzy Hash: 34a0a0859797ffd20fdbfc879cf17fbbc66c3530f463dad85ab57ab5fcb138bb
Instruction Fuzzy Hash: 2E116570640617BBE7009F64ED06BAE7EE8BF10750F108065B908E6190EB3ADA44F725

Function 0057AA79 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 131COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(005654C6,000000FF,00565482,005776FC,005653FA,00000000,?), ref: 0057AB6A
GetLastError.KERNEL32(00000000,00000000,00000000,00000000,005654C6,000000FF,00565482,005776FC,005653FA,00000000,?), ref: 0057ABAE

Part of subcall function 00579158: _memcmp.LIBVCRUNTIME ref: 005791E6
Part of subcall function 00579158: _memcmp.LIBVCRUNTIME ref: 00579220

Strings

Failed to get signer chain from authenticode certificate., xrefs: 0057ABDC
Failed to get provider state from authenticode certificate., xrefs: 0057AB98
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 0057AB40, 0057AB8E, 0057ABD2
Failed to verify expected payload against actual certificate chain., xrefs: 0057ABF2
0, xrefs: 0057AAE6
Failed authenticode verification of payload: %ls, xrefs: 0057AB4B

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast_memcmp
String ID: 0$Failed authenticode verification of payload: %ls$Failed to get provider state from authenticode certificate.$Failed to get signer chain from authenticode certificate.$Failed to verify expected payload against actual certificate chain.$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 3428363238-3510382728
Opcode ID: 5baae770693edee1e3a5dc8cd036cbcca2fa8f309029b523a5aa21b3c9425367
Instruction ID: 13eb95e977aabd87e8686b27a40c31f49d0a2a7e07ac0a1afa9e2bcccaf07e03
Opcode Fuzzy Hash: 5baae770693edee1e3a5dc8cd036cbcca2fa8f309029b523a5aa21b3c9425367
Instruction Fuzzy Hash: FA41C8B2C0122AABDB15DF94DC4AADEBFB8BF44710F114129F809B7240E7749D049BE5

Function 0057F618 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 117COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0057F62D
LeaveCriticalSection.KERNEL32(?), ref: 0057F73A

Strings

UX requested unknown container with id: %ls, xrefs: 0057F6F9
UX requested unknown payload with id: %ls, xrefs: 0057F699
Engine is active, cannot change engine state., xrefs: 0057F647
Failed to set source path for container., xrefs: 0057F71F
Failed to set source path for payload., xrefs: 0057F6C9
UX denied while trying to set source on embedded payload: %ls, xrefs: 0057F6AF

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Engine is active, cannot change engine state.$Failed to set source path for container.$Failed to set source path for payload.$UX denied while trying to set source on embedded payload: %ls$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
API String ID: 3168844106-4121889706
Opcode ID: 12db0b46a9ebfe2ef9658d23f40b392a7b8eb87756ae23775c204eed1a99276a
Instruction ID: 8de6eaf9ae6cba1231090706716362210e3a05d01ce5a1a5ba27ef5e471a9ddb
Opcode Fuzzy Hash: 12db0b46a9ebfe2ef9658d23f40b392a7b8eb87756ae23775c204eed1a99276a
Instruction Fuzzy Hash: 3F31F636A40611BB8B25DF64EC46D9A7FBCFF55760B158026F808E7350D774ED00A7A1

Function 0056720A Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 98stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000), ref: 0056721D

Strings

Failed to allocate buffer for escaped string., xrefs: 00567234
Failed to append characters., xrefs: 005672A9
Failed to format escape sequence., xrefs: 005672B7
Failed to append escape sequence., xrefs: 005672B0
[\%c], xrefs: 0056727C
[]{}, xrefs: 00567247
Failed to copy string., xrefs: 005672D1

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: lstrlen
String ID: Failed to allocate buffer for escaped string.$Failed to append characters.$Failed to append escape sequence.$Failed to copy string.$Failed to format escape sequence.$[\%c]$[]{}
API String ID: 1659193697-3250950999
Opcode ID: 9ef277310d94bb83e18038eb260c5855c97b1f088417533b9d35fee3a043b20b
Instruction ID: 23d92ee65ab23ae1ae62bc575072e780023ba00242e29b513b4a6d6c10564c36
Opcode Fuzzy Hash: 9ef277310d94bb83e18038eb260c5855c97b1f088417533b9d35fee3a043b20b
Instruction Fuzzy Hash: B0210A36D0861EFBDB215694DC5AFAE7FA8FB45B58F200156F900B7140EB74AE00D3A4

Function 00585954 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 206COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,005AA500,000000FF,feclient.dll,000000FF,00000000,00000000,?,?,?,00586548,?,00000001,?,00000000), ref: 005859BD

Strings

Failed to copy target product code., xrefs: 00585AEE
Failed to insert execute action., xrefs: 00585A12
feclient.dll, xrefs: 005859B3, 00585ADB
Failed to plan action for target product., xrefs: 00585A68
Failed grow array of ordered patches., xrefs: 00585A56

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CompareString
String ID: Failed grow array of ordered patches.$Failed to copy target product code.$Failed to insert execute action.$Failed to plan action for target product.$feclient.dll
API String ID: 1825529933-3477540455
Opcode ID: 8e47e64759a8dfa450786af6facfb94aecd146f9f0c966ec9dc4e302968cc556
Instruction ID: c5407a88656afab25e9f465792f7d5d9468635bcae573e74e59f4948962d2463
Opcode Fuzzy Hash: 8e47e64759a8dfa450786af6facfb94aecd146f9f0c966ec9dc4e302968cc556
Instruction Fuzzy Hash: DC8115B560074ADFCB19DF58C8C0AAA7BA5BF08325F158669EC15AB352E730ED11CF50

Function 0059C3AD Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,0059CB22,00000000,00000000,00000000,00000000,00000000,00592718), ref: 0059C3EF
__fassign.LIBCMT ref: 0059C46A
__fassign.LIBCMT ref: 0059C485
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 0059C4AB
WriteFile.KERNEL32(?,00000000,00000000,0059CB22,00000000,?,?,?,?,?,?,?,?,?,0059CB22,00000000), ref: 0059C4CA
WriteFile.KERNEL32(?,00000000,00000001,0059CB22,00000000,?,?,?,?,?,?,?,?,?,0059CB22,00000000), ref: 0059C503

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: efd9df60858889f642004fed10d286720d1abf5f204c7b5c984976b4c228c1a3
Instruction ID: 5c0a7487e4c87d3e8703c223f403b1c5b8c1ed167d68df2a63fff9ab8d64c401
Opcode Fuzzy Hash: efd9df60858889f642004fed10d286720d1abf5f204c7b5c984976b4c228c1a3
Instruction Fuzzy Hash: AF51B1B1A00209AFDF10CFA8D895AEEBFF8FF19300F15415AE955E7291E730A945CB61

Function 00588FA9 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 149COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000001,?,000000FF,?,000000FF,00000000,00000100,00000000,?,?,?,0057700A,000000B8,0000001C,00000100), ref: 00588FD4
CompareStringW.KERNEL32(00000000,00000001,?,000000FF,005AA4B8,000000FF,?,?,?,0057700A,000000B8,0000001C,00000100,00000100,00000100,000000B0), ref: 0058905E

Strings

BA aborted detect forward compatible bundle., xrefs: 005890C8
comres.dll, xrefs: 005890E0
Failed to initialize update bundle., xrefs: 00589101
c:\agent\_work\66\s\src\burn\engine\detect.cpp, xrefs: 005890BE

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CompareString
String ID: BA aborted detect forward compatible bundle.$Failed to initialize update bundle.$c:\agent\_work\66\s\src\burn\engine\detect.cpp$comres.dll
API String ID: 1825529933-4215571375
Opcode ID: 624ca89910f7bec1df84c4dbe00092ff675c477477b16dd5225bca0ecdf28006
Instruction ID: c178de2c9fc7220c9ba747b311862b3bbb8bb809657b7653fbf8da600bbad6e6
Opcode Fuzzy Hash: 624ca89910f7bec1df84c4dbe00092ff675c477477b16dd5225bca0ecdf28006
Instruction Fuzzy Hash: 72515E71600212FBDF15AF64CC89EBABF66BF45310F184254F914AA295C772E960EBA0

Function 0057D2BA Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 119COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,?,00000001,005AA500,?,00000001,000000FF,?,?,75C0B390,00000000,00000001,00000000,?,005773D9), ref: 0057D3E3

Strings

Failed to elevate., xrefs: 0057D3C5
UX aborted elevation requirement., xrefs: 0057D2F8
Failed to connect to elevated child process., xrefs: 0057D3CC
c:\agent\_work\66\s\src\burn\engine\elevation.cpp, xrefs: 0057D2EE
Failed to create pipe and cache pipe., xrefs: 0057D340
Failed to create pipe name and client token., xrefs: 0057D324

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseHandle
String ID: Failed to connect to elevated child process.$Failed to create pipe and cache pipe.$Failed to create pipe name and client token.$Failed to elevate.$UX aborted elevation requirement.$c:\agent\_work\66\s\src\burn\engine\elevation.cpp
API String ID: 2962429428-2367031576
Opcode ID: f7e7d917c7c0b11b122aec76c000e08b3e81bfbf42d80202dba57b76eb1b9497
Instruction ID: 2e5f652ca92eee7d2477fba030b401a38be2e3713173bf5bba4bc776704f8a8c
Opcode Fuzzy Hash: f7e7d917c7c0b11b122aec76c000e08b3e81bfbf42d80202dba57b76eb1b9497
Instruction Fuzzy Hash: 9A3162726407227BE7115660FC4AFAA6F7CFF40720F108605F91DA71C1EBA0AD00A6F2

Function 005A8C74 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 118registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005A0823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,005CAA7C,00000000,?,005A4FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 005A0837

RegCloseKey.ADVAPI32(00000001,00000001,crypt32.dll,00000000,00000001,005AA500,00000000,00000001,00000000,00020019,00000001,00000000,00000000,00020019,00000000,00000001), ref: 005A8D4C
RegCloseKey.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,crypt32.dll,00000000,00000001,005AA500,00000000,00000001,00000000,00020019), ref: 005A8D87
RegCloseKey.ADVAPI32(00000001,00000001,00020019,00000000,00000000,00000000,00000000,00000000,crypt32.dll), ref: 005A8DA3
RegCloseKey.ADVAPI32(00000000,00000001,00020019,00000000,00000000,00000000,00000000,00000000,crypt32.dll), ref: 005A8DB0
RegCloseKey.ADVAPI32(00000000,00000001,00020019,00000000,00000000,00000000,00000000,00000000,crypt32.dll), ref: 005A8DBD

Part of subcall function 005A0886: RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,005A8D39,00000001), ref: 005A089E

Strings

crypt32.dll, xrefs: 005A8D30

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Close$InfoOpenQuery
String ID: crypt32.dll
API String ID: 796878624-1661610138
Opcode ID: 3c4552e7132ae72801ef8b118ee2414dd4e4dd81c6280fe56f29b11fa7d861be
Instruction ID: 2b5e2e3002443272666ab43bf3e71cebf67a1cac9015ad9f2fc38c90205c7416
Opcode Fuzzy Hash: 3c4552e7132ae72801ef8b118ee2414dd4e4dd81c6280fe56f29b11fa7d861be
Instruction Fuzzy Hash: 6D415672C0022EFFCF12AF948C818AEFEB8FF15754F1645AAEA1177161D7314E50AA90

Function 0057D0E4 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 109threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,0057AC12,00000001,00000000,00000000), ref: 0057D170
GetLastError.KERNEL32(?,?,?,005654A3,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0057D17C

Part of subcall function 0057CDC8: WaitForSingleObject.KERNEL32(?,000493E0,00000000,?,?,0057D1EC,00000000,?,?,0057C672,?,?,?,?,?,005654A3), ref: 0057CDDA
Part of subcall function 0057CDC8: GetLastError.KERNEL32(?,?,0057D1EC,00000000,?,?,0057C672,?,?,?,?,?,005654A3,?,?,?), ref: 0057CDE4

CloseHandle.KERNEL32(00000000,00000000,?,?,0057C672,?,?,?,?,?,005654A3,?,?,?,?), ref: 0057D1FD

Strings

Failed to create elevated cache thread., xrefs: 0057D1AA
Failed to pump messages in child process., xrefs: 0057D1D4
c:\agent\_work\66\s\src\burn\engine\elevation.cpp, xrefs: 0057D1A0

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast$CloseCreateHandleObjectSingleThreadWait
String ID: Failed to create elevated cache thread.$Failed to pump messages in child process.$c:\agent\_work\66\s\src\burn\engine\elevation.cpp
API String ID: 3606931770-2334070456
Opcode ID: c7cd61a861cbed70cdaf0a41d6e2e69055e2b964ea081ed8f1c168e8598fae80
Instruction ID: a5af630147824a0f65f6b958eb0605ff5d98665e57414982722a87109692522b
Opcode Fuzzy Hash: c7cd61a861cbed70cdaf0a41d6e2e69055e2b964ea081ed8f1c168e8598fae80
Instruction Fuzzy Hash: 8641D4B6D01219AF8B45DFA8D9859DEBFF5BF48710B10812AF808E7300E774A941DFA0

Function 005A71DB Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 005639DF: GetProcessHeap.KERNEL32(?,000001C7,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F0
Part of subcall function 005639DF: RtlAllocateHeap.NTDLL(00000000,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F7

SysFreeString.OLEAUT32(00000000), ref: 005A72BE
SysFreeString.OLEAUT32(?), ref: 005A72C9
SysFreeString.OLEAUT32(00000000), ref: 005A72D4

Strings

`<u, xrefs: 005A72B3
sZ, xrefs: 005A7284, 005A72D1, 005A7296, 005A7272
c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp, xrefs: 005A7208

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: FreeString$Heap$AllocateProcess
String ID: `<u$c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp$sZ
API String ID: 2724874077-3564594314
Opcode ID: a53376fd83535a5c750d3f690d211a4526fd01caa8f01a8626c6a6571518efff
Instruction ID: e870c7bdbb372dbb7976c470f54f0273d55e8c4efc06f6e84cf3253ec2c36c6a
Opcode Fuzzy Hash: a53376fd83535a5c750d3f690d211a4526fd01caa8f01a8626c6a6571518efff
Instruction Fuzzy Hash: 6D31A23AD0462EBBDB229B95CC45F9EBFB8BF46710F114155F900BB150D770AE059BA0

Function 00567337 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,?,?,00565966,00000100,00000100,00000000,?,00000001,00000000,00000100), ref: 00567349
LeaveCriticalSection.KERNEL32(00000000,00000000,00000100,00000000,?,?,?,00565966,00000100,00000100,00000000,?,00000001,00000000,00000100), ref: 00567428

Strings

Failed to get value as string for variable: %ls, xrefs: 00567417
*****, xrefs: 005673E4, 005673F1
Failed to get unformatted string., xrefs: 005673B9
Failed to get variable: %ls, xrefs: 0056738A
Failed to format value '%ls' of variable: %ls, xrefs: 005673F2

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: *****$Failed to format value '%ls' of variable: %ls$Failed to get unformatted string.$Failed to get value as string for variable: %ls$Failed to get variable: %ls
API String ID: 3168844106-2873099529
Opcode ID: 5a5dcbb7af181bcc11d2f3399c18ae37a638ce0a49096080b484ac4bdc549f21
Instruction ID: 3c15e310d102e909a0c46c903321824fdaf66b7752c824bd6abb359c3ca6d32b
Opcode Fuzzy Hash: 5a5dcbb7af181bcc11d2f3399c18ae37a638ce0a49096080b484ac4bdc549f21
Instruction Fuzzy Hash: 5E31BF3290461ABBDF225F50CC09B9EBF65FB18329F144165F814A7290DB75AAA0EBC0

Function 005A5100 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

QueryServiceConfigW.ADVAPI32(00000000,00000000,00000000,?,00000001,00000000,?,?,00586879,00000000,?), ref: 005A5116
GetLastError.KERNEL32(?,?,00586879,00000000,?,?,?,?,?,?,?,?,?,00586C89,?,?), ref: 005A5124

Part of subcall function 005639DF: GetProcessHeap.KERNEL32(?,000001C7,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F0
Part of subcall function 005639DF: RtlAllocateHeap.NTDLL(00000000,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F7

QueryServiceConfigW.ADVAPI32(00000000,00000000,?,?,?,00000001,?,?,00586879,00000000,?), ref: 005A515E
GetLastError.KERNEL32(?,?,00586879,00000000,?,?,?,?,?,?,?,?,?,00586C89,?,?), ref: 005A5168

Strings

yhX, xrefs: 005A51B6
c:\agent\_work\66\s\src\libs\dutil\svcutil.cpp, xrefs: 005A5147, 005A5189

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ConfigErrorHeapLastQueryService$AllocateProcess
String ID: c:\agent\_work\66\s\src\libs\dutil\svcutil.cpp$yhX
API String ID: 355237494-1532427840
Opcode ID: 9b3ebdaa49f08f991e6d02e25b23c93bb6e25c6fd2a2dfcca64ca2ef1ea598fd
Instruction ID: 9d2ab8f9ab1048361e28bd1ca9846183951c29e4a1f4221f64016c7132f37263
Opcode Fuzzy Hash: 9b3ebdaa49f08f991e6d02e25b23c93bb6e25c6fd2a2dfcca64ca2ef1ea598fd
Instruction Fuzzy Hash: EA21F336901A35B7D7215A958D09FBF7D69BF93BA0F124014FD81AB200F6A48E00E6E0

Function 00578CC3 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

InitializeAcl.ADVAPI32(?,00000008,00000002,0000001A,?,?,00000000,00000000,?,?,?), ref: 00578D0E
GetLastError.KERNEL32 ref: 00578D18
SetFileAttributesW.KERNEL32(?,00000080,?,00000001,20000004,00000000,00000000,?,00000000,00000003,000007D0,?,00000000,00000000,?,?), ref: 00578D78

Strings

Failed to allocate administrator SID., xrefs: 00578CF4
Failed to initialize ACL., xrefs: 00578D46
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 00578D3C

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AttributesErrorFileInitializeLast
String ID: Failed to allocate administrator SID.$Failed to initialize ACL.$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 669721577-4043978521
Opcode ID: 6ac15cb24830f8ca7ec9d4f22971d5f2d30b5e54039e170ed9e31741bd0679cd
Instruction ID: d6fd6fe062d764d1c41e31530f47cc5ffcfe3a5a230d46ddd65f62f99c312f5e
Opcode Fuzzy Hash: 6ac15cb24830f8ca7ec9d4f22971d5f2d30b5e54039e170ed9e31741bd0679cd
Instruction Fuzzy Hash: C621EB72A80215B7DB315AD5AC4DFEEBF69BF50B50F118025BA04FB2C0EA749E04A690

Function 00564263 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00000000,00000000,?,00000000,crypt32.dll,?,?,00573FAF,00000001,feclient.dll,?,00000000,?,?,?,00564B57), ref: 0056429E
GetLastError.KERNEL32(?,?,00573FAF,00000001,feclient.dll,?,00000000,?,?,?,00564B57,?,?,005AA488,?,00000001), ref: 005642AA
GetCurrentDirectoryW.KERNEL32(00000000,?,?,00000000,?,?,00573FAF,00000001,feclient.dll,?,00000000,?,?,?,00564B57,?), ref: 005642E5
GetLastError.KERNEL32(?,?,00573FAF,00000001,feclient.dll,?,00000000,?,?,?,00564B57,?,?,005AA488,?,00000001), ref: 005642EF

Strings

c:\agent\_work\66\s\src\libs\dutil\dirutil.cpp, xrefs: 00564313
crypt32.dll, xrefs: 00564267

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CurrentDirectoryErrorLast
String ID: c:\agent\_work\66\s\src\libs\dutil\dirutil.cpp$crypt32.dll
API String ID: 152501406-3173697099
Opcode ID: 84339eaa49c46eb0b1539496055030509d93c6b8634bc995558d9e90e1cd3f64
Instruction ID: 208b2fbd17b6cccaec68e4e95be42c9ca43554c39530d9c9743b4ebd0599b17e
Opcode Fuzzy Hash: 84339eaa49c46eb0b1539496055030509d93c6b8634bc995558d9e90e1cd3f64
Instruction Fuzzy Hash: 04118477A01637A797215AD98854A6FBE58BF52B54B110525FD00FB300E724DD409EE0

Function 00580937 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 74fileCOMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 00580987
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 005809A6
GetLastError.KERNEL32 ref: 005809B0

Strings

Unexpected call to CabWrite()., xrefs: 0058096A
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 005809D4
Failed to write during cabinet extraction., xrefs: 005809DE

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorFileLastWrite_memcpy_s
String ID: Failed to write during cabinet extraction.$Unexpected call to CabWrite().$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 1970631241-3210721340
Opcode ID: bd92dde053095aaf7efdaa26082b14d8d2af70255a9e989f3a0545a8467b2b33
Instruction ID: 280dee59260521eb89791718aa8fbe676d1f42d5f0ebb91eb5691a3e74253b2d
Opcode Fuzzy Hash: bd92dde053095aaf7efdaa26082b14d8d2af70255a9e989f3a0545a8467b2b33
Instruction Fuzzy Hash: 13210C76600205AFEB40EF6DC885D9A7FA8FF84324B110058FE04EB282E371ED00DB20

Function 00569A9F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 72COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00569AB8
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,00000000,?,0056A889,00000100,000002C0,000002C0,00000100), ref: 00569ACD
GetLastError.KERNEL32(?,0056A889,00000100,000002C0,000002C0,00000100), ref: 00569ADA

Strings

Failed to format variable string., xrefs: 00569AC3
Failed while searching directory search: %ls, for path: %ls, xrefs: 00569B1A
Failed to set variable., xrefs: 00569B3F

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed to format variable string.$Failed to set variable.$Failed while searching directory search: %ls, for path: %ls
API String ID: 1811509786-402580132
Opcode ID: 4593380def3d225af0414c095a39eea5194620d5b63b74481a91951522626b8c
Instruction ID: 60702aa00689d10cda2064905ee2dbb9edcc5da850c3073fc4bc0ca60ff73517
Opcode Fuzzy Hash: 4593380def3d225af0414c095a39eea5194620d5b63b74481a91951522626b8c
Instruction Fuzzy Hash: 9711D632A44526BBCF226AA4DC06FAEBE6DFF11720F214225F811E72A0D7759D10F6D1

Function 005A2AB1 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(005AA4E8), ref: 005A2AC4
VariantInit.OLEAUT32(?), ref: 005A2AD0
VariantClear.OLEAUT32(?), ref: 005A2B44
SysFreeString.OLEAUT32(00000000), ref: 005A2B4F

Part of subcall function 005A2CFC: SysAllocString.OLEAUT32(?), ref: 005A2D11

Strings

msasn1.dll, xrefs: 005A2AC0
`<u, xrefs: 005A2B4F

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: String$AllocVariant$ClearFreeInit
String ID: `<u$msasn1.dll
API String ID: 347726874-267575571
Opcode ID: 0c44468e6a58549965a8ddda8f2bf0c9f76d92a37a39dc8334e7bb206ce9f8d8
Instruction ID: eab504b1dcfa78b631b3a27e32b5a409518729a912d7fbb22c2e9bce7ee46bb4
Opcode Fuzzy Hash: 0c44468e6a58549965a8ddda8f2bf0c9f76d92a37a39dc8334e7bb206ce9f8d8
Instruction Fuzzy Hash: F1214C31A01219AFCB15DFA8C849EAEBBB8BF56715F100598E9019B220D730DE05DBA0

Function 005809FE Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00580A6B
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00580A7D
SetFileTime.KERNEL32(?,?,?,?), ref: 00580A90
CloseHandle.KERNEL32(000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00580660,?,?), ref: 00580A9F

Strings

Invalid operation for this state., xrefs: 00580A44
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 00580A3A

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Time$File$CloseDateHandleLocal
String ID: Invalid operation for this state.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 609741386-2444813713
Opcode ID: ed1e65cec8ef711c2d328256e68dd2eea64d75503abae406c02efb4e5bd92e91
Instruction ID: 19f859035191d8a224741aa07f2c1112335081426560c7728571a3a74b4b78f1
Opcode Fuzzy Hash: ed1e65cec8ef711c2d328256e68dd2eea64d75503abae406c02efb4e5bd92e91
Instruction Fuzzy Hash: 7921D27290062AAF8B54AFA8CC088EABFADFF45720B144216F851F65D0D374E919DB90

Function 005989AF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00598973: _free.LIBCMT ref: 0059899C

_free.LIBCMT ref: 005989FD

Part of subcall function 00595CE8: HeapFree.KERNEL32(00000000,00000000,?,005989A1,?,00000000,?,00000000,?,005989C8,?,00000007,?,?,00598E2A,?), ref: 00595CFE
Part of subcall function 00595CE8: GetLastError.KERNEL32(?,?,005989A1,?,00000000,?,00000000,?,005989C8,?,00000007,?,?,00598E2A,?,?), ref: 00595D10

_free.LIBCMT ref: 00598A08
_free.LIBCMT ref: 00598A13
_free.LIBCMT ref: 00598A67
_free.LIBCMT ref: 00598A72
_free.LIBCMT ref: 00598A7D
_free.LIBCMT ref: 00598A88

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 48635352fcdb93915df3ba2fc5eddb2e5b53a02fac6a758a8558f49e26154fd7
Instruction ID: 9afd5818b0ea227dc6b11a2598d2735d90b22bc734ba8c41c2dc782706de4e20
Opcode Fuzzy Hash: 48635352fcdb93915df3ba2fc5eddb2e5b53a02fac6a758a8558f49e26154fd7
Instruction Fuzzy Hash: 60114271580F09A6DD21BBB0DC0BFEF7FDC7F81700F84082AB29966052DA65BA149755

Function 005745CE Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 005639DF: GetProcessHeap.KERNEL32(?,000001C7,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F0
Part of subcall function 005639DF: RtlAllocateHeap.NTDLL(00000000,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F7

_memcpy_s.LIBCMT ref: 0057461F
_memcpy_s.LIBCMT ref: 00574632
_memcpy_s.LIBCMT ref: 0057464D

Strings

crypt32.dll, xrefs: 00574629, 00574648
c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 005745FE
Failed to allocate memory for message., xrefs: 00574608

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: _memcpy_s$Heap$AllocateProcess
String ID: Failed to allocate memory for message.$c:\agent\_work\66\s\src\burn\engine\pipe.cpp$crypt32.dll
API String ID: 886498622-1118502555
Opcode ID: 853f6e00528be640d3694dfd239fc2ebc061a42f8eb58f464e05766cf15ae447
Instruction ID: ae6bd76b2a90b9765903f5a1d4db4e0cc9c8f2d56b61e58b9f180ed2bfd6bcd8
Opcode Fuzzy Hash: 853f6e00528be640d3694dfd239fc2ebc061a42f8eb58f464e05766cf15ae447
Instruction Fuzzy Hash: A8118FB254020ABBDB019E90DC86DEBBBACBF45704B004526BA15DB141E771EA108BE0

Function 005A34C7 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 61COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 005A351B
GetLastError.KERNEL32 ref: 005A3525
CloseHandle.KERNEL32(?), ref: 005A3558

Strings

c:\agent\_work\66\s\src\libs\dutil\shelutil.cpp, xrefs: 005A3546
PDu, xrefs: 005A351B
<, xrefs: 005A350D

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseErrorExecuteHandleLastShell
String ID: <$PDu$c:\agent\_work\66\s\src\libs\dutil\shelutil.cpp
API String ID: 3023784893-2506374349
Opcode ID: 7b3fac1ca017251273655567f6da7561afd79af9cbe2d43b9017826a90e4d785
Instruction ID: 23bcc8457e361ca211b9ded3de606cb72dce20887d08007ffe3457ac576ee6b7
Opcode Fuzzy Hash: 7b3fac1ca017251273655567f6da7561afd79af9cbe2d43b9017826a90e4d785
Instruction Fuzzy Hash: 6921A3B5E11229ABCB10CFADD944ADEBBF8BB09754F10811AF915E7340E3749A009BA0

Function 005A02EC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 53synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF,?,00000000,?,00564F5D,?,000000FF,?,?,?,?,?,00000000,?,?,?), ref: 005A02F8
GetLastError.KERNEL32(?,00564F5D,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 005A0306
GetExitCodeProcess.KERNEL32(000000FF,?), ref: 005A034B
GetLastError.KERNEL32(?,00564F5D,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 005A0355

Strings

c:\agent\_work\66\s\src\libs\dutil\procutil.cpp, xrefs: 005A032A
]OV, xrefs: 005A037B

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectProcessSingleWait
String ID: ]OV$c:\agent\_work\66\s\src\libs\dutil\procutil.cpp
API String ID: 590199018-3913551130
Opcode ID: 75ce4cf7896f5512cba47091783a296f4d6ccffbcefa1d65b4a43382ed497bfb
Instruction ID: da0f6410ba33382bace03ab396c50e3b5908af8c09aad8e3d65d89913fa16f1e
Opcode Fuzzy Hash: 75ce4cf7896f5512cba47091783a296f4d6ccffbcefa1d65b4a43382ed497bfb
Instruction Fuzzy Hash: 6D01AD36950136A7CF208A94D808AAE7E94FF167B0F029962FE54AB280E3358C00DAD5

Function 005A038A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00565EE0,00000000), ref: 005A039E
GetProcAddress.KERNEL32(00000000), ref: 005A03A5
GetLastError.KERNEL32(?,?,?,00565EE0,00000000), ref: 005A03BC

Strings

c:\agent\_work\66\s\src\libs\dutil\procutil.cpp, xrefs: 005A03DD
kernel32, xrefs: 005A0396
IsWow64Process, xrefs: 005A038F

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: IsWow64Process$c:\agent\_work\66\s\src\libs\dutil\procutil.cpp$kernel32
API String ID: 4275029093-3797636953
Opcode ID: f8f8c2c93bf0f058f62ebf92f72b4f8132f5ab4f84d4c2101c0a5c8dcbe1b077
Instruction ID: d22a15f739b3543d2a5542922be91fe606c57157432b5584a9fa9775f3ce9d4e
Opcode Fuzzy Hash: f8f8c2c93bf0f058f62ebf92f72b4f8132f5ab4f84d4c2101c0a5c8dcbe1b077
Instruction Fuzzy Hash: C2F02232A10226ABCB208BD1DC09E9F7E64FB02B50B014506FD05BB280E7B0DE04D7E0

Function 00594189 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,0059413A,00000000,?,005940DA,00000000,005C7908,0000000C,00594231,00000000,00000002), ref: 005941A9
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 005941BC
FreeLibrary.KERNEL32(00000000,?,?,?,0059413A,00000000,?,005940DA,00000000,005C7908,0000000C,00594231,00000000,00000002), ref: 005941DF

Strings

CorExitProcess, xrefs: 005941B4
8X, xrefs: 005941CD
mscoree.dll, xrefs: 005941A2

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: 8X$CorExitProcess$mscoree.dll
API String ID: 4061214504-3676166152
Opcode ID: d476267cdb1aaeeb2b74e45f1d23885a769cdf67fa95436ba77d215f863ef564
Instruction ID: 1338b8bb6fe07dd076496efe1c1e7dea6fbe464fee608e57cf7d15f0f23b7fb4
Opcode Fuzzy Hash: d476267cdb1aaeeb2b74e45f1d23885a769cdf67fa95436ba77d215f863ef564
Instruction Fuzzy Hash: 24F04F71A40608BBCF15AF94DC0DFAEBFB8FB55751F004069FC06A2190DB704E89EA91

Function 00578B85 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 121sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0,00000000,00000000), ref: 00578BF1

Strings

Failed to get old %hs package cache root directory., xrefs: 00578C91
per-machine, xrefs: 00578C42, 00578C82
per-user, xrefs: 00578C4B, 00578C50, 00578C8B, 00578C90
Failed to get %hs package cache root directory., xrefs: 00578C51
Failed to calculate cache path., xrefs: 00578BAE

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Sleep
String ID: Failed to calculate cache path.$Failed to get %hs package cache root directory.$Failed to get old %hs package cache root directory.$per-machine$per-user
API String ID: 3472027048-398165853
Opcode ID: cfc89dd6d245ee1e5cd464709a05f28a95a730d7b8a24cd6566c5273402d49b4
Instruction ID: 7db28ffc785bbfc5a320919a9de6850529934049f7d29f98d440020b95731d92
Opcode Fuzzy Hash: cfc89dd6d245ee1e5cd464709a05f28a95a730d7b8a24cd6566c5273402d49b4
Instruction Fuzzy Hash: 5031F672A81225BBEB12A6559D4EFBF6E6CFB40750F108460FD08FE141EA649D0072B1

Function 0057E7A7 Relevance: 9.1, APIs: 6, Instructions: 85windowCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000082,?,?), ref: 0057E7D6
SetWindowLongW.USER32(?,000000EB,00000000), ref: 0057E7E5
SetWindowLongW.USER32(?,000000EB,?), ref: 0057E7F9
DefWindowProcW.USER32(?,?,?,?), ref: 0057E809
GetWindowLongW.USER32(?,000000EB), ref: 0057E823
PostQuitMessage.USER32(00000000), ref: 0057E882

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Window$Long$Proc$MessagePostQuit
String ID:
API String ID: 3812958022-0
Opcode ID: 94554d92f1513925a81a549f78067a606c97f8899649619fb30808d954cd17f8
Instruction ID: f398e87547a77fd02338422bc5075a3cbcfc67b7f3e22f01b8d9fbdeb27a3f32
Opcode Fuzzy Hash: 94554d92f1513925a81a549f78067a606c97f8899649619fb30808d954cd17f8
Instruction Fuzzy Hash: 6921AE31100215BFDF155F68EC49E6A3F65FF49360F148A68FA0A9A1A0C731DD10EB51

Function 00595929 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,005912E7,00000000,80004004,?,005915EB,00000000,80004004,00000000,00000000), ref: 0059592D
_free.LIBCMT ref: 00595960
_free.LIBCMT ref: 00595988
SetLastError.KERNEL32(00000000,80004004,00000000,00000000), ref: 00595995
SetLastError.KERNEL32(00000000,80004004,00000000,00000000), ref: 005959A1
_abort.LIBCMT ref: 005959A7

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: c432a6d00a07f9b0387061e27fcc738da2c9087504a7e3eb86b681f46d7bda4d
Instruction ID: 5cc67222e07dc69b3b87556be76eac383aba9065ef0043e5dc267bb4b1c4efcc
Opcode Fuzzy Hash: c432a6d00a07f9b0387061e27fcc738da2c9087504a7e3eb86b681f46d7bda4d
Instruction Fuzzy Hash: 6FF0F439180E02ABEE1323756C0EF2E2E19BFD2774B250024F818F2191FF208D29D322

Function 0057C672 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 164synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(?), ref: 0057C6BA
CloseHandle.KERNEL32(?), ref: 0057C6C2

Strings

Failed to save state., xrefs: 0057C73A
c:\agent\_work\66\s\src\burn\engine\elevation.cpp, xrefs: 0057C861
Unexpected elevated message sent to child process, msg: %u, xrefs: 0057C86D

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseHandleMutexRelease
String ID: Failed to save state.$Unexpected elevated message sent to child process, msg: %u$c:\agent\_work\66\s\src\burn\engine\elevation.cpp
API String ID: 4207627910-1654385460
Opcode ID: 079c7507b4b5ac52e18c78e426d8333a05f20a3db611e32ae4070494167ffcd8
Instruction ID: 69659ca837f519db389dded6c7dbba590544c5248f916452c9fce7430cb36af9
Opcode Fuzzy Hash: 079c7507b4b5ac52e18c78e426d8333a05f20a3db611e32ae4070494167ffcd8
Instruction Fuzzy Hash: D261C13A100610EFCB225F88DD05D55BFA2FF58710715C9A9FAAE5A632C732E921FB41

Function 005A72DE Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 005639DF: GetProcessHeap.KERNEL32(?,000001C7,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F0
Part of subcall function 005639DF: RtlAllocateHeap.NTDLL(00000000,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F7

SysFreeString.OLEAUT32(00000000), ref: 005A743B
SysFreeString.OLEAUT32(00000000), ref: 005A7446
SysFreeString.OLEAUT32(00000000), ref: 005A7451

Strings

`<u, xrefs: 005A7430
c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp, xrefs: 005A7311

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: FreeString$Heap$AllocateProcess
String ID: `<u$c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp
API String ID: 2724874077-3052637621
Opcode ID: 5d881dfa7e22e6646669ddd84c5c14eb21c65823911879f74f48476609a41f5a
Instruction ID: 47e7c7cc011833be5173f3d524cc4393a4a25cb6390e6ba716089144d8321569
Opcode Fuzzy Hash: 5d881dfa7e22e6646669ddd84c5c14eb21c65823911879f74f48476609a41f5a
Instruction Fuzzy Hash: 5C518131A0462AAFDF11DF64CC48EAEBFB8BF49714F1145A9E901AB150D770EE04DBA0

Function 005A0AB4 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 147registrystringCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 005A0ADC
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?,?,?,?,00576FDF,00000100,000000B0,00000088,00000410,000002C0), ref: 005A0B13
lstrlenW.KERNEL32(?,?,?,00000000,?,-00000001,00000004,00000000), ref: 005A0C05

Strings

c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 005A0B56
BundleUpgradeCode, xrefs: 005A0ABB

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: QueryValue$lstrlen
String ID: BundleUpgradeCode$c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 3790715954-1890108899
Opcode ID: bc5818794521fab01e44260248497bcbd8f2a72d7a566e2fbf9e62def316ae86
Instruction ID: 57ae78f5c7139e77eb075d55848374cc54162d18501bf7c34290f16dfeeee3a0
Opcode Fuzzy Hash: bc5818794521fab01e44260248497bcbd8f2a72d7a566e2fbf9e62def316ae86
Instruction Fuzzy Hash: F841C431A1021ABFCF21DF94C985EAEBBA9FF45724F11556AF801AB291D7309D00DBA0

Function 005A5B40 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005A412E: SetFilePointerEx.KERNELBASE(?,?,?,?,?,00000000,?,?,?,00578651,00000000,00000000,00000000,00000000,00000000), ref: 005A4146
Part of subcall function 005A412E: GetLastError.KERNEL32(?,?,?,00578651,00000000,00000000,00000000,00000000,00000000), ref: 005A4150

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,005A53FE,?,?,?,?,?,?,?,00010000,?), ref: 005A5BA9
WriteFile.KERNEL32(000000FF,00000008,00000008,?,00000000,000000FF,00000000,00000000,00000000,00000000,?,005A53FE,?,?,?,?), ref: 005A5BFB
GetLastError.KERNEL32(?,005A53FE,?,?,?,?,?,?,?,00010000,?,00000001,?,GET,?,?), ref: 005A5C41
GetLastError.KERNEL32(?,005A53FE,?,?,?,?,?,?,?,00010000,?,00000001,?,GET,?,?), ref: 005A5C67

Strings

c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp, xrefs: 005A5C8B

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorFileLast$Write$Pointer
String ID: c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp
API String ID: 133221148-16760509
Opcode ID: e86e2df15faed6c81b5fe9e18fa6e55c4d3ad5b357f3025cfe08b3a529f9bc82
Instruction ID: efe1e14222a8189c8411c3dbd779b72c13d9179eb50a2b6e28dd6106a10d28c4
Opcode Fuzzy Hash: e86e2df15faed6c81b5fe9e18fa6e55c4d3ad5b357f3025cfe08b3a529f9bc82
Instruction Fuzzy Hash: 96418C72900B2ABFDB218E94CC48FAE7F68FF06361F140125BD01A6190E374DD50EBA0

Function 0056252E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00000000,0059F8C7,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,0059F8C7,00581074,?,00000000), ref: 00562574
GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,0059F8C7,00581074,?,00000000,0000FDE9,?,00581074), ref: 00562580

Part of subcall function 00563C5F: GetProcessHeap.KERNEL32(00000000,000001C7,?,005622D5,000001C7,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 00563C67
Part of subcall function 00563C5F: HeapSize.KERNEL32(00000000,?,005622D5,000001C7,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 00563C6E

Strings

c:\agent\_work\66\s\src\libs\dutil\strutil.cpp, xrefs: 005625A4

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
String ID: c:\agent\_work\66\s\src\libs\dutil\strutil.cpp
API String ID: 3662877508-792799584
Opcode ID: 603b888a277c244cec0136a1cad1b850a792c79ad3d3cc629d32045c5529fd1f
Instruction ID: 6866df5dafc9654ce5918769335062da3c1e75ed4acf481adf27531817eff852
Opcode Fuzzy Hash: 603b888a277c244cec0136a1cad1b850a792c79ad3d3cc629d32045c5529fd1f
Instruction Fuzzy Hash: 9731B871200A16AFEB219E64CCD49763ED9BB65768F108229FD129F2A0EF71CC50D761

Function 00598AD8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,BCE85006,00591C3F,00000000,00000000,00592C74,?,t,Y,?,00000001,00591C3F,BCE85006,00000001,00592C74,00592C74), ref: 00598B25
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00598BAE
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00598BC0
__freea.LIBCMT ref: 00598BC9

Part of subcall function 00595D22: HeapAlloc.KERNEL32(00000000,?,?,?,00591782,?,0000015D,?,?,?,?,00592BDB,000000FF,00000000,?,?), ref: 00595D54

Strings

t,Y, xrefs: 00598AEB

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ByteCharMultiWide$AllocHeapStringType__freea
String ID: t,Y
API String ID: 573072132-2269092704
Opcode ID: 669b6a34e2a0b0d1a0f77e2bcb4c4883b1b0f9228e2e99a7a1263c00c4fbde07
Instruction ID: b74966009a9296d9551c4a8fc46061e74d1f1e0d2364bc8dd539273374191889
Opcode Fuzzy Hash: 669b6a34e2a0b0d1a0f77e2bcb4c4883b1b0f9228e2e99a7a1263c00c4fbde07
Instruction Fuzzy Hash: BB31ADB2A0021AABDF259F65DC49EBE7FA6FB42310F180168FC04D6290EB35DD54CB90

Function 005A3A14 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

MoveFileExW.KERNEL32(00000003,00000001,00000000,00000000,00000101,?,005A3B62,00000003,00000001,00000001,000007D0,00000003,00000000,?,00579F39,00000001), ref: 005A3A32
GetLastError.KERNEL32(00000002,?,005A3B62,00000003,00000001,00000001,000007D0,00000003,00000000,?,00579F39,00000001,000007D0,00000001,00000001,00000003), ref: 005A3A41
MoveFileExW.KERNEL32(00000003,00000001,00000000,00000001,00000000,?,005A3B62,00000003,00000001,00000001,000007D0,00000003,00000000,?,00579F39,00000001), ref: 005A3ADA
GetLastError.KERNEL32(?,005A3B62,00000003,00000001,00000001,000007D0,00000003,00000000,?,00579F39,00000001,000007D0,00000001,00000001,00000003,000007D0), ref: 005A3AE4

Part of subcall function 005A3C72: FindFirstFileW.KERNEL32(00588F6B,?,00000100,00000000,00000000), ref: 005A3CAD
Part of subcall function 005A3C72: FindClose.KERNEL32(00000000), ref: 005A3CB9

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 005A3B03

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: File$ErrorFindLastMove$CloseFirst
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 3479031965-1688708105
Opcode ID: 60758ba222c8f0ae2e68d9ead3b327d73c1f2935242b85dff3f475879102d68a
Instruction ID: c731e03e6d9288d0346f26b352fcc41d5900f24411117f0168a93c89618da3b3
Opcode Fuzzy Hash: 60758ba222c8f0ae2e68d9ead3b327d73c1f2935242b85dff3f475879102d68a
Instruction Fuzzy Hash: CC310537A0023AABDB215E98CC41A7F7E96FF937A9F154126FD44AB250D7708E41D2E0

Function 0058AA41 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,?,000000FF,?,00000000,?,?,?,00000000,00000000,?,?,00000000), ref: 0058AAB0

Strings

Failed to skip the extraction of payload: %ls from container: %ls, xrefs: 0058AB45
Failed to extract payload: %ls from container: %ls, xrefs: 0058AB39
Failed to extract all payloads from container: %ls, xrefs: 0058AAF4
Failed to open container: %ls., xrefs: 0058AA82

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CompareString
String ID: Failed to extract all payloads from container: %ls$Failed to extract payload: %ls from container: %ls$Failed to open container: %ls.$Failed to skip the extraction of payload: %ls from container: %ls
API String ID: 1825529933-3891707333
Opcode ID: d7349308aedb313fd744507232173938f1f4e42299f1131633adb26019c5fe72
Instruction ID: 30aace17ae15d924f3887077e07487b7542c1a54c4fad2614815a4acc70f7fa8
Opcode Fuzzy Hash: d7349308aedb313fd744507232173938f1f4e42299f1131633adb26019c5fe72
Instruction Fuzzy Hash: CF31B032D00116BBDF11AEE4CD46E9E7F69BF44711F244122FD21B7191E730AA14DB92

Function 005A3B71 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 94registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005A3C72: FindFirstFileW.KERNEL32(00588F6B,?,00000100,00000000,00000000), ref: 005A3CAD
Part of subcall function 005A3C72: FindClose.KERNEL32(00000000), ref: 005A3CB9

RegCloseKey.ADVAPI32(?,00000000,?,00000000,?,00000000,?,00000000,?,wininet.dll,?,crypt32.dll,?,?,?,00000000), ref: 005A3C64

Part of subcall function 005A0823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,005CAA7C,00000000,?,005A4FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 005A0837

Part of subcall function 005A0AB4: RegQueryValueExW.ADVAPI32(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 005A0ADC
Part of subcall function 005A0AB4: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?,?,?,?,00576FDF,00000100,000000B0,00000088,00000410,000002C0), ref: 005A0B13

Strings

\, xrefs: 005A3BED
crypt32.dll, xrefs: 005A3B9C
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 005A3BA3
PendingFileRenameOperations, xrefs: 005A3BCF

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseFindQueryValue$FileFirstOpen
String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager$\$crypt32.dll
API String ID: 3397690329-3978359083
Opcode ID: 8b665730da7a99b785502619632c008fb52cd22578b5f0bbb9903b9172105253
Instruction ID: d47d9f00de122889470dff9c904ddf40b181c603429ee152e1b04d6fdb2fb1e8
Opcode Fuzzy Hash: 8b665730da7a99b785502619632c008fb52cd22578b5f0bbb9903b9172105253
Instruction Fuzzy Hash: AD318F31900219ABDF21AF94CD699AEBF75FF16B68F14806AF501B7151D3319F40DB50

Function 0056EFB7 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94registryCOMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,00000001,000000FF,?,000000FF,00000001,PackageVersion,00000001,?,005705EB,00000001,00000001,00000001,005705EB,00000000), ref: 0056F02F
RegCloseKey.ADVAPI32(00000000,00000001,PackageVersion,00000001,?,005705EB,00000001,00000001,00000001,005705EB,00000000,00000001,00000000,?,005705EB,00000001), ref: 0056F04C

Strings

Failed to format key for update registration., xrefs: 0056EFE5
Failed to remove update registration key: %ls, xrefs: 0056F077
PackageVersion, xrefs: 0056F010

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseCompareString
String ID: Failed to format key for update registration.$Failed to remove update registration key: %ls$PackageVersion
API String ID: 446873843-3222553582
Opcode ID: b61aac36bc529073d5164a152e08703f413d00b423e9c870a28b03e91fcd802d
Instruction ID: 12e44a1b142c29b1f0a541ad4e5cb07a4c03c24ed384f33810fa9082b44d97e7
Opcode Fuzzy Hash: b61aac36bc529073d5164a152e08703f413d00b423e9c870a28b03e91fcd802d
Instruction Fuzzy Hash: 4D219331D01226BBCF61ABA8DD0EEAEBFB8FF45760F104275B816A3191E7745A40D790

Function 005A3843 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(00000000,00564DFD,00000000,?,?,00000000,?,005A395E,00000000,00564DFD,00000000,00000000,?,005784D1,?,?), ref: 005A385D
GetLastError.KERNEL32(?,005A395E,00000000,00564DFD,00000000,00000000,?,005784D1,?,?,00000001,00000003,000007D0,?,?,?), ref: 005A386B
CopyFileW.KERNEL32(00000000,00564DFD,00000000,00564DFD,00000000,?,005A395E,00000000,00564DFD,00000000,00000000,?,005784D1,?,?,00000001), ref: 005A38DD
GetLastError.KERNEL32(?,005A395E,00000000,00564DFD,00000000,00000000,?,005784D1,?,?,00000001,00000003,000007D0,?,?,?), ref: 005A38E7

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 005A3906

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CopyErrorFileLast
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 374144340-1688708105
Opcode ID: 610bca949eeb884a2fdde2739717b3a346ff985e816bbfe457980548edaeb6a6
Instruction ID: b11bf8241039cfdf1f0214a94e1d19adead3ec12fb3511129a3b7d0ddd9eda56
Opcode Fuzzy Hash: 610bca949eeb884a2fdde2739717b3a346ff985e816bbfe457980548edaeb6a6
Instruction Fuzzy Hash: 46210837A016239BDB201ED59C44B7F7E98FF567A8F154025FD08EB110EBA4CE0192D1

Function 0056EECF Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 0056EF0A

Part of subcall function 005A3984: SetFileAttributesW.KERNEL32(00588F6B,00000080,00000000,00588F6B,000000FF,00000000,?,?,00588F6B), ref: 005A39B3
Part of subcall function 005A3984: GetLastError.KERNEL32(?,?,00588F6B), ref: 005A39BD

Part of subcall function 00563CF7: RemoveDirectoryW.KERNEL32(00000001,00000000,00000000,00000000,?,?,0056EF55,00000001,00000000,00000095,00000001,005705FA,00000095,00000000,swidtag,00000001), ref: 00563D14

Strings

swidtag, xrefs: 0056EF19
Failed to allocate regid folder path., xrefs: 0056EF70
Failed to allocate regid file path., xrefs: 0056EF69
Failed to format tag folder path., xrefs: 0056EF77

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AttributesDirectoryErrorFileLastOpen@16Remove
String ID: Failed to allocate regid file path.$Failed to allocate regid folder path.$Failed to format tag folder path.$swidtag
API String ID: 1428973842-4170906717
Opcode ID: 5f4ea14831ccd0c986629405b71312685cedeaca85c89d374f8a6990713ae57b
Instruction ID: 72f59e243df0a1206c89717d78ed564968d74f3fe6d5cc86c48521cd9ab84c3d
Opcode Fuzzy Hash: 5f4ea14831ccd0c986629405b71312685cedeaca85c89d374f8a6990713ae57b
Instruction Fuzzy Hash: 7E216735901618BBCF05AB99C846A9DFFB5FF88710F148065A404AB261DB71AE90AB90

Function 00588AF2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 85registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005A0823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,005CAA7C,00000000,?,005A4FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 005A0837

CompareStringW.KERNEL32(00000000,00000001,00000000,000000FF,?,000000FF,00000000,00000000,00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4), ref: 00588B76
RegCloseKey.ADVAPI32(00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4,?,?,?,0056F782,00000001,00000100,000001B4,00000000), ref: 00588BC4

Strings

Failed to open uninstall registry key., xrefs: 00588B39
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00588B13
Failed to enumerate uninstall key for related bundles., xrefs: 00588BD3

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseCompareOpenString
String ID: Failed to enumerate uninstall key for related bundles.$Failed to open uninstall registry key.$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 2817536665-2531018330
Opcode ID: 64b5ff0f38480bdee2e8116378b2211cab5d6613fde749513802eda437619738
Instruction ID: 512fbc7f1a1b92272557906ee2512321bc3c5148f20e5a3833b60b707629a07f
Opcode Fuzzy Hash: 64b5ff0f38480bdee2e8116378b2211cab5d6613fde749513802eda437619738
Instruction Fuzzy Hash: D1217172910219BADB11AA94CC4AFAEBE79FB81722F644264F810760A0DB755E90E790

Function 0058CF33 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 79synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 005639DF: GetProcessHeap.KERNEL32(?,000001C7,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F0
Part of subcall function 005639DF: RtlAllocateHeap.NTDLL(00000000,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F7

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0058CFC8
ReleaseMutex.KERNEL32(?), ref: 0058CFF6
SetEvent.KERNEL32(?), ref: 0058CFFF

Strings

c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp, xrefs: 0058CF6D
Failed to allocate buffer., xrefs: 0058CF77

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Heap$AllocateEventMutexObjectProcessReleaseSingleWait
String ID: Failed to allocate buffer.$c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp
API String ID: 944053411-3017045536
Opcode ID: 9ba15ded742641a05c30ef0b0e9cb8a3d39f3006433c6a58da59d522ccacbf14
Instruction ID: feb79c6abb7e3cfdb5965c1091f163b107aed63bb708eff9e5cf2fd9824271d2
Opcode Fuzzy Hash: 9ba15ded742641a05c30ef0b0e9cb8a3d39f3006433c6a58da59d522ccacbf14
Instruction Fuzzy Hash: A221D1B4600206BFEB00AF68DC45A99BFF5FF48314F108529F965A7391C771A955CB60

Function 005A2823 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 005A288A
SysFreeString.OLEAUT32(?), ref: 005A28A5
SysFreeString.OLEAUT32(?), ref: 005A28B4

Strings

"0Z, xrefs: 005A282D, 005A284C, 005A285A, 005A2868, 005A2831, 005A284F, 005A285D, 005A286B
"0Z, xrefs: 005A282A, 005A2836, 005A2850, 005A285E, 005A286C, 005A287A, 005A2895

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: FreeString
String ID: "0Z$"0Z
API String ID: 3341692771-4092986354
Opcode ID: 7159b7b54982277441e861f6aae7c2beba577f2aae630cd950b2f4e0009d7a63
Instruction ID: 6aea326268190236d5f12bef8e8f43bc2b213dc64db551f7b9730377872eb73b
Opcode Fuzzy Hash: 7159b7b54982277441e861f6aae7c2beba577f2aae630cd950b2f4e0009d7a63
Instruction Fuzzy Hash: 42215B72A1121AEFDB15CF99C985DAEBFB8FF45344B21019EF50193110EB74EA00EB24

Function 005697FE Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 0056988D

Strings

Failed to parse condition '%ls' at position: %u, xrefs: 0056983F
Failed to find variable., xrefs: 0056987A
Failed to read next symbol., xrefs: 005698A9
c:\agent\_work\66\s\src\burn\engine\condition.cpp, xrefs: 0056982F, 00569870

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: _memcpy_s
String ID: Failed to find variable.$Failed to parse condition '%ls' at position: %u$Failed to read next symbol.$c:\agent\_work\66\s\src\burn\engine\condition.cpp
API String ID: 2001391462-1451669575
Opcode ID: 4a83705b9342b87922e8d5f15c9920ba350810ce642c951932b3721f6691fe70
Instruction ID: 59fcfcc795f1c1ac6be6e65796e1a86c90838771ac1fce4bd534cf5ed8574690
Opcode Fuzzy Hash: 4a83705b9342b87922e8d5f15c9920ba350810ce642c951932b3721f6691fe70
Instruction Fuzzy Hash: 94110A339802127BEB256D6C9C4AD9B3E4DFB57720F040161FD04AF296DA72DD1193E1

Function 005749FF Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 67fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,005AA500,00000000,00000000,00000000,00000001,00000000,00000000,00000000,?,00575322), ref: 00574A4B

Strings

Failed to write message type to pipe., xrefs: 00574A8D
c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 00574A83
Failed to allocate message to write., xrefs: 00574A2A

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: FileWrite
String ID: Failed to allocate message to write.$Failed to write message type to pipe.$c:\agent\_work\66\s\src\burn\engine\pipe.cpp
API String ID: 3934441357-221464841
Opcode ID: fb3902cde8fe41a9af5fa55a644b01646c5b895095d0936f4f21e2f7897a7282
Instruction ID: 2f9cdd2d28ad02827bf97a88bebc0f7a9e19bd7f37994d37b02689f8b3bff4c0
Opcode Fuzzy Hash: fb3902cde8fe41a9af5fa55a644b01646c5b895095d0936f4f21e2f7897a7282
Instruction Fuzzy Hash: 8911727298111ABFCB21DF95ED09ADF7FAAFF40750F118155B805B6250E730AE00FAA5

Function 00569DDA Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 67COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00569DFC

Strings

Failed get file version., xrefs: 00569E3C
File search: %ls, did not find path: %ls, xrefs: 00569E67
Failed to set variable., xrefs: 00569E5B
Failed to format path string., xrefs: 00569E07

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Open@16
String ID: Failed get file version.$Failed to format path string.$Failed to set variable.$File search: %ls, did not find path: %ls
API String ID: 3613110473-2458530209
Opcode ID: f7c2e9822beafd44064abe40a0bb0ee9f75305ca9ce525c5de4d09b36475320f
Instruction ID: 5a3607717501251167278f5a843a09d6e2a3e3ebabc7b65e8793bbbb1818f0d5
Opcode Fuzzy Hash: f7c2e9822beafd44064abe40a0bb0ee9f75305ca9ce525c5de4d09b36475320f
Instruction Fuzzy Hash: E1118B76D00129BACF02AA949C46DAEBF7DFF54754B104166F801AB211D6729E50ABE0

Function 005780F6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 005639DF: GetProcessHeap.KERNEL32(?,000001C7,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F0
Part of subcall function 005639DF: RtlAllocateHeap.NTDLL(00000000,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F7

CreateWellKnownSid.ADVAPI32(00000000,00000000,00000000,00000000,00000044,00000001,00000000,00000000,?,?,00578CEE,0000001A,?,?,00000000,00000000), ref: 0057813F
GetLastError.KERNEL32(?,?,00578CEE,0000001A,?,?,00000000,00000000,?,?,?), ref: 00578149

Strings

Failed to allocate memory for well known SID., xrefs: 00578127
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 0057811D, 0057816D
Failed to create well known SID., xrefs: 00578177

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Heap$AllocateCreateErrorKnownLastProcessWell
String ID: Failed to allocate memory for well known SID.$Failed to create well known SID.$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 2186923214-2807399336
Opcode ID: 27fadbf55e89689b63a22ac0d5e769a4e70c29ed0e2f7847afe66624c89d4c41
Instruction ID: c063fda5a1229ea18b4d6013c361801d64cc861d4f8d668e8e5ca3a36163e2b1
Opcode Fuzzy Hash: 27fadbf55e89689b63a22ac0d5e769a4e70c29ed0e2f7847afe66624c89d4c41
Instruction Fuzzy Hash: 370108376816267AD7216A54AC0FFAB6E59FF81B70F554015BD08BB280EE649D01E2E0

Function 0058DA54 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000003E8,000004FF), ref: 0058DA82
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0058DAAC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,0058DC7A,00000000,?,?,?,00000000,00000000), ref: 0058DAB4

Strings

c:\agent\_work\66\s\src\burn\engine\bitsengine.cpp, xrefs: 0058DAD8
Failed while waiting for download., xrefs: 0058DAE2

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLastMessageMultipleObjectsPeekWait
String ID: Failed while waiting for download.$c:\agent\_work\66\s\src\burn\engine\bitsengine.cpp
API String ID: 435350009-842194682
Opcode ID: f9341e7c9254a8dfabc6259db455673ea02a3ad7e284a13a771678baa809c61d
Instruction ID: 312d6477d81b69f7cf021ad6aa15d363c3193fd998eb5b0914d66bf66a67f9cd
Opcode Fuzzy Hash: f9341e7c9254a8dfabc6259db455673ea02a3ad7e284a13a771678baa809c61d
Instruction Fuzzy Hash: 6001C273A4922577D724AAA89C09EEB7FE8FB05B20F100122FE05F61C1D6A4990083F0

Function 00565F5A Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,00000010), ref: 00565F88
GetLastError.KERNEL32 ref: 00565F92

Strings

Failed to set variant value., xrefs: 00565FD9
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00565FB6
Failed to get computer name., xrefs: 00565FC0

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ComputerErrorLastName
String ID: Failed to get computer name.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 3560734967-833936685
Opcode ID: b5a9af63cca12d54d329b7e269dae3c98e1711ec201a20e4bfd4f33ddd09b61c
Instruction ID: f73840626d42cb06e14feae811b21e6db2958d6e328834f6182585f8edd900e9
Opcode Fuzzy Hash: b5a9af63cca12d54d329b7e269dae3c98e1711ec201a20e4bfd4f33ddd09b61c
Instruction Fuzzy Hash: D701A573A416296BD711AAA59D05ADEBFE8BF49710F510125FD00F7280EE64EE0887E1

Function 005667C2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 005667FB
GetLastError.KERNEL32 ref: 00566805

Strings

Failed to set variant value., xrefs: 0056684F
Failed to get temp path., xrefs: 00566833
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00566829

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLastPathTemp
String ID: Failed to get temp path.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 1238063741-3623708253
Opcode ID: 8ba709a23ac522fbf35345649c70fc3e40cda232a5a9fe78d535707a1c11d36a
Instruction ID: 8c4b2f2789aed24d15f4ecaa7c8b889084876b06d4a128d4510a9a179d68c88d
Opcode Fuzzy Hash: 8ba709a23ac522fbf35345649c70fc3e40cda232a5a9fe78d535707a1c11d36a
Instruction Fuzzy Hash: 1B019672E4163A6BD720A7649C0AF9E7FE87B05714F110165BE04F72C2EA64AD0887D5

Function 00565EC2 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 55COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?), ref: 00565ED4

Part of subcall function 005A038A: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00565EE0,00000000), ref: 005A039E
Part of subcall function 005A038A: GetProcAddress.KERNEL32(00000000), ref: 005A03A5
Part of subcall function 005A038A: GetLastError.KERNEL32(?,?,?,00565EE0,00000000), ref: 005A03BC

Part of subcall function 005A3578: SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 005A35A5

Strings

Failed to get shell folder., xrefs: 00565F08
Failed to set variant value., xrefs: 00565F38
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00565EFE
Failed to get 64-bit folder., xrefs: 00565F1E

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AddressCurrentErrorFolderHandleLastModulePathProcProcess
String ID: Failed to get 64-bit folder.$Failed to get shell folder.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 2084161155-2957518125
Opcode ID: 7e25319ced5e13bafb1601bd36fba43cab1cdefe2c682ccb1fae90088f304cc3
Instruction ID: 1bdde3c833b019cc0bdfb871792aa632a9ec77cc92a8c3220bff75c4db1f0004
Opcode Fuzzy Hash: 7e25319ced5e13bafb1601bd36fba43cab1cdefe2c682ccb1fae90088f304cc3
Instruction Fuzzy Hash: E1018472994629BBDF12A7A0CC0AF9EBF68BB11754F104154F800B7191EB749A44E791

Function 005A3984 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005A3C72: FindFirstFileW.KERNEL32(00588F6B,?,00000100,00000000,00000000), ref: 005A3CAD
Part of subcall function 005A3C72: FindClose.KERNEL32(00000000), ref: 005A3CB9

SetFileAttributesW.KERNEL32(00588F6B,00000080,00000000,00588F6B,000000FF,00000000,?,?,00588F6B), ref: 005A39B3
GetLastError.KERNEL32(?,?,00588F6B), ref: 005A39BD
DeleteFileW.KERNEL32(00588F6B,00000000,00588F6B,000000FF,00000000,?,?,00588F6B), ref: 005A39DD
GetLastError.KERNEL32(?,?,00588F6B), ref: 005A39E7

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 005A3A02

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: File$ErrorFindLast$AttributesCloseDeleteFirst
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 3967264933-1688708105
Opcode ID: d55910d3b411e4fa94493fd3a7a79194b161c5d45dc8b168c6aa5c587fc76d92
Instruction ID: 0719b9f37ee0fdc689b7c6fc490520e78e09e82f529ce6883af83937c606b39d
Opcode Fuzzy Hash: d55910d3b411e4fa94493fd3a7a79194b161c5d45dc8b168c6aa5c587fc76d92
Instruction Fuzzy Hash: FA01D232A01636ABC7224B65CD0ABAF7E98BF137A9F014210FC89FA190D360CF00D5E0

Function 0058D6C3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0058D6D8
LeaveCriticalSection.KERNEL32(?), ref: 0058D71D
SetEvent.KERNEL32(?,?,?,?), ref: 0058D731

Strings

Failed to get state during job modification., xrefs: 0058D6F1
Failure while sending progress during BITS job modification., xrefs: 0058D70C

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: Failed to get state during job modification.$Failure while sending progress during BITS job modification.
API String ID: 3094578987-1258544340
Opcode ID: 7df7dcd244696bc79ea7cbe7de5f671103c0fb6733dcdc4721fb5dcba5c89ff9
Instruction ID: bb07d0ac240aca556453faacbf8b6cd4e55f20d9fd997851ca715df7416441fb
Opcode Fuzzy Hash: 7df7dcd244696bc79ea7cbe7de5f671103c0fb6733dcdc4721fb5dcba5c89ff9
Instruction Fuzzy Hash: B301B172A01626BBDB02AF55C849EAEBFBCFF15324B104215F805E7291D770E904DBE1

Function 0058D4AA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000008,00000000,00000000,?,0058DC04,?,?,?,?,?,00000000,00000000,?), ref: 0058D4C4
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,0058DC04,?,?,?,?,?,00000000,00000000,?), ref: 0058D4CF
GetLastError.KERNEL32(?,0058DC04,?,?,?,?,?,00000000,00000000,?), ref: 0058D4DC

Strings

c:\agent\_work\66\s\src\burn\engine\bitsengine.cpp, xrefs: 0058D500
Failed to create BITS job complete event., xrefs: 0058D50A

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CreateCriticalErrorEventInitializeLastSection
String ID: Failed to create BITS job complete event.$c:\agent\_work\66\s\src\burn\engine\bitsengine.cpp
API String ID: 3069647169-683598956
Opcode ID: 19e550cfef1081dde63a2584262b26ed4e6e52a91c6a0dcc83d6cffe27ca6a96
Instruction ID: 0cf1ddfb644292dbac5bbbe183258213406dadbaaa36448a6b1f37608f0148d5
Opcode Fuzzy Hash: 19e550cfef1081dde63a2584262b26ed4e6e52a91c6a0dcc83d6cffe27ca6a96
Instruction Fuzzy Hash: 3F01B176501622ABC310AF59DC09A86BFE8FF06720B004126FD08E7640E7B4E800CBF4

Function 0058D936 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000008,?,00000000,00000000,00000000,?,0058DAA2), ref: 0058D94A
LeaveCriticalSection.KERNEL32(00000008,?,0058DAA2), ref: 0058D98F
SetEvent.KERNEL32(?,?,0058DAA2), ref: 0058D9A3

Strings

Failed to get BITS job state., xrefs: 0058D963
Failure while sending progress., xrefs: 0058D97E

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: Failed to get BITS job state.$Failure while sending progress.
API String ID: 3094578987-2876445054
Opcode ID: 1fbb8904a5dd0ff27df87344b1959fb8bbf22ff6bcb39383bb4e4c12df97c170
Instruction ID: 63c9fb1c25d34a159112a0757616f7543d0a98456582971536cd3a3588f84819
Opcode Fuzzy Hash: 1fbb8904a5dd0ff27df87344b1959fb8bbf22ff6bcb39383bb4e4c12df97c170
Instruction Fuzzy Hash: E601D472600625BFDB02AB59D84AE9EBFF8FF56724B000125F805E3690D774E904D7E5

Function 005A3209 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 005A324E
SysFreeString.OLEAUT32(00000000), ref: 005A3281

Strings

`<u, xrefs: 005A3281
BTV, xrefs: 005A3209
c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp, xrefs: 005A321F, 005A3265

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: String$AllocFree
String ID: BTV$`<u$c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp
API String ID: 344208780-102306602
Opcode ID: 51f1b24b18a2c1872986e350cd18ac22de446c34fc4cda343a25dce31aa727f1
Instruction ID: 4d29490a65accc83dde96692d11f391546d20921dc6603f64ffa861b9fb9e99e
Opcode Fuzzy Hash: 51f1b24b18a2c1872986e350cd18ac22de446c34fc4cda343a25dce31aa727f1
Instruction Fuzzy Hash: B601A239640216BBDB201AD89C08F7E7E9CFF52BA4F100529FD04A7340D678CE0096A1

Function 00586951 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 48serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(ehX,00000001,?,00000001,00000000,?,?,?,?,?,?,00586865,00000000), ref: 00586979
GetLastError.KERNEL32(?,?,?,?,?,?,00586865,00000000), ref: 00586983

Strings

ehX, xrefs: 00586961, 00586978
c:\agent\_work\66\s\src\burn\engine\msuengine.cpp, xrefs: 005869A7
Failed to stop wusa service., xrefs: 005869B1

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ControlErrorLastService
String ID: Failed to stop wusa service.$c:\agent\_work\66\s\src\burn\engine\msuengine.cpp$ehX
API String ID: 4114567744-3061263122
Opcode ID: b2bd043f9c03afd560f81d5dc5d03ffeee3d4e96b39168966cefea07b1ce8711
Instruction ID: bb5780e9f0187330b74c163eec892b658a8334d0371ce9e0aaa61981c65c1f14
Opcode Fuzzy Hash: b2bd043f9c03afd560f81d5dc5d03ffeee3d4e96b39168966cefea07b1ce8711
Instruction Fuzzy Hash: B001A733A411356BD710A7759C09ADFBFE4BB49750F114025FD05BB180EA34A90482E5

Function 0056D461 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(000000D0,?,000000B8,00000000,?,00576F37,000000B8,00000000,?,00000000,75C0B390), ref: 0056D470
InterlockedCompareExchange.KERNEL32(000000E8,00000001,00000000), ref: 0056D47F
LeaveCriticalSection.KERNEL32(000000D0,?,00576F37,000000B8,00000000,?,00000000,75C0B390), ref: 0056D494

Strings

Engine active cannot be changed because it was already in that state., xrefs: 0056D4B7
c:\agent\_work\66\s\src\burn\engine\userexperience.cpp, xrefs: 0056D4AD

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CriticalSection$CompareEnterExchangeInterlockedLeave
String ID: Engine active cannot be changed because it was already in that state.$c:\agent\_work\66\s\src\burn\engine\userexperience.cpp
API String ID: 3376869089-1173769119
Opcode ID: 2287eddf7566731990d79fcb440598dc6a262267e7a3b7de515f1a18df492b9d
Instruction ID: b93164e0df00a41872aec5e618bd2553bf9e0f00d2a48333787404386f24c1bc
Opcode Fuzzy Hash: 2287eddf7566731990d79fcb440598dc6a262267e7a3b7de515f1a18df492b9d
Instruction Fuzzy Hash: 61F08C763002056B9B109FA6EC88D977BBCBA96761704042AB506C7240DBB4FC09C770

Function 005A1511 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(SRSetRestorePointW,srclient.dll), ref: 005A153C
GetLastError.KERNEL32(?,00564A21,00000001,?,?,0056459E,?,?,?,?,005654A3,?,?,?,?), ref: 005A154B

Strings

srclient.dll, xrefs: 005A151A
c:\agent\_work\66\s\src\libs\dutil\srputil.cpp, xrefs: 005A156C
SRSetRestorePointW, xrefs: 005A1531

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: SRSetRestorePointW$c:\agent\_work\66\s\src\libs\dutil\srputil.cpp$srclient.dll
API String ID: 199729137-2605395416
Opcode ID: e19c4d86f33f478740e7cf5fd6975fe4f371375bf24cd3a1319c9ff1f112a35c
Instruction ID: c5a190f591501e480e4138067a3a07c5f033f9698d82df6b36acc8a73d3de5c9
Opcode Fuzzy Hash: e19c4d86f33f478740e7cf5fd6975fe4f371375bf24cd3a1319c9ff1f112a35c
Instruction Fuzzy Hash: 8601A272D81F325BD33117D4980EB6E3D547B9A760F010225FD03AB251E720CC84AEDA

Function 00594682 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 005946F4
_free.LIBCMT ref: 00594714

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: f47a5a049e0d5ca921f3a574e6aae137767c024e0d897ee69bf900fd0c5a5036
Instruction ID: 45dc712974a612a94d9858d0d0670dc13695aa98b84454bc408ac793280842a4
Opcode Fuzzy Hash: f47a5a049e0d5ca921f3a574e6aae137767c024e0d897ee69bf900fd0c5a5036
Instruction Fuzzy Hash: 44419236A006049FCF24DFB8C885E6EBBB5FF89314B1545A9E515EB351EB31AD06CB80

Function 005622B5 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(8007139F,00000000,?,?,00000000,00000000,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005622FB
GetLastError.KERNEL32(?,00000000,00000000,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 00562307

Part of subcall function 00563C5F: GetProcessHeap.KERNEL32(00000000,000001C7,?,005622D5,000001C7,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 00563C67
Part of subcall function 00563C5F: HeapSize.KERNEL32(00000000,?,005622D5,000001C7,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 00563C6E

Strings

c:\agent\_work\66\s\src\libs\dutil\strutil.cpp, xrefs: 0056232B

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
String ID: c:\agent\_work\66\s\src\libs\dutil\strutil.cpp
API String ID: 3662877508-792799584
Opcode ID: 779894fa8fc8231c99053ad5e21327689ff7092b9d305da525fd4fcd90e22faf
Instruction ID: c67c519007bf9485f0476d067b81695d85e7297db56f0e4a571ae73a7c33403d
Opcode Fuzzy Hash: 779894fa8fc8231c99053ad5e21327689ff7092b9d305da525fd4fcd90e22faf
Instruction Fuzzy Hash: 0E311632701A26ABDB208E65CC88A6E3FA5BF45764F114A25FD55AF3A0E738CC40D7D1

Function 005689E8 Relevance: 7.6, APIs: 5, Instructions: 117stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,00000000,?,?,00568BA7,005696F4,?,005696F4,?,?,005696F4,?,?), ref: 00568A08
lstrlenW.KERNEL32(?,?,00000000,00000000,?,?,00568BA7,005696F4,?,005696F4,?,?,005696F4,?,?), ref: 00568A10
CompareStringW.KERNEL32(0000007F,?,?,?,?,00000000,?,00000000,00000000,?,?,00568BA7,005696F4,?,005696F4,?), ref: 00568A5F
CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00000000,00000000,?,?,00568BA7,005696F4,?,005696F4,?), ref: 00568AC1
CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00000000,00000000,?,?,00568BA7,005696F4,?,005696F4,?), ref: 00568AEE

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CompareString$lstrlen
String ID:
API String ID: 1657112622-0
Opcode ID: cad1fa0fdacac8426563d2d7d322186296e8d9efaf8d54204c0089541be13614
Instruction ID: 8da891154c4bd4df0b331ba25ef669e071b2d272474a1fe39e6296b67cae77e6
Opcode Fuzzy Hash: cad1fa0fdacac8426563d2d7d322186296e8d9efaf8d54204c0089541be13614
Instruction Fuzzy Hash: C2315372A00109BFCF158F98CC489BE3F66FB49360F148616FD1997210CA759D90DBA1

Function 005959AD Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000100,00000000,0059372D,00563CE2,80004005,00000000,?,c:\agent\_work\66\s\src\burn\engine\cabextract.cpp,000001C7), ref: 005959B2
_free.LIBCMT ref: 005959E7
_free.LIBCMT ref: 00595A0E
SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,00000000), ref: 00595A1B
SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,00000000), ref: 00595A24

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 5d0cd7676b5e932ed8cd4c91fe441ecd63cc00fea113334e8f28fe89924ef55d
Instruction ID: 63401ee72caa9baeea6618f67589d2d6ee1a5856353ae9fe43a9a2bfff9008fa
Opcode Fuzzy Hash: 5d0cd7676b5e932ed8cd4c91fe441ecd63cc00fea113334e8f28fe89924ef55d
Instruction Fuzzy Hash: 9401F936150E026BDE1367756C8EE2B2E19FFD63717210125F415B2152FF248C799365

Function 005674BE Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(005653FA,WixBundleOriginalSource,?,?,0057A50A,840F01E8,WixBundleOriginalSource,?,005CAA6C,?,00000000,00565482,00000001,?,?,00565482), ref: 005674CA
LeaveCriticalSection.KERNEL32(005653FA,005653FA,00000000,00000000,?,?,0057A50A,840F01E8,WixBundleOriginalSource,?,005CAA6C,?,00000000,00565482,00000001,?), ref: 00567531

Strings

Failed to get value as string for variable: %ls, xrefs: 00567520
WixBundleOriginalSource, xrefs: 005674C6
Failed to get value of variable: %ls, xrefs: 00567504

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as string for variable: %ls$Failed to get value of variable: %ls$WixBundleOriginalSource
API String ID: 3168844106-30613933
Opcode ID: 7bdad4d8814f6b172a5fcf3aa832a9c981cd27bf299c3c93f6659f384225f8b0
Instruction ID: e0c9fdac7c57dc4ead90a81b0752702a81e428daa5b59bcfd3718af77b0b0a33
Opcode Fuzzy Hash: 7bdad4d8814f6b172a5fcf3aa832a9c981cd27bf299c3c93f6659f384225f8b0
Instruction Fuzzy Hash: 5E01BC3294412DFBCF226F60CC09A8E7F69BB28329F108060FD15AB221D7399E10E7D1

Function 0058CE2C Relevance: 7.5, APIs: 5, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,00000000,?,00000000,?,0058CE24,00000000), ref: 0058CE47
CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,0058CE24,00000000), ref: 0058CE53
CloseHandle.KERNEL32(005AA518,00000000,?,00000000,?,0058CE24,00000000), ref: 0058CE60
CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,0058CE24,00000000), ref: 0058CE6D
UnmapViewOfFile.KERNEL32(005AA4E8,00000000,?,0058CE24,00000000), ref: 0058CE7C

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseHandle$FileUnmapView
String ID:
API String ID: 260491571-0
Opcode ID: 7aa5e42ab5f9468e40e816ba34809fdaa9aa0fbc5eddb94dbc5ecfd2325f231a
Instruction ID: 1800b2e3d8bb6c4cfdf5658defbe9cac09a1c2e1c832318924c6fdd9a3c03dd8
Opcode Fuzzy Hash: 7aa5e42ab5f9468e40e816ba34809fdaa9aa0fbc5eddb94dbc5ecfd2325f231a
Instruction Fuzzy Hash: 9D01D232401B169FCB32AF66D880817FFE9BF60711315C93EE59662920C771A850DF60

Function 0059890A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00598922

Part of subcall function 00595CE8: HeapFree.KERNEL32(00000000,00000000,?,005989A1,?,00000000,?,00000000,?,005989C8,?,00000007,?,?,00598E2A,?), ref: 00595CFE
Part of subcall function 00595CE8: GetLastError.KERNEL32(?,?,005989A1,?,00000000,?,00000000,?,005989C8,?,00000007,?,?,00598E2A,?,?), ref: 00595D10

_free.LIBCMT ref: 00598934
_free.LIBCMT ref: 00598946
_free.LIBCMT ref: 00598958
_free.LIBCMT ref: 0059896A

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6a500474bf3164454ccc65a2f81627273d1eaa1102ca1f207bc0292d26f8da9b
Instruction ID: b4ddc905ce3dd0f848bfcdad36897d26d32317a100379c8488f2cfc4924fd637
Opcode Fuzzy Hash: 6a500474bf3164454ccc65a2f81627273d1eaa1102ca1f207bc0292d26f8da9b
Instruction Fuzzy Hash: 1AF06232584B08AB8E20EB64F589C3A7FEDFA517143940805F008E7500CF30FC849751

Function 005948D1 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 005948EF

Part of subcall function 00595CE8: HeapFree.KERNEL32(00000000,00000000,?,005989A1,?,00000000,?,00000000,?,005989C8,?,00000007,?,?,00598E2A,?), ref: 00595CFE
Part of subcall function 00595CE8: GetLastError.KERNEL32(?,?,005989A1,?,00000000,?,00000000,?,005989C8,?,00000007,?,?,00598E2A,?,?), ref: 00595D10

_free.LIBCMT ref: 00594901
_free.LIBCMT ref: 00594914
_free.LIBCMT ref: 00594925
_free.LIBCMT ref: 00594936

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 04810e37403fa94fbc6f97e728caefff798d9764f35e9003e10ae7a2e11c1679
Instruction ID: 16dd13e3376317b46f9f4fcc895ab1eeb930b6635bd573201e1732a026e64332
Opcode Fuzzy Hash: 04810e37403fa94fbc6f97e728caefff798d9764f35e9003e10ae7a2e11c1679
Instruction Fuzzy Hash: BBF01774841E668F9A126B18BC4AC083F68F734B20B09056AF02062271DB240D99FF82

Function 005A7ED3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 137timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,00000000,00000000,clbcatq.dll,00000000,clbcatq.dll,00000000,00000000,00000000), ref: 005A7FE0
GetLastError.KERNEL32 ref: 005A7FEA

Strings

clbcatq.dll, xrefs: 005A7EF1, 005A7EFC
c:\agent\_work\66\s\src\libs\dutil\timeutil.cpp, xrefs: 005A800E

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Time$ErrorFileLastSystem
String ID: c:\agent\_work\66\s\src\libs\dutil\timeutil.cpp$clbcatq.dll
API String ID: 2781989572-2453645868
Opcode ID: ae28fd75f85dbaeed8c57ee7d7ff13f5cd7c708d743f466941381ce386cbbf5a
Instruction ID: 14dbfc6252ad286fe0bf5e6404235a3b913dd0b3946be11c3ee647210a75a206
Opcode Fuzzy Hash: ae28fd75f85dbaeed8c57ee7d7ff13f5cd7c708d743f466941381ce386cbbf5a
Instruction Fuzzy Hash: AC41D236E1820B6ADB20ABB88C09BBEBE74BF96701F144429F501B7180E675DF04C7A1

Function 005A2F2C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(000002C0), ref: 005A2F46
SysAllocString.OLEAUT32(?), ref: 005A2F56
VariantClear.OLEAUT32(?), ref: 005A3035

Strings

c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp, xrefs: 005A2F6E

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Variant$AllocClearInitString
String ID: c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp
API String ID: 2213243845-3017383397
Opcode ID: a3beee095d4787799a40070246fe23ec157cc1ec08b9d2e01ebd8b815b4efb49
Instruction ID: af670c96f3c3cdad7de299e01129e798ce1c549a0645ffb3bc56063f08280ea2
Opcode Fuzzy Hash: a3beee095d4787799a40070246fe23ec157cc1ec08b9d2e01ebd8b815b4efb49
Instruction Fuzzy Hash: 8D418275900225AFCB10EFA8C888EAEBFB8BF16754F0541A5FD01EB201D735DE408BA0

Function 005908B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 005908E3
__IsNonwritableInCurrentImage.LIBCMT ref: 0059099C

Strings

csm, xrefs: 00590986
8X, xrefs: 005909B5

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: 8X$csm
API String ID: 3480331319-733475224
Opcode ID: 831213aee3b12e9ed9c035a56231ab410658661e989db997163d213fc338cbb7
Instruction ID: 91aab135983f0c81df5b85953c42bc252c43ff56b1c49a7c421822ee402f60f0
Opcode Fuzzy Hash: 831213aee3b12e9ed9c035a56231ab410658661e989db997163d213fc338cbb7
Instruction Fuzzy Hash: CF41A234E00219AFCF10DF68C848AAEBFA5BF85324F149A55E8186B2D2D731DE05CB90

Function 005A0708 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000002,00000100,00000000,00000000,?,?,00588B57), ref: 005A0763
RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00588B57,00000000), ref: 005A0781
RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000003,?,?,00588B57,00000000,00000000,00000000), ref: 005A07D7

Strings

c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 005A07A7

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Enum$InfoQuery
String ID: c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 73471667-3237223240
Opcode ID: 50ffb46ec399ac428e0b928861a83fcdeadd5ecd9ecfd8f11972ddb5694abfe6
Instruction ID: 9fac2a322e6fe137f84d9e08da856b2e6184eda35c0420af6e82a18f7bdaa0aa
Opcode Fuzzy Hash: 50ffb46ec399ac428e0b928861a83fcdeadd5ecd9ecfd8f11972ddb5694abfe6
Instruction Fuzzy Hash: 8F31A17691152AFBEB118A94CC84EAFBFACFF01794F114065BD01AB190D634AE00EAA4

Function 005939BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe,00000104), ref: 005939F8
_free.LIBCMT ref: 00593AC3
_free.LIBCMT ref: 00593ACD

Strings

C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe, xrefs: 005939EF, 005939F6, 00593A25, 00593A5D

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\MemProfilerInstaller5_7_28.exe
API String ID: 2506810119-1254916115
Opcode ID: b3353bfd20cb26ce2d53c591eddd6c3eaa1c3efa38404d38bf0147fdcc4f865f
Instruction ID: c21fec600145cb6c4b21a2b90e04eb0fc586bd41654ad45c4b6dd66a1f1bf5b2
Opcode Fuzzy Hash: b3353bfd20cb26ce2d53c591eddd6c3eaa1c3efa38404d38bf0147fdcc4f865f
Instruction Fuzzy Hash: BA316971A00609EFDF21DF999885DAEBFECFB94710F14406AE844A7211D6718F45DB90

Function 005A8B19 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005A85F6: lstrlenW.KERNEL32(00000100,?,?,?,005A8996,000002C0,00000100,00000100,00000100,?,?,?,00587AD3,?,?,000001BC), ref: 005A861B

RegCloseKey.ADVAPI32(00000000,00000000,crypt32.dll,00000000,00000000,00000000,00000000,crypt32.dll), ref: 005A8BFE
RegCloseKey.ADVAPI32(00000001,00000000,crypt32.dll,00000000,00000000,00000000,00000000,crypt32.dll), ref: 005A8C18

Part of subcall function 005A04A5: RegCreateKeyExW.ADVAPI32(00000001,00000000,00000000,00000000,00000000,00000001,00000000,?,00000000,00000001,?,?,005705B1,?,00000000,00020006), ref: 005A04CA

Part of subcall function 005A0D87: RegSetValueExW.ADVAPI32(00020006,005AFF38,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,0056F2DF,00000000,?,00020006), ref: 005A0DBA

Part of subcall function 005A0D87: RegDeleteValueW.ADVAPI32(00020006,005AFF38,00000000,?,?,0056F2DF,00000000,?,00020006,?,005AFF38,00020006,00000000,?,?,?), ref: 005A0DEA

Part of subcall function 005A0D39: RegSetValueExW.ADVAPI32(?,00000005,00000000,00000004,?,00000004,00000001,?,0056F237,005AFF38,Resume,00000005,?,00000000,00000000,00000000), ref: 005A0D4E

Strings

crypt32.dll, xrefs: 005A8B27
%ls\%ls, xrefs: 005A8B7A

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Value$Close$CreateDeletelstrlen
String ID: %ls\%ls$crypt32.dll
API String ID: 3924016894-1754266218
Opcode ID: 6c05af34294b5044b732ab330f13edce7a7bf7bcabe3dc3cbb9b979f2c4a1436
Instruction ID: 844d26f071b2a03f034b2366cab2c18f72c49e9b9020a4a9a70e7fa99382d2fd
Opcode Fuzzy Hash: 6c05af34294b5044b732ab330f13edce7a7bf7bcabe3dc3cbb9b979f2c4a1436
Instruction Fuzzy Hash: C731F8B2C0152EBF8F12AFD4CD81DAEBFB9FF45754B014166A90076121DB319E51ABA0

Function 00588857 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 75registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005A0823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,005CAA7C,00000000,?,005A4FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 005A0837

RegCloseKey.ADVAPI32(00000000,00000000,00000088,00000000,000002C0,00000410,00020019,00000000,000002C0,00000000,?,?,?,00588B93,00000000,00000000), ref: 00588914

Strings

Failed to ensure there is space for related bundles., xrefs: 005888C7
Failed to open uninstall key for potential related bundle: %ls, xrefs: 00588883
Failed to initialize package from related bundle id: %ls, xrefs: 005888FA

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseOpen
String ID: Failed to ensure there is space for related bundles.$Failed to initialize package from related bundle id: %ls$Failed to open uninstall key for potential related bundle: %ls
API String ID: 47109696-1717420724
Opcode ID: 04eae2780edec299522c4ac80e9af7b2497b89ae6333397480504eb6033def12
Instruction ID: 9877e8510205eb69a931990a818c4eaac8f98090083b284fcd499887664b7f59
Opcode Fuzzy Hash: 04eae2780edec299522c4ac80e9af7b2497b89ae6333397480504eb6033def12
Instruction Fuzzy Hash: 6A21687290021ABBDF12AE90CC0ABFEBF78FB04710F544065FD10B6150EB71AA20EB91

Function 00563BA1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80004005,00000000,00000000,00000100,?,0056146A,00000000,80004005,00000000,80004005,00000000,000001C7,?,005613B0), ref: 00563BBF
HeapReAlloc.KERNEL32(00000000,?,0056146A,00000000,80004005,00000000,80004005,00000000,000001C7,?,005613B0,000001C7,00000100,?,80004005,00000000), ref: 00563BC6

Part of subcall function 005639DF: GetProcessHeap.KERNEL32(?,000001C7,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F0
Part of subcall function 005639DF: RtlAllocateHeap.NTDLL(00000000,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F7

Part of subcall function 00563C5F: GetProcessHeap.KERNEL32(00000000,000001C7,?,005622D5,000001C7,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 00563C67
Part of subcall function 00563C5F: HeapSize.KERNEL32(00000000,?,005622D5,000001C7,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 00563C6E

_memcpy_s.LIBCMT ref: 00563C12

Strings

c:\agent\_work\66\s\src\libs\dutil\memutil.cpp, xrefs: 00563C53

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Heap$Process$AllocAllocateSize_memcpy_s
String ID: c:\agent\_work\66\s\src\libs\dutil\memutil.cpp
API String ID: 3406509257-1758765531
Opcode ID: 7e84bf54135d0dfc8cd743681599c758cbaa7dcb75d18028b05180d2b2895333
Instruction ID: fdc927d1ef8755dbe5e1847a2621989e63c1ca5b722741941358b61862842836
Opcode Fuzzy Hash: 7e84bf54135d0dfc8cd743681599c758cbaa7dcb75d18028b05180d2b2895333
Instruction Fuzzy Hash: DE11063160015ABFEF216F68DD49C6E3E5AFF81760B054614F814AB261CB36CF24A790

Function 005A8109 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69timeCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 005A814D
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 005A8175
GetLastError.KERNEL32 ref: 005A817F

Strings

c:\agent\_work\66\s\src\libs\dutil\inetutil.cpp, xrefs: 005A81A0

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLastTime$FileSystem
String ID: c:\agent\_work\66\s\src\libs\dutil\inetutil.cpp
API String ID: 1528435940-2024166147
Opcode ID: 479048803f070dda535fe85732450bd2112393b182d3d0b4002bd93136aa400c
Instruction ID: 9ba275279bc81df7be332a14a4728ada430d91f7d25b6f389fe8e95344b5428d
Opcode Fuzzy Hash: 479048803f070dda535fe85732450bd2112393b182d3d0b4002bd93136aa400c
Instruction Fuzzy Hash: 1E11967390162AABE721DBA5CD49BAFBFA8BB05790F110425EE01F7140EA249D05D6E1

Function 005A002E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62filestringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenA.KERNEL32(00581074,00000000,00000000,?,?,?,0059F8EB,00581074,00581074,?,00000000,0000FDE9,?,00581074,8007139F,Invalid operation for this state.), ref: 005A0040
WriteFile.KERNEL32(FFFFFFFF,00000000,00000000,?,00000000,?,?,0059F8EB,00581074,00581074,?,00000000,0000FDE9,?,00581074,8007139F), ref: 005A007C
GetLastError.KERNEL32(?,?,0059F8EB,00581074,00581074,?,00000000,0000FDE9,?,00581074,8007139F,Invalid operation for this state.,c:\agent\_work\66\s\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 005A0086

Strings

c:\agent\_work\66\s\src\libs\dutil\logutil.cpp, xrefs: 005A00B7

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorFileLastWritelstrlen
String ID: c:\agent\_work\66\s\src\libs\dutil\logutil.cpp
API String ID: 606256338-727082060
Opcode ID: 12ea6f4f63e0c3053465128316e3034af0f0c31cff638d861e5f9d5a606070c4
Instruction ID: 263906ed4a6a2967b5b9dac2e8ee55a40895841d48fb3f42faee5f12d5394029
Opcode Fuzzy Hash: 12ea6f4f63e0c3053465128316e3034af0f0c31cff638d861e5f9d5a606070c4
Instruction Fuzzy Hash: A011A372A11625AB97219AB58D4CFEF7EA8FB627A0F410614FD01E7280E7A0DD40D6E0

Function 00561206 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,0056527C,00000000,?), ref: 00561244
GetLastError.KERNEL32(?,?,?,0056527C,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 0056124E

Strings

c:\agent\_work\66\s\src\libs\dutil\apputil.cpp, xrefs: 0056126F
ignored , xrefs: 00561213

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ArgvCommandErrorLastLine
String ID: c:\agent\_work\66\s\src\libs\dutil\apputil.cpp$ignored
API String ID: 3459693003-1283515844
Opcode ID: 4be381a80c6c01b2800dc6b13866abdac13ff324535781f3590ef7d7aa66d028
Instruction ID: f6b13e61fc2119b05d9dfa2c0f45e28faaae84a6508b6582ae7416b634ea0c4a
Opcode Fuzzy Hash: 4be381a80c6c01b2800dc6b13866abdac13ff324535781f3590ef7d7aa66d028
Instruction Fuzzy Hash: 5E11917AD01525EB8B21DB9AC915DAEBFB8FF45B50B054155FD00E7210E770DE00DAE4

Function 0059F6FD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00000900,?,?,00000000,00000000,00000000,?,00000000,?,?,0059FDC0,?,?,?,?,00000001), ref: 0059F71C
GetLastError.KERNEL32(?,0059FDC0,?,?,?,?,00000001,?,00565651,?,?,00000000,?,?,005653D2,00000002), ref: 0059F728
LocalFree.KERNEL32(00000000,?,?,00000000,?,?,0059FDC0,?,?,?,?,00000001,?,00565651,?,?), ref: 0059F791

Strings

c:\agent\_work\66\s\src\libs\dutil\logutil.cpp, xrefs: 0059F747

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: c:\agent\_work\66\s\src\libs\dutil\logutil.cpp
API String ID: 1365068426-727082060
Opcode ID: 883d85a729b78f9d98a054112656be3964111d36e8496a67b8daf1a65f8bc373
Instruction ID: bca07cb79b4108f5a81c88a474dc0758f18ee8e8946c57fb72ea238e89657267
Opcode Fuzzy Hash: 883d85a729b78f9d98a054112656be3964111d36e8496a67b8daf1a65f8bc373
Instruction Fuzzy Hash: 6F119A3260012ABBDF219FD0DD09EAE7E69FF54750F018029FD01E6160D7308E60E7A0

Function 0058CE8D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00000000,74DF30D0,?,?,0058D0C2,00000000,00000000,00000000,00000000), ref: 0058CE9D
ReleaseMutex.KERNEL32(?,?,0058D0C2,00000000,00000000,00000000,00000000), ref: 0058CF24

Part of subcall function 005639DF: GetProcessHeap.KERNEL32(?,000001C7,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F0
Part of subcall function 005639DF: RtlAllocateHeap.NTDLL(00000000,?,0056237C,?,00000001,80004005,8007139F,?,?,0059FB39,8007139F,?,00000000,00000000,8007139F), ref: 005639F7

Strings

c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp, xrefs: 0058CEE2
Failed to allocate memory for message data, xrefs: 0058CEEC

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Heap$AllocateMutexObjectProcessReleaseSingleWait
String ID: Failed to allocate memory for message data$c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp
API String ID: 2993511968-3819074818
Opcode ID: 0ea3ef61eb9c78eb4909f475da2a21ecea19705b77b7075b23deeeb4392d5437
Instruction ID: 13d693104bf6d165c04bc4c9c7e9b726e1c6d4fff7c868c871ee516718fa5a9a
Opcode Fuzzy Hash: 0ea3ef61eb9c78eb4909f475da2a21ecea19705b77b7075b23deeeb4392d5437
Instruction Fuzzy Hash: DD118CB1300216AFDB159F28EC95EAABFE5FF49720B104165F9059B3A1C771AC20CBA4

Function 005A45C9 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(002E0032,40000000,00000001,00000000,00000002,00000080,00000000,00570458,00000000,?,0056F49C,005AA500,00000080,002E0032,00000000), ref: 005A45E1
GetLastError.KERNEL32(?,0056F49C,005AA500,00000080,002E0032,00000000,?,00570458,crypt32.dll,00000094,?,?,?,?,?,00000000), ref: 005A45EE
CloseHandle.KERNEL32(00000000,00000000,005AA500,0056F49C,?,0056F49C,005AA500,00000080,002E0032,00000000,?,00570458,crypt32.dll,00000094), ref: 005A4642

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 005A4612

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 2528220319-1688708105
Opcode ID: d3907b16a32c89f37b84549e4903fbd07449d9adee1fc06aa0392192f15b76a2
Instruction ID: 64c29a1cb0e6d5fb1cf49aed8342724c345633fa1660664ceb7b216b1bdc1ad5
Opcode Fuzzy Hash: d3907b16a32c89f37b84549e4903fbd07449d9adee1fc06aa0392192f15b76a2
Instruction Fuzzy Hash: DE01D433641125A7DB310EE89C09F5E3E54BBD3B70F064210FF21AB1D0C7B19C01AAA5

Function 005A4199 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000080,00000001,00000000,00000003,00000080,00000000,000002C0,00000000,?,005889B4,00000000,00000088,000002C0,BundleCachePath,00000000), ref: 005A41CD
GetLastError.KERNEL32(?,005889B4,00000000,00000088,000002C0,BundleCachePath,00000000,000002C0,BundleVersion,000000B8,000002C0,EngineVersion,000002C0,000000B0), ref: 005A41DA

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 005A41AE, 005A41FE

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CreateErrorFileLast
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 1214770103-1688708105
Opcode ID: d2f3dc5be0786321c900ca0a98aac3046f1c9bca31ecfcfde4f58dd6c3c0f93a
Instruction ID: 1ac90e175bf6cc53bee3794e3b251def90ac977fc040363a790d683dac1c452e
Opcode Fuzzy Hash: d2f3dc5be0786321c900ca0a98aac3046f1c9bca31ecfcfde4f58dd6c3c0f93a
Instruction Fuzzy Hash: B501A236681121BBE33126D89C0DFAE2E98BF92B61F114111BE01BB1D1C6E54D41EAE5

Function 005706B6 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 49registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005A0823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,005CAA7C,00000000,?,005A4FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 005A0837

RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,00000001,00000000), ref: 00570726

Strings

Failed to update resume mode., xrefs: 005706F7
Failed to open registration key., xrefs: 005706DD
Failed to update name and publisher., xrefs: 00570710

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseOpen
String ID: Failed to open registration key.$Failed to update name and publisher.$Failed to update resume mode.
API String ID: 47109696-1865096027
Opcode ID: e906df57eaa675a3ceb362e31018492099b414f95c07e40418d08d51ca7fdec5
Instruction ID: c334a12ffad90cf7e6e8bf5b5c1fa7bcf897a5c66c24264dd7393563e2b6d676
Opcode Fuzzy Hash: e906df57eaa675a3ceb362e31018492099b414f95c07e40418d08d51ca7fdec5
Instruction Fuzzy Hash: 1601B132950229F7DB165A94EC56F9EBFA9FB81754F105011F504B61D1A7B0AE10BBC0

Function 005A3183 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(005AA594), ref: 005A31C8
SysFreeString.OLEAUT32(00000000), ref: 005A31FB

Strings

`<u, xrefs: 005A31FB
c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp, xrefs: 005A3199, 005A31DF

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: String$AllocFree
String ID: `<u$c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp
API String ID: 344208780-1301604586
Opcode ID: 2563f8ee9148495273c91190906da950fad54378be8328979920cef2e8e3d51c
Instruction ID: 8b394fac04b238c06bbf54af019eea7509319080e4aed232fb506f343925b5d0
Opcode Fuzzy Hash: 2563f8ee9148495273c91190906da950fad54378be8328979920cef2e8e3d51c
Instruction Fuzzy Hash: E501DF31644216ABEB200A949C08FAE3EA8BF92765F10447AF905A7340D6788E05D2A1

Function 005A608D Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 005A60EC

Part of subcall function 005A7ED3: SystemTimeToFileTime.KERNEL32(?,00000000,00000000,clbcatq.dll,00000000,clbcatq.dll,00000000,00000000,00000000), ref: 005A7FE0
Part of subcall function 005A7ED3: GetLastError.KERNEL32 ref: 005A7FEA

Strings

clbcatq.dll, xrefs: 005A60B9
`<u, xrefs: 005A60EC
c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp, xrefs: 005A60DA

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Time$ErrorFileFreeLastStringSystem
String ID: `<u$c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp$clbcatq.dll
API String ID: 211557998-485600161
Opcode ID: 3b194dde7f33113cdcbd6a7c14f74dc44458ed9e106afd6fba68cbe979a8d2e4
Instruction ID: 6e9c266ba1f8faef33569b0638a51f38dbc77d387c53f670585c24cda0919132
Opcode Fuzzy Hash: 3b194dde7f33113cdcbd6a7c14f74dc44458ed9e106afd6fba68cbe979a8d2e4
Instruction Fuzzy Hash: 2A01D171900127FF8B209F95884989EFFA8FF16760B14817AF604A7111D371CE44E7A0

Function 0057EB14 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009002,00000000,?), ref: 0057EB3C
GetLastError.KERNEL32 ref: 0057EB46

Strings

c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp, xrefs: 0057EB6A
Failed to post elevate message., xrefs: 0057EB74

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post elevate message.$c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp
API String ID: 2609174426-3565835173
Opcode ID: b7feeae078e6c4326c6e96c9429bfa28ac19a4172ebf943eea3611057973f0d2
Instruction ID: 3bb32bc5786cb16c282d01caacd81d5a4fd60a3c84f1ebfe8e8077e3a602f6ec
Opcode Fuzzy Hash: b7feeae078e6c4326c6e96c9429bfa28ac19a4172ebf943eea3611057973f0d2
Instruction Fuzzy Hash: C3F0F637A41331A7C7205A98AC0BE977F84BF09B30F118265BE1DAF2C1D7259C02A3D4

Function 0056D88A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,BootstrapperApplicationDestroy), ref: 0056D8B1
FreeLibrary.KERNEL32(?,?,00564920,00000000,?,?,005654CB,?,?), ref: 0056D8C0
GetLastError.KERNEL32(?,00564920,00000000,?,?,005654CB,?,?), ref: 0056D8CA

Strings

BootstrapperApplicationDestroy, xrefs: 0056D8A9

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AddressErrorFreeLastLibraryProc
String ID: BootstrapperApplicationDestroy
API String ID: 1144718084-3186005537
Opcode ID: c70faf7bc86d5f8e84474d992ce674d30077cfc69bdef34c7aad9b134f9d44d3
Instruction ID: 39be0c4881c6d798af49b5e8dc6337048aa5b2a7849ba8a9324b14fd47ea9e8e
Opcode Fuzzy Hash: c70faf7bc86d5f8e84474d992ce674d30077cfc69bdef34c7aad9b134f9d44d3
Instruction Fuzzy Hash: 89F0C232B00626ABC7205FA5D808B2AFBB4FF517627058629E814D7520C720EC50DBE0

Function 005A2A57 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 005A2A6C
SysFreeString.OLEAUT32(00000000), ref: 005A2A9C

Strings

`<u, xrefs: 005A2A9C
c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp, xrefs: 005A2A80

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: String$AllocFree
String ID: `<u$c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp
API String ID: 344208780-1301604586
Opcode ID: 448419d8b5c0e0ec4f75d86dd46de5349a5e8bc1d0b694d03ec92032a4bd562c
Instruction ID: 5f02966578a7bc06c465614cd860fbc1f86dca5ac5dc49d265646baebcd5c0da
Opcode Fuzzy Hash: 448419d8b5c0e0ec4f75d86dd46de5349a5e8bc1d0b694d03ec92032a4bd562c
Instruction Fuzzy Hash: 3CF0B431201555EBC7314F48AC09F6F7F65BF82761F144029FC0467210C7B48D10DAE5

Function 005A2CFC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 005A2D11
SysFreeString.OLEAUT32(00000000), ref: 005A2D41

Strings

`<u, xrefs: 005A2D41
c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp, xrefs: 005A2D28

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: String$AllocFree
String ID: `<u$c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp
API String ID: 344208780-1301604586
Opcode ID: 830e0b3f55b6e554d892be45f4afcd7ca6fcc9a79fbbbc373db5040a48f9c7b2
Instruction ID: eb5ae92d756bb20b97f170aa0f5846abbadccea67cc843f2a042a0e94550197b
Opcode Fuzzy Hash: 830e0b3f55b6e554d892be45f4afcd7ca6fcc9a79fbbbc373db5040a48f9c7b2
Instruction Fuzzy Hash: F3F0BE31201155ABCB225F48DC09EAE7F68BB82760F10441AFD08AF221C778DD02EAA1

Function 0057F11E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009001,00000000,?), ref: 0057F133
GetLastError.KERNEL32 ref: 0057F13D

Strings

c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp, xrefs: 0057F161
Failed to post plan message., xrefs: 0057F16B

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post plan message.$c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp
API String ID: 2609174426-4270167399
Opcode ID: d82feb7318e933893deb6f33708d0a2dc3f69d247e8e0d22057af525e32bb326
Instruction ID: 7f55f62df86bdd5454059b38ec70cd8ab84a0742e750d6b7516a51068eae2b2b
Opcode Fuzzy Hash: d82feb7318e933893deb6f33708d0a2dc3f69d247e8e0d22057af525e32bb326
Instruction Fuzzy Hash: CAF0A7336412316B97219AA9EC09D87BE84BF06BB0F124031BE0CAB281E6259C00D2E1

Function 0057F22C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009005,?,00000000), ref: 0057F241
GetLastError.KERNEL32 ref: 0057F24B

Strings

Failed to post shutdown message., xrefs: 0057F279
c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp, xrefs: 0057F26F

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post shutdown message.$c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp
API String ID: 2609174426-519151043
Opcode ID: fdace0c189ed2623ae5ac7cac1355944b303af808748141b8287e9a1780eca0a
Instruction ID: 8196f0eda736d679e5d1806d49d3099d0553d01cc7aa0a7231d8c59ebfe482d6
Opcode Fuzzy Hash: fdace0c189ed2623ae5ac7cac1355944b303af808748141b8287e9a1780eca0a
Instruction Fuzzy Hash: 6BF0A73B6412356797215AE56C0DE8B7E44BF05B60B028021BE08BB181E6149C00D7D5

Function 00580564 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(005AA478,00000000,?,005814B9,?,00000000,BTV,0056C24A,?,BTV,?,00577498,?,?,00565442,?), ref: 0058056E
GetLastError.KERNEL32(?,005814B9,?,00000000,BTV,0056C24A,?,BTV,?,00577498,?,?,00565442,?,00565482,00000001), ref: 00580578

Strings

c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 0058059C
Failed to set begin operation event., xrefs: 005805A6

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorEventLast
String ID: Failed to set begin operation event.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 3848097054-3321223842
Opcode ID: d5e3fa37338c9b8e0e247af7dbf1bb8bccb8fb1e52a9e6c20d10c3ad3c9aa95b
Instruction ID: 71f16cbc2015ae52e1758a2a18cefe7a55c418f02bdbf16a0b5f3977c69a2975
Opcode Fuzzy Hash: d5e3fa37338c9b8e0e247af7dbf1bb8bccb8fb1e52a9e6c20d10c3ad3c9aa95b
Instruction Fuzzy Hash: 21F0EC3794263227532137956D0AADB7F88BF06B617010025FE05FB280F715EC0457F5

Function 0057EA1A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009003,00000000,?), ref: 0057EA2F
GetLastError.KERNEL32 ref: 0057EA39

Strings

Failed to post apply message., xrefs: 0057EA67
c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp, xrefs: 0057EA5D

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post apply message.$c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp
API String ID: 2609174426-1324423724
Opcode ID: a49473e113072613b3fa5fad8c98d548e5d48167f09a5456f70025a52c67496b
Instruction ID: affd9b2d249822229c3b206b19fb3086b740e872244347539ad3410596b348e7
Opcode Fuzzy Hash: a49473e113072613b3fa5fad8c98d548e5d48167f09a5456f70025a52c67496b
Instruction Fuzzy Hash: F8F0A7336413366B972156A5AC0ED8BBF84BF05B60B024061BE0CBB281E6149D00D2D1

Function 0057EAAB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009000,00000000,?), ref: 0057EAC0
GetLastError.KERNEL32 ref: 0057EACA

Strings

c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp, xrefs: 0057EAEE
Failed to post detect message., xrefs: 0057EAF8

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post detect message.$c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp
API String ID: 2609174426-2517332631
Opcode ID: c0800ade215e176d1b13b745b7f4649680a86c84b67d9a527991379fa4fb3abc
Instruction ID: 2ff6fb38aceec53ed7421bcdbb8a3ca54da89d4a117af59a052619d84aa952fa
Opcode Fuzzy Hash: c0800ade215e176d1b13b745b7f4649680a86c84b67d9a527991379fa4fb3abc
Instruction Fuzzy Hash: 40F0A7336413316797211A956C0EE8BBF98FF15B60B124055BE0CBF180D614AC00E2D4

Function 005963C9 Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00596454
__alldvrm.LIBCMT ref: 00596655
__alldvrm.LIBCMT ref: 00596677

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: ad949144aaf5d9b16d0cabd91b61aa8499d9bd64d722724cfcb4a13481783838
Instruction ID: 7c1058913b75a2380b4f064e5bee7a8abfa5a33c8ca1a2d2e7bb1c53679bb45e
Opcode Fuzzy Hash: ad949144aaf5d9b16d0cabd91b61aa8499d9bd64d722724cfcb4a13481783838
Instruction Fuzzy Hash: 95A16672A003969FDF22CF68C891BAEBFE4FF55350F19416DE9859B281C6388D49CB50

Function 005A56B4 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 162stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 005A5781
lstrlenW.KERNEL32(00000000), ref: 005A5799

Strings

c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp, xrefs: 005A5822

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: lstrlen
String ID: c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp
API String ID: 1659193697-16760509
Opcode ID: ad4cb3460f2023a11b2236c6717c6d76591f48a5b166301819b5030dda5374bb
Instruction ID: 6a046596bf19a6cc925ec061dd4d64d7d87ab09d746ba9bdde3039c0f3f7f624
Opcode Fuzzy Hash: ad4cb3460f2023a11b2236c6717c6d76591f48a5b166301819b5030dda5374bb
Instruction Fuzzy Hash: 72516076D01A2AAFDB129FA48884DAEBFB9FF89750B154014F904B7210E774DD41DBA0

Function 005A8352 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 146COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 005A846B

Strings

c:\agent\_work\66\s\src\libs\dutil\uriutil.cpp, xrefs: 005A848C
<, xrefs: 005A83BC
WZ, xrefs: 005A8394

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast
String ID: WZ$<$c:\agent\_work\66\s\src\libs\dutil\uriutil.cpp
API String ID: 1452528299-3490909556
Opcode ID: 664dd0ed77feedcf27040adb97a7f8c270b74accdffac6913c8ec8aad9acd9a0
Instruction ID: 70f76acb3114898fa2f14cec5c3e37b828e6993af0384fa79872ab76d3f0bb5a
Opcode Fuzzy Hash: 664dd0ed77feedcf27040adb97a7f8c270b74accdffac6913c8ec8aad9acd9a0
Instruction Fuzzy Hash: 20510C75D016399BCF31DF65CC88A9DBBB8BF09714F4141EAA908B7211DB309E888F51

Function 00564FE1 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00000000,?,0056558F,?,?,?,?,?,?), ref: 0056503B
DeleteCriticalSection.KERNEL32(?,?,?,00000000,?,0056558F,?,?,?,?,?,?), ref: 0056504F
TlsFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,0056558F,?,?), ref: 0056513E
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,0056558F,?,?), ref: 00565145

Part of subcall function 0056115F: LocalFree.KERNEL32(?,?,00564FF8,?,00000000,?,0056558F,?,?,?,?,?,?), ref: 00561169

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CriticalDeleteFreeSection$CloseHandleLocal
String ID:
API String ID: 3671900028-0
Opcode ID: 6efb2d852ddf06d68f4c985f7d3f0a92df1b52b521225c315e1f743f6e8353ed
Instruction ID: 04e7b1ae7766c76bf90b82d124bc37b6afa68095a26f158a476b6cc435479fa2
Opcode Fuzzy Hash: 6efb2d852ddf06d68f4c985f7d3f0a92df1b52b521225c315e1f743f6e8353ed
Instruction Fuzzy Hash: 3741FAB1640B06ABDA61EBB0C84DF9B7BECBF55310F444829B299D3051EB34E544CB64

Function 00564CC9 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0056F90C: RegCloseKey.ADVAPI32(00000000,?,?,00000001,00000000,00000000,?,?,00564CE8,?,?,00000001), ref: 0056F95C

CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,?,?,00000001,00000000,?,?,?), ref: 00564D4F

Strings

Unable to get resume command line from the registry, xrefs: 00564CEE
Failed to re-launch bundle process after RunOnce: %ls, xrefs: 00564D39
Failed to get current process path., xrefs: 00564D0D

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Close$Handle
String ID: Failed to get current process path.$Failed to re-launch bundle process after RunOnce: %ls$Unable to get resume command line from the registry
API String ID: 187904097-642631345
Opcode ID: 99c61bfb25b380eb4c052da04a75477b5a95daf21e20827b81cc6fefc72f0c3e
Instruction ID: c6967369807f1524ca6a6c306fa580c478614b29fb364c18b662828e94e267f5
Opcode Fuzzy Hash: 99c61bfb25b380eb4c052da04a75477b5a95daf21e20827b81cc6fefc72f0c3e
Instruction Fuzzy Hash: 12114C71D00619BACF22AB94D8098AEBFB8FF91710B108166F811B7211E7719F40EB91

Function 0059815F Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00598303,00000000,00000000,?,00598106,00598303,00000000,00000000,00000000,?,00598303,00000006,FlsSetValue), ref: 00598191
GetLastError.KERNEL32(?,00598106,00598303,00000000,00000000,00000000,?,00598303,00000006,FlsSetValue,005C1A28,FlsSetValue,00000000,00000364,?,005959FB), ref: 0059819D
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00598106,00598303,00000000,00000000,00000000,?,00598303,00000006,FlsSetValue,005C1A28,FlsSetValue,00000000), ref: 005981AB

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 6c31c998059343e0f49f304565c039aebc51748e94b8bffc5a169afca7826b24
Instruction ID: 896bd1cfca0ea34df461a80e72161b411217246678f270402082e2d145910335
Opcode Fuzzy Hash: 6c31c998059343e0f49f304565c039aebc51748e94b8bffc5a169afca7826b24
Instruction Fuzzy Hash: D701F736645622ABCF214B689C44EB77F9CBF577A1B140920FD06D3140DF20D806E6E0

Function 0056743E Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0056744A
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 005674B1

Strings

Failed to get value as numeric for variable: %ls, xrefs: 005674A0
Failed to get value of variable: %ls, xrefs: 00567484

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as numeric for variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-4270472870
Opcode ID: b83ad1cf0849a9da537c850a6fd5e5337b7c0d066dd075e7274d20564853a800
Instruction ID: 6ba01b344a0328b02c19c83ac8f19bd203178380089d1e5441eed00d902ba8b7
Opcode Fuzzy Hash: b83ad1cf0849a9da537c850a6fd5e5337b7c0d066dd075e7274d20564853a800
Instruction Fuzzy Hash: 3401967294452CBBCF126F50CC0EA8E7F29BF1832AF108120FD04AB221DB369A50E7D0

Function 005675AD Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 005675B9
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00567620

Strings

Failed to get value as version for variable: %ls, xrefs: 0056760F
Failed to get value of variable: %ls, xrefs: 005675F3

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as version for variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-1851729331
Opcode ID: cbf681558399dd699b1779638a1b20e3238f7d50dd5e5fec615fc98d717b5192
Instruction ID: 13c6a12e24a3929c2d2fa5c932edbf7f34ac530dd28d6771e2e1c8ee9f3c8c46
Opcode Fuzzy Hash: cbf681558399dd699b1779638a1b20e3238f7d50dd5e5fec615fc98d717b5192
Instruction Fuzzy Hash: 32017C7294452DBBCF216F48CC09A8E7F64BB25729F144061FD05AB261D3359A10EBD5

Function 0056753E Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000006,?,0056985C,00000000,?,00000000,00000000,00000000,?,0056969D,00000000,?,00000000,00000000), ref: 0056754A
LeaveCriticalSection.KERNEL32(00000000,00000000,00000000,00000000,?,0056985C,00000000,?,00000000,00000000,00000000,?,0056969D,00000000,?,00000000), ref: 005675A0

Strings

Failed to copy value of variable: %ls, xrefs: 0056758F
Failed to get value of variable: %ls, xrefs: 00567570

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to copy value of variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-2936390398
Opcode ID: 11678eceb4c3e9bdc596c64c1b3afca215a3880791fa6640482c5c3b751c35cf
Instruction ID: 3a0fe16aea3595da40f72a666506fdbe7af5649cb776ca2c2b6d3ba3f23669ad
Opcode Fuzzy Hash: 11678eceb4c3e9bdc596c64c1b3afca215a3880791fa6640482c5c3b751c35cf
Instruction Fuzzy Hash: 3FF03C72944229BBCF026F94CC0999E7F69FF69369F1480A0FD05A7261D7359A10EB90

Function 00567F3B Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,74DEDFD0,?,BTV,00575C58,005AA4A0,BTV,?,BTV,00000000,00000000,005653FA,00000000), ref: 00567F47
LeaveCriticalSection.KERNEL32(00000000,00000000,005653FA,00000000,?,BTV,00575C58,005AA4A0,BTV,?,BTV,00000000,00000000,005653FA,00000000), ref: 00567F95

Strings

BTV, xrefs: 00567F3B
Failed to get visibility of variable: %ls, xrefs: 00567F77

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: BTV$Failed to get visibility of variable: %ls
API String ID: 3168844106-886121279
Opcode ID: ccc8f59148f1651e0ce8a0e026b868ac2ca2bb4db48426d79de8515c4d41c44a
Instruction ID: cd2ecef2ae0bfdea9e05524462ca1274771414d4f19310955585a82af61f045f
Opcode Fuzzy Hash: ccc8f59148f1651e0ce8a0e026b868ac2ca2bb4db48426d79de8515c4d41c44a
Instruction Fuzzy Hash: 0BF0F276604228BFDB029F50CC09E9EBFB4FB59359F018160FC05AB260E7769E10EB90

Function 0059DC03 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,0059D5DF), ref: 0059DC26

Strings

8X, xrefs: 0059DC9C, 0059DD36, 0059DDEE
tO\, xrefs: 0059DCD8

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: DecodePointer
String ID: 8X$tO\
API String ID: 3527080286-948849841
Opcode ID: f95bbed26a9945e8e4fe882fab5946a974fa56657b63b72cb077553947c44f1b
Instruction ID: 760ad4c7c7652674e5d5e02baa59b9d32612701b304c669a9550bce87c41a454
Opcode Fuzzy Hash: f95bbed26a9945e8e4fe882fab5946a974fa56657b63b72cb077553947c44f1b
Instruction Fuzzy Hash: 09516C7490460ECFCF10DFA8E948AACBFB4FF5A304F650599D481AB264CB758E24DB64

Function 005A0517 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000), ref: 005A0692

Strings

c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 005A067F

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Close
String ID: c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 3535843008-3237223240
Opcode ID: c342762fdbd88e1ef521bf9c29d398656b99e811b851f3bf654dd4b70341a334
Instruction ID: f695cae929f364eeb42db34da36766a4510082b12d4b3cca4226486a674302bd
Opcode Fuzzy Hash: c342762fdbd88e1ef521bf9c29d398656b99e811b851f3bf654dd4b70341a334
Instruction Fuzzy Hash: 5141E332D20126EFDF319A94CC04BAE7EA1BB86724F199125ED05AB1D0D735CD64EBD0

Function 005A3FBE Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 135registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005A0823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,005CAA7C,00000000,?,005A4FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 005A0837

RegCloseKey.ADVAPI32(00000000,80000002,SYSTEM\CurrentControlSet\Control\Session Manager,00000003,?,?,00000000,00000101), ref: 005A411F

Strings

SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 005A3FCF
PendingFileRenameOperations, xrefs: 005A400F, 005A40F7

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 47109696-3023217399
Opcode ID: ab05385c7140ccb5dbfc26fc1145d430b017740eeef14612cd874c02ac791a8e
Instruction ID: e560ce109473b723dd2f3127e1a46f03ada69725e28b2e63e48f03048d1e1571
Opcode Fuzzy Hash: ab05385c7140ccb5dbfc26fc1145d430b017740eeef14612cd874c02ac791a8e
Instruction Fuzzy Hash: 2C417E71E00215EFCB20EFD4C8499AEBFB5FB96710F114069E601AB251D7B19E41EF50

Function 005A095E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 126registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 005A09D4
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 005A0A0C

Strings

c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 005A0A48

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: QueryValue
String ID: c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 3660427363-3237223240
Opcode ID: e0470e98aa30454efb771ab40148bdbf4c75d2a40b5c8d3d6ccf9d83c6c6be18
Instruction ID: b8bd6b40af026b6e86e377120fb6fa8e23c923470f9ea9ddbe1cfe18b9f7a807
Opcode Fuzzy Hash: e0470e98aa30454efb771ab40148bdbf4c75d2a40b5c8d3d6ccf9d83c6c6be18
Instruction Fuzzy Hash: B941B232D1022AFFDF20DF94C8459AEBFB9BF42750F10916AE900A7191D7309E50DB90

Function 00595F23 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(005AA518,00000000,00000006,00000001,comres.dll,?,00000000,?,00000000,?,?,00000000,00000006,?,comres.dll,?), ref: 00595FF6
GetLastError.KERNEL32 ref: 00596012

Strings

comres.dll, xrefs: 00595F9D, 00595FEB, 00596027

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID: comres.dll
API String ID: 203985260-246242247
Opcode ID: fc78252c5b8199007201e588b9b8ae62b99da9f23264e015c2e598c49ba810a9
Instruction ID: f7468a05ad79638d68a133e8437b8b486a05fc5b28e9f3f98e2ba43ddf98ad7c
Opcode Fuzzy Hash: fc78252c5b8199007201e588b9b8ae62b99da9f23264e015c2e598c49ba810a9
Instruction Fuzzy Hash: 9E31B3B1600A02ABCF229F55C889BAB7FA8FF95760F140169F80456190FB318E14C7A1

Function 005A8705 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005A85F6: lstrlenW.KERNEL32(00000100,?,?,?,005A8996,000002C0,00000100,00000100,00000100,?,?,?,00587AD3,?,?,000001BC), ref: 005A861B

RegCloseKey.ADVAPI32(00000000,?,?,00000000,?,00000000,?,?,?,00000000,wininet.dll,?,005AA500,wininet.dll,?), ref: 005A8805
RegCloseKey.ADVAPI32(?,?,?,00000000,?,00000000,?,?,?,00000000,wininet.dll,?,005AA500,wininet.dll,?), ref: 005A8812

Part of subcall function 005A0823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,005CAA7C,00000000,?,005A4FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 005A0837

Part of subcall function 005A0708: RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000002,00000100,00000000,00000000,?,?,00588B57), ref: 005A0763
Part of subcall function 005A0708: RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00588B57,00000000), ref: 005A0781

Strings

wininet.dll, xrefs: 005A877A, 005A87C7

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Close$EnumInfoOpenQuerylstrlen
String ID: wininet.dll
API String ID: 2680864210-3354682871
Opcode ID: c53c6c79ecc4adda0da455bb5aca3e6e42e7eca626bc4286b79087295deafeb2
Instruction ID: aa36f7e08d9ea2f84e1e842c745f2f99c728c09c9ebecf80a5084d893d7175d3
Opcode Fuzzy Hash: c53c6c79ecc4adda0da455bb5aca3e6e42e7eca626bc4286b79087295deafeb2
Instruction Fuzzy Hash: 7D311972C0012AAFCF11AF94C9848AEBFB9FF45750B254169E91077121DB368E50EBA0

Function 00563ADB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 00563B3E

Strings

wininet.dll, xrefs: 00563AFC
crypt32.dll, xrefs: 00563AFB, 00563B3A, 00563B3C

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: _memcpy_s
String ID: crypt32.dll$wininet.dll
API String ID: 2001391462-82500532
Opcode ID: 4ae1699a8e0cffef73e401e02ee7f8f13826bdea54519662f1ff0bf1fc8a425b
Instruction ID: e41f7200a634c2e02b082e61e4514830c9d6daef9a2a3f4caee3a4f45b5f0f47
Opcode Fuzzy Hash: 4ae1699a8e0cffef73e401e02ee7f8f13826bdea54519662f1ff0bf1fc8a425b
Instruction Fuzzy Hash: 5B112E71600219ABCF08DF29CDD99AF7F69EF89394B148129FD059B351D671EA108BE0

Function 00573A2C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005A0823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,005CAA7C,00000000,?,005A4FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 005A0837

RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000000,?,?,?,?,00573F3C,feclient.dll,?,00000000,?,?,?,00564B57), ref: 00573ACD

Part of subcall function 005A095E: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 005A09D4
Part of subcall function 005A095E: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 005A0A0C

Strings

Logging, xrefs: 00573A5A
SOFTWARE\Policies\Microsoft\Windows\Installer, xrefs: 00573A43

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Logging$SOFTWARE\Policies\Microsoft\Windows\Installer
API String ID: 1586453840-387823766
Opcode ID: 588649a90c999069a24da11233a04762107615bdf89d2687793ca09c0a5053e8
Instruction ID: ed8a515715647a67bdfa41c672b0098d8b2b44bf1a0badca01b6e22d09cc396f
Opcode Fuzzy Hash: 588649a90c999069a24da11233a04762107615bdf89d2687793ca09c0a5053e8
Instruction Fuzzy Hash: 65110836640216BBEB24DB90E90BFFEBF68BB00724F548155E885A7190D7709F81F750

Function 005A0D87 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.ADVAPI32(00020006,005AFF38,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,0056F2DF,00000000,?,00020006), ref: 005A0DBA
RegDeleteValueW.ADVAPI32(00020006,005AFF38,00000000,?,?,0056F2DF,00000000,?,00020006,?,005AFF38,00020006,00000000,?,?,?), ref: 005A0DEA

Strings

c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 005A0E1E

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Value$Delete
String ID: c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 1738766685-3237223240
Opcode ID: ec00bb9f6a3f807a184589053990e8c2f7cc70b76820ef6a343a523fd096f433
Instruction ID: 4ed24e38a686059719c6b8796bc3fc5ec011ad957634b2f161ae188c001d6c4d
Opcode Fuzzy Hash: ec00bb9f6a3f807a184589053990e8c2f7cc70b76820ef6a343a523fd096f433
Instruction Fuzzy Hash: C511A33796123ABBDF214A948D05BAFBE69FB06760F115924FE01BE1D0D670DD10A7E0

Function 0056DD59 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,00000000,000000FF,?,000000FF,IGNOREDEPENDENCIES,00000000,?,?,005873ED,00000000,IGNOREDEPENDENCIES,00000000,?,005AA518), ref: 0056DDAA

Strings

Failed to copy the property value., xrefs: 0056DDDE
IGNOREDEPENDENCIES, xrefs: 0056DD61

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CompareString
String ID: Failed to copy the property value.$IGNOREDEPENDENCIES
API String ID: 1825529933-1412343224
Opcode ID: 146847e3d40a74ddad4354632a908b143b99411beab941249e33dc81e04cb70a
Instruction ID: 3805e0b7c466f38006c576e0becaf1000b966db011fb83e0d4ade58d5d6bc3ae
Opcode Fuzzy Hash: 146847e3d40a74ddad4354632a908b143b99411beab941249e33dc81e04cb70a
Instruction Fuzzy Hash: D811C632B00215AFDB10AF54DC84FA9BFB5BF44321F254975FA199F291CB709850C7A0

Function 00561578 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(0000007F,00000000,00000000,00576FDF,00000000,00576FDF,00000000,00000000,00576FDF,00000000,00000000,00000000,?,00562420,00000000,00000000), ref: 005615BC
GetLastError.KERNEL32(?,00562420,00000000,00000000,00576FDF,00000200,?,005A4ABC,00000000,00576FDF,00000000,00576FDF,00000000,00000000,00000000), ref: 005615C6

Strings

c:\agent\_work\66\s\src\libs\dutil\strutil.cpp, xrefs: 005615EA

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLastString
String ID: c:\agent\_work\66\s\src\libs\dutil\strutil.cpp
API String ID: 3728238275-792799584
Opcode ID: 06ca7cd5f3f2e38a3207b58a3809d461edab1222f77b874a09e3ab7d4337d800
Instruction ID: 7ebda91871395070306e7473231bd1a4ee6bdc0cf3667b6d8f5bf5fd738ef95e
Opcode Fuzzy Hash: 06ca7cd5f3f2e38a3207b58a3809d461edab1222f77b874a09e3ab7d4337d800
Instruction Fuzzy Hash: CA01F933941A366BCB218A958C04EABBE68BFD5760B050114FE11AB240D720DC10DFE5

Function 0057573C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 00575759
CoUninitialize.OLE32(?,00000000,?,?,?,?,?,?,?), ref: 005757B2

Strings

Failed to initialize COM on cache thread., xrefs: 0057576E

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: InitializeUninitialize
String ID: Failed to initialize COM on cache thread.
API String ID: 3442037557-3629645316
Opcode ID: dd348451187442eacc7ca457e525eab04d3a915260c7884e1d2c92eb79c677f9
Instruction ID: a0d0b2b99a9987e948bdc1e98c66a0d0246991e37e857711c80917969278c73c
Opcode Fuzzy Hash: dd348451187442eacc7ca457e525eab04d3a915260c7884e1d2c92eb79c677f9
Instruction Fuzzy Hash: B8016572600515BFDB059F94DC84DDAFFADFF19354B108125F50997210E770AD54D790

Function 005A4E42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(20000004,00000000,00000000,00000000,00000000,00000000,?,?,00578D6E,?,00000001,20000004,00000000,00000000,?,00000000), ref: 005A4E71
SetNamedSecurityInfoW.ADVAPI32(00000000,?,000007D0,00000003,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00578D6E,?), ref: 005A4E8C

Strings

c:\agent\_work\66\s\src\libs\dutil\aclutil.cpp, xrefs: 005A4EB0

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: InfoNamedSecuritySleep
String ID: c:\agent\_work\66\s\src\libs\dutil\aclutil.cpp
API String ID: 2352087905-2024494872
Opcode ID: 270151c66b9341c24ff5feaddad7f5c49fae7aa00bb47aae92418d99f1bd36d8
Instruction ID: f70407394fbd3dbd78c5d3f2912a1abe379284117e8c886409f34c8d9186fddd
Opcode Fuzzy Hash: 270151c66b9341c24ff5feaddad7f5c49fae7aa00bb47aae92418d99f1bd36d8
Instruction Fuzzy Hash: AD013C37901129EBCF229ED59D05E8E7E6AFB85751F024115BD0466110C2B59D21EA91

Function 00598397 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,BCE85006,00000001,?,000000FF), ref: 00598408

Strings

8X, xrefs: 005983E4
LCMapStringEx, xrefs: 005983A8, 005983B2

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: String
String ID: 8X$LCMapStringEx
API String ID: 2568140703-3395053276
Opcode ID: c387b453afc91e6688b5d78c876db83e1b1098530f92c770ae8eceb2f8f9ca36
Instruction ID: 749cf5fe671eca3c6eab3de53d9a2d6e3f29f07f6a5e02a78e5409cbb6e48daf
Opcode Fuzzy Hash: c387b453afc91e6688b5d78c876db83e1b1098530f92c770ae8eceb2f8f9ca36
Instruction Fuzzy Hash: 7A01C23254120ABBCF12AF909D0AEEE7FA2FF49750F054518FA1866161CB729931EB91

Function 00565160 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(burn.clean.room,?,?,?,?,00561104,?,?,00000000), ref: 0056517F
CompareStringW.KERNEL32(0000007F,00000001,?,0000000F,burn.clean.room,0000000F,?,?,?,?,00561104,?,?,00000000), ref: 005651AF

Strings

burn.clean.room, xrefs: 0056516C, 00565179, 005651A6

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CompareStringlstrlen
String ID: burn.clean.room
API String ID: 1433953587-3055529264
Opcode ID: 45c7c396dd62ead03c20080508d0efa223e2ce26b7c21a34173857cd991e77ba
Instruction ID: 4615025b7841131e9172fae21566f8bc293cdf905e249a7593405ae8a2c123c5
Opcode Fuzzy Hash: 45c7c396dd62ead03c20080508d0efa223e2ce26b7c21a34173857cd991e77ba
Instruction Fuzzy Hash: B30186B2650A246F97244B48AD88E77BFACFB2E754F100216F549C3610E3759C94D7A1

Function 005A3448 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005A0823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,005CAA7C,00000000,?,005A4FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 005A0837

RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,00000000,?,?,?,?,?,005A32E8,?), ref: 005A34B9

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, xrefs: 005A3463
EnableLUA, xrefs: 005A348B

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseOpen
String ID: EnableLUA$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
API String ID: 47109696-3551287084
Opcode ID: 3464da1c3c069b5094460373f0d5dcf38bc104139b126304a912ebe8936ecad4
Instruction ID: 387dbce6bfbeaf4906cac3feb42f6d41bdd64cbb3bd88c2c17c5b1b9dff430bc
Opcode Fuzzy Hash: 3464da1c3c069b5094460373f0d5dcf38bc104139b126304a912ebe8936ecad4
Instruction Fuzzy Hash: 58017C72C10229EFDB129BA4C90EB9DFEA8BB09729F204169B901B7050E3B85F44D7D4

Function 005A60FB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 005A6160

Strings

`<u, xrefs: 005A6160
c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp, xrefs: 005A611C

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: FreeString
String ID: `<u$c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp
API String ID: 3341692771-3052637621
Opcode ID: 071e93abd44afa17093547a6ee59f8f0ae702f49dee5c4d39ebdd4bd02ea34b0
Instruction ID: 8fe0107eddbd3d75bcbb7a6909bb9883b5eb5994a06cf5cd34b46beba5fb7f5f
Opcode Fuzzy Hash: 071e93abd44afa17093547a6ee59f8f0ae702f49dee5c4d39ebdd4bd02ea34b0
Instruction Fuzzy Hash: 5E01F436800116FBCB2256948E0AFAEFFB8FF82B60F284125B90077152D3748E00E6A0

Function 005634C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,005610DD,?,00000000), ref: 005634E5
GetLastError.KERNEL32(?,?,?,?,005610DD,?,00000000), ref: 005634FC

Strings

c:\agent\_work\66\s\src\libs\dutil\pathutil.cpp, xrefs: 00563520

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: c:\agent\_work\66\s\src\libs\dutil\pathutil.cpp
API String ID: 2776309574-4168559387
Opcode ID: f10960f8adbf71a24dfee346f948fe5f2e67186633920e4570d866075a041c48
Instruction ID: f2e8bc0d0cdea8f127700f5a05585a2928f60c165c01fd12ea9065496f39792a
Opcode Fuzzy Hash: f10960f8adbf71a24dfee346f948fe5f2e67186633920e4570d866075a041c48
Instruction Fuzzy Hash: E9F0C273A0153167873256968C09E8BFF58BB91BA1B064125FD06EB200EB64DE01D2E1

Function 00566540 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?), ref: 00566552

Part of subcall function 005A038A: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00565EE0,00000000), ref: 005A039E
Part of subcall function 005A038A: GetProcAddress.KERNEL32(00000000), ref: 005A03A5
Part of subcall function 005A038A: GetLastError.KERNEL32(?,?,?,00565EE0,00000000), ref: 005A03BC

Part of subcall function 00565D14: RegCloseKey.ADVAPI32(00000000,?,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 00565D9A

Strings

Failed to set variant value., xrefs: 0056658F
Failed to get 64-bit folder., xrefs: 00566575

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AddressCloseCurrentErrorHandleLastModuleProcProcess
String ID: Failed to get 64-bit folder.$Failed to set variant value.
API String ID: 3109562764-2681622189
Opcode ID: dade5a0346efd9dc54f9ae6412a8272eb7e20411cf3f5058f109947208ced303
Instruction ID: ca89a871b820e64bc00ac767dd9c12490daa69504b621fb4da65faeea1cfb924
Opcode Fuzzy Hash: dade5a0346efd9dc54f9ae6412a8272eb7e20411cf3f5058f109947208ced303
Instruction Fuzzy Hash: 13016D32910629FBCF12ABA0DC0AA9E7F78FB15B21F604151B801A7155EB71AF40DB90

Function 0058DFDF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 0058E902

Part of subcall function 00590AD1: RaiseException.KERNEL32(?,?,?,$X,?,00000000,00000000,?,?,?,?,?,0058E924,?,005C78A8), ref: 00590B31

__CxxThrowException@8.LIBVCRUNTIME ref: 0058E91F

Strings

Unknown exception, xrefs: 0058E92C

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 306e9b875977aed0a25390890007ac03f5836eb903476631655a59e79e38ae1d
Instruction ID: f392c2945f6b2a2f97a22a2b4b14b65ccd38920d6b68cc789b158282aeb5831f
Opcode Fuzzy Hash: 306e9b875977aed0a25390890007ac03f5836eb903476631655a59e79e38ae1d
Instruction Fuzzy Hash: F0F0AF2490420EBBCF14BAA5D85EE5D7FBCBA40710BA04924FD28B54E1EBB0DD569A90

Function 005A4224 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetFileSizeEx.KERNEL32(00000000,00000000,00000000,74DF34C0,?,?,?,0056B9EC,?,?,?,00000000,00000000), ref: 005A423C
GetLastError.KERNEL32(?,?,?,0056B9EC,?,?,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 005A4246

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 005A426A

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorFileLastSize
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 464720113-1688708105
Opcode ID: e54ad032fe04b2d6389171f36cc86d94a40de3973296038f48370b93be6ce420
Instruction ID: 671d661d91562cb7ecbc58164eaba49426922ba35ec4ecdc88c78ac7e35e25f8
Opcode Fuzzy Hash: e54ad032fe04b2d6389171f36cc86d94a40de3973296038f48370b93be6ce420
Instruction Fuzzy Hash: 5EF062B6901236ABD7108BC5C909A9EFFACFF96B60F018119BD45A7340E3B4AD00CBD5

Function 005A35D7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35comCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(Microsoft.Update.AutoUpdate,005654A3,?,00000000,005654A3,?,?,?), ref: 005A35FE
CoCreateInstance.OLE32(00000000,00000000,00000001,005C6B4C,?), ref: 005A3616

Strings

Microsoft.Update.AutoUpdate, xrefs: 005A35F9

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID: Microsoft.Update.AutoUpdate
API String ID: 2151042543-675569418
Opcode ID: c65ef8d49575f5eca872a3336fb716e0fe0b76882f56d69f6f65ab618469be3f
Instruction ID: b745e566c488961c82db801dac0fd8364dd17b325b0bdab992d6d02f9feb3078
Opcode Fuzzy Hash: c65ef8d49575f5eca872a3336fb716e0fe0b76882f56d69f6f65ab618469be3f
Instruction Fuzzy Hash: 03F0D071600509BFDB00EBA8DD05EEFBBB8EB59754F500425AA01F7191D674AA08D662

Function 00598335 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00596F11), ref: 00598380

Strings

InitializeCriticalSectionEx, xrefs: 00598346, 00598350
8X, xrefs: 00598370

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: 8X$InitializeCriticalSectionEx
API String ID: 2593887523-1730781991
Opcode ID: f1d5a58af77fb5d4eb672b25735a5c5c6ff2c368c04b46f282d6074a108cc73d
Instruction ID: 5e95b0eb0f9794b8661659be3236d255d8f2cc59eea0ddd87c69beb76ba6bef0
Opcode Fuzzy Hash: f1d5a58af77fb5d4eb672b25735a5c5c6ff2c368c04b46f282d6074a108cc73d
Instruction Fuzzy Hash: 80F0B435A4150CBBCF11AF51CC09EAD7FA1FF56750B004518FD0526161DF728A24EBD5

Function 005981DA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00598219

Strings

FlsAlloc, xrefs: 005981EB, 005981F5
8X, xrefs: 0059820F

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Alloc
String ID: 8X$FlsAlloc
API String ID: 2773662609-1782855459
Opcode ID: 0b8ad859fe487dc80735f1abfecdcf20efbd1d6d11a7f6fbae725dd1d3ce9b53
Instruction ID: b94e2ef5d1d85e83df7af814d6c3cea10b3c77e6768b749c551ef01f8cea10a6
Opcode Fuzzy Hash: 0b8ad859fe487dc80735f1abfecdcf20efbd1d6d11a7f6fbae725dd1d3ce9b53
Instruction Fuzzy Hash: 00E05536A806087F8F006BA09C1AE3DBF94FB67750B000218FC0563241CF701D04D6CA

Function 00598230 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

TlsFree.KERNEL32(?), ref: 0059826F

Strings

FlsFree, xrefs: 00598241, 0059824B
8X, xrefs: 00598265

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Free
String ID: 8X$FlsFree
API String ID: 3978063606-1090864576
Opcode ID: 48963f2f1a15177a6555c042e9550b5cea4a6566454481909748f4423fb95da6
Instruction ID: b5340fb23c7e35a1e467606b0722299f3c18eef4aa7ee36d534b62a4dcf00c72
Opcode Fuzzy Hash: 48963f2f1a15177a6555c042e9550b5cea4a6566454481909748f4423fb95da6
Instruction Fuzzy Hash: 45E0E531A42A187FCE10BBA09C0AE7EBF94FB57B11B04015EBD0667242DF300D04D6DA

Function 005A2CB1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

Part of subcall function 005A2AB1: SysAllocString.OLEAUT32(005AA4E8), ref: 005A2AC4
Part of subcall function 005A2AB1: VariantInit.OLEAUT32(?), ref: 005A2AD0
Part of subcall function 005A2AB1: VariantClear.OLEAUT32(?), ref: 005A2B44
Part of subcall function 005A2AB1: SysFreeString.OLEAUT32(00000000), ref: 005A2B4F

SysFreeString.OLEAUT32(00000000), ref: 005A2CEF

Strings

msasn1.dll, xrefs: 005A2CBC
`<u, xrefs: 005A2CEF

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: String$FreeVariant$AllocClearInit
String ID: `<u$msasn1.dll
API String ID: 3379191133-267575571
Opcode ID: d3b41ed95aec3d70ecee87c93072caf11eb0382d96409e1a953d1f29bc2509c0
Instruction ID: cc02833396d66e1c514fec3e604b9b83d2e6c69e8c88636e8e1872a150005e84
Opcode Fuzzy Hash: d3b41ed95aec3d70ecee87c93072caf11eb0382d96409e1a953d1f29bc2509c0
Instruction Fuzzy Hash: C8F0F875504209FBCF129F98CD0AB9D7B75FB85364F204064F901A6160DB719E24EB50

Function 00590F0C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00590F21

Strings

8X, xrefs: 00590F34
FlsAlloc, xrefs: 00590F10, 00590F1A

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: try_get_function
String ID: 8X$FlsAlloc
API String ID: 2742660187-1782855459
Opcode ID: b8e2779bb2c3d16e2d2b69a1584fb45f18642a8783b0e9cc65170e378de8b513
Instruction ID: 31acb18b0a91e05077ea197b5b5754bb8d2862ac8c6bd0f961f18b8d89ef2399
Opcode Fuzzy Hash: b8e2779bb2c3d16e2d2b69a1584fb45f18642a8783b0e9cc65170e378de8b513
Instruction Fuzzy Hash: CCD0C231684224AFCD5426C06C06FAA7E44F741BB2F042861FA0C512C296610800D2C2

Function 0059F699 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(75A70000,00000001,005655C7,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0059F6A6
FreeLibrary.KERNEL32(00000000,00000001,005655C7,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0059F6C8

Strings

`+?s, xrefs: 0059F6B8

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: FreeLibrary
String ID: `+?s
API String ID: 3664257935-3215494052
Opcode ID: f7f3da23ce821a51de904916b982cb0291fa326bd82c8a8d4547ac4e3e133a29
Instruction ID: e11c9f0505a5b377af6f468fc0245e4d9f9ddb9456bce288f648e27d8e4ab574
Opcode Fuzzy Hash: f7f3da23ce821a51de904916b982cb0291fa326bd82c8a8d4547ac4e3e133a29
Instruction Fuzzy Hash: 51E0E2B5904A059FA7508F6AFC46D16FAFDBAF6741B04411FA800D2234E7B09449EF14

Function 005A06C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 005A06E1

Strings

RegDeleteKeyExW, xrefs: 005A06D6
AdvApi32.dll, xrefs: 005A06C6

Memory Dump Source

Source File: 00000000.00000002.2974614916.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.2974560855.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974701306.00000000005AA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974768918.00000000005CA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2974819366.00000000005CD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AddressProc
String ID: AdvApi32.dll$RegDeleteKeyExW
API String ID: 190572456-850864035
Opcode ID: 0966f03b9d9fab0a6c501fbefb2a1af5afe33dd62159f9708c60b8574808848b
Instruction ID: 811a1aff10562f140d987dd836a77dcef712c9d03956056fee747198cd217c13
Opcode Fuzzy Hash: 0966f03b9d9fab0a6c501fbefb2a1af5afe33dd62159f9708c60b8574808848b
Instruction Fuzzy Hash: 33E0EC70652E219FFB105F95EC4AF5A3E50BB25B69F001228E401972A1D77158CDAB85

Analysis Process: MemProfilerInstaller5_7_28.exePID: 7316, Parent PID: 7296COMMON

Executed Functions

Function 00121070 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 77fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001234C4: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,001210DD,?,00000000), ref: 001234E5

CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000080,00000000,?,00000000), ref: 001210F6

Part of subcall function 00121173: HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,0012111A,cabinet.dll,00000009,?,?,00000000), ref: 00121184
Part of subcall function 00121173: GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,0012111A,cabinet.dll,00000009,?,?,00000000), ref: 0012118F
Part of subcall function 00121173: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0012119D
Part of subcall function 00121173: GetLastError.KERNEL32(?,?,?,?,?,0012111A,cabinet.dll,00000009,?,?,00000000), ref: 001211B8
Part of subcall function 00121173: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 001211C0
Part of subcall function 00121173: GetLastError.KERNEL32(?,?,?,?,?,0012111A,cabinet.dll,00000009,?,?,00000000), ref: 001211D5

CloseHandle.KERNEL32(?,?,?,?,0016A4D0,?,cabinet.dll,00000009,?,?,00000000), ref: 00121131

Strings

msasn1.dll, xrefs: 001210C3
version.dll, xrefs: 001210A7
msi.dll, xrefs: 001210A0
comres.dll, xrefs: 001210B5
clbcatq.dll, xrefs: 001210BC
wininet.dll, xrefs: 001210AE
feclient.dll, xrefs: 001210D1
crypt32.dll, xrefs: 001210CA
cabinet.dll, xrefs: 00121099, 00121114

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AddressErrorFileHandleLastModuleProc$CloseCreateHeapInformationName
String ID: cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$feclient.dll$msasn1.dll$msi.dll$version.dll$wininet.dll
API String ID: 3687706282-3151496603
Opcode ID: b1e83864f7502fdef70ff0e11ec0e3110ba99e83311345bfd41a497b98428a1a
Instruction ID: 7809eea52bd62d9657f216c7b83cfe47f32fa85be53d2f4da37d5440df9f848a
Opcode Fuzzy Hash: b1e83864f7502fdef70ff0e11ec0e3110ba99e83311345bfd41a497b98428a1a
Instruction Fuzzy Hash: F7216071900228BBDB10DFB4ED49BEEBBB8FF54714F944115FA11B6280DBB099248FA1

Function 0015F79E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 131threadtimeCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0018B5D4,00000000,?,?,?,?,00141074,8007139F,Invalid operation for this state.,c:\agent\_work\66\s\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 0015F7CC
GetCurrentProcessId.KERNEL32(00000000,?,00141074,8007139F,Invalid operation for this state.,c:\agent\_work\66\s\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 0015F7DC
GetCurrentThreadId.KERNEL32 ref: 0015F7E5
GetLocalTime.KERNEL32(8007139F,?,00141074,8007139F,Invalid operation for this state.,c:\agent\_work\66\s\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 0015F7FB
LeaveCriticalSection.KERNEL32(0018B5D4,00141074,?,00000000,0000FDE9,?,00141074,8007139F,Invalid operation for this state.,c:\agent\_work\66\s\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 0015F8F2

Strings

%ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls, xrefs: 0015F898

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CriticalCurrentSection$EnterLeaveLocalProcessThreadTime
String ID: %ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls
API String ID: 296830338-59366893
Opcode ID: 32ef540b02415abb5ea6a90f2ea432bfe8d7e43f5434ed3e148ded95650fed2b
Instruction ID: bbee78585140091024a50572203c5f179d20e1945d18e31a7f2f763419a63fe6
Opcode Fuzzy Hash: 32ef540b02415abb5ea6a90f2ea432bfe8d7e43f5434ed3e148ded95650fed2b
Instruction Fuzzy Hash: 1A418571D00119EFDB219FA4DC44ABEB7B5EB18712F140139F911FA2A0D7349E86DBA1

Function 0012F981 Relevance: 114.2, APIs: 3, Strings: 62, Instructions: 445
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Register, xrefs: 0012FAFB
Failed to parse software tag., xrefs: 0012FDAE
Failed to select ARP node., xrefs: 0012FAED
Failed to get @DisableRemove., xrefs: 0012FD7E
Failed to get @AboutUrl., xrefs: 0012FBEC
ExecutableName, xrefs: 0012FA92
Arp, xrefs: 0012FAD1
c:\agent\_work\66\s\src\burn\engine\registration.cpp, xrefs: 0012FD25
Update, xrefs: 0012FDBC
Department, xrefs: 0012FE15
ProductFamily, xrefs: 0012FE3A
Contact, xrefs: 0012FC6F
Failed to get @Contact., xrefs: 0012FC86
Failed to get @ParentDisplayName., xrefs: 0012FC36
HelpTelephone, xrefs: 0012FBB0
Failed to get @UpdateUrl., xrefs: 0012FC11
HelpLink, xrefs: 0012FB8B
Failed to get @ProviderKey., xrefs: 0012FA84
DisplayVersion, xrefs: 0012FB41
Failed to select registration node., xrefs: 0012F9BA
PerMachine, xrefs: 0012FAB0
DisableRemove, xrefs: 0012FD67
Failed to get @ProductFamily., xrefs: 0012FE51
Failed to get @PerMachine., xrefs: 0012FAC3
Failed to set registration paths., xrefs: 0012FEA6
Tag, xrefs: 0012F9F5
Failed to get @DisableModify., xrefs: 0012FD56
Invalid modify disabled type: %ls, xrefs: 0012FD32
Version, xrefs: 0012FA2F
Failed to get @Register., xrefs: 0012FB0E
Manufacturer, xrefs: 0012FDF1
Comments, xrefs: 0012FC47
Failed to parse related bundles, xrefs: 0012FA21
DisplayName, xrefs: 0012FB1C
Failed to parse @Version: %ls, xrefs: 0012FA63
AboutUrl, xrefs: 0012FBD5
button, xrefs: 0012FCB3
Failed to get @HelpLink., xrefs: 0012FBA2
Failed to get @Id., xrefs: 0012F9E7
Publisher, xrefs: 0012FB66
Failed to get @Publisher., xrefs: 0012FB7D
DisableModify, xrefs: 0012FC94
Failed to get @ExecutableName., xrefs: 0012FAA5
Failed to get @DisplayName., xrefs: 0012FB33
Failed to get @DisplayVersion., xrefs: 0012FB58
Failed to get @Manufacturer., xrefs: 0012FE04
Name, xrefs: 0012FE5F
Failed to get @Department., xrefs: 0012FE2C
Failed to get @Name., xrefs: 0012FE72
Failed to get @HelpTelephone., xrefs: 0012FBC7
ParentDisplayName, xrefs: 0012FC1F
Classification, xrefs: 0012FE80
yes, xrefs: 0012FCD4
Failed to get @Version., xrefs: 0012FA42
@, xrefs: 0012FE7F
Registration, xrefs: 0012F99B
UpdateUrl, xrefs: 0012FBFA
Failed to select Update node., xrefs: 0012FDDA
Failed to get @Classification., xrefs: 0012FE93
Failed to get @Tag., xrefs: 0012FA08
ProviderKey, xrefs: 0012FA71
Failed to get @Comments., xrefs: 0012FC5E

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: AboutUrl$Arp$Classification$Comments$Contact$Department$DisableModify$DisableRemove$DisplayName$DisplayVersion$ExecutableName$Failed to get @AboutUrl.$Failed to get @Classification.$Failed to get @Comments.$Failed to get @Contact.$Failed to get @Department.$Failed to get @DisableModify.$Failed to get @DisableRemove.$Failed to get @DisplayName.$Failed to get @DisplayVersion.$Failed to get @ExecutableName.$Failed to get @HelpLink.$Failed to get @HelpTelephone.$Failed to get @Id.$Failed to get @Manufacturer.$Failed to get @Name.$Failed to get @ParentDisplayName.$Failed to get @PerMachine.$Failed to get @ProductFamily.$Failed to get @ProviderKey.$Failed to get @Publisher.$Failed to get @Register.$Failed to get @Tag.$Failed to get @UpdateUrl.$Failed to get @Version.$Failed to parse @Version: %ls$Failed to parse related bundles$Failed to parse software tag.$Failed to select ARP node.$Failed to select Update node.$Failed to select registration node.$Failed to set registration paths.$HelpLink$HelpTelephone$Invalid modify disabled type: %ls$Manufacturer$Name$ParentDisplayName$PerMachine$ProductFamily$ProviderKey$Publisher$Register$Registration$Tag$Update$UpdateUrl$Version$button$c:\agent\_work\66\s\src\burn\engine\registration.cpp$yes$@
API String ID: 760788290-3384854740
Opcode ID: 44e9e8bb3f9597239e5c3615f975c2de8e9038c11997f6545b00a53229f92823
Instruction ID: 5c2a6c18054e51f9be1dd93df2e2a192fd8131deef67b270067e99ac576f0f05
Opcode Fuzzy Hash: 44e9e8bb3f9597239e5c3615f975c2de8e9038c11997f6545b00a53229f92823
Instruction Fuzzy Hash: A6E1B832E4073AFBCB239A60EC41EAD7674AB18B10F134239F925B71A1D771AD765780

Function 0012B45A Relevance: 91.6, APIs: 24, Strings: 28, Instructions: 577
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 0012B4D1
SetFilePointerEx.KERNELBASE(000000FF,00000000,00000000,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0012B51F
GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 0012B525
ReadFile.KERNELBASE(00000000,001244B0,00000040,?,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0012B56D
GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 0012B573
SetFilePointerEx.KERNELBASE(00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0012B5D0
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0012B5D6
ReadFile.KERNELBASE(00000000,?,00000018,00000040,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0012B61F
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0012B625
SetFilePointerEx.KERNELBASE(00000000,-00000098,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0012B696
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0012B69C
ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0012B6E5
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0012B6EB
ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0012B734
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0012B73A
SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0012B786
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0012B78C

Part of subcall function 001239DF: GetProcessHeap.KERNEL32(?,000001C7,?,0012237C,?,00000001,80004005,8007139F,?,?,0015FB39,8007139F,?,00000000,00000000,8007139F), ref: 001239F0
Part of subcall function 001239DF: RtlAllocateHeap.NTDLL(00000000,?,0012237C,?,00000001,80004005,8007139F,?,?,0015FB39,8007139F,?,00000000,00000000,8007139F), ref: 001239F7

ReadFile.KERNEL32(00000000,?,00000028,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0012B7DF
ReadFile.KERNEL32(00000000,?,00000028,00000028,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0012B841
SetFilePointerEx.KERNELBASE(00000000,?,00000000,00000000,00000000,00000034,00000001,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0012B8CB
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0012B8D5

Strings

Failed to read NT header., xrefs: 0012B650
Failed to find valid DOS image header in buffer., xrefs: 0012BBBA
Failed to read image section header, index: %u, xrefs: 0012BB7B
4, xrefs: 0012B853
.wix, xrefs: 0012B7FF
Failed to read complete section info., xrefs: 0012B994
Failed to allocate memory for container sizes., xrefs: 0012BAA2
Failed to open handle to engine process path., xrefs: 0012B4FC
Failed to get total size of bundle., xrefs: 0012B9F2
Failed to read signature offset., xrefs: 0012B716
Failed to find Burn section., xrefs: 0012BB01
Failed to allocate buffer for section info., xrefs: 0012B8B3
burn, xrefs: 0012B807
(, xrefs: 0012B7EC
Failed to read section info, data to short: %u, xrefs: 0012B879
c:\agent\_work\66\s\src\burn\engine\section.cpp, xrefs: 0012B4F2, 0012B546, 0012B594, 0012B5F7, 0012B646, 0012B6BD, 0012B70C, 0012B75B, 0012B7B0, 0012B867, 0012B8A7, 0012B8F9, 0012B95E, 0012B988, 0012B9AF, 0012BA96, 0012BAD6, 0012BAF5, 0012BB32, 0012BB70, 0012BB93, 0012BBAE
Failed to seek to NT header., xrefs: 0012B601
Failed to seek past optional headers., xrefs: 0012B7BA
Failed to read complete image section header, index: %u, xrefs: 0012BB44
Failed to find valid NT image header in buffer., xrefs: 0012BB9F
PE Header from file didn't match PE Header in memory., xrefs: 0012BAE0
Failed to seek to section info., xrefs: 0012B6C7, 0012B903
Failed to seek to start of file., xrefs: 0012B550
Failed to read signature size., xrefs: 0012B765
Failed to read section info., xrefs: 0012B968
Failed to read section info, unsupported version: %08x, xrefs: 0012B9C4
Failed to read DOS header., xrefs: 0012B59E
PE, xrefs: 0012B667

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: File$ErrorLast$Read$Pointer$Heap$AllocateProcess
String ID: ($.wix$4$Failed to allocate buffer for section info.$Failed to allocate memory for container sizes.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get total size of bundle.$Failed to open handle to engine process path.$Failed to read DOS header.$Failed to read NT header.$Failed to read complete image section header, index: %u$Failed to read complete section info.$Failed to read image section header, index: %u$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$Failed to read section info.$Failed to read signature offset.$Failed to read signature size.$Failed to seek past optional headers.$Failed to seek to NT header.$Failed to seek to section info.$Failed to seek to start of file.$PE$PE Header from file didn't match PE Header in memory.$burn$c:\agent\_work\66\s\src\burn\engine\section.cpp
API String ID: 3411815225-1671293494
Opcode ID: bb9ccef2d6b5c7d0cf7171b38cb25348d33fdd24a583a0a054ecfd3c34138960
Instruction ID: cff536004f24c702f8a051704b104d4d8968157cc5bf62265ba24b3c240a8444
Opcode Fuzzy Hash: bb9ccef2d6b5c7d0cf7171b38cb25348d33fdd24a583a0a054ecfd3c34138960
Instruction Fuzzy Hash: 31121976E44235ABDB349B14AC86FAB77A9AF04710F0102A5FD05BF281E7749D60CBE1

Function 00140ABB Relevance: 54.6, APIs: 20, Strings: 11, Instructions: 306
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEvent.KERNEL32(?,?,?,?,?,0014066B,?,?), ref: 00140ACA
GetLastError.KERNEL32(?,?,?,?,0014066B,?,?), ref: 00140AD4
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,0014066B,?,?), ref: 00140B19
GetLastError.KERNEL32(?,?,?,?,0014066B,?,?), ref: 00140B24
ResetEvent.KERNEL32(?,?,?,?,?,0014066B,?,?), ref: 00140B5C
GetLastError.KERNEL32(?,?,?,?,0014066B,?,?), ref: 00140B66

Strings

Failed to set operation complete event., xrefs: 00140B02, 00140C43
Failed to wait for begin operation event., xrefs: 00140B52, 00140C8B
Invalid operation for this state., xrefs: 00140BC2
Failed to set file pointer to end of file., xrefs: 00140DF4
Failed to reset begin operation event., xrefs: 00140B94, 00140CD0
Failed to set end of file., xrefs: 00140E39
Failed to set file pointer to beginning of file., xrefs: 00140E7D
Failed to copy stream name: %ls, xrefs: 00140BF5
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 00140AF8, 00140B48, 00140B8A, 00140BB6, 00140C39, 00140C81, 00140CC6, 00140D2E, 00140D99, 00140DEA, 00140E2F, 00140E73
Failed to create file: %ls, xrefs: 00140DA6
Failed to allocate buffer for stream., xrefs: 00140D38

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast$Event$ObjectResetSingleWait
String ID: Failed to allocate buffer for stream.$Failed to copy stream name: %ls$Failed to create file: %ls$Failed to reset begin operation event.$Failed to set end of file.$Failed to set file pointer to beginning of file.$Failed to set file pointer to end of file.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 1865021742-1830388895
Opcode ID: e2d7d3bad7bd1c07ca3ee5869906dbf9cff104bf5e6c7d2bbf1c499d610e97f6
Instruction ID: 164067a53de3e8b1fd3b81f9c58db0989b9625769ec57a36c3d15b6165d81714
Opcode Fuzzy Hash: e2d7d3bad7bd1c07ca3ee5869906dbf9cff104bf5e6c7d2bbf1c499d610e97f6
Instruction Fuzzy Hash: 15913537D80632B7E32216AA9D0AB562964BF08B20F024324FF15FF6E1E3B9DC1485D1

Function 0012A3D4 Relevance: 44.1, APIs: 8, Strings: 17, Instructions: 311
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 0012A418
_MREFOpen@16.MSPDB140-MSVCRT ref: 0012A440
RegCloseKey.KERNELBASE(00000000,?,00000000,?,?,?,?,?), ref: 0012A73F

Strings

Registry key not found. Key = '%ls', xrefs: 0012A478
Failed to query registry key value size., xrefs: 0012A51C
Failed to clear variable., xrefs: 0012A49E
Failed to get expand environment string., xrefs: 0012A6AD
Failed to open registry key., xrefs: 0012A4B3
Failed to allocate memory registry value., xrefs: 0012A54F
Unsupported registry key value type. Type = '%u', xrefs: 0012A5D2
c:\agent\_work\66\s\src\burn\engine\search.cpp, xrefs: 0012A510, 0012A545, 0012A598, 0012A6A1
Failed to change value type., xrefs: 0012A6E3, 0012A706
Failed to set variable., xrefs: 0012A701
Failed to format key string., xrefs: 0012A425
Failed to allocate string buffer., xrefs: 0012A633
Failed to query registry key value., xrefs: 0012A5A4
Failed to read registry value., xrefs: 0012A6C8
Failed to format value string., xrefs: 0012A44D
RegistrySearchValue failed: ID '%ls', HRESULT 0x%x, xrefs: 0012A717
Registry value not found. Key = '%ls', Value = '%ls', xrefs: 0012A4E2

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Open@16$Close
String ID: Failed to allocate memory registry value.$Failed to allocate string buffer.$Failed to change value type.$Failed to clear variable.$Failed to format key string.$Failed to format value string.$Failed to get expand environment string.$Failed to open registry key.$Failed to query registry key value size.$Failed to query registry key value.$Failed to read registry value.$Failed to set variable.$Registry key not found. Key = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchValue failed: ID '%ls', HRESULT 0x%x$Unsupported registry key value type. Type = '%u'$c:\agent\_work\66\s\src\burn\engine\search.cpp
API String ID: 2348241696-2754605460
Opcode ID: f8656bfb5909ca4d062176a27ac5e93432a98afbb66c1e6095b457f70f3e127e
Instruction ID: 4c43cd5bda0c63d384f7ef39d22fabdd159caf737df617466902fcea454eac4c
Opcode Fuzzy Hash: f8656bfb5909ca4d062176a27ac5e93432a98afbb66c1e6095b457f70f3e127e
Instruction Fuzzy Hash: CFA1F372E00135FBCF129AA4ED05AAEBAB9AF18710F558125FD01FB250D771DD209BE2

Function 001257A7 Relevance: 42.5, APIs: 5, Strings: 19, Instructions: 477
stringCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(00000100,00000100,00000100,00000000,00000100,00000000,?,0012A889,00000100,000002C0,000002C0,00000100), ref: 001257CC
lstrlenW.KERNEL32(000002C0,?,0012A889,00000100,000002C0,000002C0,00000100), ref: 001257D6
_wcschr.LIBVCRUNTIME ref: 001259DB
LeaveCriticalSection.KERNEL32(00000100,00000000,000002C0,000002C0,00000000,000002C0,00000001,?,0012A889,00000100,000002C0,000002C0,00000100), ref: 00125C7E

Strings

Failed to allocate buffer for format string., xrefs: 001257F4
Failed to format record., xrefs: 00125C42
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00125A32, 00125A53, 00125AAC, 00125AFE, 00125B8A, 00125BBC, 00125C38
Failed to append placeholder., xrefs: 00125A81
*****, xrefs: 0012594D
Failed to allocate variable array., xrefs: 00125AB9
[%d], xrefs: 00125996
Failed to copy string., xrefs: 00125C62
Failed to set record format string., xrefs: 00125B08
Failed to format placeholder string., xrefs: 00125A8B
Failed to append string., xrefs: 00125852
Failed to allocate string., xrefs: 00125BF5
Failed to determine variable visibility: '%ls'., xrefs: 00125A6E
Failed to set record string., xrefs: 00125B94
Failed to allocate record., xrefs: 00125A3F
Failed to get formatted length., xrefs: 00125BC6
Failed to set variable value., xrefs: 00125A95
Failed to reallocate variable array., xrefs: 00125A60
Failed to get variable name., xrefs: 00125AC0

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CriticalSection$EnterLeave_wcschrlstrlen
String ID: *****$Failed to allocate buffer for format string.$Failed to allocate record.$Failed to allocate string.$Failed to allocate variable array.$Failed to append placeholder.$Failed to append string.$Failed to copy string.$Failed to determine variable visibility: '%ls'.$Failed to format placeholder string.$Failed to format record.$Failed to get formatted length.$Failed to get variable name.$Failed to reallocate variable array.$Failed to set record format string.$Failed to set record string.$Failed to set variable value.$[%d]$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 1026845265-1173883696
Opcode ID: d0f939afbd60a7afdc3c74ed29bf4f463122bb57798313611d0beb87f63ceb73
Instruction ID: 94e218cce5fe015a92ad8ef24b8dc674f4c3bc2ea4891344c9feffacae71c05b
Opcode Fuzzy Hash: d0f939afbd60a7afdc3c74ed29bf4f463122bb57798313611d0beb87f63ceb73
Instruction Fuzzy Hash: 5DF1C671D01635EFCB14DFA4AC819BF7BBAAB14B50F158129FD15EB240E7749A208BE0

Function 001251D2 Relevance: 40.6, APIs: 5, Strings: 18, Instructions: 314
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?), ref: 00125254

Part of subcall function 0015FDC4: InitializeCriticalSection.KERNEL32(0018B5D4,?,00125260,00000000,?,?,?,?,?,?), ref: 0015FDDB

Part of subcall function 00121206: CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,0012527C,00000000,?), ref: 00121244
Part of subcall function 00121206: GetLastError.KERNEL32(?,?,?,0012527C,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 0012124E

CoInitializeEx.OLE32(00000000,00000000,?,?,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 001252C2

Part of subcall function 001606C0: GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 001606E1

GetVersionExW.KERNEL32(?,?,?,?,?,?,?), ref: 00125354
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 0012535E
CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 001255CB

Strings

Failed to initialize Regutil., xrefs: 00125306
3.11.2.4516, xrefs: 001253C1
Invalid run mode., xrefs: 00125436
Failed to run embedded mode., xrefs: 00125481
Failed to initialize Wiutil., xrefs: 0012531E
Failed to run RunOnce mode., xrefs: 00125459
Failed to run per-user mode., xrefs: 001254D1
Failed to initialize Cryputil., xrefs: 001252E3
c:\agent\_work\66\s\src\burn\engine\engine.cpp, xrefs: 00125382
Failed to initialize XML util., xrefs: 00125336
Failed to initialize core., xrefs: 00125400
@, xrefs: 00125532
Failed to parse command line., xrefs: 00125282
Failed to run untrusted mode., xrefs: 001254F3
Failed to run per-machine mode., xrefs: 001254A9
Failed to initialize engine state., xrefs: 001252A9
Failed to get OS info., xrefs: 0012538C
Failed to initialize COM., xrefs: 001252CE

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorInitializeLast$AddressArgvCommandCriticalHandleLineModuleProcSectionUninitializeVersion
String ID: 3.11.2.4516$Failed to get OS info.$Failed to initialize COM.$Failed to initialize Cryputil.$Failed to initialize Regutil.$Failed to initialize Wiutil.$Failed to initialize XML util.$Failed to initialize core.$Failed to initialize engine state.$Failed to parse command line.$Failed to run RunOnce mode.$Failed to run embedded mode.$Failed to run per-machine mode.$Failed to run per-user mode.$Failed to run untrusted mode.$Invalid run mode.$c:\agent\_work\66\s\src\burn\engine\engine.cpp$@
API String ID: 3262001429-4222581132
Opcode ID: 0005bfe62ca7be5533a7bb021e29126ec8616a4b2ee718b76c407917cf749cff
Instruction ID: 83fc2f721c59b7f70b95ccb42f08ae0cf3a228419629df4096d147c7efe02f8e
Opcode Fuzzy Hash: 0005bfe62ca7be5533a7bb021e29126ec8616a4b2ee718b76c407917cf749cff
Instruction Fuzzy Hash: EBB1B572D40A399BDB31AFA4EC85BED76B6AF14710F410195F908B7241EB709EA0CF91

Function 0013741D Relevance: 37.0, APIs: 1, Strings: 20, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to initialize internal cache functionality., xrefs: 00137692
Failed to initialize variables., xrefs: 00137464
Failed to get unique temporary folder for bootstrapper application., xrefs: 001376C1
WixBundleUILevel, xrefs: 001375C9, 001375DA
Failed to load manifest., xrefs: 001374DB
Failed to set source process path variable., xrefs: 001375FC
Failed to set source process folder variable., xrefs: 00137638
Failed to get manifest stream from container., xrefs: 001374BF
WixBundleSourceProcessFolder, xrefs: 00137627
WixBundleSourceProcessPath, xrefs: 001375EB
Failed to load catalog files., xrefs: 00137702
Failed to open manifest stream., xrefs: 0013749E
Failed to set original source variable., xrefs: 0013765D
Failed to parse command line., xrefs: 0013755A
Failed to extract bootstrapper application payloads., xrefs: 001376E2
Failed to open attached UX container., xrefs: 00137481
WixBundleOriginalSource, xrefs: 0013764C
Failed to overwrite the %ls built-in variable., xrefs: 001375AE
Failed to get source process folder from path., xrefs: 00137618
WixBundleElevated, xrefs: 00137598, 001375A9

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: Failed to extract bootstrapper application payloads.$Failed to get manifest stream from container.$Failed to get source process folder from path.$Failed to get unique temporary folder for bootstrapper application.$Failed to initialize internal cache functionality.$Failed to initialize variables.$Failed to load catalog files.$Failed to load manifest.$Failed to open attached UX container.$Failed to open manifest stream.$Failed to overwrite the %ls built-in variable.$Failed to parse command line.$Failed to set original source variable.$Failed to set source process folder variable.$Failed to set source process path variable.$WixBundleElevated$WixBundleOriginalSource$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleUILevel
API String ID: 32694325-1564579409
Opcode ID: 161ee43b633ba8b141fec6c43ba4589f6036865d0b485806d6d5c4af90775d2f
Instruction ID: 21410fb3a1e35883890c3f1665d0bc20aee257d54555ac8df254f0c1e146bd65
Opcode Fuzzy Hash: 161ee43b633ba8b141fec6c43ba4589f6036865d0b485806d6d5c4af90775d2f
Instruction Fuzzy Hash: 34A1A3F2E44626BBDB279AA4CC85EEEB77CBB14700F014226F515E7181D770EA508BD0

Function 0012762D Relevance: 34.9, APIs: 1, Strings: 22, Instructions: 419
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(0013745E,001253FA,00000000,00125482), ref: 0012764D

Strings

0, xrefs: 00127664
WixBundleExecutePackageCacheFolder, xrefs: 00127D99
WixBundleUILevel, xrefs: 00127EBF
WixBundleVersion, xrefs: 00127ECF
WixBundleTag, xrefs: 00127EAF
InstallerVersion, xrefs: 00127834
WixBundleSourceProcessFolder, xrefs: 00127E9F
WixBundleExecutePackageAction, xrefs: 00127DF9
WixBundleSourceProcessPath, xrefs: 00127E8F
WixBundleForcedRestartPackage, xrefs: 00127E15
WixBundleActiveParent, xrefs: 00127E63
WixBundleProviderKey, xrefs: 00127E7F
LogonUser, xrefs: 00127883
Date, xrefs: 00127771
InstallerName, xrefs: 00127813
', xrefs: 001278EC
WixBundleInstalled, xrefs: 00127E2B
$, xrefs: 00127D4A
#, xrefs: 001276CC
WixBundleAction, xrefs: 00127D77
WixBundleElevated, xrefs: 00127E47
Failed to add built-in variable: %ls., xrefs: 00127F1A

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: #$$$'$0$Date$Failed to add built-in variable: %ls.$InstallerName$InstallerVersion$LogonUser$WixBundleAction$WixBundleActiveParent$WixBundleElevated$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$WixBundleForcedRestartPackage$WixBundleInstalled$WixBundleProviderKey$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleTag$WixBundleUILevel$WixBundleVersion
API String ID: 32694325-3635313340
Opcode ID: 6fa6c0899f9218d0a33f5b8e147975da835b0998d94303536ff46eabdb4f85fb
Instruction ID: 137286d667138b0fc151727f664cbb3a979f4dcb4371975934e237c4b7b5f9e4
Opcode Fuzzy Hash: 6fa6c0899f9218d0a33f5b8e147975da835b0998d94303536ff46eabdb4f85fb
Instruction Fuzzy Hash: 9B3246B0D056699BDB658F5ADA883CDFAB5BB48304F5081EED20CB7250D7B00AD88F45

Function 0013819F Relevance: 31.7, APIs: 7, Strings: 11, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,00000000,00000000,001254C6), ref: 001381F5

Part of subcall function 00160141: OpenProcessToken.ADVAPI32(?,00000008,?,001253FA,00000000,?,?,?,?,?,?,?,00137590,00000000), ref: 0016015F
Part of subcall function 00160141: GetLastError.KERNEL32(?,?,?,?,?,?,?,00137590,00000000), ref: 00160169
Part of subcall function 00160141: FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,00137590,00000000), ref: 001601F3

GetWindowsDirectoryW.KERNEL32(?,00000104,00000000), ref: 0013821B
GetLastError.KERNEL32 ref: 00138225
GetTempPathW.KERNEL32(00000104,?,00000000), ref: 001382A2
GetLastError.KERNEL32 ref: 001382AC
UuidCreate.RPCRT4(?), ref: 001382EB

Strings

Temp\, xrefs: 0013827A
Failed to convert working folder guid into string., xrefs: 0013832B
Failed to get windows path for working folder., xrefs: 00138253
Failed to ensure windows path for working folder ended in backslash., xrefs: 00138270
Failed to append bundle id on to temp path for working folder., xrefs: 00138355
Failed to get temp path for working folder., xrefs: 001382DA
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 00138249, 001382D0, 00138321
Failed to copy working folder path., xrefs: 00138370
Failed to concat Temp directory on windows path for working folder., xrefs: 00138292
%ls%ls\, xrefs: 0013833D
Failed to create working folder guid., xrefs: 001382F8

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast$Process$ChangeCloseCreateCurrentDirectoryFindNotificationOpenPathTempTokenUuidWindows
String ID: %ls%ls\$Failed to append bundle id on to temp path for working folder.$Failed to concat Temp directory on windows path for working folder.$Failed to convert working folder guid into string.$Failed to copy working folder path.$Failed to create working folder guid.$Failed to ensure windows path for working folder ended in backslash.$Failed to get temp path for working folder.$Failed to get windows path for working folder.$Temp\$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 2898636500-2821718772
Opcode ID: 89fa2bdc7f0aa61e6a94f92076931ca6d31b2795bfa713a16bc0ef23a8db2632
Instruction ID: 873f0f0823449c0c706ecb204d573a8b878e267051d119238e2dd6f0bb3c9e62
Opcode Fuzzy Hash: 89fa2bdc7f0aa61e6a94f92076931ca6d31b2795bfa713a16bc0ef23a8db2632
Instruction Fuzzy Hash: 1441D572A40B35B7D720A7E49C4AF9B77B8AF10B11F514161FA09F7240EBB8DE448A91

Function 00140EA0 Relevance: 30.0, APIs: 8, Strings: 9, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 00140EC2
CoUninitialize.OLE32 ref: 0014113D

Strings

Failed to set operation complete event., xrefs: 00141069
Failed to wait for begin operation event., xrefs: 001410B6
Failed to initialize cabinet.dll., xrefs: 00140F44
Invalid operation for this state., xrefs: 00141121
Failed to reset begin operation event., xrefs: 001410F5
Failed to extract all files from container, erf: %d:%X:%d, xrefs: 0014101E
<the>.cab, xrefs: 00140F62
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 00140F38, 0014105F, 001410AC, 001410EB, 00141117
Failed to initialize COM., xrefs: 00140ECE

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: InitializeUninitialize
String ID: <the>.cab$Failed to extract all files from container, erf: %d:%X:%d$Failed to initialize COM.$Failed to initialize cabinet.dll.$Failed to reset begin operation event.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 3442037557-964446333
Opcode ID: 447c2ee53d950b9f2cc1f560e74d3003b41d5972edfc2f180d4a24c4672bb92c
Instruction ID: 40c779a2ff250f2d579b0c6938d1f2c53687cc80a697fe20aa3ef1f324d8edc4
Opcode Fuzzy Hash: 447c2ee53d950b9f2cc1f560e74d3003b41d5972edfc2f180d4a24c4672bb92c
Instruction Fuzzy Hash: 6B518737E80272F7D72457A59C01EBB3624AF44B20B27022AFD15BF2A0D76E8CC096D1

Function 00143845 Relevance: 28.6, APIs: 1, Strings: 15, Instructions: 577COMMON

Download Yara Rule

Strings

msasn1.dll, xrefs: 0014399E, 00143AA8, 00143D76, 00143EB1
Language, xrefs: 00143C83
Failed to query feature state., xrefs: 00143EE0
Failed to get version for product in machine context: %ls, xrefs: 00143E79
UX aborted detect related MSI package., xrefs: 001439C7
UX aborted detect compatible MSI package., xrefs: 00143ACB
Failed to get version for product in user unmanaged context: %ls, xrefs: 00143E57
VersionString, xrefs: 001438A0, 00143A1C, 00143B77, 00143BAE
Failed to get product information for ProductCode: %ls, xrefs: 001439E7
c:\agent\_work\66\s\src\burn\engine\msiengine.cpp, xrefs: 001439BD, 00143AC1, 00143EF2, 00143F09
Failed to convert version: %ls to DWORD64 for ProductCode: %ls, xrefs: 001438E5
Failed to copy the installed ProductCode to the package., xrefs: 00143AEB
Invalid state value., xrefs: 00143EFC
UX aborted detect., xrefs: 00143F13
Failed to enum related products., xrefs: 00143E83

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: lstrlen
String ID: Failed to convert version: %ls to DWORD64 for ProductCode: %ls$Failed to copy the installed ProductCode to the package.$Failed to enum related products.$Failed to get product information for ProductCode: %ls$Failed to get version for product in machine context: %ls$Failed to get version for product in user unmanaged context: %ls$Failed to query feature state.$Invalid state value.$Language$UX aborted detect compatible MSI package.$UX aborted detect related MSI package.$UX aborted detect.$VersionString$c:\agent\_work\66\s\src\burn\engine\msiengine.cpp$msasn1.dll
API String ID: 1659193697-341873357
Opcode ID: 725770eb2f7cf944350e9b11d5067b85fe10f910418d34b31f9cbd7a453c04be
Instruction ID: 2912592092039cba6152df79e16fe3a010a1013c2b1059acf406a86162557bf4
Opcode Fuzzy Hash: 725770eb2f7cf944350e9b11d5067b85fe10f910418d34b31f9cbd7a453c04be
Instruction Fuzzy Hash: 2A22AB71D00218EFDF259FA4CC85FAEBBB9FF54700F244169E929AB166D7319A40CB60

Function 00124326 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 157
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(00000000,?,00000000,00000000,?,?,001252A3,?,?,00000000,?,?), ref: 00124352
InitializeCriticalSection.KERNEL32(000000D0,?,?,001252A3,?,?,00000000,?,?), ref: 0012435B
lstrlenW.KERNEL32(burn.filehandle.attached,000004B8,000004A0,?,?,001252A3,?,?,00000000,?,?), ref: 001243A1
lstrlenW.KERNEL32(burn.filehandle.attached,burn.filehandle.attached,00000000,?,?,001252A3,?,?,00000000,?,?), ref: 001243AB
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,001252A3,?,?,00000000,?,?), ref: 001243BF
lstrlenW.KERNEL32(burn.filehandle.attached,?,?,001252A3,?,?,00000000,?,?), ref: 001243CF
lstrlenW.KERNEL32(burn.filehandle.self,?,?,001252A3,?,?,00000000,?,?), ref: 0012441F
lstrlenW.KERNEL32(burn.filehandle.self,burn.filehandle.self,00000000,?,?,001252A3,?,?,00000000,?,?), ref: 00124429
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,001252A3,?,?,00000000,?,?), ref: 0012443D
lstrlenW.KERNEL32(burn.filehandle.self,?,?,001252A3,?,?,00000000,?,?), ref: 0012444D

Strings

Failed to initialize engine section., xrefs: 001244B6
Failed to parse file handle: '%ls', xrefs: 001244CF
burn.filehandle.attached, xrefs: 0012439C, 001243A4, 001243A9, 001243AA, 001243CA, 001244EC
burn.filehandle.self, xrefs: 0012441A, 00124422, 00124427, 00124428, 00124448, 00124518
c:\agent\_work\66\s\src\burn\engine\engine.cpp, xrefs: 001244E2, 0012450E
Missing required parameter for switch: %ls, xrefs: 001244F1

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: lstrlen$CompareCriticalInitializeSectionString
String ID: Failed to initialize engine section.$Failed to parse file handle: '%ls'$Missing required parameter for switch: %ls$burn.filehandle.attached$burn.filehandle.self$c:\agent\_work\66\s\src\burn\engine\engine.cpp
API String ID: 3039292287-2540856168
Opcode ID: 2d81ada1464ccb6b0f31347696f2db23d527aed343de98555ede426fcfd88416
Instruction ID: 5bfb3f8f313df9dd8e65e0ecb96de7a4e087e0d9317fcddf4dd2251c1b1badf0
Opcode Fuzzy Hash: 2d81ada1464ccb6b0f31347696f2db23d527aed343de98555ede426fcfd88416
Instruction Fuzzy Hash: 51510571A40221BFC724AF68EC46F9A7769FF10720F514116F618E7290DBB4B960CFA5

Function 0013E60C Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 134
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsSetValue.KERNEL32(?,?), ref: 0013E652
RegisterClassW.USER32(?), ref: 0013E67E
GetLastError.KERNEL32 ref: 0013E689
CreateWindowExW.USER32(00000080,001791B4,00000000,90000000,80000000,00000008,00000000,00000000,00000000,00000000,?,?), ref: 0013E6F0
GetLastError.KERNEL32 ref: 0013E6FA
UnregisterClassW.USER32(WixBurnMessageWindow,?), ref: 0013E798

Strings

Failed to create window., xrefs: 0013E728
WixBurnMessageWindow, xrefs: 0013E677, 0013E793
Failed to register window., xrefs: 0013E6B7
c:\agent\_work\66\s\src\burn\engine\uithread.cpp, xrefs: 0013E6AD, 0013E71E
Unexpected return value from message pump., xrefs: 0013E783

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ClassErrorLast$CreateRegisterUnregisterValueWindow
String ID: Failed to create window.$Failed to register window.$Unexpected return value from message pump.$WixBurnMessageWindow$c:\agent\_work\66\s\src\burn\engine\uithread.cpp
API String ID: 213125376-1202977178
Opcode ID: 5f06b4135b9c16d3758c334ff7ee20f2c36cb42e0ec2170cc3ebaac087e8d44f
Instruction ID: 7179a588409189bb7cafa36f9c4a4eae2a59c78fa82e6464cf0bd3b0cecf25c2
Opcode Fuzzy Hash: 5f06b4135b9c16d3758c334ff7ee20f2c36cb42e0ec2170cc3ebaac087e8d44f
Instruction Fuzzy Hash: 3441B176900325ABDB208BA4DD49ADEBFF9FF04760F114125F905BA290E770A944CBE1

Function 0012C252 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 131
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,08000080,00000000,?,00000000,00000000,?,0012C442,00125442,?,?,00125482), ref: 0012C299
GetLastError.KERNEL32(?,0012C442,00125442,?,?,00125482,00125482,00000000,?,00000000), ref: 0012C2AA
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,?,00000000,00000000,?,0012C442,00125442,?,?,00125482,00125482,00000000,?), ref: 0012C2F9
GetCurrentProcess.KERNEL32(000000FF,00000000,?,0012C442,00125442,?,?,00125482,00125482,00000000,?,00000000), ref: 0012C2FF
DuplicateHandle.KERNELBASE(00000000,?,0012C442,00125442,?,?,00125482,00125482,00000000,?,00000000), ref: 0012C302
GetLastError.KERNEL32(?,0012C442,00125442,?,?,00125482,00125482,00000000,?,00000000), ref: 0012C30C
SetFilePointerEx.KERNELBASE(?,00000000,00000000,00000000,00000000,?,0012C442,00125442,?,?,00125482,00125482,00000000,?,00000000), ref: 0012C35E
GetLastError.KERNEL32(?,0012C442,00125442,?,?,00125482,00125482,00000000,?,00000000), ref: 0012C368

Strings

Failed to duplicate handle to container: %ls, xrefs: 0012C33D
Failed to open container., xrefs: 0012C3B4
c:\agent\_work\66\s\src\burn\engine\container.cpp, xrefs: 0012C2CE, 0012C330, 0012C38C
Failed to move file pointer to container offset., xrefs: 0012C396
feclient.dll, xrefs: 0012C35B
crypt32.dll, xrefs: 0012C35A
Failed to open file: %ls, xrefs: 0012C2DB

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast$CurrentFileProcess$CreateDuplicateHandlePointer
String ID: Failed to duplicate handle to container: %ls$Failed to move file pointer to container offset.$Failed to open container.$Failed to open file: %ls$c:\agent\_work\66\s\src\burn\engine\container.cpp$crypt32.dll$feclient.dll
API String ID: 2619879409-1064011499
Opcode ID: 92ba7ba7cd50c6592a9171d54e8053bb143e2f9f20686055c7b73492bcedd16a
Instruction ID: ed34412977f4247124a488a5268f9e73a68e5e3df1f6d403ca9762ff985992dc
Opcode Fuzzy Hash: 92ba7ba7cd50c6592a9171d54e8053bb143e2f9f20686055c7b73492bcedd16a
Instruction Fuzzy Hash: 3D410636140221ABD7208F59AD45E1F3BAAFFD4720F218519FE14EB241EB75D821DBA1

Function 00162368 Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 78
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001238D1: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00123910
Part of subcall function 001238D1: GetLastError.KERNEL32 ref: 0012391A

Part of subcall function 00164289: GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 001642BA

GetProcAddress.KERNEL32(MsiDeterminePatchSequenceW,00000000), ref: 001623B2
GetProcAddress.KERNEL32(MsiDetermineApplicablePatchesW), ref: 001623D2
GetProcAddress.KERNEL32(MsiEnumProductsExW), ref: 001623F2
GetProcAddress.KERNEL32(MsiGetPatchInfoExW), ref: 00162412
GetProcAddress.KERNEL32(MsiGetProductInfoExW), ref: 00162432
GetProcAddress.KERNEL32(MsiSetExternalUIRecord), ref: 00162452
GetProcAddress.KERNEL32(MsiSourceListAddSourceExW), ref: 00162472

Strings

MsiDetermineApplicablePatchesW, xrefs: 001623C7
MsiSourceListAddSourceExW, xrefs: 00162467
MsiGetProductInfoExW, xrefs: 00162427
MsiGetPatchInfoExW, xrefs: 00162407
MsiDeterminePatchSequenceW, xrefs: 001623A7
MsiEnumProductsExW, xrefs: 001623E7
MsiSetExternalUIRecord, xrefs: 00162447
Msi.dll, xrefs: 0016237A

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AddressProc$ErrorLast$DirectorySystem
String ID: Msi.dll$MsiDetermineApplicablePatchesW$MsiDeterminePatchSequenceW$MsiEnumProductsExW$MsiGetPatchInfoExW$MsiGetProductInfoExW$MsiSetExternalUIRecord$MsiSourceListAddSourceExW
API String ID: 2510051996-1735120554
Opcode ID: 1ab92ea7c28da38c6fc8c6d642b7618eccf854d1f712f781297f2c9d1fc705e3
Instruction ID: 93fa58e6b361e1d04928beeada1e66c53dc84f6728cf2e7168ae8aa5d9f65010
Opcode Fuzzy Hash: 1ab92ea7c28da38c6fc8c6d642b7618eccf854d1f712f781297f2c9d1fc705e3
Instruction Fuzzy Hash: 6431D6B0909A55EED711AF60ECC5B597BA2F714708F30422AE4005AE71F7B90BA9DF40

Function 001628BD Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 152libraryloadercomCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00162E6B,00000000,?,00000000), ref: 001628D7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,0014BD14,?,00125442,?,00000000,?), ref: 001628E3
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00162923
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 0016292F
GetProcAddress.KERNEL32(00000000,Wow64EnableWow64FsRedirection), ref: 0016293A
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00162944
CoCreateInstance.OLE32(0018B688,00000000,00000001,0016A878,?,?,?,?,?,?,?,?,?,?,?,0014BD14), ref: 0016297F
ExitProcess.KERNEL32 ref: 00162A2E

Strings

IsWow64Process, xrefs: 0016291D
Wow64RevertWow64FsRedirection, xrefs: 0016293C
c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp, xrefs: 00162907
Wow64EnableWow64FsRedirection, xrefs: 00162931
kernel32.dll, xrefs: 001628C7
Wow64DisableWow64FsRedirection, xrefs: 00162929

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AddressProc$CreateErrorExitHandleInstanceLastModuleProcess
String ID: IsWow64Process$Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp$kernel32.dll
API String ID: 2124981135-3734847636
Opcode ID: 6621808755f355f93722369645b705894c7cc245eef25e243dcd1a3ec0eb2fdb
Instruction ID: c93257e64a8b189da7facc3027929c54ad7bf7c718e9604754976516efa2f591
Opcode Fuzzy Hash: 6621808755f355f93722369645b705894c7cc245eef25e243dcd1a3ec0eb2fdb
Instruction Fuzzy Hash: 1A41C531A01B25ABDB24AFA8CC44FAEBBA5EF44755F210068E901F7641D7B5DE50CF90

Function 0015F58A Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 76libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNELBASE(SystemFunction040,AdvApi32.dll), ref: 0015F5B2
GetProcAddress.KERNEL32(SystemFunction041), ref: 0015F5C4
GetProcAddress.KERNEL32(CryptProtectMemory,Crypt32.dll), ref: 0015F607
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 0015F61B
GetProcAddress.KERNEL32(CryptUnprotectMemory), ref: 0015F653
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 0015F667

Strings

CryptProtectMemory, xrefs: 0015F5FC
SystemFunction040, xrefs: 0015F5A7
c:\agent\_work\66\s\src\libs\dutil\cryputil.cpp, xrefs: 0015F63C
AdvApi32.dll, xrefs: 0015F591
SystemFunction041, xrefs: 0015F5B4
Crypt32.dll, xrefs: 0015F5E8
CryptUnprotectMemory, xrefs: 0015F648
`+?s, xrefs: 0015F5C6, 0015F5CD, 0015F655

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AddressProc$ErrorLast
String ID: AdvApi32.dll$Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory$SystemFunction040$SystemFunction041$`+?s$c:\agent\_work\66\s\src\libs\dutil\cryputil.cpp
API String ID: 4214558900-323720281
Opcode ID: 8537ad334129c49fb22fc8272709b4d20cd1dc366d2d575010bfe28ce34e7e29
Instruction ID: ead41530531d85132536894330df2ffb441b766e965109f69879a49487fc51f7
Opcode Fuzzy Hash: 8537ad334129c49fb22fc8272709b4d20cd1dc366d2d575010bfe28ce34e7e29
Instruction Fuzzy Hash: 2221C232945732EBC3256B64ACD5B463991EB10752F02023DFC20BF6B0E7648E8A8F90

Function 001414E3 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 106COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,wininet.dll,?,00000000,00000000,00000000,?,?,0012C3AE,?,00000000,?,0012C442), ref: 0014151A
GetLastError.KERNEL32(?,0012C3AE,?,00000000,?,0012C442,00125442,?,?,00125482,00125482,00000000,?,00000000), ref: 00141523

Strings

Failed to create operation complete event., xrefs: 00141597
Failed to create extraction thread., xrefs: 001415E3
Failed to copy file name., xrefs: 00141505
wininet.dll, xrefs: 001414F9
Failed to create begin operation event., xrefs: 00141551
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 00141547, 0014158D, 001415D9
Failed to wait for operation complete., xrefs: 001415F6

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CreateErrorEventLast
String ID: Failed to copy file name.$Failed to create begin operation event.$Failed to create extraction thread.$Failed to create operation complete event.$Failed to wait for operation complete.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp$wininet.dll
API String ID: 545576003-1014644744
Opcode ID: 2f486ba647230511cd20ee6e23c4172f3076b0d376ace7f2447eec99777d17e0
Instruction ID: 0eda74f430b7dd4352c44737a3ba5c82ff633f383011f4b0589d5ff0cbd117e1
Opcode Fuzzy Hash: 2f486ba647230511cd20ee6e23c4172f3076b0d376ace7f2447eec99777d17e0
Instruction Fuzzy Hash: 36212BB3E8173777E33112A98D55EA7696CAF417A0B024221FD45FF590E7A8DC8046E4

Function 00140671 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CompareStringA.KERNELBASE(00000000,00000000,<the>.cab,?,?), ref: 001406A1
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 001406B9
GetCurrentProcess.KERNEL32(?,00000000,?,?), ref: 001406BE
DuplicateHandle.KERNELBASE(00000000,?,?), ref: 001406C1
GetLastError.KERNEL32(?,?), ref: 001406CB
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,08000080,00000000,?,?), ref: 0014073A
GetLastError.KERNEL32(?,?), ref: 00140747

Strings

Failed to open cabinet file: %hs, xrefs: 00140778
<the>.cab, xrefs: 0014069A
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 001406EF, 0014076B
Failed to duplicate handle to cab container., xrefs: 001406F9
Failed to add virtual file pointer for cab container., xrefs: 00140720

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CurrentErrorLastProcess$CompareCreateDuplicateFileHandleString
String ID: <the>.cab$Failed to add virtual file pointer for cab container.$Failed to duplicate handle to cab container.$Failed to open cabinet file: %hs$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 3030546534-886985619
Opcode ID: 42e4c7ff19390654864b646e7008a745790a8fc0067fca710be88a83dac1acdd
Instruction ID: ee0b17b1188267a2c94b84c3e88ddc622b1d18faa8c39d4123b12fe5b8c8d71d
Opcode Fuzzy Hash: 42e4c7ff19390654864b646e7008a745790a8fc0067fca710be88a83dac1acdd
Instruction Fuzzy Hash: 08313476941236BBD7225BA98C49E8F7F6CEF08761F114114FE04BB260D774AD00CAE1

Function 00126DCB Relevance: 19.7, APIs: 2, Strings: 11, Instructions: 164COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,001253FA,00000000,00125482,00000000,?,001282B1,?,?,?,00000000,00000000), ref: 00126DDA

Part of subcall function 001256E2: CompareStringW.KERNEL32(0000007F,00001000,?,000000FF,version.dll,000000FF,?,?,00000000,001265B1,001265B1,?,00125678,?,?,00000000), ref: 0012571E
Part of subcall function 001256E2: GetLastError.KERNEL32(?,00125678,?,?,00000000,?,?,001265B1,?,00127F03,?,?,?,?,?), ref: 0012574D

LeaveCriticalSection.KERNEL32(00000000,?,?,00000000,00000000,00000000), ref: 00126F6A

Strings

Attempt to set built-in variable value: %ls, xrefs: 00126E68
Failed to find variable value '%ls'., xrefs: 00126DF5
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00126E5D
Setting string variable '%ls' to value '%ls', xrefs: 00126EFA, 00126F02
Setting variable failed: ID '%ls', HRESULT 0x%x, xrefs: 00126F7C
Setting version variable '%ls' to value '%hu.%hu.%hu.%hu', xrefs: 00126EDF
Setting numeric variable '%ls' to value %lld, xrefs: 00126F0B
Setting hidden variable '%ls', xrefs: 00126E98
Unsetting variable '%ls', xrefs: 00126EF3, 00126F26
Failed to set value of variable: %ls, xrefs: 00126F52
Failed to insert variable '%ls'., xrefs: 00126E1F

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CriticalSection$CompareEnterErrorLastLeaveString
String ID: Attempt to set built-in variable value: %ls$Failed to find variable value '%ls'.$Failed to insert variable '%ls'.$Failed to set value of variable: %ls$Setting hidden variable '%ls'$Setting numeric variable '%ls' to value %lld$Setting string variable '%ls' to value '%ls'$Setting variable failed: ID '%ls', HRESULT 0x%x$Setting version variable '%ls' to value '%hu.%hu.%hu.%hu'$Unsetting variable '%ls'$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 2716280545-3393465121
Opcode ID: 00e42a8e5b8730899b0d2900f763455b4487a1e4ed9a014a044b39246c03ad80
Instruction ID: 42ffdd0529daa4f889a1c4d8cbfac6898795d06c365e93a2af918c4616b89e30
Opcode Fuzzy Hash: 00e42a8e5b8730899b0d2900f763455b4487a1e4ed9a014a044b39246c03ad80
Instruction Fuzzy Hash: 6B51F471A00235EBCF349E14ED9AF6B3B68EBA5705F250129F8509A2C2C335DD71CAE0

Function 00124B2A Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 143windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00124CA9
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00124CBA

Strings

Failed while running , xrefs: 00124C6F
Failed to set action variables., xrefs: 00124C09
Failed to query registration., xrefs: 00124BF3
Failed to set registration variables., xrefs: 00124C23
WixBundleLayoutDirectory, xrefs: 00124C3A
Failed to set layout directory variable to value provided from command-line., xrefs: 00124C4B
Failed to check global conditions, xrefs: 00124B8E
Failed to open log., xrefs: 00124B5D
Failed to create the message window., xrefs: 00124BDD

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: MessagePostWindow
String ID: Failed to check global conditions$Failed to create the message window.$Failed to open log.$Failed to query registration.$Failed to set action variables.$Failed to set layout directory variable to value provided from command-line.$Failed to set registration variables.$Failed while running $WixBundleLayoutDirectory
API String ID: 3618638489-3051724725
Opcode ID: 94f12871993188f42da8b427e62bce2b71ec2d0d873049c5c18e29f085f09cf3
Instruction ID: 282cab568b75eb089d54de14d65ee88d43f2cdf1211dbce1f611c555054f5069
Opcode Fuzzy Hash: 94f12871993188f42da8b427e62bce2b71ec2d0d873049c5c18e29f085f09cf3
Instruction Fuzzy Hash: E7411571A01A36BBDB2A9B64EC45FBAB66CBF10750F010225F815B6150DB70ED70CBD1

Function 0013E8CE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 100threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,?,001254CB,?,?), ref: 0013E8EE
GetLastError.KERNEL32(?,001254CB,?,?), ref: 0013E8FB
CreateThread.KERNELBASE(00000000,00000000,Function_0001E60C,?,00000000,00000000), ref: 0013E954
GetLastError.KERNEL32(?,001254CB,?,?), ref: 0013E961
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,001254CB,?,?), ref: 0013E99C
CloseHandle.KERNEL32(00000000,?,001254CB,?,?), ref: 0013E9BB
FindCloseChangeNotification.KERNELBASE(?,?,001254CB,?,?), ref: 0013E9C8

Strings

Failed to create the UI thread., xrefs: 0013E98C
c:\agent\_work\66\s\src\burn\engine\uithread.cpp, xrefs: 0013E91C, 0013E982
Failed to create initialization event., xrefs: 0013E926

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseCreateErrorLast$ChangeEventFindHandleMultipleNotificationObjectsThreadWait
String ID: Failed to create initialization event.$Failed to create the UI thread.$c:\agent\_work\66\s\src\burn\engine\uithread.cpp
API String ID: 1372344712-1290259148
Opcode ID: e9683dc3899688be541f0ab0ccf93d7aef6328ec82a84436f20b704a0120a92a
Instruction ID: c0d10422f4509d0f9b17c7efa5e1573399017af6513d6f36b1d2df649ab3784a
Opcode Fuzzy Hash: e9683dc3899688be541f0ab0ccf93d7aef6328ec82a84436f20b704a0120a92a
Instruction Fuzzy Hash: E431C476D4022ABBD7109F998D44B9FBAFCBF04754F114169F905F7280E7749E008BA1

Function 00141286 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 87threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,74DF2F60,?,?), ref: 001412AA
GetLastError.KERNEL32 ref: 001412BD
GetExitCodeThread.KERNELBASE(0016A488,00000000), ref: 001412FF
GetLastError.KERNEL32 ref: 0014130D
ResetEvent.KERNEL32(0016A460), ref: 00141348
GetLastError.KERNEL32 ref: 00141352

Strings

Failed to get extraction thread exit code., xrefs: 0014133E
Failed to reset operation complete event., xrefs: 00141383
Failed to wait for operation complete event., xrefs: 001412EE
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 001412E4, 00141334, 00141379

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast$CodeEventExitMultipleObjectsResetThreadWait
String ID: Failed to get extraction thread exit code.$Failed to reset operation complete event.$Failed to wait for operation complete event.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 2979751695-3513947302
Opcode ID: 64287b20e1055f14b7daab3285d09818915aa2e98e4ce30c250c82bfeb2f1572
Instruction ID: ff16eaac3aec0ebe800dd2376119e21ede75a013d9a9e9b43418a46d40efc9d8
Opcode Fuzzy Hash: 64287b20e1055f14b7daab3285d09818915aa2e98e4ce30c250c82bfeb2f1572
Instruction Fuzzy Hash: 22318F70A40306FBE7109FA5CD01BAE76F9BF00721F108169F905EA5A0E779DA849B11

Function 00122EBC Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 202sleepfiletimeCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000000,00000000,00000000), ref: 00122F5C
GetLastError.KERNEL32 ref: 00122F66
GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 00123006
CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000001,00000080,00000000), ref: 00123093
GetLastError.KERNEL32 ref: 001230A0
Sleep.KERNEL32(00000064), ref: 001230B4
CloseHandle.KERNEL32(?), ref: 0012311C

Strings

c:\agent\_work\66\s\src\libs\dutil\pathutil.cpp, xrefs: 00122F8A
%ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls, xrefs: 00123063

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast$CloseCreateFileHandleLocalPathSleepTempTime
String ID: %ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls$c:\agent\_work\66\s\src\libs\dutil\pathutil.cpp
API String ID: 3480017824-3233915199
Opcode ID: 669fd24a6cdf8e2331a36428db6bd0902fc5c110c8f420ac44d1de2c2e4d8c1d
Instruction ID: 613e891d467b6cc615dcaa6abab9367d8054e258dac85f9f7613ec48373c96d1
Opcode Fuzzy Hash: 669fd24a6cdf8e2331a36428db6bd0902fc5c110c8f420ac44d1de2c2e4d8c1d
Instruction Fuzzy Hash: C9718172D01239ABDB309B64ED49BEDB3B8AF18710F000195FA19B7190D7789EA1CF60

Function 0012CB82 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 143COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,FFFEB88D,000000FF,00000001,000000FF,?,00000001,001253FA,00000000,001254C6,00125482,WixBundleUILevel,840F01E8,?,00000001), ref: 0012CBD9

Strings

Failed to get directory portion of local file path, xrefs: 0012CCB2
Failed to concat file paths., xrefs: 0012CCB9
Payload was not found in container: %ls, xrefs: 0012CCE6
Failed to find embedded payload: %ls, xrefs: 0012CC05
Failed to ensure directory exists, xrefs: 0012CCAB
Failed to get next stream., xrefs: 0012CCC0
c:\agent\_work\66\s\src\burn\engine\payload.cpp, xrefs: 0012CCDA
Failed to extract file., xrefs: 0012CCA4

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CompareString
String ID: Failed to concat file paths.$Failed to ensure directory exists$Failed to extract file.$Failed to find embedded payload: %ls$Failed to get directory portion of local file path$Failed to get next stream.$Payload was not found in container: %ls$c:\agent\_work\66\s\src\burn\engine\payload.cpp
API String ID: 1825529933-3317369491
Opcode ID: c389c8b06a425935e411cf88e27a5d8df73991a143a638136e79b989667ed645
Instruction ID: 8235970347fe716706dd2520179a7997c3a4a38c11a0b60ca7bff351baef4a70
Opcode Fuzzy Hash: c389c8b06a425935e411cf88e27a5d8df73991a143a638136e79b989667ed645
Instruction Fuzzy Hash: B641EF31900235EFCF29DF88EC419AEBBA5BF50710B11816AEA19AB251D3719E70DBD0

Function 001247DF Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 127windowthreadCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(00000000,00000000,00000400,00000400,00000000), ref: 00124804
GetCurrentThreadId.KERNEL32 ref: 0012480A
GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00124898

Strings

Failed to load UX., xrefs: 0012484D
wininet.dll, xrefs: 00124837
Failed to start bootstrapper application., xrefs: 00124866
Failed to create engine for UX., xrefs: 00124824
c:\agent\_work\66\s\src\burn\engine\engine.cpp, xrefs: 001248E4
Unexpected return value from message pump., xrefs: 001248EE

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Message$CurrentPeekThread
String ID: Failed to create engine for UX.$Failed to load UX.$Failed to start bootstrapper application.$Unexpected return value from message pump.$c:\agent\_work\66\s\src\burn\engine\engine.cpp$wininet.dll
API String ID: 673430819-1140212773
Opcode ID: 1eda40eab7a06151b17cdf6f9fea82f465d2b0f002401b30c93ace4fd5c68fe0
Instruction ID: 571564cb1456170f4e210ef9aff5edae762838189bf48ceb3765a76dc23247c4
Opcode Fuzzy Hash: 1eda40eab7a06151b17cdf6f9fea82f465d2b0f002401b30c93ace4fd5c68fe0
Instruction Fuzzy Hash: 0041D371600625BFEB149BA4EC85EBF77ACEF14314F100129F915EB280DB30ED658BA0

Function 0012D679 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(?,00000000,00000008,00000000,?,00124847,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,001254CB,?), ref: 0012D68A
GetLastError.KERNEL32(?,00124847,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,001254CB,?,?), ref: 0012D697
GetProcAddress.KERNEL32(00000000,BootstrapperApplicationCreate), ref: 0012D6CF
GetLastError.KERNEL32(?,00124847,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,001254CB,?,?), ref: 0012D6DB

Strings

Failed to create UX., xrefs: 0012D71F
Failed to get BootstrapperApplicationCreate entry-point, xrefs: 0012D706
BootstrapperApplicationCreate, xrefs: 0012D6C9
Failed to load UX DLL., xrefs: 0012D6C2
c:\agent\_work\66\s\src\burn\engine\userexperience.cpp, xrefs: 0012D6B8, 0012D6FC

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID: BootstrapperApplicationCreate$Failed to create UX.$Failed to get BootstrapperApplicationCreate entry-point$Failed to load UX DLL.$c:\agent\_work\66\s\src\burn\engine\userexperience.cpp
API String ID: 1866314245-3967977479
Opcode ID: 92b87d5f43f38b65b08d73516eb737f2bcbb7f9ba9dcc4576bc56d362f59b9d8
Instruction ID: 7c365835e5bc35b0545302a4f67cab828263f0460cebdd2b7bce3c8c5a13a15d
Opcode Fuzzy Hash: 92b87d5f43f38b65b08d73516eb737f2bcbb7f9ba9dcc4576bc56d362f59b9d8
Instruction Fuzzy Hash: 35110A37A80B32A7D7255A94FC19F5B3B946F15BA1F014139FE15FB280EB69DC204AD0

Function 0012F7B4 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 116registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 0012F8E4
RegCloseKey.ADVAPI32(00000000,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 0012F8F1

Strings

Failed to format pending restart registry key to read., xrefs: 0012F7E8
Failed to open registration key., xrefs: 0012F84D
%ls.RebootRequired, xrefs: 0012F7D1
Failed to read Resume value., xrefs: 0012F87A
Resume, xrefs: 0012F858

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Close
String ID: %ls.RebootRequired$Failed to format pending restart registry key to read.$Failed to open registration key.$Failed to read Resume value.$Resume
API String ID: 3535843008-3890505273
Opcode ID: 26097a4b38bf6246c2ce474da022fc1b1f9fac8c1e5730265859e78914aebe9f
Instruction ID: 929c53bf51afb5cf71868e6a6216348b14338da4d15345830ea20b96f64a55df
Opcode Fuzzy Hash: 26097a4b38bf6246c2ce474da022fc1b1f9fac8c1e5730265859e78914aebe9f
Instruction Fuzzy Hash: B6416331D00229FFDB169FA4E941AADFBB4FF14310F11817AE915AB250D3B19E61DB90

Function 0015FDEF Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 116fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0018B5D4,00000000,?,?,?,00134192,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00125537,?), ref: 0015FDFF
CreateFileW.KERNEL32(40000000,00000001,00000000,00000000,00000080,00000000,?,00000000,?,?,?,0018B5CC,?,00134192,00000000,Setup), ref: 0015FEA3
GetLastError.KERNEL32(?,00134192,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00125537,?,?,?), ref: 0015FEB3
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00134192,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00125537,?), ref: 0015FEED

Part of subcall function 00122EBC: GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 00123006

LeaveCriticalSection.KERNEL32(0018B5D4,?,?,0018B5CC,?,00134192,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00125537,?), ref: 0015FF46

Strings

c:\agent\_work\66\s\src\libs\dutil\logutil.cpp, xrefs: 0015FED2

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CriticalFileSection$CreateEnterErrorLastLeaveLocalPointerTime
String ID: c:\agent\_work\66\s\src\libs\dutil\logutil.cpp
API String ID: 4111229724-727082060
Opcode ID: 1209f2f78c41f806ca05eef8cce7308fc3f84593c3798b0e7bca65c10d641633
Instruction ID: 4955a3af4d7088bbf7afa458de2a300f3ccf072cdf921ba44366383058307592
Opcode Fuzzy Hash: 1209f2f78c41f806ca05eef8cce7308fc3f84593c3798b0e7bca65c10d641633
Instruction Fuzzy Hash: F931183290422AFFDB216FA0EC96A5E3A69FF10741F014239FD10AA561D771CE559FA0

Function 00162B5D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00162B73
SysAllocString.OLEAUT32(?), ref: 00162B8F
VariantClear.OLEAUT32(?), ref: 00162C16
SysFreeString.OLEAUT32(00000000), ref: 00162C21

Strings

c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp, xrefs: 00162BA6
`<u, xrefs: 00162C21

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: `<u$c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp
API String ID: 760788290-1301604586
Opcode ID: ba8c18a63f4c41538a56a2b30ce99267cc67bcf1cf61406d30c99e71151f9ae0
Instruction ID: dfc574ebb011e52ead53dc9542af47a71b8a2a93ca3a132ab4e15fe3eefb1389
Opcode Fuzzy Hash: ba8c18a63f4c41538a56a2b30ce99267cc67bcf1cf61406d30c99e71151f9ae0
Instruction Fuzzy Hash: A321A136A00629EFCB10DF68CC48EAEBBB9EF45751F154158F815AB220CB319D51DB90

Function 00140937 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 74fileCOMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 00140987
WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 001409A6
GetLastError.KERNEL32 ref: 001409B0

Strings

Unexpected call to CabWrite()., xrefs: 0014096A
Failed to write during cabinet extraction., xrefs: 001409DE
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 001409D4

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorFileLastWrite_memcpy_s
String ID: Failed to write during cabinet extraction.$Unexpected call to CabWrite().$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 1970631241-3210721340
Opcode ID: 8785a002155cad8b333b0e3280750a73615ba3144525296aa854a6ef04e3220c
Instruction ID: 0fbefb0d7ae869b176f527700532d021c7382619c7e86009fe1621f33a3a3574
Opcode Fuzzy Hash: 8785a002155cad8b333b0e3280750a73615ba3144525296aa854a6ef04e3220c
Instruction Fuzzy Hash: BA21CF76500101ABEB06CF6ED985D9A77A9EF88728B110059FF18D72A2E775DD00CB60

Function 00160141 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32(?,00000008,?,001253FA,00000000,?,?,?,?,?,?,?,00137590,00000000), ref: 0016015F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00137590,00000000), ref: 00160169
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?,?,?,?,?,?,?,?,00137590,00000000), ref: 0016019B
GetLastError.KERNEL32(?,?,?,?,?,?,?,00137590,00000000), ref: 001601B4
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,00137590,00000000), ref: 001601F3

Strings

c:\agent\_work\66\s\src\libs\dutil\procutil.cpp, xrefs: 001601E1

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLastToken$ChangeCloseFindInformationNotificationOpenProcess
String ID: c:\agent\_work\66\s\src\libs\dutil\procutil.cpp
API String ID: 3650908616-2457365779
Opcode ID: 7d256273d30a21329718cafc0157d77d36aa46867c65f96df952197d663f96ca
Instruction ID: 66632780ad1a54afbafb3deb615639d6ec266a305c2b03bda5479b01bd42882e
Opcode Fuzzy Hash: 7d256273d30a21329718cafc0157d77d36aa46867c65f96df952197d663f96ca
Instruction Fuzzy Hash: 0D219D76E41229FBCB229B998C04A9FBAA8EF19710F024166ED05BB250D374CF50DAD0

Function 001409FE Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00140A6B
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00140A7D
SetFileTime.KERNELBASE(?,?,?,?), ref: 00140A90
FindCloseChangeNotification.KERNELBASE(000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00140660,?,?), ref: 00140A9F

Strings

Invalid operation for this state., xrefs: 00140A44
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 00140A3A

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Time$File$ChangeCloseDateFindLocalNotification
String ID: Invalid operation for this state.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 1330928052-2444813713
Opcode ID: d95f257b8bcabdd1808bb42d3ca2f74055379627511f727edfcb260deb22ec86
Instruction ID: 26cc57f9cab8c89faa9297ac3ce6fa63c3873e3631e572fcc2fa7531877b4798
Opcode Fuzzy Hash: d95f257b8bcabdd1808bb42d3ca2f74055379627511f727edfcb260deb22ec86
Instruction Fuzzy Hash: AF21C37290061AAE8710DFA9DC088AA7BBDFF48720764821AF951E75E0D375D951CF90

Function 00162DC7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00162DD6
InterlockedIncrement.KERNEL32(0018B69C), ref: 00162DF3
CLSIDFromProgID.OLE32(Msxml2.DOMDocument,0018B688,?,?,?,?,?,?), ref: 00162E0E
CLSIDFromProgID.OLE32(MSXML.DOMDocument,0018B688,?,?,?,?,?,?), ref: 00162E1A

Strings

Msxml2.DOMDocument, xrefs: 00162E09
MSXML.DOMDocument, xrefs: 00162E15

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: FromProg$IncrementInitializeInterlocked
String ID: MSXML.DOMDocument$Msxml2.DOMDocument
API String ID: 2109125048-2356320334
Opcode ID: 9b8514750275f2c4d8d4e69a45f8b5cd07954f2a1d297276617c8118fac420f9
Instruction ID: 7b81f8dd2d5bae5e4dc9c9b1f7989d9dea65986bc1374182b7d91f31f6bc8dbd
Opcode Fuzzy Hash: 9b8514750275f2c4d8d4e69a45f8b5cd07954f2a1d297276617c8118fac420f9
Instruction Fuzzy Hash: A3F0E53174A5359BD7212BA2AD08F4B3E6AEB91B51F901028E801E1560E3B089918FB1

Function 00164289 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 001642BA
GlobalAlloc.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000001), ref: 001642E7
GetLastError.KERNEL32(?,00000000,?,00000000), ref: 00164313
GetLastError.KERNEL32(00000000,0016A800,?,00000000,?,00000000,?,00000000), ref: 00164351
GlobalFree.KERNEL32(00000000), ref: 00164382

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 001642D5, 0016432E

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLast$Global$AllocFree
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 1145190524-1688708105
Opcode ID: f74be29ef40f5de0ceb2b448f9f31d8c55ddbe805458d4d5d29ed27f7882f17e
Instruction ID: 5579072cb5b9d9306c2bfc1bfd6bbbcf2019f3cc9fea2240068611122739a9d3
Opcode Fuzzy Hash: f74be29ef40f5de0ceb2b448f9f31d8c55ddbe805458d4d5d29ed27f7882f17e
Instruction Fuzzy Hash: B831B137D40239ABD7229B998D41EAFBAA9BF54760F124255FD04EB341E770DD208AE0

Function 0013E7A7 Relevance: 9.1, APIs: 6, Instructions: 85windowCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000082,?,?), ref: 0013E7D6
SetWindowLongW.USER32(?,000000EB,00000000), ref: 0013E7E5
SetWindowLongW.USER32(?,000000EB,?), ref: 0013E7F9
DefWindowProcW.USER32(?,?,?,?), ref: 0013E809
GetWindowLongW.USER32(?,000000EB), ref: 0013E823
PostQuitMessage.USER32(00000000), ref: 0013E882

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Window$Long$Proc$MessagePostQuit
String ID:
API String ID: 3812958022-0
Opcode ID: 9d99ba760a141aabda55d4d385466364af8067ae0cbdc7a145864b504896ba52
Instruction ID: 075b903e5478317a7166f43819d0261158181f884a4721fba269327e5ac57162
Opcode Fuzzy Hash: 9d99ba760a141aabda55d4d385466364af8067ae0cbdc7a145864b504896ba52
Instruction Fuzzy Hash: FE21CF32500214BFDF055F68DC48EAA3FA9FF45360F548268FA1AAA2E0C731DD60DB61

Function 00160AB4 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 147registrystringCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 00160ADC
RegQueryValueExW.KERNELBASE(?,00000000,00000000,?,?,?,?,?,?,00136FDF,00000100,000000B0,00000088,00000410,000002C0), ref: 00160B13
lstrlenW.KERNEL32(?,?,?,00000000,?,-00000001,00000004,00000000), ref: 00160C05

Strings

c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 00160B56
BundleUpgradeCode, xrefs: 00160ABB

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: QueryValue$lstrlen
String ID: BundleUpgradeCode$c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 3790715954-1890108899
Opcode ID: c9d724c908b4f476ad2a0e32e2f9df940637267bbaf1ca15082bc3fa91e59fd9
Instruction ID: 56321df6ee633b46dd114c4af783f1fd2d357fea522dfb6b6103c4cd3f03ea5f
Opcode Fuzzy Hash: c9d724c908b4f476ad2a0e32e2f9df940637267bbaf1ca15082bc3fa91e59fd9
Instruction Fuzzy Hash: 6741C835A0011AEFCB26DF54CC81AAFB7B9EF08714F1581A9F805AB210D770DD20CB94

Function 0014082C Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 001408D2
GetLastError.KERNEL32(?,?,?), ref: 001408DC

Strings

c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 00140900
Failed to move file pointer 0x%x bytes., xrefs: 0014090D
Invalid seek type., xrefs: 00140868

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move file pointer 0x%x bytes.$Invalid seek type.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 2976181284-424406494
Opcode ID: 3d2cc79780e6bc385da77bd83cca9439e65f5bbd2e3e3a06595bda75e01920fd
Instruction ID: 0a748ea5c971bf3d0ddb68da0438ab8c5dbba4a8fa09759f48725e40638c2882
Opcode Fuzzy Hash: 3d2cc79780e6bc385da77bd83cca9439e65f5bbd2e3e3a06595bda75e01920fd
Instruction Fuzzy Hash: 7F31AB71E0011AEFDB05CFA9CD51E99B7A9FF08324B048129FA18A7661E374EA10CBD0

Function 00148AF2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 85registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00160823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0018AA7C,00000000,?,00164FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00160837

CompareStringW.KERNEL32(00000000,00000001,00000000,000000FF,?,000000FF,00000000,00000000,00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4), ref: 00148B76
RegCloseKey.ADVAPI32(00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4,?,?,?,0012F782,00000001,00000100,000001B4,00000000), ref: 00148BC4

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00148B13
Failed to open uninstall registry key., xrefs: 00148B39
Failed to enumerate uninstall key for related bundles., xrefs: 00148BD3

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseCompareOpenString
String ID: Failed to enumerate uninstall key for related bundles.$Failed to open uninstall registry key.$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 2817536665-2531018330
Opcode ID: 50e7a2b8c6c00c5d2b846a19f6d95cfd8e3f8e5bd8461e88cca6b440c45d21f5
Instruction ID: a7116eca1e0ffca3bad57a812e3abca584ca98ae678cb9af20cea94c725db5e0
Opcode Fuzzy Hash: 50e7a2b8c6c00c5d2b846a19f6d95cfd8e3f8e5bd8461e88cca6b440c45d21f5
Instruction Fuzzy Hash: BB21D672910228FFDF12AB94DC86FEEBA79EF14721F244264F810760B0CB754E90D690

Function 0012415F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,840F01E8,00000000,00000000,?,00139FBC,00000000,00000000,?,00000000,001253FA,00000000,?,?,0012D567,?), ref: 0012416D
GetLastError.KERNEL32(?,00139FBC,00000000,00000000,?,00000000,001253FA,00000000,?,?,0012D567,?,00000000,00000000), ref: 0012417B
CreateDirectoryW.KERNEL32(?,840F01E8,001254C6,?,00139FBC,00000000,00000000,?,00000000,001253FA,00000000,?,?,0012D567,?,00000000), ref: 001241EB
GetLastError.KERNEL32(?,00139FBC,00000000,00000000,?,00000000,001253FA,00000000,?,?,0012D567,?,00000000,00000000), ref: 001241F5

Strings

c:\agent\_work\66\s\src\libs\dutil\dirutil.cpp, xrefs: 00124225

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: c:\agent\_work\66\s\src\libs\dutil\dirutil.cpp
API String ID: 1375471231-2061300336
Opcode ID: 122f9bcaece3274d11c9ad4d6fb37bb35cd4f48bdb2ebe10fdb988a8c83ba4ca
Instruction ID: 92ed764e5f2643fefa93187758a0a89c5415ced0da149473b71743819ad27b37
Opcode Fuzzy Hash: 122f9bcaece3274d11c9ad4d6fb37bb35cd4f48bdb2ebe10fdb988a8c83ba4ca
Instruction Fuzzy Hash: CD215736A40231E7EB315BA67C00B3BBAA9EF65B61F524025FD09FB240D364DCB196D1

Function 00160708 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.KERNELBASE(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000002,00000100,00000000,00000000,?,?,00148B57), ref: 00160763
RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00148B57,00000000), ref: 00160781
RegEnumKeyExW.KERNELBASE(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000003,?,?,00148B57,00000000,00000000,00000000), ref: 001607D7

Strings

c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 001607A7

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Enum$InfoQuery
String ID: c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 73471667-3237223240
Opcode ID: ea72be694a247c1417ca0d77153b766ff62130bab445320c288ac4a00e0a6f5a
Instruction ID: 81fb2dfb1381b2bc7c7c06a1f26498c169e6a31d96fa25a96058e81e7e05300f
Opcode Fuzzy Hash: ea72be694a247c1417ca0d77153b766ff62130bab445320c288ac4a00e0a6f5a
Instruction Fuzzy Hash: F6319276D0112AFBEB12CA94CD84EAFB76DEF18794F114065BD41AB110E7309E20DBA0

Function 00148857 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 75registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00160823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0018AA7C,00000000,?,00164FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00160837

RegCloseKey.KERNELBASE(00000000,00000000,00000088,00000000,000002C0,00000410,00020019,00000000,000002C0,00000000,?,?,?,00148B93,00000000,00000000), ref: 00148914

Strings

Failed to open uninstall key for potential related bundle: %ls, xrefs: 00148883
Failed to ensure there is space for related bundles., xrefs: 001488C7
Failed to initialize package from related bundle id: %ls, xrefs: 001488FA

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseOpen
String ID: Failed to ensure there is space for related bundles.$Failed to initialize package from related bundle id: %ls$Failed to open uninstall key for potential related bundle: %ls
API String ID: 47109696-1717420724
Opcode ID: fb7468497efc7fbc17a6bfa741742ab6bd27798644adc1542b9d1cb87381f8c8
Instruction ID: 3e20068d280ff364aa14f6beea7972ef7594c771739c5f1425a5dd3e901a4717
Opcode Fuzzy Hash: fb7468497efc7fbc17a6bfa741742ab6bd27798644adc1542b9d1cb87381f8c8
Instruction Fuzzy Hash: 1321BB7290061AFBDF128E80DC02BFEBB78EF45314F104064F910B61A0DB71AE61EB91

Function 0016002E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62filestringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenA.KERNEL32(00141074,00000000,00000000,?,?,?,0015F8EB,00141074,00141074,?,00000000,0000FDE9,?,00141074,8007139F,Invalid operation for this state.), ref: 00160040
WriteFile.KERNELBASE(0000021C,00000000,00000000,?,00000000,?,?,0015F8EB,00141074,00141074,?,00000000,0000FDE9,?,00141074,8007139F), ref: 0016007C
GetLastError.KERNEL32(?,?,0015F8EB,00141074,00141074,?,00000000,0000FDE9,?,00141074,8007139F,Invalid operation for this state.,c:\agent\_work\66\s\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 00160086

Strings

c:\agent\_work\66\s\src\libs\dutil\logutil.cpp, xrefs: 001600B7

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorFileLastWritelstrlen
String ID: c:\agent\_work\66\s\src\libs\dutil\logutil.cpp
API String ID: 606256338-727082060
Opcode ID: aed17663bc29bc92b416c662f9d0365003266bbfb3adee4847862906e83716d6
Instruction ID: 624618bffc6595d2ceaf1f71170b4ebb6f2ab01198415cbc6f5d20e3c74fa3b9
Opcode Fuzzy Hash: aed17663bc29bc92b416c662f9d0365003266bbfb3adee4847862906e83716d6
Instruction Fuzzy Hash: CE118672601235A7D3259AB59D44BEF7A6DEF497E0B510215FD01E7240E7B09D9086E0

Function 0015F6FD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00000900,?,?,00000000,00000000,00000000,?,00000000,?,?,0015FDC0,?,?,?,?,00000001), ref: 0015F71C
GetLastError.KERNEL32(?,0015FDC0,?,?,?,?,00000001,?,00125651,?,?,00000000,?,?,001253D2,00000002), ref: 0015F728
LocalFree.KERNEL32(00000000,?,?,00000000,?,?,0015FDC0,?,?,?,?,00000001,?,00125651,?,?), ref: 0015F791

Strings

c:\agent\_work\66\s\src\libs\dutil\logutil.cpp, xrefs: 0015F747

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: c:\agent\_work\66\s\src\libs\dutil\logutil.cpp
API String ID: 1365068426-727082060
Opcode ID: 9ae8bb1b8214b41e74a12bc54b442bb361b4af4a5dad098102ffff203198e73b
Instruction ID: 60d11ef7bd035e091db6f3e4dd2921cb828b3b8a5aad21ce5612aaf16e15c800
Opcode Fuzzy Hash: 9ae8bb1b8214b41e74a12bc54b442bb361b4af4a5dad098102ffff203198e73b
Instruction Fuzzy Hash: 7411E332501129FBDF259F90DD05EEE7B6AEF58751F01802DFD10AA160D7708E52DAA0

Function 00140797 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001411B1: SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,001407C6,?,?,?), ref: 001411D9
Part of subcall function 001411B1: GetLastError.KERNEL32(?,001407C6,?,?,?), ref: 001411E3

ReadFile.KERNELBASE(?,?,?,?,00000000,?,?,?), ref: 001407D4
GetLastError.KERNEL32 ref: 001407DE

Strings

Failed to read during cabinet extraction., xrefs: 0014080C
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 00140802

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorFileLast$PointerRead
String ID: Failed to read during cabinet extraction.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 2170121939-3499834177
Opcode ID: d18622db1ecfd79dcb886c6abc720082a4dcd14d9469384d2e0d938c66dd0309
Instruction ID: 2db7a5258d0e7846644720796d64aafe3576c704a66224b40c45dcc6a6813162
Opcode Fuzzy Hash: d18622db1ecfd79dcb886c6abc720082a4dcd14d9469384d2e0d938c66dd0309
Instruction Fuzzy Hash: 7F01A136A4026AFBDB119FA9DD04D8A7BA8FF09B64B014128FE04E7660D734E910CAD4

Function 001411B1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,001407C6,?,?,?), ref: 001411D9
GetLastError.KERNEL32(?,001407C6,?,?,?), ref: 001411E3

Strings

Failed to move to virtual file pointer., xrefs: 00141211
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 00141207

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move to virtual file pointer.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 2976181284-1387633737
Opcode ID: 269b1e24d72b1d642f0c31ee0552c5a43b50b203dc2f7ca75cdf96ef3e7cf4d3
Instruction ID: 2e729c0a9346a0cb3fac29317afcd3ad19449cde1f74f29985c8eb435f64f699
Opcode Fuzzy Hash: 269b1e24d72b1d642f0c31ee0552c5a43b50b203dc2f7ca75cdf96ef3e7cf4d3
Instruction Fuzzy Hash: 5E01A737940536B7C7211B95AC04D8BBF29EF51BB1711C125FE18EA120D765DC5086D0

Function 00140564 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(0016A478,00000000,?,001414B9,?,00000000,?,0012C24A,?,00125442,?,00137498,?,?,00125442,?), ref: 0014056E
GetLastError.KERNEL32(?,001414B9,?,00000000,?,0012C24A,?,00125442,?,00137498,?,?,00125442,?,00125482,00000001), ref: 00140578

Strings

Failed to set begin operation event., xrefs: 001405A6
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 0014059C

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorEventLast
String ID: Failed to set begin operation event.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 3848097054-3321223842
Opcode ID: 051b5952bfb60b6f56b41106e16995b847cf77da23769d640707c04ec77221a7
Instruction ID: e489e4011efc761471a9148056d69270a6c04bc1fe620d0896ca319e382883b6
Opcode Fuzzy Hash: 051b5952bfb60b6f56b41106e16995b847cf77da23769d640707c04ec77221a7
Instruction Fuzzy Hash: 19F0EC3394163167832122A65D05A877798DF1DB617010125FF04FF250F769AD404AE5

Function 0013EAAB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009000,00000000,?), ref: 0013EAC0
GetLastError.KERNEL32 ref: 0013EACA

Strings

Failed to post detect message., xrefs: 0013EAF8
c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp, xrefs: 0013EAEE

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post detect message.$c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp
API String ID: 2609174426-2517332631
Opcode ID: a46da88fc8e69f0253877fe4f10fbdb4f352c97eff6d1a793be24cfedd32e2d3
Instruction ID: 67456d2176dc8394a52f81e12aff3cb69aa06373e061f9386c316f3e982669e5
Opcode Fuzzy Hash: a46da88fc8e69f0253877fe4f10fbdb4f352c97eff6d1a793be24cfedd32e2d3
Instruction Fuzzy Hash: 4EF0A7336413317BD22116A55C09E87BF98BF15B61F024015FE18BF281E764DC00C6D4

Function 00133A2C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00160823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0018AA7C,00000000,?,00164FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00160837

RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000000,?,?,?,?,00133F3C,feclient.dll,?,00000000,?,?,?,00124B57), ref: 00133ACD

Part of subcall function 0016095E: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 001609D4
Part of subcall function 0016095E: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00160A0C

Strings

Logging, xrefs: 00133A5A
SOFTWARE\Policies\Microsoft\Windows\Installer, xrefs: 00133A43

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Logging$SOFTWARE\Policies\Microsoft\Windows\Installer
API String ID: 1586453840-387823766
Opcode ID: 208dd274524ca6067c3dd79a8a6cb8a5c50b4386dd4bd004777cde8a23bdc5de
Instruction ID: 2014a2886b18b020b66c06e90d7ed0b6a2be851994fe935e9e651be7d7ffdc15
Opcode Fuzzy Hash: 208dd274524ca6067c3dd79a8a6cb8a5c50b4386dd4bd004777cde8a23bdc5de
Instruction Fuzzy Hash: 5E11573660021ABBEB29DA80DD06FFAB778AB00B04F904055E881E7090C7708F828758

Function 00125160 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(burn.clean.room,?,?,?,?,00121104,?,?,00000000), ref: 0012517F
CompareStringW.KERNELBASE(0000007F,00000001,?,0000000F,burn.clean.room,0000000F,?,?,?,?,00121104,?,?,00000000), ref: 001251AF

Strings

burn.clean.room, xrefs: 0012516C, 00125179, 001251A6

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CompareStringlstrlen
String ID: burn.clean.room
API String ID: 1433953587-3055529264
Opcode ID: be304de488c41835bd0bf6816f84d6cc37b53e908ea1a2804fc74e9efa460cc2
Instruction ID: 04781e49aee79692bd3da0600a33c72c70855f24044394e554666e656663b861
Opcode Fuzzy Hash: be304de488c41835bd0bf6816f84d6cc37b53e908ea1a2804fc74e9efa460cc2
Instruction Fuzzy Hash: 0E016272610A306BE7244B49BDC4E73BBAEEF19B517500116F505D3E10C3759CB0CBA2

Function 001238D1 Relevance: 4.6, APIs: 3, Instructions: 79libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00123910
GetLastError.KERNEL32 ref: 0012391A
LoadLibraryW.KERNELBASE(?,?,00000104,?), ref: 00123983

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: DirectoryErrorLastLibraryLoadSystem
String ID:
API String ID: 1230559179-0
Opcode ID: ed2ec544bcf10e2437afd2b9a4f2375b44c6bc32df37d14cca1f7c468203e63d
Instruction ID: dccf4354f6a3b44f5244a2b956ce438d068034690f7af61289abef4251be0763
Opcode Fuzzy Hash: ed2ec544bcf10e2437afd2b9a4f2375b44c6bc32df37d14cca1f7c468203e63d
Instruction Fuzzy Hash: 782107B6D0133967DF209BA4AC49F9A77AC9F01714F110265FE24F7241E7B8DE908A90

Function 00123AA4 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,0015FB87,00000000,8007139F,?,00000000,00000000,8007139F,?,?,?,0015FB1B,000001C7), ref: 00123AAE
RtlFreeHeap.NTDLL(00000000,?,0015FB87,00000000,8007139F,?,00000000,00000000,8007139F,?,?,?,0015FB1B,000001C7,?,?), ref: 00123AB5
GetLastError.KERNEL32(?,0015FB87,00000000,8007139F,?,00000000,00000000,8007139F,?,?,?,0015FB1B,000001C7,?,?), ref: 00123ABF

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Heap$ErrorFreeLastProcess
String ID:
API String ID: 406640338-0
Opcode ID: 4bb43cac9cb89490c8181a92c6c489bd4fa12dcaff51c4a9fc7034f2b3bfff5d
Instruction ID: ba4812bc55f5469b1a611981281ae33e26388b48b8cd2ab59ae0a4cb2bc92dc3
Opcode Fuzzy Hash: 4bb43cac9cb89490c8181a92c6c489bd4fa12dcaff51c4a9fc7034f2b3bfff5d
Instruction Fuzzy Hash: 7FD01273B0013967872117E96C0C957BE5CEF056A1B454121FD44F7610DA69CD509BE5

Function 0012F6F9 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00160823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0018AA7C,00000000,?,00164FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00160837

RegCloseKey.ADVAPI32(00000000,?,?,00000001,00000000,00000000,?,?,?,00137C46,?,?,?), ref: 0012F75D

Part of subcall function 001608D7: RegQueryValueExW.ADVAPI32(00000004,?,00000000,00000000,?,00000000,?,00000000,?,?,?,0012F732,00000000,Installed,00000000,?), ref: 001608FC

Strings

Installed, xrefs: 0012F725

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Installed
API String ID: 3677997916-3662710971
Opcode ID: 7f627b5c5d068de05825bfd4ff31ce1cebc2783128b638df912a978444630f69
Instruction ID: 8ab5b5876638382d8bd792064ec6cafc7aa1c80f3d8f6c63a1e32a5c47574299
Opcode Fuzzy Hash: 7f627b5c5d068de05825bfd4ff31ce1cebc2783128b638df912a978444630f69
Instruction Fuzzy Hash: 78014B36910128FFCB15DB94DD46BDEBAB8EF04725F1141B8E900AB150D3759E60DBD0

Function 00160823 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0018AA7C,00000000,?,00164FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00160837

Strings

c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 00160874

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Open
String ID: c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 71445658-3237223240
Opcode ID: 7fd2003f9aaff6bc5b1112b9867677cc4108ff48aed839edf1e5397690790f14
Instruction ID: 2e37ba239d71c80f478ab9918a5b4a1d385dc0c5adb4c564c1a21fed4a829374
Opcode Fuzzy Hash: 7fd2003f9aaff6bc5b1112b9867677cc4108ff48aed839edf1e5397690790f14
Instruction Fuzzy Hash: 7FF0B432E40235A3873289969C05AAB7E5E9B487B0F164125BD49EB225F725CC7193E0

Function 0015ED39 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0015ED51

Part of subcall function 001690AE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00169121
Part of subcall function 001690AE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00169132

Strings

PA<n, xrefs: 0015ED39, 0015ED4B

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: PA<n
API String ID: 1269201914-1122501353
Opcode ID: 3bdb3a27566b6b0f02cc75b4cdc1c055a9ce96b03a7f6fb8854d172cd162211b
Instruction ID: 93656181054a6aa2a2b6a34a331d044392b6e61344d0e07a5dde30c66dc78471
Opcode Fuzzy Hash: 3bdb3a27566b6b0f02cc75b4cdc1c055a9ce96b03a7f6fb8854d172cd162211b
Instruction Fuzzy Hash: 1DB0129965E003BEB10C31411E02C36011CC7E1B21332815BFC00D908197C04F0405B3

Function 0015ED5A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0015ED51

Part of subcall function 001690AE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00169121
Part of subcall function 001690AE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00169132

Strings

PA<n, xrefs: 0015ED4B

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: PA<n
API String ID: 1269201914-1122501353
Opcode ID: 739318a475cd84a9a1d1c59d516e8ed6a55cc23da951f54483cd5cddd5a4fbbe
Instruction ID: cf641c1b11a306c1e216c3477f159ede6dc2c7929504f0a6ff771bf356d31bfb
Opcode Fuzzy Hash: 739318a475cd84a9a1d1c59d516e8ed6a55cc23da951f54483cd5cddd5a4fbbe
Instruction Fuzzy Hash: 87B0129565E003AFB10C71451F03C36015CC7E1B21332415BF800CA081D7C54F050673

Function 0015ED6A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0015ED51

Part of subcall function 001690AE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00169121
Part of subcall function 001690AE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00169132

Strings

PA<n, xrefs: 0015ED4B

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: PA<n
API String ID: 1269201914-1122501353
Opcode ID: b2ece28b817cf18a91c1c0a0ed6af39ea23e23e4fd06efbe7f228ab2d6446c62
Instruction ID: ae4943ebf7c72501f5d0f97850cb422179ce3b6b6595079f9426f117a6669e37
Opcode Fuzzy Hash: b2ece28b817cf18a91c1c0a0ed6af39ea23e23e4fd06efbe7f228ab2d6446c62
Instruction Fuzzy Hash: 80B0129565E103AEB10C71451E02C36015CC7E1B21333825BF800CA081D7D04F440673

Function 00157B50 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00155929: GetLastError.KERNEL32(?,00000000,001512E7,00000000,80004004,?,001515EB,00000000,80004004,00000000,00000000), ref: 0015592D
Part of subcall function 00155929: _free.LIBCMT ref: 00155960
Part of subcall function 00155929: SetLastError.KERNEL32(00000000,80004004,00000000,00000000), ref: 001559A1
Part of subcall function 00155929: _abort.LIBCMT ref: 001559A7

Part of subcall function 00157C6F: _abort.LIBCMT ref: 00157CA1
Part of subcall function 00157C6F: _free.LIBCMT ref: 00157CD5

Part of subcall function 001578E4: GetOEMCP.KERNEL32(00000000), ref: 0015790F

_free.LIBCMT ref: 00157BC8
_free.LIBCMT ref: 00157BFE

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: d07ddc3a9f3ce5099c8d4e3f5557eec5cab03db5dd6e9cf25207eddf620e1d38
Instruction ID: 7aa0cde2e139fc55efc9869400430cac5291ba34cc1680a752ead7df6b72dc8f
Opcode Fuzzy Hash: d07ddc3a9f3ce5099c8d4e3f5557eec5cab03db5dd6e9cf25207eddf620e1d38
Instruction Fuzzy Hash: 6431E731908205EFDB11DBA9E446BAD77F9EF11322F25409AEC245F2D1EB315E48DB50

Function 00123B7C Relevance: 3.0, APIs: 2, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,000001C7,?,?,00122375,000001C7,?,00000001,80004005,8007139F,?,?,0015FB39,8007139F,?,00000000), ref: 00123B90
RtlReAllocateHeap.NTDLL(00000000,?,00122375,000001C7,?,00000001,80004005,8007139F,?,?,0015FB39,8007139F,?,00000000,00000000,8007139F), ref: 00123B97

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: b293b6acec000bb6923236e0659272000fd4df24df68648587a76ad0bd202a50
Instruction ID: 7366df9ca8602ff42b6b7bae2844f84cd0ddd6e56f3270d122c96b2709dc2194
Opcode Fuzzy Hash: b293b6acec000bb6923236e0659272000fd4df24df68648587a76ad0bd202a50
Instruction Fuzzy Hash: 68D0C97215420DAB8F005FE8DC09DAA3BADEB59602B448405F915D2510C67DE4609A61

Function 001239DF Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,000001C7,?,0012237C,?,00000001,80004005,8007139F,?,?,0015FB39,8007139F,?,00000000,00000000,8007139F), ref: 001239F0
RtlAllocateHeap.NTDLL(00000000,?,0012237C,?,00000001,80004005,8007139F,?,?,0015FB39,8007139F,?,00000000,00000000,8007139F), ref: 001239F7

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 8501cc688685ef32ba84c3d9ba8680eb1b86b9e70f1c2005c338d7e17acf5ed2
Instruction ID: 4c6fe5edfba5fc3fab961c314808be83a341a7badd87f19950c097de01f89fea
Opcode Fuzzy Hash: 8501cc688685ef32ba84c3d9ba8680eb1b86b9e70f1c2005c338d7e17acf5ed2
Instruction Fuzzy Hash: 26C012721A420CAB8B006FF8EC0EC9A3BACBB29602B488400F905D2510C678E0908B61

Function 00162E25 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00162E5A

Part of subcall function 001628BD: GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00162E6B,00000000,?,00000000), ref: 001628D7
Part of subcall function 001628BD: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,0014BD14,?,00125442,?,00000000,?), ref: 001628E3

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: ErrorHandleInitLastModuleVariant
String ID:
API String ID: 52713655-0
Opcode ID: ad76f369491b12a74539c78f283b7e91c3ff377d0c2a6513d09ff2c7082f0542
Instruction ID: 61a35bce9e39041219e39d1767dd8938cc480c0b3d4453ecc2586bd8c4ab0aa3
Opcode Fuzzy Hash: ad76f369491b12a74539c78f283b7e91c3ff377d0c2a6513d09ff2c7082f0542
Instruction Fuzzy Hash: 44312776E006299BCB11DFA8C884ADEB7F8EF08710F01456AE915BB311DB75AD148BA0

Function 0016897B Relevance: 1.6, APIs: 1, Instructions: 81registryCOMMON

Download Yara Rule

APIs

Part of subcall function 001685F6: lstrlenW.KERNEL32(00000100,?,?,?,00168996,000002C0,00000100,00000100,00000100,?,?,?,00147AD3,?,?,000001BC), ref: 0016861B

RegCloseKey.ADVAPI32(000002C0,000002C0,00000100,00000100,00000100,?,?,?,00147AD3,?,?,000001BC,00000000,00000000,00000000,00000100), ref: 00168A33

Part of subcall function 00160823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0018AA7C,00000000,?,00164FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00160837

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: CloseOpenlstrlen
String ID:
API String ID: 514153755-0
Opcode ID: 5d8a4cd097102c8847d7be710fcee2c5b289ae4bdf90b4b36c03b8dd873defd4
Instruction ID: 76536527883710afa6c7d8365a7901f9f991a9f5e5e178680652d6e3744056c4
Opcode Fuzzy Hash: 5d8a4cd097102c8847d7be710fcee2c5b289ae4bdf90b4b36c03b8dd873defd4
Instruction Fuzzy Hash: B0214A32C1012AEB8F329EA8CD4189EBAB5EB54754B158366FD41B7121E7325E60ABD0

Function 0016506B Relevance: 1.6, APIs: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(80070490,00000000,80070490,0018AA7C,00000000,80070490,?,?,001389F4,WiX\Burn,PackageCache,00000000,0018AA7C,00000000,00000000,80070490), ref: 001650C5

Part of subcall function 0016095E: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 001609D4
Part of subcall function 0016095E: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00160A0C

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: QueryValue$Close
String ID:
API String ID: 1979452859-0
Opcode ID: 4328da9a9b88266433535f9529b9355f43679e7e1f47875e998dc198447d4de0
Instruction ID: 6e280dc5b344acb880cb2bb877a239e1c42d53f07fad58ad78763bc2881adef2
Opcode Fuzzy Hash: 4328da9a9b88266433535f9529b9355f43679e7e1f47875e998dc198447d4de0
Instruction Fuzzy Hash: 29118E3680162AEBCB326E98CD859AEB66AEB14360F254139FD4167110C7728D70DAD2

Function 00155D22 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00151782,?,0000015D,?,?,?,?,00152BDB,000000FF,00000000,?,?), ref: 00155D54

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b797eb23e466c8d04bdfe01349999046c2b7869bad46e1e22267581d743ff56a
Instruction ID: 3dde1b7df7829a1d39e349cb0833b90b4a0c2729783baa8a8cd0e3de6d8ff3ab
Opcode Fuzzy Hash: b797eb23e466c8d04bdfe01349999046c2b7869bad46e1e22267581d743ff56a
Instruction Fuzzy Hash: E5E0E533601924E7EB3126E19C1975E3A6A9F523E3F4A0120EC349E091DB60EC4942B4

Function 001235A8 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,00000104,00000000,?,00138AAE,0000001C,80070490,00000000,00000000,80070490), ref: 001235C8

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 11ece5539595e016a22fabf8a8608077dd52dd69d9fc2c6c78debe01b0fd0708
Instruction ID: cd78ab3ddb996e48639964f58926c69931786771fb78e41baa17a574be2d7d7b
Opcode Fuzzy Hash: 11ece5539595e016a22fabf8a8608077dd52dd69d9fc2c6c78debe01b0fd0708
Instruction Fuzzy Hash: EBE017723412387BAB016AA5AC05DEB7B9CEF25BA5B004011FE58E6400DB7AEA6157B1

Function 00124238 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000,00000000,?,0013A318,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,80070490), ref: 00124241

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9260d9e04b73de3dc61595156999169559d88ef8d1ef245164fec8d17e3854c6
Instruction ID: e76f8bf424173c6b3ad1b586ad6cc4fdd1da646fe14bd64347e19d052e073530
Opcode Fuzzy Hash: 9260d9e04b73de3dc61595156999169559d88ef8d1ef245164fec8d17e3854c6
Instruction Fuzzy Hash: C7D05B3120113497571C5FFBB8045667B55DF427717415215FD7AD6590D3319C6187C0

Function 00168DC8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00168DE0

Part of subcall function 001690AE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00169121
Part of subcall function 001690AE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00169132

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e28975617d0b67713e9be462b7948c822c8004ad1b1e9540da9a57fa2cb7e1c9
Instruction ID: 5a36b436fa48eedc9a02fc8e494c20072495b62a3fae7cf111d229c0625987a3
Opcode Fuzzy Hash: e28975617d0b67713e9be462b7948c822c8004ad1b1e9540da9a57fa2cb7e1c9
Instruction Fuzzy Hash: 59B012822DC1027EB50831401E42C37010CCFF0B11333865BF800F10C19B944E100733

Function 00168DF9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00168DE0

Part of subcall function 001690AE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00169121
Part of subcall function 001690AE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00169132

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6dc6b5ceb722ccab8ea9f0ad370d1c5590b87c4d7ae3f3491a2b17b86acb209a
Instruction ID: 1d70dd742cd8fc72696104261c866059d522f011c3a9fabeca48bd767b72ad5a
Opcode Fuzzy Hash: 6dc6b5ceb722ccab8ea9f0ad370d1c5590b87c4d7ae3f3491a2b17b86acb209a
Instruction Fuzzy Hash: CDB0128229C2026E754871842F03C37010CCFE0B10333461BF800E20C1DB954E110733

Function 00168DE9 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00168DE0

Part of subcall function 001690AE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00169121
Part of subcall function 001690AE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00169132

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b5a63c31043e1913a5f67409a8c9e39655e1ecd63b102c2cd927140b22d97a3f
Instruction ID: 47e08edd8194f2b902d669529b59b4264a513e86c89760f45852f9c7afa13c64
Opcode Fuzzy Hash: b5a63c31043e1913a5f67409a8c9e39655e1ecd63b102c2cd927140b22d97a3f
Instruction Fuzzy Hash: 41B0128229C0036E714871441E03C37010CCBE0B10333C61BFD00D20C1DB904E140733

Function 001214AC Relevance: 1.3, APIs: 1, Instructions: 52stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00000000,00000000,?,?,001222B1,?,00000000,?,00000000,?,001239A5,00000000,?,00000104), ref: 001214DC

Part of subcall function 00123C5F: GetProcessHeap.KERNEL32(00000000,000001C7,?,001222D5,000001C7,80004005,8007139F,?,?,0015FB39,8007139F,?,00000000,00000000,8007139F), ref: 00123C67
Part of subcall function 00123C5F: HeapSize.KERNEL32(00000000,?,001222D5,000001C7,80004005,8007139F,?,?,0015FB39,8007139F,?,00000000,00000000,8007139F), ref: 00123C6E

Memory Dump Source

Source File: 00000001.00000002.2974386780.0000000000121000.00000020.00000001.01000000.00000005.sdmp, Offset: 00120000, based on PE: true

Associated: 00000001.00000002.2974312304.0000000000120000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974492966.000000000016A000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974579966.000000000018A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2974641082.000000000018D000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID: Heap$ProcessSizelstrlen
String ID:
API String ID: 3492610842-0
Opcode ID: 01aef7f13cfb0ef641e3b2bda8fd0da4fbbc0f1b0f5c4d4cec4db4babbe21f8f
Instruction ID: ac9844cb29f17bb779e03faa12a25046ff8d8f3f16cc3e09b0a9f581c05587f9
Opcode Fuzzy Hash: 01aef7f13cfb0ef641e3b2bda8fd0da4fbbc0f1b0f5c4d4cec4db4babbe21f8f
Instruction Fuzzy Hash: D701D832100174BBCF11EE15FC80FDB7BA9AFB5760F114111FE196B191D770AD6096A0

Function 028DD7F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2976666524.00000000028DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 028DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_28dd000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e05aec742e1fd532f4cb755cc9d0545d0b6bf4ade7d1c79e18133854bcb3749
Instruction ID: bb58e7a1f11108b64de796ea3452df36476666bf89c16f00de33c00947ac7c9e
Opcode Fuzzy Hash: 2e05aec742e1fd532f4cb755cc9d0545d0b6bf4ade7d1c79e18133854bcb3749
Instruction Fuzzy Hash: B321367A540244EFDB06DF14D9C0B26BFA5FB88714F20CA69ED098A216C33AD41ACB61

Function 028DD7EB Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2976666524.00000000028DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 028DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_28dd000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df0bd32e4515bfc64f4669bd6e5df24beab7746e27edbbb70efe0df04415bf6d
Instruction ID: 55bda8dd5eb378ef7fdc70981cabbeef919e93dd1f97dcc2091cb470305da825
Opcode Fuzzy Hash: df0bd32e4515bfc64f4669bd6e5df24beab7746e27edbbb70efe0df04415bf6d
Instruction Fuzzy Hash: C721C07A544280DFCB06CF14D9C4B16BF71FB88314F24C6A9DD484A216C33AD41ACB91

Function 028DD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2976666524.00000000028DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 028DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_28dd000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d9ea11ed2defdfe3d0844b53b11e1b3c5428937508bf770840ac286f724b428
Instruction ID: cd1278df837e28559cd1f8117e4a7e482efa71e14650cd42ebb1e802f2219927
Opcode Fuzzy Hash: 8d9ea11ed2defdfe3d0844b53b11e1b3c5428937508bf770840ac286f724b428
Instruction Fuzzy Hash: CA01F73A0093049AE7108A25CD84B67BFD8DF81328F18C529EC488B146C379DC49C7B1

Function 028DD005 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2976666524.00000000028DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 028DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_28dd000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 789257956843e235802e09cddc158ac689f27aa1e2abcecea6476dc7189f8d69
Instruction ID: 61d67dbd84c97303708ef3405103832e08ebd5a8cdf12268b5a1402018d1bda3
Opcode Fuzzy Hash: 789257956843e235802e09cddc158ac689f27aa1e2abcecea6476dc7189f8d69
Instruction Fuzzy Hash: C1015E6600E3C09FD7128B258C94B52BFB4EF53224F18C1DBD8888F1A3C2699C49C7B2

Function 028DD767 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2976666524.00000000028DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 028DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_28dd000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ceca57f296359ae26c60266a1c46bdade211c72a011993df148fe085194c2ba
Instruction ID: 0068ac5210558ac3cdd3ed41378e09a27c2308f79e923e56210ff3ef1027af19
Opcode Fuzzy Hash: 5ceca57f296359ae26c60266a1c46bdade211c72a011993df148fe085194c2ba
Instruction Fuzzy Hash: DC01DA76200A04AFD7619F46C984C23FBB9FF98760355855EE98A4BA21C372F851DFA0

Function 028DD758 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2976666524.00000000028DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 028DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_28dd000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9aefa0d07a5c5765314509fe70962a39c10706fa6728f01a2470f43b9b44acc
Instruction ID: aba3fe31f8c6c03ce10b8b1dcbacb19d9b0a00c2f47a0d124ff9815071e113d3
Opcode Fuzzy Hash: c9aefa0d07a5c5765314509fe70962a39c10706fa6728f01a2470f43b9b44acc
Instruction Fuzzy Hash: 0601DE76104640AFD7228F55C944C63FFB9FF89620719858DE9864BA22C331F852DF60

Function 028DD703 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2976666524.00000000028DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 028DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_28dd000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95e0c19b144d5e86e2bbafeca65e32923ddf03813aefaf17256feacded73a2a2
Instruction ID: 1c3da93dbd1ba2d663156ac149c24d60c3060847e216777fa53e09dd3cf06c51
Opcode Fuzzy Hash: 95e0c19b144d5e86e2bbafeca65e32923ddf03813aefaf17256feacded73a2a2
Instruction Fuzzy Hash: 1FF0F97A600644AF9720CF0AD984C23FBA9EFD4674315C59AE84A9B612C771FC41CBA0

Function 028DD6F8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2976666524.00000000028DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 028DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_28dd000_MemProfilerInstaller5_7_28.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c6bb934e073622382148ef6f69533f2d62d68a8a12152dc2e92a3a69f3debac
Instruction ID: 5ac32b85e6f265933314e6968265f9bcdf8d6ebef37159c3c7788d74079b3b1d
Opcode Fuzzy Hash: 2c6bb934e073622382148ef6f69533f2d62d68a8a12152dc2e92a3a69f3debac
Instruction Fuzzy Hash: E0F0F979104680AFD725CF16C984C23BBB9EB956647198489E84A9B712C775FC42CBA0

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report MemProfilerInstaller5_7_28.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\.NET_Memory_Profiler_5.7_20240524002121.log

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1028\mbapreq.wxl

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1029\mbapreq.wxl

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1030\mbapreq.wxl

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1031\mbapreq.wxl

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1032\mbapreq.wxl

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1035\mbapreq.wxl

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1036\mbapreq.wxl

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1038\mbapreq.wxl

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1040\mbapreq.wxl

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1041\mbapreq.wxl

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1042\mbapreq.wxl

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1043\mbapreq.wxl

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1044\mbapreq.wxl

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1045\mbapreq.wxl

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1046\mbapreq.wxl

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1049\mbapreq.wxl

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1051\mbapreq.wxl

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1053\mbapreq.wxl

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1055\mbapreq.wxl

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\1060\mbapreq.wxl

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\2052\mbapreq.wxl

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\2070\mbapreq.wxl

C:\Windows\Temp\{2CFE9258-2647-47E2-8C0C-66233E78E1BF}\.ba\3082\mbapreq.wxl

Windows Analysis Report
MemProfilerInstaller5_7_28.exe

Function 005651D2 Relevance: 38.8, APIs: 5, Strings: 17, Instructions: 314
COMMON

Function 005A28BD Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 152
libraryloadercomCOMMON

Function 0056F981 Relevance: 117.7, APIs: 3, Strings: 64, Instructions: 445
COMMON

Function 0056B45A Relevance: 91.6, APIs: 24, Strings: 28, Instructions: 577
fileCOMMON

Function 00580ABB Relevance: 54.6, APIs: 20, Strings: 11, Instructions: 306
synchronizationCOMMON

Function 00564D7A Relevance: 42.2, APIs: 6, Strings: 18, Instructions: 219
COMMON

Function 0057741D Relevance: 37.0, APIs: 1, Strings: 20, Instructions: 290
COMMON

Function 005785B1 Relevance: 35.2, APIs: 9, Strings: 11, Instructions: 208
fileCOMMON

Function 0056762D Relevance: 34.9, APIs: 1, Strings: 22, Instructions: 419
COMMON

Function 0057819F Relevance: 31.7, APIs: 7, Strings: 11, Instructions: 152
COMMON

Function 00580EA0 Relevance: 30.0, APIs: 8, Strings: 9, Instructions: 216
COMMON

Function 00564326 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 157
stringCOMMON

Function 0056C252 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 131
fileCOMMON