Edit tour

Windows Analysis Report
68#U2591.exe

Overview

General Information

Sample name:	68#U2591.exe renamed because original name is a hash value
Original sample name:	.exe
Analysis ID:	1467849
MD5:	22342e77c7b9c74bccf3eb48621e3e4b
SHA1:	68577e7840691d8a0c8533f0c703f13432cad144
SHA256:	3d686d48bf794ce3814f7001c4f5916733acf2eeab5140e373e0bd863f105a25
Tags:	DCRATexe
Infos:

Detection

Score:	4
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found evasive API chain (date check)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

68#U2591.exe (PID: 6576 cmdline: "C:\Users\user\Desktop\68#U2591.exe" MD5: 22342E77C7B9C74BCCF3EB48621E3E4B)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: 68#U2591.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: 68#U2591.exe

Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEC0B190 SetDlgItemTextW,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,GetDlgItem,IsDlgButtonChecked,IsDlgButtonChecked,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetDlgItemTextW,GetDlgItem,SetWindowLongPtrW,SetDlgItemTextW,IsDlgButtonChecked,SendDlgItemMessageW,GetDlgItem,IsDlgButtonChecked,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,SetForegroundWindow,DialogBoxParamW,IsDlgButtonChecked,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,GetDlgItem,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF7FEC0B190
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEBF40BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF7FEBF40BC
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEC1FCA0 FindFirstFileExA,	0_2_00007FF7FEC1FCA0

Source: C:\Users\user\Desktop\68#U2591.exe

Code function: 0_2_00007FF7FEC07D10 SetWindowLongPtrW,NtdllDefWindowProc_W,NtdllDefWindowProc_W,

0_2_00007FF7FEC07D10

Source: C:\Users\user\Desktop\68#U2591.exe

Code function: 0_2_00007FF7FEBEC2F0: CreateFileW,CloseHandle,wcscpy,wcscpy,wcscpy,wcscpy,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF7FEBEC2F0

Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEC0CE88	0_2_00007FF7FEC0CE88
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEBE5E24	0_2_00007FF7FEBE5E24
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEC10754	0_2_00007FF7FEC10754
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEBFA4AC	0_2_00007FF7FEBFA4AC
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEC0B190	0_2_00007FF7FEC0B190
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEC01F20	0_2_00007FF7FEC01F20
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEBFAF18	0_2_00007FF7FEBFAF18
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEC22080	0_2_00007FF7FEC22080
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEC08DF4	0_2_00007FF7FEC08DF4
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEC10754	0_2_00007FF7FEC10754
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEC02D58	0_2_00007FF7FEC02D58
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEC04B98	0_2_00007FF7FEC04B98
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEBF5B60	0_2_00007FF7FEBF5B60
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEBFBB90	0_2_00007FF7FEBFBB90
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEC18C1C	0_2_00007FF7FEC18C1C
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEC189A0	0_2_00007FF7FEC189A0
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEC03964	0_2_00007FF7FEC03964
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEBFC96C	0_2_00007FF7FEBFC96C
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEBEF930	0_2_00007FF7FEBEF930
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEBF4928	0_2_00007FF7FEBF4928
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEC25AF8	0_2_00007FF7FEC25AF8
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEBE1AA4	0_2_00007FF7FEBE1AA4
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEC02AB0	0_2_00007FF7FEC02AB0
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEC1FA94	0_2_00007FF7FEC1FA94
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEBF1A48	0_2_00007FF7FEBF1A48
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEBE4840	0_2_00007FF7FEBE4840
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEC1C838	0_2_00007FF7FEC1C838
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEBFB534	0_2_00007FF7FEBFB534
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEC22550	0_2_00007FF7FEC22550
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEBE76C0	0_2_00007FF7FEBE76C0
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEC053F0	0_2_00007FF7FEC053F0
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEC03484	0_2_00007FF7FEC03484
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEC021D0	0_2_00007FF7FEC021D0
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEBFF180	0_2_00007FF7FEBFF180
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEBEC2F0	0_2_00007FF7FEBEC2F0
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEBEA310	0_2_00007FF7FEBEA310
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEBF126C	0_2_00007FF7FEBF126C
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEBE7288	0_2_00007FF7FEBE7288

Source: C:\Users\user\Desktop\68#U2591.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: classification engine

Classification label: clean4.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\68#U2591.exe

Code function: 0_2_00007FF7FEBEB6D8 GetLastError,FormatMessageW,LocalFree,

0_2_00007FF7FEBEB6D8

Source: C:\Users\user\Desktop\68#U2591.exe

Code function: 0_2_00007FF7FEC08624 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipAlloc,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_00007FF7FEC08624

Source: 68#U2591.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\68#U2591.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\68#U2591.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\68#U2591.exe

File read: C:\Users\user\Desktop\68#U2591.exe

Jump to behavior

Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: ehstorshell.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: cscui.dll	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Section loaded: networkexplorer.dll	Jump to behavior

Source: C:\Users\user\Desktop\68#U2591.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\68#U2591.exe	Automated click: OK
Source: C:\Users\user\Desktop\68#U2591.exe	Automated click: OK
Source: C:\Users\user\Desktop\68#U2591.exe	Automated click: OK
Source: C:\Users\user\Desktop\68#U2591.exe	Automated click: OK
Source: C:\Users\user\Desktop\68#U2591.exe	Automated click: OK
Source: C:\Users\user\Desktop\68#U2591.exe	Automated click: OK
Source: C:\Users\user\Desktop\68#U2591.exe	Automated click: OK
Source: C:\Users\user\Desktop\68#U2591.exe	Automated click: OK
Source: C:\Users\user\Desktop\68#U2591.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 68#U2591.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 68#U2591.exe

Static file information: File size 3200437 > 1048576

Source: 68#U2591.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 68#U2591.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 68#U2591.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 68#U2591.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 68#U2591.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 68#U2591.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 68#U2591.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: 68#U2591.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: 68#U2591.exe

Source: 68#U2591.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 68#U2591.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 68#U2591.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 68#U2591.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 68#U2591.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: 68#U2591.exe	Static PE information: section name: .didat
Source: 68#U2591.exe	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEC25166 push rsi; retf		0_2_00007FF7FEC25167
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEC25156 push rsi; retf		0_2_00007FF7FEC25157

Source: C:\Users\user\Desktop\68#U2591.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\68#U2591.exe	Memory allocated: 1D80A200000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Memory allocated: 1D80E880000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\68#U2591.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_0-26067

Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEC0B190 SetDlgItemTextW,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,GetDlgItem,IsDlgButtonChecked,IsDlgButtonChecked,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetDlgItemTextW,GetDlgItem,SetWindowLongPtrW,SetDlgItemTextW,IsDlgButtonChecked,SendDlgItemMessageW,GetDlgItem,IsDlgButtonChecked,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,SetForegroundWindow,DialogBoxParamW,IsDlgButtonChecked,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,GetDlgItem,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF7FEC0B190
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEBF40BC FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF7FEBF40BC
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEC1FCA0 FindFirstFileExA,	0_2_00007FF7FEC1FCA0

Source: C:\Users\user\Desktop\68#U2591.exe

Code function: 0_2_00007FF7FEC116A4 VirtualQuery,GetSystemInfo,

0_2_00007FF7FEC116A4

Source: 68#U2591.exe, 00000000.00000003.2209584881.000001D80E46B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}\
Source: 68#U2591.exe, 00000000.00000003.2073400394.000001D80E46F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}
Source: 68#U2591.exe, 00000000.00000003.3033217202.000001D80E467000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}2
Source: 68#U2591.exe, 00000000.00000003.2623368167.000001D80E46E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 68#U2591.exe, 00000000.00000003.3175942372.000001D80E44C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ECVMWar&Prod_VMware_SATA_CD00#4&
Source: 68#U2591.exe, 00000000.00000003.2073400394.000001D80E46F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}\#
Source: 68#U2591.exe, 00000000.00000003.3033217202.000001D80E467000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:U
Source: 68#U2591.exe, 00000000.00000003.3031890332.000001D80E44C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA
Source: 68#U2591.exe, 00000000.00000003.2623368167.000001D80E46E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}
Source: 68#U2591.exe, 00000000.00000003.3031890332.000001D80E46E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}\
Source: 68#U2591.exe, 00000000.00000003.2622294439.000001D80E44C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_p
Source: 68#U2591.exe, 00000000.00000003.2622294439.000001D80E46E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}\2
Source: 68#U2591.exe, 00000000.00000002.3248490915.000001D80E44C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}
Source: 68#U2591.exe, 00000000.00000003.2209888802.000001D80E466000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_
Source: 68#U2591.exe, 00000000.00000003.2623368167.000001D80E46E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Local PicturesProd_VMware_SATA_CD00#4&
Source: 68#U2591.exe, 00000000.00000003.3033217202.000001D80E467000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}b8b}\W
Source: 68#U2591.exe, 00000000.00000003.3031890332.000001D80E46E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}\W
Source: 68#U2591.exe, 00000000.00000003.3175942372.000001D80E44C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA
Source: 68#U2591.exe, 00000000.00000003.2623368167.000001D80E46E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}\
Source: 68#U2591.exe, 00000000.00000003.3176038912.000001D80E467000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: 68#U2591.exe, 00000000.00000003.2073400394.000001D80E480000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 07500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 68#U2591.exe, 00000000.00000003.3031890332.000001D80E46E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 68#U2591.exe, 00000000.00000003.2209584881.000001D80E46B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}
Source: 68#U2591.exe, 00000000.00000003.2623368167.000001D80E46E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}\2
Source: 68#U2591.exe, 00000000.00000002.3247009335.000001D0080F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_p<
Source: 68#U2591.exe, 00000000.00000002.3248490915.000001D80E44C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: E#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA
Source: 68#U2591.exe, 00000000.00000003.2622294439.000001D80E46E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}\W

Source: C:\Users\user\Desktop\68#U2591.exe

Code function: 0_2_00007FF7FEC176D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7FEC176D8

Source: C:\Users\user\Desktop\68#U2591.exe

Code function: 0_2_00007FF7FEC20D20 GetProcessHeap,

0_2_00007FF7FEC20D20

Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEC176D8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7FEC176D8
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEC13354 SetUnhandledExceptionFilter,	0_2_00007FF7FEC13354
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEC12510 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7FEC12510
Source: C:\Users\user\Desktop\68#U2591.exe	Code function: 0_2_00007FF7FEC13170 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7FEC13170

Source: C:\Users\user\Desktop\68#U2591.exe

Code function: 0_2_00007FF7FEBFDC70 cpuid

0_2_00007FF7FEBFDC70

Source: C:\Users\user\Desktop\68#U2591.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

0_2_00007FF7FEC0A2CC

Source: C:\Users\user\Desktop\68#U2591.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\68#U2591.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\68#U2591.exe

Code function: 0_2_00007FF7FEC10754 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,MapViewOfFile,UnmapViewOfFile,CloseHandle,SetEnvironmentVariableW,GetLocalTime,swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,CloseHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF7FEC10754

Source: C:\Users\user\Desktop\68#U2591.exe

Code function: 0_2_00007FF7FEBF4EB0 GetVersionExW,

0_2_00007FF7FEBF4EB0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 DLL Side-Loading	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	34 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
68#U2591.exe	5%	ReversingLabs

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467849
Start date and time:	2024-07-04 22:02:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	68#U2591.exe renamed because original name is a hash value
Original Sample Name:	.exe
Detection:	CLEAN
Classification:	clean4.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 45 Number of non-executed functions: 104
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 68#U2591.exe

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.931418959089458
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	68#U2591.exe
File size:	3'200'437 bytes
MD5:	22342e77c7b9c74bccf3eb48621e3e4b
SHA1:	68577e7840691d8a0c8533f0c703f13432cad144
SHA256:	3d686d48bf794ce3814f7001c4f5916733acf2eeab5140e373e0bd863f105a25
SHA512:	3ad6747d0e26c85d6dded7d55a5e028f6132276c4a2dc85072468655decefe0706231cd3c4cf2b27a5be8f8209b4f64c513a1a7c70aff4a98749fcc0c4b37bc6
SSDEEP:	98304:ZqwC4+8R/uFrEEgEmHmcHqonAkr/zB7Rd:ZqwwY/MQ59HqS1r/zB7Rd
TLSH:	40E5231AE6E804F5D0A6D538CA674D43F3BA7C4E1330978F13A5656B2F272A0DE2E711
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.2.`.\.`.\.`.\..y..h.\..y....\..y..m.\.....b.\...X.r.\..._.j.\...Y.Y.\.i...i.\.i...b.\.i...g.\.`.].C.\...Y.R.\...\.a.\.....a.\

File Icon


Icon Hash:	1515d4d4442f2d2d

Static PE Info

General

Entrypoint:	0x140032ee0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66409723 [Sun May 12 10:17:07 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	b1c5b1beabd90d9fdabd1df0779ea832

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F44C4C3DB48h
dec eax
add esp, 28h
jmp 00007F44C4C3D4DFh
int3
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+08h], ebx
dec eax
mov dword ptr [eax+10h], ebp
dec eax
mov dword ptr [eax+18h], esi
dec eax
mov dword ptr [eax+20h], edi
inc ecx
push esi
dec eax
sub esp, 20h
dec ebp
mov edx, dword ptr [ecx+38h]
dec eax
mov esi, edx
dec ebp
mov esi, eax
dec eax
mov ebp, ecx
dec ecx
mov edx, ecx
dec eax
mov ecx, esi
dec ecx
mov edi, ecx
inc ecx
mov ebx, dword ptr [edx]
dec eax
shl ebx, 04h
dec ecx
add ebx, edx
dec esp
lea eax, dword ptr [ebx+04h]
call 00007F44C4C3C963h
mov eax, dword ptr [ebp+04h]
and al, 66h
neg al
mov eax, 00000001h
sbb edx, edx
neg edx
add edx, eax
test dword ptr [ebx+04h], edx
je 00007F44C4C3D673h
dec esp
mov ecx, edi
dec ebp
mov eax, esi
dec eax
mov edx, esi
dec eax
mov ecx, ebp
call 00007F44C4C3F687h
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov ebp, dword ptr [esp+38h]
dec eax
mov esi, dword ptr [esp+40h]
dec eax
mov edi, dword ptr [esp+48h]
dec eax
add esp, 20h
inc ecx
pop esi
ret
int3
int3
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F44C4C2BEF3h
dec eax
lea edx, dword ptr [00025747h]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F44C4C3E742h
int3
jmp 00007F44C4C44924h
int3
int3
int3
int3
int3
int3

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x597a0	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x597d4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x70000	0xe3bc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x6a000	0x306c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7f000	0x970	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x536c0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x53780	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4b3f0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x48000	0x508	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x588bc	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4676e	0x46800	f06bb06e02377ae8b223122e53be35c2	False	0.5372340425531915	data	6.47079645411382	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x48000	0x128c4	0x12a00	2de06d4a6920a6911e64ff20000ea72f	False	0.4499003775167785	data	5.273999097784603	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5b000	0xe75c	0x1a00	0dbdb901a7d477980097e42e511a94fb	False	0.28275240384615385	data	3.2571023907881185	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x6a000	0x306c	0x3200	b0ce0f057741ad2a4ef4717079fa34e9	False	0.483359375	data	5.501810413666288	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat	0x6e000	0x360	0x400	1fcc7b1d7a02443319f8fcc2be4ca936	False	0.2578125	data	3.0459938492946015	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0x6f000	0x15c	0x200	3f331ec50f09ba861beaf955b33712d5	False	0.408203125	data	3.3356393424384843	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x70000	0xe3bc	0xe400	1b279dad3e3d77fcdfb269a130bf474b	False	0.6334121436403509	data	6.778407783727912	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7f000	0x970	0xa00	77a9ddfc47a5650d6eebbcc823e39532	False	0.52421875	data	5.336289720085303	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
PNG	0x70674	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	1.0027729636048528
PNG	0x711bc	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	0.9363390441839495
RT_ICON	0x72768	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, resolution 2834 x 2834 px/m, 256 important colors	0.47832369942196534
RT_ICON	0x72cd0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colors	0.5410649819494585
RT_ICON	0x73578	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, resolution 2834 x 2834 px/m, 256 important colors	0.4933368869936034
RT_ICON	0x74420	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m	0.5390070921985816
RT_ICON	0x74888	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	0.41393058161350843
RT_ICON	0x75930	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m	0.3479253112033195
RT_ICON	0x77ed8	0x3d71	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9809269502193401
RT_DIALOG	0x7bc4c	0x2ba	data	0.5286532951289399
RT_DIALOG	0x7bf08	0x13a	data	0.6560509554140127
RT_DIALOG	0x7c044	0xf2	data	0.71900826446281
RT_DIALOG	0x7c138	0x14a	data	0.6
RT_DIALOG	0x7c284	0x314	data	0.47588832487309646
RT_DIALOG	0x7c598	0x24a	data	0.6279863481228669
RT_STRING	0x7c7e4	0x1fc	data	0.421259842519685
RT_STRING	0x7c9e0	0x246	data	0.41924398625429554
RT_STRING	0x7cc28	0x1a6	data	0.514218009478673
RT_STRING	0x7cdd0	0xdc	data	0.65
RT_STRING	0x7ceac	0x470	data	0.3873239436619718
RT_STRING	0x7d31c	0x164	data	0.5056179775280899
RT_STRING	0x7d480	0x110	data	0.5772058823529411
RT_STRING	0x7d590	0x158	data	0.4563953488372093
RT_STRING	0x7d6e8	0xe8	data	0.5948275862068966
RT_STRING	0x7d7d0	0x1c6	data	0.5242290748898678
RT_STRING	0x7d998	0x268	data	0.4837662337662338
RT_GROUP_ICON	0x7dc00	0x68	data	0.7019230769230769
RT_MANIFEST	0x7dc68	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	0.3957333333333333

Imports

DLL	Import
KERNEL32.dll	LocalFree, GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, GetCurrentProcessId, CreateDirectoryW, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetModuleFileNameW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExpandEnvironmentStringsW, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, GlobalMemoryStatusEx, LoadResource, SizeofResource, GetTimeFormatW, GetDateFormatW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, IsValidCodePage, FindNextFileA, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, InitializeCriticalSectionAndSpinCount, WaitForSingleObjectEx, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlPcToFileHeader, RtlUnwindEx, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, GetStringTypeW, HeapReAlloc, LCMapStringW, FindFirstFileExA
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear
gdiplus.dll	GdipCloneImage, GdipFree, GdipDisposeImage, GdipCreateBitmapFromStream, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipAlloc

Target ID:	0
Start time:	16:02:51
Start date:	04/07/2024
Path:	C:\Users\user\Desktop\68#U2591.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\68#U2591.exe"
Imagebase:	0x7ff7febe0000
File size:	3'200'437 bytes
MD5 hash:	22342E77C7B9C74BCCF3EB48621E3E4B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	7.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	31.1%
Total number of Nodes:	1729
Total number of Limit Nodes:	25

Executed Functions

Function 00007FF7FEC0B190 Relevance: 111.7, APIs: 52, Strings: 11, Instructions: 1421windowfilesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FEBE255C: GetParent.USER32 ref: 00007FF7FEBE2599
Part of subcall function 00007FF7FEBE255C: GetDlgItem.USER32 ref: 00007FF7FEBE25AC
Part of subcall function 00007FF7FEBE255C: SetDlgItemTextW.USER32 ref: 00007FF7FEBE25C8

SetDlgItemTextW.USER32 ref: 00007FF7FEC0B320
GetMessageW.USER32 ref: 00007FF7FEC0B350
IsDialogMessageW.USER32 ref: 00007FF7FEC0B369
TranslateMessage.USER32 ref: 00007FF7FEC0B37B
DispatchMessageW.USER32 ref: 00007FF7FEC0B389
GetDlgItem.USER32 ref: 00007FF7FEC0B410
IsDlgButtonChecked.USER32 ref: 00007FF7FEC0B431
IsDlgButtonChecked.USER32 ref: 00007FF7FEC0B449
GetLastError.KERNEL32 ref: 00007FF7FEC0B634
GetLastError.KERNEL32 ref: 00007FF7FEC0B665
GetTickCount.KERNEL32 ref: 00007FF7FEC0B68B
GetLastError.KERNEL32 ref: 00007FF7FEC0B6F5
GetCommandLineW.KERNEL32 ref: 00007FF7FEC0B841
CreateFileMappingW.KERNEL32 ref: 00007FF7FEC0B900
Sleep.KERNEL32 ref: 00007FF7FEC0B9B6
UnmapViewOfFile.KERNEL32 ref: 00007FF7FEC0B9DF
CloseHandle.KERNEL32 ref: 00007FF7FEC0B9E8
SetDlgItemTextW.USER32 ref: 00007FF7FEC0BCDE
SetForegroundWindow.USER32 ref: 00007FF7FEC0C07D
DialogBoxParamW.USER32 ref: 00007FF7FEC0C0D7
IsDlgButtonChecked.USER32 ref: 00007FF7FEC0C2F8
MapViewOfFile.KERNEL32 ref: 00007FF7FEC0B923

Part of subcall function 00007FF7FEBFAAE0: LoadStringW.USER32 ref: 00007FF7FEBFAB67
Part of subcall function 00007FF7FEBFAAE0: LoadStringW.USER32 ref: 00007FF7FEBFAB80

IsDlgButtonChecked.USER32 ref: 00007FF7FEC0BEC3
SendDlgItemMessageW.USER32 ref: 00007FF7FEC0BEEA
GetDlgItem.USER32 ref: 00007FF7FEC0BEF8
IsDlgButtonChecked.USER32 ref: 00007FF7FEC0BF12
GetDlgItem.USER32 ref: 00007FF7FEC0BF4F
SetDlgItemTextW.USER32 ref: 00007FF7FEC0BFEC
SetDlgItemTextW.USER32 ref: 00007FF7FEC0C004
SetDlgItemTextW.USER32 ref: 00007FF7FEC0C321
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0C363
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0C369
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0C36F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0C375
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0C37B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0C381
SendDlgItemMessageW.USER32 ref: 00007FF7FEC0C449
GetDlgItem.USER32 ref: 00007FF7FEC0C491
SendDlgItemMessageW.USER32 ref: 00007FF7FEC0C53E
FindFirstFileW.KERNEL32 ref: 00007FF7FEC0C562
FindClose.KERNEL32 ref: 00007FF7FEC0C68A
SendDlgItemMessageW.USER32 ref: 00007FF7FEC0C7AF

Part of subcall function 00007FF7FEBE129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7FEBE1396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0CAA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0CAAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0CAB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0CABB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0CAC1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0CAC7

Strings

-el -s2 "-d%s" "-sp%s", xrefs: 00007FF7FEC0B799
p, xrefs: 00007FF7FEC0B7AB
LICENSEDLG, xrefs: 00007FF7FEC0C0C9
REPLACEFILEDLG, xrefs: 00007FF7FEC0C3D3
__tmp_rar_sfx_access_check_, xrefs: 00007FF7FEC0B6A9
%s %s, xrefs: 00007FF7FEC0C6D9, 00007FF7FEC0C946
c:\, xrefs: 00007FF7FEC0BF58
runas, xrefs: 00007FF7FEC0B7C9
@, xrefs: 00007FF7FEC0B7B6
winrarsfxmappingfile.tmp, xrefs: 00007FF7FEC0B8E0
STARTDLG, xrefs: 00007FF7FEC0B1CA

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: Item$_invalid_parameter_noinfo_noreturn$Message$Text$ButtonChecked$FileSend$ErrorLast$CloseDialogFindLoadStringView$CommandConcurrency::cancel_current_taskCountCreateDispatchFirstForegroundHandleLineMappingParamParentSleepTickTranslateUnmapWindow
String ID: %s %s$-el -s2 "-d%s" "-sp%s"$@$LICENSEDLG$REPLACEFILEDLG$STARTDLG$__tmp_rar_sfx_access_check_$c:\$p$runas$winrarsfxmappingfile.tmp
API String ID: 3781586631-2870799519
Opcode ID: 8c25b8f5574f35ddc0c2ad3852aa72c203d9154403b40ae796b6435585b0b73b
Instruction ID: 6c6919896f4ae12b1343a530a525da842bfd0cf8bfbc7e1eda26b8c8e2fedde1
Opcode Fuzzy Hash: 8c25b8f5574f35ddc0c2ad3852aa72c203d9154403b40ae796b6435585b0b73b
Instruction Fuzzy Hash: 62D2CF62A0D68285EB20FB25E8406F9E361EFC5790FD04131FAAD476E6DE3CE544C7A1

Function 00007FF7FEC0CE88 Relevance: 65.0, APIs: 25, Strings: 11, Instructions: 1963fileCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF7FEC0D5F3
IsDlgButtonChecked.USER32 ref: 00007FF7FEC0D626
IsDlgButtonChecked.USER32 ref: 00007FF7FEC0D655
MoveFileW.KERNEL32 ref: 00007FF7FEC0DB4B
MoveFileExW.KERNEL32 ref: 00007FF7FEC0DB69
GetTempPathW.KERNEL32 ref: 00007FF7FEC0DC49

Part of subcall function 00007FF7FEBE1FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBE1FFB

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7FEC0EEE3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0EEEF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0EF07
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0EF0D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0EF13
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0EF19
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0EF1F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0EF25
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0EF2B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0EF31
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0EF37
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0EF3D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0EF43
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0EF49
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0EF4F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0EF55
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0EF5B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7FEC0EF67
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7FEC0EF73

Strings

MIN, xrefs: 00007FF7FEC0EAE5, 00007FF7FEC0EAF4
<br>, xrefs: 00007FF7FEC0D6DA, 00007FF7FEC0D6E9
ProgramFilesDir, xrefs: 00007FF7FEC0D4F0
HIDE, xrefs: 00007FF7FEC0E9E5, 00007FF7FEC0E9F4
c:\, xrefs: 00007FF7FEC0D5D1
MAX, xrefs: 00007FF7FEC0EA82, 00007FF7FEC0EA91
lnk, xrefs: 00007FF7FEC0E3CA, 00007FF7FEC0E3D9
@set:user, xrefs: 00007FF7FEC0DD96, 00007FF7FEC0DDA5
.tmp, xrefs: 00007FF7FEC0DA85
.lnk, xrefs: 00007FF7FEC0E406, 00007FF7FEC0E415
Software\Microsoft\Windows\CurrentVersion, xrefs: 00007FF7FEC0D501

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task$ButtonCheckedFileMove$ItemPathTemp
String ID: .lnk$.tmp$<br>$@set:user$HIDE$MAX$MIN$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$c:\$lnk
API String ID: 1440029262-811407598
Opcode ID: feba819d6598e8d423f9e7027c5168d8c23c22b90adcf7986964b7bc32e38086
Instruction ID: 916f0f7168417f78b162591d59f41773677da7a117737977968849574b085efc
Opcode Fuzzy Hash: feba819d6598e8d423f9e7027c5168d8c23c22b90adcf7986964b7bc32e38086
Instruction Fuzzy Hash: A0138272B04B8289EB10EF64D8402EC77A1EB84798FD01536EB6D57AD9DF38D585C3A0

Function 00007FF7FEC10754 Relevance: 42.4, APIs: 19, Strings: 5, Instructions: 380
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7FEBFDFD0: GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF7FEBFE018
Part of subcall function 00007FF7FEBFDFD0: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF7FEBFE030
Part of subcall function 00007FF7FEBFDFD0: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF7FEBFE05D

Part of subcall function 00007FF7FEBF62DC: GetCurrentDirectoryW.KERNEL32 ref: 00007FF7FEBF62F2
Part of subcall function 00007FF7FEBF62DC: GetCurrentDirectoryW.KERNEL32 ref: 00007FF7FEBF632C

Part of subcall function 00007FF7FEC0946C: OleInitialize.OLE32 ref: 00007FF7FEC09486
Part of subcall function 00007FF7FEC0946C: SHGetMalloc.SHELL32 ref: 00007FF7FEC094D4

GetCommandLineW.KERNEL32 ref: 00007FF7FEC1096E
OpenFileMappingW.KERNEL32 ref: 00007FF7FEC10A07
MapViewOfFile.KERNEL32 ref: 00007FF7FEC10A30
UnmapViewOfFile.KERNEL32 ref: 00007FF7FEC10A46
MapViewOfFile.KERNEL32 ref: 00007FF7FEC10A63
UnmapViewOfFile.KERNEL32 ref: 00007FF7FEC10ACA
CloseHandle.KERNEL32 ref: 00007FF7FEC10AD3
SetEnvironmentVariableW.KERNEL32 ref: 00007FF7FEC10BAD
GetLocalTime.KERNEL32 ref: 00007FF7FEC10BB8
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7FEC10C13
SetEnvironmentVariableW.KERNEL32 ref: 00007FF7FEC10C26
GetModuleHandleW.KERNEL32 ref: 00007FF7FEC10C2E
LoadIconW.USER32 ref: 00007FF7FEC10C4D
DialogBoxParamW.USER32 ref: 00007FF7FEC10CB6
Sleep.KERNEL32 ref: 00007FF7FEC10CE6
CloseHandle.KERNEL32 ref: 00007FF7FEC10D67
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC10DD7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC10DDD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC10DE3

Part of subcall function 00007FF7FEC0FD0C: SetEnvironmentVariableW.KERNEL32 ref: 00007FF7FEC0FD43
Part of subcall function 00007FF7FEC0FD0C: SetEnvironmentVariableW.KERNEL32 ref: 00007FF7FEC0FDBC

Strings

%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00007FF7FEC10C02
sfxstime, xrefs: 00007FF7FEC10C1F
winrarsfxmappingfile.tmp, xrefs: 00007FF7FEC109F9
STARTDLG, xrefs: 00007FF7FEC10CA5
sfxname, xrefs: 00007FF7FEC10B9B

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: File$EnvironmentHandleVariableView$_invalid_parameter_noinfo_noreturn$AddressCloseCurrentDirectoryModuleProcUnmap$CommandDialogIconInitializeLineLoadLocalMallocMappingOpenParamSleepTimeswprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 3400486126-3710569615
Opcode ID: 90ce4131d24f677c68c7a398a64b562f3535bba57e65092bbdebbf5ef0a00a5f
Instruction ID: b87bb65a732d635c479ff7af40aa5588bcbfd87c2245373ddb8eff95d575fae3
Opcode Fuzzy Hash: 90ce4131d24f677c68c7a398a64b562f3535bba57e65092bbdebbf5ef0a00a5f
Instruction Fuzzy Hash: 18126661A19B8285EB10BB25E8452BDE361FFC4794FC04231EABD46AE5DF3CE540C7A0

Function 00007FF7FEBFA4AC Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7FEBFA504

Part of subcall function 00007FF7FEC00F68: WideCharToMultiByte.KERNEL32 ref: 00007FF7FEC00F99

SetDlgItemTextW.USER32 ref: 00007FF7FEBFA573
GetWindowRect.USER32 ref: 00007FF7FEBFA5AD
GetClientRect.USER32 ref: 00007FF7FEBFA5BB
GetWindowRect.USER32 ref: 00007FF7FEBFA6B2
SetDlgItemTextW.USER32 ref: 00007FF7FEBFA6EC
GetSystemMetrics.USER32 ref: 00007FF7FEBFA6F7
GetWindow.USER32 ref: 00007FF7FEBFA708
GetWindowRect.USER32 ref: 00007FF7FEBFA746
GetWindow.USER32 ref: 00007FF7FEBFA808

Strings

CAPTION, xrefs: 00007FF7FEBFA6CF
$%s:, xrefs: 00007FF7FEBFA4EF

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: Window$Rect$ItemText$ByteCharClientMetricsMultiSystemWideswprintf
String ID: $%s:$CAPTION
API String ID: 165908239-404845831
Opcode ID: 1224945cd41bf140f0dcf37f1b002595631e4f701a4b658f84a72e9da714e3d9
Instruction ID: 766d351bb0eb863e92388c2a47d2e8fc185db522695703aa784054d4403443c1
Opcode Fuzzy Hash: 1224945cd41bf140f0dcf37f1b002595631e4f701a4b658f84a72e9da714e3d9
Instruction Fuzzy Hash: F791E932B186428AE718EF69A800A69F7A1FBC4784F805535FE5D47B98CF3CE805CB50

Function 00007FF7FEC08624 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 101
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32 ref: 00007FF7FEC0863D
SizeofResource.KERNEL32 ref: 00007FF7FEC08659
LoadResource.KERNEL32 ref: 00007FF7FEC08673
LockResource.KERNEL32 ref: 00007FF7FEC08685
GlobalAlloc.KERNEL32 ref: 00007FF7FEC086A6
GlobalLock.KERNEL32 ref: 00007FF7FEC086BB
GdipAlloc.GDIPLUS ref: 00007FF7FEC086FE
GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF7FEC08769
GlobalUnlock.KERNEL32 ref: 00007FF7FEC0878C
GlobalFree.KERNEL32 ref: 00007FF7FEC08795

Strings

PNG, xrefs: 00007FF7FEC0862F

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: GlobalResource$AllocGdipLock$BitmapCreateFindFreeFromLoadSizeofUnlock
String ID: PNG
API String ID: 541704414-364855578
Opcode ID: c8606208415c3a11eb94d5df8c8f8595ea54109f2541637b646828bce78d4013
Instruction ID: 52ba653229761e38c799ebd8718e84d69439367e202fcb8e8b571e90ac8b2b12
Opcode Fuzzy Hash: c8606208415c3a11eb94d5df8c8f8595ea54109f2541637b646828bce78d4013
Instruction Fuzzy Hash: CE412326A09B0281EF15AB16D845379E3A1AFC4B90F844435FE2D873E8EF7CD444C7A0

Function 00007FF7FEBE4840 Relevance: 12.1, APIs: 5, Strings: 1, Instructions: 1624COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBE511E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBE5124
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBE512A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBE5E16
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBE5E1C

Strings

CMT, xrefs: 00007FF7FEBE59B2

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: CMT
API String ID: 3668304517-2756464174
Opcode ID: fdd9c915db8bbdbc7b678ee07b0780c4e124944889983d71e770a4cd879ae1d4
Instruction ID: af58f4ce66db3964822afccfca6d79286a26059e676412252a52be0701c8b90e
Opcode Fuzzy Hash: fdd9c915db8bbdbc7b678ee07b0780c4e124944889983d71e770a4cd879ae1d4
Instruction Fuzzy Hash: 1EE2DE22B0968286EB18EB75D550AFDB7A1EB85384FC00035DA6E477D6DF3CE454C3A2

Function 00007FF7FEBE5E24 Relevance: 7.6, APIs: 3, Strings: 1, Instructions: 586COMMON

Download Yara Rule

Strings

CMT, xrefs: 00007FF7FEBE59B2, 00007FF7FEBE675B

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID:
String ID: CMT
API String ID: 0-2756464174
Opcode ID: 589854a86694341a55c69b07c8121abed16d2d53b78a965ac968b8bdafdd2d04
Instruction ID: 69c6e6979b8d6e92bd5225a1d95cd6e13e6f2bbc2260a4e8a54060686e885f5a
Opcode Fuzzy Hash: 589854a86694341a55c69b07c8121abed16d2d53b78a965ac968b8bdafdd2d04
Instruction Fuzzy Hash: 6042C062B0868296EB18EBB4C1506FDB7A1EB91344FC00136DB7E576DADF38E518C391

Function 00007FF7FEC07D10 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SetWindowLongPtrW.USER32 ref: 00007FF7FEC07D42

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 76ef30bd2952a735a61a9b11dbe66dc2751a7d34feade28c12788be8e6367f79
Instruction ID: 8dd1360c52f3218e6d38f17ffbfb279246544132ad179c7fcc707450b528930b
Opcode Fuzzy Hash: 76ef30bd2952a735a61a9b11dbe66dc2751a7d34feade28c12788be8e6367f79
Instruction Fuzzy Hash: F801D223E0CB8186E720AB166C40059EBA1FB95FD0B4D8271EFA8077D6CE38E851C380

Function 00007FF7FEBFDFD0 Relevance: 143.9, APIs: 16, Strings: 66, Instructions: 440
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF7FEBFE018
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF7FEBFE030
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF7FEBFE05D
CreateFileW.KERNEL32 ref: 00007FF7FEBFE3F0
SetFilePointer.KERNEL32 ref: 00007FF7FEBFE40E
ReadFile.KERNEL32 ref: 00007FF7FEBFE436

Part of subcall function 00007FF7FEBFDFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF7FEBFDDDF

CompareStringW.KERNEL32 ref: 00007FF7FEBFE559
CloseHandle.KERNEL32 ref: 00007FF7FEBFE4F3

Part of subcall function 00007FF7FEBE1FA0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBE1FFB

Part of subcall function 00007FF7FEBF51A4: GetVersionExW.KERNEL32 ref: 00007FF7FEBF51D5

Part of subcall function 00007FF7FEBFDFD0: LoadLibraryW.KERNEL32 ref: 00007FF7FEBFDEFF
Part of subcall function 00007FF7FEBFDFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBFDFB5
Part of subcall function 00007FF7FEBFDFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBFDFBB
Part of subcall function 00007FF7FEBFDFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBFDFC1
Part of subcall function 00007FF7FEBFDFD0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBFDFC7

AllocConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF7FEBFE74B
GetCurrentProcessId.KERNEL32(?,?,?,00000000,?), ref: 00007FF7FEBFE755
AttachConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF7FEBFE75D
GetStdHandle.KERNEL32(?,?,?,00000000,?), ref: 00007FF7FEBFE780
WriteConsoleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF7FEBFE799
Sleep.KERNEL32(?,?,?,00000000,?), ref: 00007FF7FEBFE7A4
FreeConsole.KERNEL32(?,?,?,00000000,?), ref: 00007FF7FEBFE7AA
ExitProcess.KERNEL32 ref: 00007FF7FEBFE7BB

Strings

slc.dll, xrefs: 00007FF7FEBFE23D
shdocvw.dll, xrefs: 00007FF7FEBFE179
shell32.dll, xrefs: 00007FF7FEBFE1BF
ntmarta.dll, xrefs: 00007FF7FEBFE1F7
aclui.dll, xrefs: 00007FF7FEBFE371
dhcpcsvc6.dll, xrefs: 00007FF7FEBFE31D
psapi.dll, xrefs: 00007FF7FEBFE115
crypt32.dll, xrefs: 00007FF7FEBFE187
mpr.dll, xrefs: 00007FF7FEBFE291
ws2_32.dll, xrefs: 00007FF7FEBFE0FF
ntshrui.dll, xrefs: 00007FF7FEBFE12B
browcli.dll, xrefs: 00007FF7FEBFE301
userenv.dll, xrefs: 00007FF7FEBFE15D
clbcatq.dll, xrefs: 00007FF7FEBFE0E9
dsrole.dll, xrefs: 00007FF7FEBFE37F
rasadhlp.dll, xrefs: 00007FF7FEBFE30F
msasn1.dll, xrefs: 00007FF7FEBFE195
kernel32, xrefs: 00007FF7FEBFE011
WINNSI.DLL, xrefs: 00007FF7FEBFE275
XmlLite.dll, xrefs: 00007FF7FEBFE339
comres.dll, xrefs: 00007FF7FEBFE0F4
oleaccrc.dll, xrefs: 00007FF7FEBFE1E9
peerdist.dll, xrefs: 00007FF7FEBFE38D
profapi.dll, xrefs: 00007FF7FEBFE205
ws2help.dll, xrefs: 00007FF7FEBFE10A
mlang.dll, xrefs: 00007FF7FEBFE2BB
netutils.dll, xrefs: 00007FF7FEBFE283
dfscli.dll, xrefs: 00007FF7FEBFE2F3
srvcli.dll, xrefs: 00007FF7FEBFE221
samcli.dll, xrefs: 00007FF7FEBFE2C9
sfc_os.dll, xrefs: 00007FF7FEBFE091
ieframe.dll, xrefs: 00007FF7FEBFE120
propsys.dll, xrefs: 00007FF7FEBFE2AD
devrtl.dll, xrefs: 00007FF7FEBFE29F
version.dll, xrefs: 00007FF7FEBFE07B
apphelp.dll, xrefs: 00007FF7FEBFE14F
uxtheme.dll, xrefs: 00007FF7FEBFE66D
rsaenh.dll, xrefs: 00007FF7FEBFE0A7
DXGIDebug.dll, xrefs: 00007FF7FEBFE086, 00007FF7FEBFE5B6
wkscli.dll, xrefs: 00007FF7FEBFE2E5
iphlpapi.DLL, xrefs: 00007FF7FEBFE267
cryptbase.dll, xrefs: 00007FF7FEBFE0C8
wintrust.dll, xrefs: 00007FF7FEBFE1B1
usp10.dll, xrefs: 00007FF7FEBFE0DE
SSPICLI.DLL, xrefs: 00007FF7FEBFE09C
setupapi.dll, xrefs: 00007FF7FEBFE141
SetDefaultDllDirectories, xrefs: 00007FF7FEBFE053
SetDllDirectoryW, xrefs: 00007FF7FEBFE026
atl.dll, xrefs: 00007FF7FEBFE136
lpk.dll, xrefs: 00007FF7FEBFE0D3
RpcRtRemote.dll, xrefs: 00007FF7FEBFE363
UXTheme.dll, xrefs: 00007FF7FEBFE0B2
imageres.dll, xrefs: 00007FF7FEBFE24B
dhcpcsvc.dll, xrefs: 00007FF7FEBFE32B
secur32.dll, xrefs: 00007FF7FEBFE1CD
dnsapi.DLL, xrefs: 00007FF7FEBFE259
cabinet.dll, xrefs: 00007FF7FEBFE1DB
linkinfo.dll, xrefs: 00007FF7FEBFE347
cryptsp.dll, xrefs: 00007FF7FEBFE355
cryptui.dll, xrefs: 00007FF7FEBFE1A3
dwmapi.dll, xrefs: 00007FF7FEBFE0BD, 00007FF7FEBFE661
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00007FF7FEBFE73B
cscapi.dll, xrefs: 00007FF7FEBFE22F
WindowsCodecs.dll, xrefs: 00007FF7FEBFE213
samlib.dll, xrefs: 00007FF7FEBFE2D7
netapi32.dll, xrefs: 00007FF7FEBFE16B

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Console$FileHandle$AddressProcProcess$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadModulePointerReadSleepStringSystemVersionWrite
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$RpcRtRemote.dll$SSPICLI.DLL$SetDefaultDllDirectories$SetDllDirectoryW$UXTheme.dll$WINNSI.DLL$WindowsCodecs.dll$XmlLite.dll$aclui.dll$apphelp.dll$atl.dll$browcli.dll$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$cryptbase.dll$cryptsp.dll$cryptui.dll$cscapi.dll$devrtl.dll$dfscli.dll$dhcpcsvc.dll$dhcpcsvc6.dll$dnsapi.DLL$dsrole.dll$dwmapi.dll$ieframe.dll$imageres.dll$iphlpapi.DLL$kernel32$linkinfo.dll$lpk.dll$mlang.dll$mpr.dll$msasn1.dll$netapi32.dll$netutils.dll$ntmarta.dll$ntshrui.dll$oleaccrc.dll$peerdist.dll$profapi.dll$propsys.dll$psapi.dll$rasadhlp.dll$rsaenh.dll$samcli.dll$samlib.dll$secur32.dll$setupapi.dll$sfc_os.dll$shdocvw.dll$shell32.dll$slc.dll$srvcli.dll$userenv.dll$usp10.dll$uxtheme.dll$version.dll$wintrust.dll$wkscli.dll$ws2_32.dll$ws2help.dll
API String ID: 1496594111-2013832382
Opcode ID: b00e2e6d214aa52dc68ba8bdb5057dfd573f1e9f3d9b8fa57946a832f5175614
Instruction ID: 4c6a4f79b23a16473e1fa17b40f3c51304cb6467524ee282b762aad0a7ad142c
Opcode Fuzzy Hash: b00e2e6d214aa52dc68ba8bdb5057dfd573f1e9f3d9b8fa57946a832f5175614
Instruction Fuzzy Hash: 07321D35A09B8295EB11AF64E8405E9B3A4FFC4354FD00236EA6D067E5EF3CD655C3A0

Function 00007FF7FEBF98DC Relevance: 25.2, APIs: 3, Strings: 11, Instructions: 702COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FEBF8E58: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7FEBF8F8D

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7FEBF9F75
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBFA42F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBFA435

Part of subcall function 00007FF7FEC00BBC: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7FEC00B44), ref: 00007FF7FEC00BE9

Strings

DIRECTION, xrefs: 00007FF7FEBF9DE5
STRINGS, xrefs: 00007FF7FEBF9DC1
@%s:, xrefs: 00007FF7FEBF9F57
*messages***, xrefs: 00007FF7FEBF9BC6
DIALOG, xrefs: 00007FF7FEBF9DCD
*messages***, xrefs: 00007FF7FEBF9C04
RTL, xrefs: 00007FF7FEBF9F2E
,, xrefs: 00007FF7FEBF9FAA
$%s:, xrefs: 00007FF7FEBF9F50
MENU, xrefs: 00007FF7FEBF9DD9
, xrefs: 00007FF7FEBF9DF9

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ByteCharConcurrency::cancel_current_taskMultiWide_snwprintf
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS
API String ID: 3629253777-3268106645
Opcode ID: d5f6a8ed9f6566674b9dc477b5212b2b29b5a39c6d918fbb76a58129d937936d
Instruction ID: e195a5c74499c2c4730a8dc4c8a2cb7f1281d0113edc745723b546d089a42f14
Opcode Fuzzy Hash: d5f6a8ed9f6566674b9dc477b5212b2b29b5a39c6d918fbb76a58129d937936d
Instruction Fuzzy Hash: 4162C132B1968285EB14EBA4D444ABDA365FB84784FC05132EA7D476E9EF3CE544C3E0

Function 00007FF7FEC11900 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 195
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7FEC11558: DloadProtectSection.DELAYIMP ref: 00007FF7FEC115C9

RaiseException.KERNEL32 ref: 00007FF7FEC119A7
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF7FEC11993

Part of subcall function 00007FF7FEC11868: DloadProtectSection.DELAYIMP ref: 00007FF7FEC118C7

LoadLibraryExA.KERNEL32 ref: 00007FF7FEC11A46
GetLastError.KERNEL32 ref: 00007FF7FEC11A54
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF7FEC11A86
RaiseException.KERNEL32 ref: 00007FF7FEC11A9A

Strings

H, xrefs: 00007FF7FEC11974

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: DloadSection$AccessExceptionProtectRaiseReleaseWrite$ErrorLastLibraryLoad
String ID: H
API String ID: 3432403771-2852464175
Opcode ID: cf3fc932a6b7fb7fc9ef8320b4dd67bfc8d7ec91281715f792326570f1d4a57f
Instruction ID: 7ffee3e49a4324b9b70463b1d05e910e4e716ce0d530a157d1c0e5cfa805f790
Opcode Fuzzy Hash: cf3fc932a6b7fb7fc9ef8320b4dd67bfc8d7ec91281715f792326570f1d4a57f
Instruction Fuzzy Hash: 21915E72A15B518AEB10DF65D8406ACB3B1FB88BA4F854436EE2D17794EF3CE445C3A0

Function 00007FF7FEC07B28 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShowWindow.USER32 ref: 00007FF7FEC07B6F

Part of subcall function 00007FF7FEC07778: LoadCursorW.USER32 ref: 00007FF7FEC077C1
Part of subcall function 00007FF7FEC07778: RegisterClassExW.USER32 ref: 00007FF7FEC077EC

GetWindowRect.USER32 ref: 00007FF7FEC07BC0
GetParent.USER32 ref: 00007FF7FEC07BC9
MapWindowPoints.USER32 ref: 00007FF7FEC07BDF
GetParent.USER32 ref: 00007FF7FEC07C07
CreateWindowExW.USER32 ref: 00007FF7FEC07C54
ShowWindow.USER32 ref: 00007FF7FEC07C96
ShowWindow.USER32 ref: 00007FF7FEC07CC3
UpdateWindow.USER32 ref: 00007FF7FEC07CCD

Strings

RarHtmlClassName, xrefs: 00007FF7FEC07C4B

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: Window$Show$Parent$ClassCreateCursorLoadPointsRectRegisterUpdate
String ID: RarHtmlClassName
API String ID: 1583632621-1658105358
Opcode ID: 25e10118fc127f943416c4d3264f1baf1a615f34ad43d758d85ed87ca73a3c98
Instruction ID: fc3042ffc1c40cdb270c71806b8fc3576ffdd70ace59079699fde43ccde2698f
Opcode Fuzzy Hash: 25e10118fc127f943416c4d3264f1baf1a615f34ad43d758d85ed87ca73a3c98
Instruction Fuzzy Hash: D9518421609B818AEB68FB26E44437AE361FBC5780F804435EE9E47795DF3CE445CB90

Function 00007FF7FEC06E80 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 204
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7FEC07E9B), ref: 00007FF7FEC07080
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0717B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC07181
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC07187

Strings

<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>, xrefs: 00007FF7FEC06ED5, 00007FF7FEC06EE4
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00007FF7FEC06F2C, 00007FF7FEC06F3B
</html>, xrefs: 00007FF7FEC06F72, 00007FF7FEC06F81
<html>, xrefs: 00007FF7FEC06F13

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$AllocGlobal
String ID: </html>$<html>$<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 2721297748-1533471033
Opcode ID: 124782140cab751a06563efccc428b77e03dcad5fc607de4dfc3233a338ff39a
Instruction ID: c7f40236e92563e16579c7c4411113da107fc927206fca4c25b4e84feeb96d8e
Opcode Fuzzy Hash: 124782140cab751a06563efccc428b77e03dcad5fc607de4dfc3233a338ff39a
Instruction Fuzzy Hash: B681C162F19A4285FB04FBA5D4402EDA371AF85798F800135EE2D57ADADE3CD50AC3A4

Function 00007FF7FEBF24C0 Relevance: 9.2, APIs: 6, Instructions: 164
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 00007FF7FEBF259B
GetLastError.KERNEL32 ref: 00007FF7FEBF25AE
CreateFileW.KERNEL32 ref: 00007FF7FEBF260E
GetLastError.KERNEL32 ref: 00007FF7FEBF2617
SetFileTime.KERNEL32 ref: 00007FF7FEBF26C9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF2736

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: File$CreateErrorLast$Time_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3536497005-0
Opcode ID: 3a28dd0dcfd7b89b689d9fe25ecc7464786bdc3a32dccfb94d5fbab1a7314792
Instruction ID: 5cf30bd198875de83b0e147b44ab9829c5effafaa969408d7fe52534ce639da7
Opcode Fuzzy Hash: 3a28dd0dcfd7b89b689d9fe25ecc7464786bdc3a32dccfb94d5fbab1a7314792
Instruction Fuzzy Hash: A6610266A0878185E720AB69E40076EA7B1FBC47A8F900334DFB903AD8DF3DC454C794

Function 00007FF7FEC0AE1C Relevance: 7.5, APIs: 5, Instructions: 27
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32 ref: 00007FF7FEC0AE32
GetMessageW.USER32 ref: 00007FF7FEC0AE49
IsDialogMessageW.USER32 ref: 00007FF7FEC0AE60
TranslateMessage.USER32 ref: 00007FF7FEC0AE6F
DispatchMessageW.USER32 ref: 00007FF7FEC0AE7A

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 8f901ab8bb575df3ccfb48a5cb3294f091b017f84468599a2020223c8e70b7dc
Instruction ID: 11cb30e9daf02f58495f4de7fe54383913be38f95f627c013826e3023e0a9bda
Opcode Fuzzy Hash: 8f901ab8bb575df3ccfb48a5cb3294f091b017f84468599a2020223c8e70b7dc
Instruction Fuzzy Hash: FCF04F72B3C54286FB50AB20EC95A36A362FFD0744FC05431F65E86894DF2CD508CB50

Function 00007FF7FEC091E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32 ref: 00007FF7FEC09211
SHAutoComplete.SHLWAPI ref: 00007FF7FEC09255

Part of subcall function 00007FF7FEC013C4: CompareStringW.KERNEL32 ref: 00007FF7FEC013E3

FindWindowExW.USER32 ref: 00007FF7FEC0923F

Strings

EDIT, xrefs: 00007FF7FEC0921B, 00007FF7FEC09233

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 5198dd27efd6ef2cfe81d4e1a42d30dc263c523227a297f5f4c02164b2b5e029
Instruction ID: 90d4b784b9ed1b15bd2e341e8ea6a2b52579e2cd99135072108523192f6dfbc5
Opcode Fuzzy Hash: 5198dd27efd6ef2cfe81d4e1a42d30dc263c523227a297f5f4c02164b2b5e029
Instruction Fuzzy Hash: C6013161B18A4381FB20AB25EC117B6E395AFD8744FC41031EA6E4B7E5DE2CE149C7A0

Function 00007FF7FEC12D6C Relevance: 6.1, APIs: 4, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF7FEC12D7B

Part of subcall function 00007FF7FEC127FC: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF7FEC1281E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF7FEC12D90
__scrt_release_startup_lock.LIBCMT ref: 00007FF7FEC12DFE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF7FEC12E51

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: f380b52e8f95e6a0f24ce785192d8cb773bc143ddf3d62aee805abe4fb8ed354
Instruction ID: 75174709bac201e0c9557bbd1a91dd20d66cdc33a8167a71a559f96fa74290bd
Opcode Fuzzy Hash: f380b52e8f95e6a0f24ce785192d8cb773bc143ddf3d62aee805abe4fb8ed354
Instruction Fuzzy Hash: B7310A29A0C20342FB58BB68D4517BEA291AFC1764FD55434FA3E4B6D3DE2CA405D2F1

Function 00007FF7FEBF2320 Relevance: 6.1, APIs: 4, Instructions: 58
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(?,?,?,?,00000000,00007FF7FEBF2927,?,00100000,?,00000001,00000000,00000000,?,00007FF7FEBF14C1), ref: 00007FF7FEBF2348
ReadFile.KERNEL32 ref: 00007FF7FEBF2367
GetLastError.KERNEL32 ref: 00007FF7FEBF239B
GetLastError.KERNEL32 ref: 00007FF7FEBF23BA

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: e6c7667c98988b07af27c09c467f113a23c428662ff70dade886dc0e45c8ef01
Instruction ID: b9c6906192f7b8777ccfe269cfbd5d98330572b35670b447a75b0bea767a6378
Opcode Fuzzy Hash: e6c7667c98988b07af27c09c467f113a23c428662ff70dade886dc0e45c8ef01
Instruction Fuzzy Hash: D8218462E0C58289EB60BF91A90063DE3A0FBC5B94FD44531DA7D4A7D4CF7CD88587A1

Function 00007FF7FEC0B014 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadBitmapW.USER32 ref: 00007FF7FEC0B02A
GetObjectW.GDI32 ref: 00007FF7FEC0B05B

Part of subcall function 00007FF7FEC08624: FindResourceW.KERNEL32 ref: 00007FF7FEC0863D
Part of subcall function 00007FF7FEC08624: SizeofResource.KERNEL32 ref: 00007FF7FEC08659
Part of subcall function 00007FF7FEC08624: LoadResource.KERNEL32 ref: 00007FF7FEC08673
Part of subcall function 00007FF7FEC08624: LockResource.KERNEL32 ref: 00007FF7FEC08685
Part of subcall function 00007FF7FEC08624: GlobalAlloc.KERNEL32 ref: 00007FF7FEC086A6
Part of subcall function 00007FF7FEC08624: GlobalLock.KERNEL32 ref: 00007FF7FEC086BB
Part of subcall function 00007FF7FEC08624: GdipAlloc.GDIPLUS ref: 00007FF7FEC086FE
Part of subcall function 00007FF7FEC08624: GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF7FEC08769
Part of subcall function 00007FF7FEC08624: GlobalUnlock.KERNEL32 ref: 00007FF7FEC0878C
Part of subcall function 00007FF7FEC08624: GlobalFree.KERNEL32 ref: 00007FF7FEC08795

Strings

], xrefs: 00007FF7FEC0B063

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: GlobalResource$AllocBitmapGdipLoadLock$CreateFindFreeFromObjectSizeofUnlock
String ID: ]
API String ID: 3029289444-3352871620
Opcode ID: 2f79d63664e457f963bfbd157e1c525b341384e02eb8e860e1f42d2dee528bbf
Instruction ID: af398ab74571873faeef435f8ce3eaca7e152e2d2554f57d7bf02ab66df8f0b7
Opcode Fuzzy Hash: 2f79d63664e457f963bfbd157e1c525b341384e02eb8e860e1f42d2dee528bbf
Instruction Fuzzy Hash: EB117F61B0D64245EB64FB21A654279D292AFC8BC4F884034FB7E47BD6DE2CE904C7A0

Function 00007FF7FEBE1EC4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetMalloc.SHELL32 ref: 00007FF7FEBE1EEF
SHBrowseForFolderW.SHELL32 ref: 00007FF7FEBE1F2C

Part of subcall function 00007FF7FEBF7F08: SHGetPathFromIDListW.SHELL32 ref: 00007FF7FEBF7F42

Strings

A, xrefs: 00007FF7FEBE1F24

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: BrowseFolderFromListMallocPath
String ID: A
API String ID: 2332185071-3554254475
Opcode ID: 0c281e5323f8bfbdeeaae068e3954dc023ec51b6ad3a07668b904f8d39298968
Instruction ID: 04d7afdded918c4a3a5dc116c32605b11ca2cef307527350f8b56e1e846c69f7
Opcode Fuzzy Hash: 0c281e5323f8bfbdeeaae068e3954dc023ec51b6ad3a07668b904f8d39298968
Instruction Fuzzy Hash: E6119166618B8586FB509B11F48436AF3A4FBC8BD0F940031EA9D07B99DF3CD048CB90

Function 00007FF7FEC0946C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7FEBFDFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF7FEBFDDDF

OleInitialize.OLE32 ref: 00007FF7FEC09486
SHGetMalloc.SHELL32 ref: 00007FF7FEC094D4

Strings

riched20.dll, xrefs: 00007FF7FEC09475

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: DirectoryInitializeMallocSystem
String ID: riched20.dll
API String ID: 174490985-3360196438
Opcode ID: 0d85db053d286d1bd0fa19ead2840fc3f5149c6ee0f027e6ed6c33eb2c824e37
Instruction ID: 8d46e3911c86417775a3dd145d329f3c3d9f1fd38c7153b05f5364b98b564a84
Opcode Fuzzy Hash: 0d85db053d286d1bd0fa19ead2840fc3f5149c6ee0f027e6ed6c33eb2c824e37
Instruction Fuzzy Hash: 50F03C71A1CA8186EB01AF60E81466AB3A0FBC8754F800135F9AE46794DF7CD159CB50

Function 00007FF7FEC01F94 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7FEC0205B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7FEC02077
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7FEC02093

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: std::bad_alloc::bad_alloc
String ID:
API String ID: 1875163511-0
Opcode ID: 473e069831e40b03067e3ac07c55198f41caec4ce5e3ab4939735fa524c57bef
Instruction ID: 03ab4b5ac7c7a50be943c42f2f8f9c7f69168dd6e7f22ec19002358ac2aa9c03
Opcode Fuzzy Hash: 473e069831e40b03067e3ac07c55198f41caec4ce5e3ab4939735fa524c57bef
Instruction Fuzzy Hash: E9318322A0864651FB24B714E4443BDE7A0FBC0B88F944032F7BC465E6DF6DDA46C351

Function 00007FF7FEBF32BC Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,?,?,00007FF7FEBFE5B1,?,?,?,00000000,?), ref: 00007FF7FEBF32E7
GetFileAttributesW.KERNEL32 ref: 00007FF7FEBF3334
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF3399

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: 85da30fe1743cc553a0db4a1375168b1f74b8b313009b96f55f923233ac5e066
Instruction ID: bc7ac50afe381377c1aeb4a2713903ac81f420d1c56cf8a86b43d8425d3f207c
Opcode Fuzzy Hash: 85da30fe1743cc553a0db4a1375168b1f74b8b313009b96f55f923233ac5e066
Instruction Fuzzy Hash: C3213022A1878181EB10EB69E44512DA361FBC9BA4F900231FABD47BE9DF3CD541C794

Function 00007FF7FEBE255C Relevance: 4.5, APIs: 3, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FEBFA4AC: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7FEBFA504
Part of subcall function 00007FF7FEBFA4AC: SetDlgItemTextW.USER32 ref: 00007FF7FEBFA573
Part of subcall function 00007FF7FEBFA4AC: GetWindowRect.USER32 ref: 00007FF7FEBFA5AD
Part of subcall function 00007FF7FEBFA4AC: GetClientRect.USER32 ref: 00007FF7FEBFA5BB

GetParent.USER32 ref: 00007FF7FEBE2599
GetDlgItem.USER32 ref: 00007FF7FEBE25AC
SetDlgItemTextW.USER32 ref: 00007FF7FEBE25C8

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: Item$RectText$ClientParentWindowswprintf
String ID:
API String ID: 209416863-0
Opcode ID: ad94589889145b650e3461eb84003e845283bd92425fc2a9221c8100a4e27e71
Instruction ID: e7ae45a7d38aa2c655fc440dd522b738eecb4dd802797ab45195b6f94b588bf8
Opcode Fuzzy Hash: ad94589889145b650e3461eb84003e845283bd92425fc2a9221c8100a4e27e71
Instruction Fuzzy Hash: EA014420E0D38A41FF597752A55867AE7D26FC5748FC84035DC6D062D9EE6CE884C3A1

Function 00007FF7FEBE3904 Relevance: 3.1, APIs: 2, Instructions: 124COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBE3AB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBE3AB9

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 059fe93b6b6045c61731c70e0e29f52abe1320b84121e6dc329f1e36eead177c
Instruction ID: 3de097dea32e8709eb538e95ada853749ae63407ac7f87e544137d43c32cbc85
Opcode Fuzzy Hash: 059fe93b6b6045c61731c70e0e29f52abe1320b84121e6dc329f1e36eead177c
Instruction Fuzzy Hash: CB41B122F1465184FB10EBB5D441AADB361AF84B98FD41235EE2D27ADADE3CD482C391

Function 00007FF7FEBE15B8 Relevance: 3.1, APIs: 2, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBE1731
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7FEBE173D

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 85daa6c2c240d2c4d18d7ff96353ee588ba1a4ebacb5533b4b5283e299b1b2c1
Instruction ID: 92663ef718d5180eaa945343f350f60c09ea92da7e273c5c3cce0388ef3a3df3
Opcode Fuzzy Hash: 85daa6c2c240d2c4d18d7ff96353ee588ba1a4ebacb5533b4b5283e299b1b2c1
Instruction Fuzzy Hash: 2D41F262B0864695EB04AB56A5045BEF351AB84FE4FE80632EF7D07BD6DE3CE041C391

Function 00007FF7FEBF2778 Relevance: 3.1, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000002,?,00000F99,?,00007FF7FEBF274D), ref: 00007FF7FEBF28A9
GetLastError.KERNEL32(?,00007FF7FEBF274D), ref: 00007FF7FEBF28B8

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 043a82e8aff847b2e282b78885e55c7214a93c585b530bdf19c19deffc600893
Instruction ID: 0e9f399017ca84365123b8f6422b2e7c95ea5fafed9de0df094b2ea73f690c17
Opcode Fuzzy Hash: 043a82e8aff847b2e282b78885e55c7214a93c585b530bdf19c19deffc600893
Instruction Fuzzy Hash: 9D31B822B1959282EF65ABAAD940A79A350AFC4BD4FD40131DE3D477D0DE3CD841D7A0

Function 00007FF7FEBF7F08 Relevance: 3.1, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

SHGetPathFromIDListW.SHELL32 ref: 00007FF7FEBF7F42
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF7FBB

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: FromListPath_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2469645512-0
Opcode ID: 41b94f6260d4a77b131a65acd134c30259ca8eda58d601b7dc2cd8c4afeb0d78
Instruction ID: 3ab41965837dd592600a525a012ab9db5f9723d787a64b01d7044ba51ef081b7
Opcode Fuzzy Hash: 41b94f6260d4a77b131a65acd134c30259ca8eda58d601b7dc2cd8c4afeb0d78
Instruction Fuzzy Hash: BB110466B2568542EE14AB66944437DE311AFC9FE0F948231EB7D077D6DE2CD480C250

Function 00007FF7FEC06BD0 Relevance: 3.1, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 00007FF7FEC06C27
CopyRect.USER32 ref: 00007FF7FEC06C48

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: Rect$ClientCopy
String ID:
API String ID: 1880273418-0
Opcode ID: 2f6d5af47f683ad8005f9bb983b07738bfe9bdf6addeaebacbd905efd0d7acb8
Instruction ID: 9f09a57d6d37cccfe04cd70d0c8dc61d5d4ccdca3b614afdcfd009cb8483ca72
Opcode Fuzzy Hash: 2f6d5af47f683ad8005f9bb983b07738bfe9bdf6addeaebacbd905efd0d7acb8
Instruction Fuzzy Hash: 6E216A73610B848AE710DF26E48476AB3A0F388BA5F448021EF9D4B751DB3DD4A5CB40

Function 00007FF7FEBFAAE0 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF7FEBFAB67
LoadStringW.USER32 ref: 00007FF7FEBFAB80

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: efc1550bd5bba1d5ac9face2304fa075ed5e4cb94ffc19493764f318ca00d951
Instruction ID: 987ae537d7f77b44b28ba85643dc5d2a892339638ac83439a9a1050de973f04a
Opcode Fuzzy Hash: efc1550bd5bba1d5ac9face2304fa075ed5e4cb94ffc19493764f318ca00d951
Instruction Fuzzy Hash: 5811A961B0865186EB04AF06A840428F7A2BBD8FC0BD44435DA2D937A5DE3CE501C394

Function 00007FF7FEBF2BB0 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32 ref: 00007FF7FEBF2C11
GetLastError.KERNEL32 ref: 00007FF7FEBF2C1E

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 5eda2cbf1ce6837a88d649c872729f31e823bc49095d59e5e9b193bf7b9166cd
Instruction ID: fb57a48e56a5dbd8c633568fe1f4fe1fa14aca021e9a25a2d386ef5c1b43dfa5
Opcode Fuzzy Hash: 5eda2cbf1ce6837a88d649c872729f31e823bc49095d59e5e9b193bf7b9166cd
Instruction Fuzzy Hash: 6B11B731A0C68181EB60AB65E841679A360FBC4BB4FD40331EA7D462E5CF3CD992C390

Function 00007FF7FEBFEB58 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7FEBFEBAD,?,?,?,?,00007FF7FEBF5752,?,?,?,00007FF7FEBF56DE), ref: 00007FF7FEBFEB5C
GetProcessAffinityMask.KERNEL32 ref: 00007FF7FEBFEB6F

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 444071b75e142e51b736d9fa504759652bc9944b894df1f8101a797a07211085
Instruction ID: da6038f0cf7980ada6904642838ef8f5c2c6a927720b334cbd5b63a64a11ebc4
Opcode Fuzzy Hash: 444071b75e142e51b736d9fa504759652bc9944b894df1f8101a797a07211085
Instruction Fuzzy Hash: F8E02B62F1458642DF089F55C8408E9B392BFC8B40BC48036E61B83658DE2CE145CB40

Function 00007FF7FEC121D0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7FEC12200

Part of subcall function 00007FF7FEC12F7C: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7FEC12F85

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7FEC12206

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: ac554a43d54612151bc7e480101717375080be3004ee5b366f50feb51e7139dd
Instruction ID: cc6f462f290ece2232c0a54c2aee11b7c8a0ae7b2964f00e59cb0e5428c8f6ad
Opcode Fuzzy Hash: ac554a43d54612151bc7e480101717375080be3004ee5b366f50feb51e7139dd
Instruction Fuzzy Hash: 21E0EC45E0910B45FF2D726118251BC80400FD9370FE81730FE7E056D2AD1CA896E1F1

Function 00007FF7FEC1D90C Relevance: 3.0, APIs: 2, Instructions: 19threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlRestoreThreadPreferredUILanguages.NTDLL ref: 00007FF7FEC1D922
GetLastError.KERNEL32 ref: 00007FF7FEC1D934

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: ErrorLanguagesLastPreferredRestoreThread
String ID:
API String ID: 588628887-0
Opcode ID: 7829e02dcbd74b51c5e196648e5aad52518f68633834b7095f7e5950a32ae739
Instruction ID: 0fb3dc5b6eaefee3564d06823b4c6a8c3f33c1fa3035af09c4983e6d78567589
Opcode Fuzzy Hash: 7829e02dcbd74b51c5e196648e5aad52518f68633834b7095f7e5950a32ae739
Instruction Fuzzy Hash: FFE08C61E0D10346FF08BBB298051BC9B915FD4B62F840030E92D8A2D2EE2CA481C7A0

Function 00007FF7FEBE33E4 Relevance: 1.8, APIs: 1, Instructions: 328COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBE388C

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 7a23e25faff7f81180b76b60ee52a325f4d060335247a6f7438b488b522aacc7
Instruction ID: df5a49caf761445d3757856f9628d7bbd3cd5e47f7fd80e5bbc18c1b35ab6ac9
Opcode Fuzzy Hash: 7a23e25faff7f81180b76b60ee52a325f4d060335247a6f7438b488b522aacc7
Instruction Fuzzy Hash: 60D1A672B0868256EB69AB2595406BDF7A1FF85B84FC40035CB6D077E1CF3CE46187A2

Function 00007FF7FEC01870 Relevance: 1.7, APIs: 1, Instructions: 172COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FEBFE948: ReleaseSemaphore.KERNEL32 ref: 00007FF7FEBFE974
Part of subcall function 00007FF7FEBFE948: CloseHandle.KERNEL32 ref: 00007FF7FEBFE993
Part of subcall function 00007FF7FEBFE948: DeleteCriticalSection.KERNEL32 ref: 00007FF7FEBFE9AA
Part of subcall function 00007FF7FEBFE948: CloseHandle.KERNEL32 ref: 00007FF7FEBFE9B7

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC01ACB

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: CloseHandle$CriticalDeleteReleaseSectionSemaphore_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 904680172-0
Opcode ID: 9769b8d8c6adf9e9843dd34bf36c89e921551141ac818f266a3f44a314c80fc1
Instruction ID: 7aa62883eb55961a43f1014c77a14abbbe6844a206fc0e6319bde6a9cedea91d
Opcode Fuzzy Hash: 9769b8d8c6adf9e9843dd34bf36c89e921551141ac818f266a3f44a314c80fc1
Instruction Fuzzy Hash: 17614B62B15A85A2EF08EB65D5540BCE365FB80FA0B944236E73D47AD6CF2CE471C390

Function 00007FF7FEBF1794 Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF187D

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: ea6a7865e2e9e8746dbc325a2513cec599ace0577c60dc52ba5a7a1e0ec76fb7
Instruction ID: 19e09f9979c57495d6fda8caa3d6e06e06a86f76901b65e7bcd7e17e8b7e2349
Opcode Fuzzy Hash: ea6a7865e2e9e8746dbc325a2513cec599ace0577c60dc52ba5a7a1e0ec76fb7
Instruction Fuzzy Hash: 7041C462B18AC142EB14AA57AA44769E255EBC4BD0FC48536EE6C07F9ADF3CD4518380

Function 00007FF7FEC06D14 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF7FEC06E39

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: d099c03d8e2848a1e30d564a57ddf97b32082f3d37bcdae0bfe2462c3f495dc5
Instruction ID: edd3d6ab334f910c48ae74aa6bf9de15b4dbe372c993f32edffc17736b719ca4
Opcode Fuzzy Hash: d099c03d8e2848a1e30d564a57ddf97b32082f3d37bcdae0bfe2462c3f495dc5
Instruction Fuzzy Hash: 18410866B04B1686FB10AB6AD9903AC6770BB84B88F804032EF1D87BA5DF3CD444C390

Function 00007FF7FEBE129C Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7FEBE1396

Part of subcall function 00007FF7FEBE1F80: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7FEBE1F89

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstd::bad_alloc::bad_alloc
String ID:
API String ID: 680105476-0
Opcode ID: cdd7092e0f71e960e2c796ddb651167829935750abdcc78008bf605f86b39d5f
Instruction ID: 98ec1623831f7acc5cae60d2da594b798b3f2ebd9b606d6a42c40d3709e2649e
Opcode Fuzzy Hash: cdd7092e0f71e960e2c796ddb651167829935750abdcc78008bf605f86b39d5f
Instruction Fuzzy Hash: DC21A122A0825195EB14AF51A50067DB250FB84BF0FF80B32EE7E07BC1DE7CE4518391

Function 00007FF7FEC2124C Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FEC21280

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9dd5a9e84c18447e56e2265fa04046f11d37b96b7f5b774ce3305aa6458b3f00
Instruction ID: 0d08060fcbb4a2e721b76f5d08f9b52e9ae998556298ae0cabb563ac7cff0ce2
Opcode Fuzzy Hash: 9dd5a9e84c18447e56e2265fa04046f11d37b96b7f5b774ce3305aa6458b3f00
Instruction Fuzzy Hash: 23110722A1C69386F720AB51A440679E2A5FBC0790FD50536FAADD66D6DF2CE800C7A4

Function 00007FF7FEC11558 Relevance: 1.5, APIs: 1, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF7FEC11604: GetModuleHandleW.KERNEL32(?,?,?,00007FF7FEC11573,?,?,?,00007FF7FEC1192A), ref: 00007FF7FEC1162B

DloadProtectSection.DELAYIMP ref: 00007FF7FEC115C9

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: DloadHandleModuleProtectSection
String ID:
API String ID: 2883838935-0
Opcode ID: 902d746097657f35995c40355b3f554eba39218e3fb79a70aefbb70b68ceb6fd
Instruction ID: 33dd001d58912c3f638ef5e05f78830cf27d3508dd731faadb4f62bf4299d293
Opcode Fuzzy Hash: 902d746097657f35995c40355b3f554eba39218e3fb79a70aefbb70b68ceb6fd
Instruction Fuzzy Hash: F011E162D0C60781FB60BB15A840378A391AFD4B58FD40436F92D462E2EF3CA495D7F0

Function 00007FF7FEC1FA04 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00007FF7FEC1FA59

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c4d23aaef5024e3722ccbb242168b3e22d65bf63548bcaacbbf61b8d0a3ba7a1
Instruction ID: d8a6c4280f5d7de4f4da1419b8a5b52328126d58193205d730cd5c57348417e3
Opcode Fuzzy Hash: c4d23aaef5024e3722ccbb242168b3e22d65bf63548bcaacbbf61b8d0a3ba7a1
Instruction Fuzzy Hash: 5CF06D91B0924789FF587A6199113BC92909FC8BA0FCC5430E92E8A3C1ED2CE691C2B0

Function 00007FF7FEBF20D0 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,?,00000001,00007FF7FEBF207E), ref: 00007FF7FEBF20F6

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: ccbd9008d2c4ce7168f8d058ff2f34620ae6bf54bfe45a0cbca9d6a6f1a7c065
Instruction ID: 94fe4bdb8c6bcd41d2be7b2ef29d5557d50cbe4384d933b1efd3db3bb9f74e39
Opcode Fuzzy Hash: ccbd9008d2c4ce7168f8d058ff2f34620ae6bf54bfe45a0cbca9d6a6f1a7c065
Instruction Fuzzy Hash: CDF0FF22A0828285FB289B60E042778A661EBD0B78FC80334E73C011D4CF28C995C3A4

Function 00007FF7FEC1D94C Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00007FF7FEC1D98A

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5fa632deebd8181b9f3ea37834cf4eccbda839d7d0d6f948310c23224b4a93e7
Instruction ID: e9d2ef26f88858b8cde2f3ab6796ed830bf540b444697c779b741ab8038fe97a
Opcode Fuzzy Hash: 5fa632deebd8181b9f3ea37834cf4eccbda839d7d0d6f948310c23224b4a93e7
Instruction Fuzzy Hash: 3FF05811B0924785FF187AB158102BC9A905FC47B2F881A30FD3E862C1DE2CA480C6B0

Function 00007FF7FEC06B80 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

IsWindow.USER32 ref: 00007FF7FEC06B94

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 19568bbba615d437ef4d7e10947b2e48dd1839d5b66ced1b227cb4eb1e0913fe
Instruction ID: 55b999ab435e421e8e2fe73d26f2e3992b705846c3cb1a27ac56118acec3d226
Opcode Fuzzy Hash: 19568bbba615d437ef4d7e10947b2e48dd1839d5b66ced1b227cb4eb1e0913fe
Instruction Fuzzy Hash: ACE0E6B271894181EB645F56F9801296370DB8CBD4F555131EB5DC7754DE28C8E1D740

Non-executed Functions

Function 00007FF7FEBEC2F0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 754fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FEBEDE04: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7FEBECF4B), ref: 00007FF7FEBEDE27
Part of subcall function 00007FF7FEBEDE04: GetLastError.KERNEL32 ref: 00007FF7FEBEDE88
Part of subcall function 00007FF7FEBEDE04: CloseHandle.KERNEL32 ref: 00007FF7FEBEDE9B

wcscpy.LIBCMT ref: 00007FF7FEBECBC8
wcscpy.LIBCMT ref: 00007FF7FEBECBFE
CreateFileW.KERNEL32 ref: 00007FF7FEBECC38
DeviceIoControl.KERNEL32 ref: 00007FF7FEBECD01
CloseHandle.KERNEL32 ref: 00007FF7FEBECD12
GetLastError.KERNEL32 ref: 00007FF7FEBECD2E
RemoveDirectoryW.KERNEL32 ref: 00007FF7FEBECD7D
DeleteFileW.KERNEL32 ref: 00007FF7FEBECD88
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBECE89
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBECE8F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBECE9B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBECEA1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBECEAD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBECEB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBECEB9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBECEBF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBECEC5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBECECB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBECED1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBECED7

Strings

SeRestorePrivilege, xrefs: 00007FF7FEBEC343
SeCreateSymbolicLinkPrivilege, xrefs: 00007FF7FEBEC34F
UNC\, xrefs: 00007FF7FEBEC53F, 00007FF7FEBEC55D
\??\, xrefs: 00007FF7FEBEC392, 00007FF7FEBEC3B8

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseErrorFileHandleLastwcscpy$ControlCreateCurrentDeleteDeviceDirectoryProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 2659423929-3508440684
Opcode ID: d022bdf220f1469836e8b11dc5ccee1e8133842d4d74336f22b2492593fef88c
Instruction ID: c59c6045b3f2409042333260f42c00c8e08e73bd61ea05452ddede11a549d7e8
Opcode Fuzzy Hash: d022bdf220f1469836e8b11dc5ccee1e8133842d4d74336f22b2492593fef88c
Instruction Fuzzy Hash: AF62C162F0868285FB00AB74D4486BDB361ABC57A4FD04231EA7C57ADADF3CE584C791

Function 00007FF7FEBFF180 Relevance: 43.2, APIs: 22, Strings: 2, Instructions: 1205COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF7FEC00528

Part of subcall function 00007FF7FEBFAAE0: LoadStringW.USER32 ref: 00007FF7FEBFAB67
Part of subcall function 00007FF7FEBFAAE0: LoadStringW.USER32 ref: 00007FF7FEBFAB80

Part of subcall function 00007FF7FEC0B0DC: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF7FEC00429), ref: 00007FF7FEC0B110
Part of subcall function 00007FF7FEC0B0DC: SetLastError.KERNEL32 ref: 00007FF7FEC0B153

Part of subcall function 00007FF7FEBE129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7FEBE1396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC00490
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC00496
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0049C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC004A2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC004A8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC004AE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC004B4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC004BA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC004C0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC004C6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC004CC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC004D2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC004D8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC004DE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC004E4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC004EA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC004F0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC004F6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC00532
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC00538

Strings

%ls, xrefs: 00007FF7FEBFF3AC, 00007FF7FEBFF3FF
%s: %s, xrefs: 00007FF7FEBFFC11

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ErrorLastLoadString$Concurrency::cancel_current_taskInit_thread_footer
String ID: %ls$%s: %s
API String ID: 2539828978-2259941744
Opcode ID: 5f8e31e4d4d181a0b4ac54d77603c22ade31506edde57a20747cb3639f8e7bc1
Instruction ID: 8a9a89b2f72574806e8ac01b488c1958d9d86bfffd0942fefe0db46dbd1e91a3
Opcode Fuzzy Hash: 5f8e31e4d4d181a0b4ac54d77603c22ade31506edde57a20747cb3639f8e7bc1
Instruction Fuzzy Hash: 88B2D862A1968241EB14BB65E4551BEE311EFC6790FD04236FBBD43BEADE2CD540C390

Function 00007FF7FEC22550 Relevance: 22.3, APIs: 8, Strings: 4, Instructions: 1310COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FEC22C12
memcpy_s.LIBCMT ref: 00007FF7FEC235BF
memcpy_s.LIBCMT ref: 00007FF7FEC23666

Part of subcall function 00007FF7FEC238BC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FEC238EE

memcpy_s.LIBCMT ref: 00007FF7FEC2372F

Part of subcall function 00007FF7FEC1D008: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FEC1D02D

Strings

1#SNAN, xrefs: 00007FF7FEC237C9
1#INF, xrefs: 00007FF7FEC23807
1#QNAN, xrefs: 00007FF7FEC237E8
1#IND, xrefs: 00007FF7FEC237AA

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _invalid_parameter_noinfomemcpy_s
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 1759834784-2761157908
Opcode ID: c1568b5568d689d261f1f0b975b9c1104ab10acfc5286cd5346a40821ab4f9bc
Instruction ID: 3483994be4265ea8f45c78bf09d4330a5fcfc12b3fc7a3049c8c736e74470bdd
Opcode Fuzzy Hash: c1568b5568d689d261f1f0b975b9c1104ab10acfc5286cd5346a40821ab4f9bc
Instruction Fuzzy Hash: 1AB2FB72E082828BE729AE69D4407FDB795FBC4788F905135EA2957BC4DF38E504CB90

Function 00007FF7FEBF1A48 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 375fileCOMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32 ref: 00007FF7FEBF1A97
GetLongPathNameW.KERNEL32 ref: 00007FF7FEBF1AE0
GetShortPathNameW.KERNEL32 ref: 00007FF7FEBF1B21
GetShortPathNameW.KERNEL32 ref: 00007FF7FEBF1B6A

Part of subcall function 00007FF7FEC013C4: CompareStringW.KERNEL32 ref: 00007FF7FEC013E3

MoveFileW.KERNEL32 ref: 00007FF7FEBF1DFE
MoveFileW.KERNEL32 ref: 00007FF7FEBF1E65

Part of subcall function 00007FF7FEBF2134: CreateFileW.KERNEL32 ref: 00007FF7FEBF223C

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF1FE1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF1FE7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF1FED

Strings

rtmp, xrefs: 00007FF7FEBF1CF4, 00007FF7FEBF1D03

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: NamePath$File_invalid_parameter_noinfo_noreturn$LongMoveShort$CompareCreateString
String ID: rtmp
API String ID: 3587137053-870060881
Opcode ID: 9584e141ec954376f8208e33381218a1dea599408f88b417761a047d989f2899
Instruction ID: 5f6852986f482645a0fc786290f266be3237d74bf148be8ab000d7690d1a7cd8
Opcode Fuzzy Hash: 9584e141ec954376f8208e33381218a1dea599408f88b417761a047d989f2899
Instruction Fuzzy Hash: F2F1D522B08A8281EB10EBA5D8405FDA761FBC57D4FD01532EA6D47AEADF3CD584C790

Function 00007FF7FEBEF930 Relevance: 17.2, APIs: 8, Strings: 1, Instructions: 1417COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF1239
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF123F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF1245
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF124B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF1251
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF1257
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF125D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF1263

Strings

__tmp_reference_source_, xrefs: 00007FF7FEBEFCCF, 00007FF7FEBEFCDE

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: __tmp_reference_source_
API String ID: 3668304517-685763994
Opcode ID: 03d12901710120870c289bb985fda3a35d64c61b5b23fc82cc44f1d8826b478f
Instruction ID: ccd8aa6c26782f3e4fcb5bacf3d8284636cb7964fe3ec47edd7c4cb2bdbc1f5b
Opcode Fuzzy Hash: 03d12901710120870c289bb985fda3a35d64c61b5b23fc82cc44f1d8826b478f
Instruction Fuzzy Hash: 1DE28462A086C292EB64ABA5E1407AEE761FBC1750FC04132DBBD136E6CF3CE455C791

Function 00007FF7FEBF5B60 Relevance: 12.3, APIs: 8, Instructions: 256COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF7FEBF5BC2
GetFullPathNameW.KERNEL32 ref: 00007FF7FEBF5C0E
GetFullPathNameW.KERNEL32 ref: 00007FF7FEBF5D2B
GetFullPathNameW.KERNEL32 ref: 00007FF7FEBF5D70
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF5EE0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF5EE6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF5EEC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF5EF2

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: FullNamePath_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1693479884-0
Opcode ID: 42882c5e1b64cf364603feffb0a4dffa6fd5e54fa856c7804417c031547eb997
Instruction ID: 2bc8a5668eb19e8f0a55aceb9918945ce73444bf97c69a3f82626ac100aab97e
Opcode Fuzzy Hash: 42882c5e1b64cf364603feffb0a4dffa6fd5e54fa856c7804417c031547eb997
Instruction Fuzzy Hash: 88A1C662F1AB9145FF00ABB998545BCA361ABC5BE4BD44231DE3E17BC5DE3CD481C290

Function 00007FF7FEBF40BC Relevance: 10.7, APIs: 7, Instructions: 153fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF7FEBF410B
FindFirstFileW.KERNEL32 ref: 00007FF7FEBF415E
GetLastError.KERNEL32 ref: 00007FF7FEBF41AF
FindNextFileW.KERNEL32 ref: 00007FF7FEBF41D7
GetLastError.KERNEL32 ref: 00007FF7FEBF41E5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF430F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF4315

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: FileFind$ErrorFirstLast_invalid_parameter_noinfo_noreturn$Next
String ID:
API String ID: 474548282-0
Opcode ID: e946e08dc8eba9ecab1b1533132c2bb6995f9a4699fd30eb303f74d9a567b386
Instruction ID: dbf091419f4d8de98261b998f105491d1a34e56f04249caae5583abd68ec50a8
Opcode Fuzzy Hash: e946e08dc8eba9ecab1b1533132c2bb6995f9a4699fd30eb303f74d9a567b386
Instruction Fuzzy Hash: 2861B172A18A8281EB10AB69E84066DA361FBC57B4FD04331EABD076D9DF3CD584C790

Function 00007FF7FEC13170 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF7FEC1318C
RtlCaptureContext.KERNEL32 ref: 00007FF7FEC131B9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7FEC131D3
RtlVirtualUnwind.KERNEL32 ref: 00007FF7FEC13214
IsDebuggerPresent.KERNEL32 ref: 00007FF7FEC13268
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7FEC13289
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7FEC13294

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: eb4060bcbbf6947450414bc0ac192b8da1feec02df413969c5a674799d26ef14
Instruction ID: f41eb8f09e4d77cb434cfd5c1340911c981dcd24490a2c88ae1b656328ba3bea
Opcode Fuzzy Hash: eb4060bcbbf6947450414bc0ac192b8da1feec02df413969c5a674799d26ef14
Instruction Fuzzy Hash: 00315072608B818AEB60AF64E8503EDB364FB84758F844439EA5D47BD9DF3CD548C760

Function 00007FF7FEC176D8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7FEC17751
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7FEC17769
RtlVirtualUnwind.KERNEL32 ref: 00007FF7FEC177A4
IsDebuggerPresent.KERNEL32 ref: 00007FF7FEC177DD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7FEC177E7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7FEC177F2

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 5940ef1d6d2c32beaf7af9e8e0892e721e3d30544378453b8f42f9f5775f8da8
Instruction ID: 477793625ba78d4f2e616eca438b40c04a5da2c14aa88efa714fa93698b00f83
Opcode Fuzzy Hash: 5940ef1d6d2c32beaf7af9e8e0892e721e3d30544378453b8f42f9f5775f8da8
Instruction Fuzzy Hash: 80316236608B8185EB60DF25E8402AEB3A4FBC9764F940135FAAD43B99DF3CD545CB50

Function 00007FF7FEBE1AA4 Relevance: 6.3, APIs: 4, Instructions: 285COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBE1EA9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBE1EAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBE1EB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBE1EBB

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 2ede25571788319afd1ece2c8349ab9326b5cc4c0a2031bfa6d214eef26c37c8
Instruction ID: d2224ca6030702aa5889f6cfb0efe6382f0c287da4f9c509ad4c27503c4d07c9
Opcode Fuzzy Hash: 2ede25571788319afd1ece2c8349ab9326b5cc4c0a2031bfa6d214eef26c37c8
Instruction Fuzzy Hash: D8B1EF22B15A8685EB10AB65D8446EDB361FFC5794FE04232EAAC07BDADF3CD540C391

Function 00007FF7FEC1FA94 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FEC1FAC4

Part of subcall function 00007FF7FEC17934: GetCurrentProcess.KERNEL32(00007FF7FEC20CCD), ref: 00007FF7FEC17961

Strings

*?, xrefs: 00007FF7FEC1FAEB
., xrefs: 00007FF7FEC1FEE4

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *?$.
API String ID: 2518042432-3972193922
Opcode ID: f96344909874f118cd7fc652812aee2de17a0b901a5c412331694f6fbd6e8fc4
Instruction ID: 445f66bea13fdc06c82dfc79369033ff7e604573f0a8a27655e3c0f759eea5a5
Opcode Fuzzy Hash: f96344909874f118cd7fc652812aee2de17a0b901a5c412331694f6fbd6e8fc4
Instruction Fuzzy Hash: 1B51C362B15B9585EB10EFA698104BDA7A4FF98BE8B844531EE2D17BC5DE3CD042C360

Function 00007FF7FEC22080 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCMT ref: 00007FF7FEC2210B

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction ID: 5dbbf55b1cc7cc95e7b734926c1b3407a876eaed675cedd2158cf0c7659b1c46
Opcode Fuzzy Hash: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction Fuzzy Hash: 46D1E432B1828687DB38DF15E1846AAF7A1FBC8784F548134EB5E57B84DA3DE841CB50

Function 00007FF7FEBEB6D8 Relevance: 4.5, APIs: 3, Instructions: 36windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF7FEBEBA9D), ref: 00007FF7FEBEB6E5
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,00007FF7FEBEBA9D), ref: 00007FF7FEBEB719
LocalFree.KERNEL32(?,?,?,?,?,?,?,00007FF7FEBEBA9D), ref: 00007FF7FEBEB743

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID:
API String ID: 1365068426-0
Opcode ID: c27e05edbcf0c556cf9f4b9f4aa6354f64d9dc72ff0f252d3a2ededa039666af
Instruction ID: d182e1ccd44b7070589faa2284c913eba83876d078f736924aa5752e4398b85f
Opcode Fuzzy Hash: c27e05edbcf0c556cf9f4b9f4aa6354f64d9dc72ff0f252d3a2ededa039666af
Instruction Fuzzy Hash: 7701F47660C74282D714AF16B89057AB355FBC97C1F844034EAAD47B85CE3CD505C755

Function 00007FF7FEC1FCA0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

., xrefs: 00007FF7FEC1FEE4

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 7c9d8364e7b62915daf92aecf888b4814fe01b6aae5fc02ec6e7aa2f3019df5b
Instruction ID: b79dc1c02784b857a282981ef52d58d3def30594f2b7ad4a6d70b1c42092b734
Opcode Fuzzy Hash: 7c9d8364e7b62915daf92aecf888b4814fe01b6aae5fc02ec6e7aa2f3019df5b
Instruction Fuzzy Hash: 3431B622B186D545EB20AA2698057BDAA91AFD5BF4F948235FE7C47BC6CE3CD501C340

Function 00007FF7FEC25AF8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF7FEC25D45
RaiseException.KERNEL32 ref: 00007FF7FEC25D56

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 131550a8e914c8a4384a7255cc8ec53066b4dff0b7ecc1394be8dfb6b4310eca
Instruction ID: 2bd761ac74f7f261443b138e3f752569b7a397458899a0c61c4af84e6e7aed6b
Opcode Fuzzy Hash: 131550a8e914c8a4384a7255cc8ec53066b4dff0b7ecc1394be8dfb6b4310eca
Instruction Fuzzy Hash: A6B19D73600B888BEB15CF29C84636DBBA0F784B48F148821EB6D837E8CB39D451C711

Function 00007FF7FEC0A2CC Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00007FF7FEC0A315
GetNumberFormatW.KERNEL32 ref: 00007FF7FEC0A371

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: a0c8fcaef59427837b2a7c7753e3d717a8442860a15e47712294eddcbb527c28
Instruction ID: 403d300b15be5a5a96955ccfaec08acd02f0ee58327cf9a1fc5eb734b769e3fa
Opcode Fuzzy Hash: a0c8fcaef59427837b2a7c7753e3d717a8442860a15e47712294eddcbb527c28
Instruction Fuzzy Hash: A9111A32A19B8199E761AF11E8107E9B361FFC8B44FC44135EA9D03698DF3CE545C794

Function 00007FF7FEBF126C Relevance: 1.7, APIs: 1, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FEBF24C0: CreateFileW.KERNEL32 ref: 00007FF7FEBF259B
Part of subcall function 00007FF7FEBF24C0: GetLastError.KERNEL32 ref: 00007FF7FEBF25AE
Part of subcall function 00007FF7FEBF24C0: CreateFileW.KERNEL32 ref: 00007FF7FEBF260E
Part of subcall function 00007FF7FEBF24C0: GetLastError.KERNEL32 ref: 00007FF7FEBF2617

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF15D0

Part of subcall function 00007FF7FEBF3980: MoveFileW.KERNEL32 ref: 00007FF7FEBF39BD
Part of subcall function 00007FF7FEBF3980: MoveFileW.KERNEL32 ref: 00007FF7FEBF3A34

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: File$CreateErrorLastMove$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 34527147-0
Opcode ID: bf192cea98af03643e15de890051a395ba0ec686757b7d1c45a8bc4adf441be7
Instruction ID: c4f1a915a3710b7ef10f717db4080dc41fdcfe10d1cf1d0332d47e8ae9f6afc1
Opcode Fuzzy Hash: bf192cea98af03643e15de890051a395ba0ec686757b7d1c45a8bc4adf441be7
Instruction Fuzzy Hash: 8491C122B1868282EB10EBA6D444AADA361FBD4BC4FC04032EE2D57BD6DF3CD545C790

Function 00007FF7FEC08DF4 Relevance: 1.7, APIs: 1, Instructions: 186COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FEC085E0: GetDC.USER32 ref: 00007FF7FEC085EC
Part of subcall function 00007FF7FEC085E0: GetDeviceCaps.GDI32 ref: 00007FF7FEC085FD
Part of subcall function 00007FF7FEC085E0: ReleaseDC.USER32 ref: 00007FF7FEC0860A

GetObjectW.GDI32 ref: 00007FF7FEC08E48

Part of subcall function 00007FF7FEC090B0: GetDC.USER32 ref: 00007FF7FEC090D9
Part of subcall function 00007FF7FEC090B0: GetObjectW.GDI32 ref: 00007FF7FEC09107
Part of subcall function 00007FF7FEC090B0: ReleaseDC.USER32 ref: 00007FF7FEC091BB

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID:
API String ID: 1061551593-0
Opcode ID: 68dbe16693602acb82a0a9c061fd0d735b77194d41f4ab9e90264308bb487059
Instruction ID: a2cfefbceb9d12662c3d3f5a2b9bf3f689e003e33357d0c79f908132446d4383
Opcode Fuzzy Hash: 68dbe16693602acb82a0a9c061fd0d735b77194d41f4ab9e90264308bb487059
Instruction Fuzzy Hash: F6810976B18A0586EB209F6AE8406ADB771FBC8B88F404132EE2D577A4DF3CD545C790

Function 00007FF7FEBF4EB0 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00007FF7FEBF4EE2

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 5e1f820920c456f15e44ae9d5f0cc3b6f822566f542002a6e47536c5256bfc9c
Instruction ID: 6c6627cd4dd12956457c51ef1a2d437185cde3ea9e2a950151d624e6ab4a8350
Opcode Fuzzy Hash: 5e1f820920c456f15e44ae9d5f0cc3b6f822566f542002a6e47536c5256bfc9c
Instruction Fuzzy Hash: 56018F71A8D5C289FB31A764A4157B9E3929BE9306FC50134E5FC062D1CE3CA048CBB5

Function 00007FF7FEC18C1C Relevance: 1.5, Strings: 1, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF7FEC18DD3

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 0fbd957179d89af9e1d3453d65279f22830f04fe064c784c04e338e6c7bf3646
Instruction ID: cd8f21d29f5a8af58dde36ea409cc6404f1eb7762bb9ec89a40932c7d50b703a
Opcode Fuzzy Hash: 0fbd957179d89af9e1d3453d65279f22830f04fe064c784c04e338e6c7bf3646
Instruction Fuzzy Hash: 1F81F327A1C34346EBA8BA1580406BDE291EFD1B68FD41531FD2987AD5CF2DE846C7E0

Function 00007FF7FEC189A0 Relevance: 1.4, Strings: 1, Instructions: 199COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF7FEC18B3A

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: a261a21fa45f21d734edfefcd2ffe271b1157111beaf653bc061adca1a26389c
Instruction ID: f8737be0b06a08ed7786b9327251ce6346172adeb7aed2d2419fd24b4368a6e2
Opcode Fuzzy Hash: a261a21fa45f21d734edfefcd2ffe271b1157111beaf653bc061adca1a26389c
Instruction Fuzzy Hash: 76711823A0C28247FB68AA29444027DE7919FC1B78F941931FD2D877D6CE2DE856C7E1

Function 00007FF7FEBFC96C Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

gj, xrefs: 00007FF7FEBFC97B

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 226aa63bfce789330e15763d8953fb7d553c3450d9c1aa6f260de1088bdface5
Instruction ID: 9f0d191099c9a6beea1c74bc82aa1003c2a511ca67159c19959810f0da29851b
Opcode Fuzzy Hash: 226aa63bfce789330e15763d8953fb7d553c3450d9c1aa6f260de1088bdface5
Instruction Fuzzy Hash: 265190377286908BD724CF25E404A9EB3A5F388758F445126EF9A93B49CB3DE945CF40

Function 00007FF7FEC1C838 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

@, xrefs: 00007FF7FEC1C874

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 49e7fa989fc271adaa8e130b28d1cae0d9f82f392019a5f874cdac11a507a941
Instruction ID: e9f5d3a0ca3e8295066c89391708fb24f5f32637f8ad27614811c122ab7d68dd
Opcode Fuzzy Hash: 49e7fa989fc271adaa8e130b28d1cae0d9f82f392019a5f874cdac11a507a941
Instruction Fuzzy Hash: 3F41DF72714B548AEB08DF2AD4552A9B3A1A788FD0B999037EF2D87794DE3CD442C340

Function 00007FF7FEC20D20 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF7FEC20D24

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 4ce929ddb23f73c0a8458b43b9ad49d4d7e2a2f746430c3d48bba7e89996d797
Instruction ID: 4bb13f4aaa8ec967fcb1a0a7af3f9de476d3f73f23015d2b10e19777c333b0e8
Opcode Fuzzy Hash: 4ce929ddb23f73c0a8458b43b9ad49d4d7e2a2f746430c3d48bba7e89996d797
Instruction Fuzzy Hash: 8FB09220E1BA02C2EB083B116C8225462A5BF88700FD48038E21C41360DE3C21A587A0

Function 00007FF7FEC03964 Relevance: .9, Instructions: 931COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f10b3c0000bd651423828cb986904098d4bd6c393877fd54d7a895255c38939a
Instruction ID: f70a105c643ed4c4a9ea075a9a563419044f02ff97d9c4386806537475410cfc
Opcode Fuzzy Hash: f10b3c0000bd651423828cb986904098d4bd6c393877fd54d7a895255c38939a
Instruction Fuzzy Hash: 5E8225B3A096C186D705DF68D4042BDBBA1F791B88F59813AEB6E873C6DA3CD445C360

Function 00007FF7FEBE76C0 Relevance: .9, Instructions: 893COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb6bb4a62616f0bcd3e2e2126cd32946fe2ad160a7c0dbd4e5bd03ed1428d6a6
Instruction ID: b537a4d98007c191cfc4aa045c88cd7990ccfe50af12699a38c7cb388474909b
Opcode Fuzzy Hash: fb6bb4a62616f0bcd3e2e2126cd32946fe2ad160a7c0dbd4e5bd03ed1428d6a6
Instruction Fuzzy Hash: 44627F9AD3AF9A1EE303A53954131D2E35C0EF74C9551E31BFCE431E66EB92A6832314

Function 00007FF7FEC053F0 Relevance: .9, Instructions: 891COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48af5ed364a5f24a1952bf7eddbdda76aa6abd9a5dc0519f651bf09102684f27
Instruction ID: 2f17200b610c235d6f652dc1b11e808b724109dcdc3e1238824ac197f1d8a2b5
Opcode Fuzzy Hash: 48af5ed364a5f24a1952bf7eddbdda76aa6abd9a5dc0519f651bf09102684f27
Instruction Fuzzy Hash: 4D8211B3A096C18BD724DF28D4046FCBB61F795B48F488136EBAD87785CA3C9845C760

Function 00007FF7FEBFBB90 Relevance: .6, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffdf8f5a64276e3eb417e3b9ae5b43350349d41efb04db03fca9f8ba9e24336f
Instruction ID: 5876c112e0917b26b3f17d77f32da7c298269998229a71951762043bfa7e1b79
Opcode Fuzzy Hash: ffdf8f5a64276e3eb417e3b9ae5b43350349d41efb04db03fca9f8ba9e24336f
Instruction Fuzzy Hash: 1022F4B3B246508BD728CF25C89AE5E3766F798744B4B8229DF0ACB785DB38D505CB40

Function 00007FF7FEC04B98 Relevance: .6, Instructions: 578COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21143e83615dcc23e36b64f0d60848ac948cba63854c17a605a1a3ec217f9251
Instruction ID: 515680522d1e3275f7723d253af51494429603f6e72c4156f5c2c61aa600967d
Opcode Fuzzy Hash: 21143e83615dcc23e36b64f0d60848ac948cba63854c17a605a1a3ec217f9251
Instruction Fuzzy Hash: 3532F472A082918BE72CDF24D550ABD77A1F794B08F458139EB6A87BC4DB3CE854C790

Function 00007FF7FEC01F20 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0228d8965efd66e5acd2ce596e8aa2d6118fa608a5d4ddadfc443f2646216464
Instruction ID: dc4ee8270193cbd798d6ecb586351ab1639440531ef264c794c3010fa0f9e394
Opcode Fuzzy Hash: 0228d8965efd66e5acd2ce596e8aa2d6118fa608a5d4ddadfc443f2646216464
Instruction Fuzzy Hash: BAE1E562A082828AEB74EF29A0442BEF791FB84748F854135EB6EC77C5DE3CE541C754

Function 00007FF7FEC03484 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c3f9089be966249862bf56ce032710d6eb03eb50aa34be6e58aa05575d530c2
Instruction ID: 7ab9eaa1487c4c5f60abff21ad16e691db249ab953a01061228ffc0c1e08d143
Opcode Fuzzy Hash: 8c3f9089be966249862bf56ce032710d6eb03eb50aa34be6e58aa05575d530c2
Instruction Fuzzy Hash: 54B1CFA2B04BC992DF59EA6AD6086E9A391B785FC4F848032EF2D47781DF3CE155C350

Function 00007FF7FEBE7288 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 063370d9e2e9571dc593e8358d008e0ec5385ad0435e9f2f5019d46da215c13b
Instruction ID: 56fbad733d3b269dd8118f40d4892333c9b1adad725245975e3d9eb83d3a6177
Opcode Fuzzy Hash: 063370d9e2e9571dc593e8358d008e0ec5385ad0435e9f2f5019d46da215c13b
Instruction Fuzzy Hash: D1C1AEB7B281908FE350CF7AD400A9D7BB1F39878CB515125EF59A3B09D639D645CB40

Function 00007FF7FEC02D58 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 602477e063b5c1ca901f2159ae3c7fc010244aaa433e93e1960e83d539d05e76
Instruction ID: 0719a1a65c3c2f854cf27f81a05c30b288d6fb748d4773e7c4bfa3ce63fd5388
Opcode Fuzzy Hash: 602477e063b5c1ca901f2159ae3c7fc010244aaa433e93e1960e83d539d05e76
Instruction Fuzzy Hash: 42A15A73A0818246EB19EA28D4047FDAB91EBD1748FD54535EB6D877C6CE3CE941C3A0

Function 00007FF7FEBFAF18 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f156a61251d3696a660eff3e2c5499dd818c979554cbf7ea7c30eccab92618
Instruction ID: 67c22010ef819ca285cc66535ff5733e978f558a25334a4d1e32fb81aa6c686b
Opcode Fuzzy Hash: e3f156a61251d3696a660eff3e2c5499dd818c979554cbf7ea7c30eccab92618
Instruction Fuzzy Hash: D9C10673A291E04DE302CBB5A4248FD3FB1E75D34DB864152EFA666B4AC5285201DB70

Function 00007FF7FEBEA310 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: ba0d91b71a6ba36ace61fab0c0f7d4922daa1e3f8d028e3e8b3457ff5b2a4fa0
Instruction ID: be6296d6a6d5cb3bf4dd3306462f075dc574310e4046c04be7111de35f2abdf9
Opcode Fuzzy Hash: ba0d91b71a6ba36ace61fab0c0f7d4922daa1e3f8d028e3e8b3457ff5b2a4fa0
Instruction Fuzzy Hash: 22912062B185C196EB11EF29D441AEDA721FF95788FC40031EF5E07799EE38E64AC390

Function 00007FF7FEBFB534 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd80b8924012b3a81ce264cde7180753b201b1e387c519ebd9873ce58afa85e
Instruction ID: fc60ea16df4b611194a0062270cdd6e6bc6d4d4daf916c17c7df15f9dd15948f
Opcode Fuzzy Hash: cfd80b8924012b3a81ce264cde7180753b201b1e387c519ebd9873ce58afa85e
Instruction Fuzzy Hash: 1A612423F085D159EB01DFB585508FDBFA1A789784BC58032DFBA57686CA3CE505CBA0

Function 00007FF7FEC021D0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8137a9b05b05aada6fbcd6bbdda66db02b1ef4637fe403d2df7c72722ebbdea5
Instruction ID: 9d4c3def957773b9f6e23511fb482562728d8280e6e4798d3f95ed5049cc44e8
Opcode Fuzzy Hash: 8137a9b05b05aada6fbcd6bbdda66db02b1ef4637fe403d2df7c72722ebbdea5
Instruction Fuzzy Hash: 62510173A181514BE7289F28A018BADBB51F7D0B58F854134EB5987BCACE3DE541CB90

Function 00007FF7FEBF4928 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID:
API String ID: 3340455307-0
Opcode ID: 68becbd5703a10b5a30c686f297672e1b1629d23221157c68dbf3feabe6115d7
Instruction ID: 041dc8156f56e8ac6ddcf9eb76756e4722495c7fdbbee51f76e44b720d75cbcb
Opcode Fuzzy Hash: 68becbd5703a10b5a30c686f297672e1b1629d23221157c68dbf3feabe6115d7
Instruction Fuzzy Hash: FB411732B156A646FB64EF61A900B6AA252FBC4784FC49030DE6D077D4DE3CE4428794

Function 00007FF7FEC02AB0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525267a7f117e2089c634eae81b531c40420bccc1aa688f1dd99d62513960580
Instruction ID: a14935169b0c0bde9d7426e845c1da527a91119b39053c578477a2c389d2695d
Opcode Fuzzy Hash: 525267a7f117e2089c634eae81b531c40420bccc1aa688f1dd99d62513960580
Instruction Fuzzy Hash: 4331D2B2A085914BD758EE5A965067EABD0B7C4344F848139EB6A83B82DE3CE045C760

Function 00007FF7FEBFDC70 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a4fac86f8f1a6b9d8c17b4c2881c5c96027003405599c7815143c772f625e0d
Instruction ID: 1849b9a961d84744e6f90a27b89171fa7ae30a70caf1891aaa2b0aa9baa4fac2
Opcode Fuzzy Hash: 6a4fac86f8f1a6b9d8c17b4c2881c5c96027003405599c7815143c772f625e0d
Instruction Fuzzy Hash: C6F01261F1C0C742FB6830AD5C19B39A0569BD1314FD44935D53FC62C5D9EDE88111EA

Function 00007FF7FEC13354 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e57e15d0ab639cfe726454a8769b7378f2b682ff734fe90589bfb13db1bf513a
Instruction ID: 1596f5bb2148c3a13ea589536f238d86ad248e7c90a6533246da522bda28541f
Opcode Fuzzy Hash: e57e15d0ab639cfe726454a8769b7378f2b682ff734fe90589bfb13db1bf513a
Instruction Fuzzy Hash: 1FA0026690CC42D0E744AB14EC64074E330FBD0B14BD14031F02D412E4DF3CA402C3A4

Function 00007FF7FEBED7D0 Relevance: 26.3, APIs: 1, Strings: 14, Instructions: 98COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBED964

Strings

::$EA, xrefs: 00007FF7FEBED81D
::$FILE_NAME, xrefs: 00007FF7FEBED833
::$REPARSE_POINT, xrefs: 00007FF7FEBED88B
::$DATA, xrefs: 00007FF7FEBED812
:$I30:$INDEX_ALLOCATION, xrefs: 00007FF7FEBED849
:$TXF_DATA:$LOGGED_UTILITY_STREAM, xrefs: 00007FF7FEBED875
::$INDEX_ROOT, xrefs: 00007FF7FEBED854
::$ATTRIBUTE_LIST, xrefs: 00007FF7FEBED7FC
:$EFS:$LOGGED_UTILITY_STREAM, xrefs: 00007FF7FEBED86A
::$BITMAP, xrefs: 00007FF7FEBED807
::$OBJECT_ID, xrefs: 00007FF7FEBED880
::$INDEX_ALLOCATION, xrefs: 00007FF7FEBED83E
::$EA_INFORMATION, xrefs: 00007FF7FEBED828
::$LOGGED_UTILITY_STREAM, xrefs: 00007FF7FEBED85F

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: :$EFS:$LOGGED_UTILITY_STREAM$:$I30:$INDEX_ALLOCATION$:$TXF_DATA:$LOGGED_UTILITY_STREAM$::$ATTRIBUTE_LIST$::$BITMAP$::$DATA$::$EA$::$EA_INFORMATION$::$FILE_NAME$::$INDEX_ALLOCATION$::$INDEX_ROOT$::$LOGGED_UTILITY_STREAM$::$OBJECT_ID$::$REPARSE_POINT
API String ID: 3668304517-727060406
Opcode ID: 2f19ab4c30c8eac6d144c901c4549240b956f6a692c877d1095a563e450749ff
Instruction ID: 80b0570351e5ae5322dc5d44184acbc7eb3486d55c67d1a3e807ff6f75f5ff16
Opcode Fuzzy Hash: 2f19ab4c30c8eac6d144c901c4549240b956f6a692c877d1095a563e450749ff
Instruction Fuzzy Hash: B541E936B05F0199EB00AF65E8403ED73A9EB88798F800136EA6C03799EF78D555C394

Function 00007FF7FEC12A10 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF7FEC12A26
GetModuleHandleW.KERNEL32 ref: 00007FF7FEC12A33
GetModuleHandleW.KERNEL32 ref: 00007FF7FEC12A48
GetProcAddress.KERNEL32 ref: 00007FF7FEC12A60
GetProcAddress.KERNEL32 ref: 00007FF7FEC12A73
CreateEventW.KERNEL32 ref: 00007FF7FEC12A9F
DeleteCriticalSection.KERNEL32 ref: 00007FF7FEC12AEB
CloseHandle.KERNEL32 ref: 00007FF7FEC12AFD

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 00007FF7FEC12A2C
SleepConditionVariableCS, xrefs: 00007FF7FEC12A56
kernel32.dll, xrefs: 00007FF7FEC12A41
WakeAllConditionVariable, xrefs: 00007FF7FEC12A66

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 6e1e709f092c3aabc6fb1c9db3d7c09c3ef1a4a7bf2af41e7ac9402dec2f511f
Instruction ID: 013bf9f06ce11157f5c691eb9bd46355bde7d1efd28e0d7310aab74ecd23f5da
Opcode Fuzzy Hash: 6e1e709f092c3aabc6fb1c9db3d7c09c3ef1a4a7bf2af41e7ac9402dec2f511f
Instruction Fuzzy Hash: 7921196AE1DB4385FB58BB50EC54178A3A1AFC8790FC44034F96E027E0DE3CA455E3A0

Function 00007FF7FEC0F0A4 Relevance: 16.6, APIs: 11, Instructions: 102COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FEC0AE1C: PeekMessageW.USER32 ref: 00007FF7FEC0AE32
Part of subcall function 00007FF7FEC0AE1C: GetMessageW.USER32 ref: 00007FF7FEC0AE49
Part of subcall function 00007FF7FEC0AE1C: IsDialogMessageW.USER32 ref: 00007FF7FEC0AE60
Part of subcall function 00007FF7FEC0AE1C: TranslateMessage.USER32 ref: 00007FF7FEC0AE6F
Part of subcall function 00007FF7FEC0AE1C: DispatchMessageW.USER32 ref: 00007FF7FEC0AE7A

GetDlgItem.USER32 ref: 00007FF7FEC0F0E3
ShowWindow.USER32 ref: 00007FF7FEC0F109
IsDlgButtonChecked.USER32 ref: 00007FF7FEC0F11E
IsDlgButtonChecked.USER32 ref: 00007FF7FEC0F136
IsDlgButtonChecked.USER32 ref: 00007FF7FEC0F157
IsDlgButtonChecked.USER32 ref: 00007FF7FEC0F173
IsDlgButtonChecked.USER32 ref: 00007FF7FEC0F1B6
IsDlgButtonChecked.USER32 ref: 00007FF7FEC0F1D4
IsDlgButtonChecked.USER32 ref: 00007FF7FEC0F1E8
IsDlgButtonChecked.USER32 ref: 00007FF7FEC0F212
IsDlgButtonChecked.USER32 ref: 00007FF7FEC0F22A

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: ButtonChecked$Message$DialogDispatchItemPeekShowTranslateWindow
String ID:
API String ID: 4119318379-0
Opcode ID: 6d17268858d6b6aed380ad60cc2cf8b16547cb3a0c40a3112c59011326a33119
Instruction ID: 8a698ebad39a3efe8795ee949dd26e0a914b707cbf333d0d0f66705182dd9e72
Opcode Fuzzy Hash: 6d17268858d6b6aed380ad60cc2cf8b16547cb3a0c40a3112c59011326a33119
Instruction Fuzzy Hash: 0641B431B186428AF710EF61EC10BA9A361EBC5B98F841135ED2A0BBD5CE7DD445C7A4

Function 00007FF7FEBF6A0C Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 444COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF70A6

Part of subcall function 00007FF7FEBE2004: std::_Xinvalid_argument.LIBCPMT ref: 00007FF7FEBE200F

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF70B2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF70B8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF70C4
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF70D6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF70DC

Strings

\\?\, xrefs: 00007FF7FEBF6A57, 00007FF7FEBF6A66
DXGIDebug.dll, xrefs: 00007FF7FEBF6A18
UNC, xrefs: 00007FF7FEBF6BBF

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Xinvalid_argumentstd::_
String ID: DXGIDebug.dll$UNC$\\?\
API String ID: 4097890229-4048004291
Opcode ID: bb0a924f0c5a4caa22d27de4294407f5187326082299eb41cc76b54580724487
Instruction ID: 28dd482899ae14bf0148fd9e21368f0adc1d014ca5ce5243bf91cf1bbcdc9686
Opcode Fuzzy Hash: bb0a924f0c5a4caa22d27de4294407f5187326082299eb41cc76b54580724487
Instruction Fuzzy Hash: F212BE22B19A8280EB10EBA5E4545ADA375EBC1B98FD04132DE7D07AE9DF3CD549C3D0

Function 00007FF7FEC0F4E0 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 285COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF7FEC0F786
GetExitCodeProcess.KERNEL32 ref: 00007FF7FEC0F7BD
CloseHandle.KERNEL32 ref: 00007FF7FEC0F7E7
ShowWindow.USER32 ref: 00007FF7FEC0F83F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0F8FB

Strings

.exe, xrefs: 00007FF7FEC0F7F2
.inf, xrefs: 00007FF7FEC0F675
p, xrefs: 00007FF7FEC0F529
Install, xrefs: 00007FF7FEC0F684

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: ShowWindow$CloseCodeExitHandleProcess_invalid_parameter_noinfo_noreturn
String ID: .exe$.inf$Install$p
API String ID: 2891444047-3607691742
Opcode ID: 169854d1da345eb311f85763710173a518587d7cc33cadbf2b322f6e3284e820
Instruction ID: a675c3ceab137ad99ff93f052053e9b985e079b1375558044dda227eba6231ef
Opcode Fuzzy Hash: 169854d1da345eb311f85763710173a518587d7cc33cadbf2b322f6e3284e820
Instruction Fuzzy Hash: AFC18F62F1D64285FB00EB25D9402BDA3A1AFC9B84F844131EB6D876E5DF3CE495C3A0

Function 00007FF7FEC1E650 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FEC1E7CD

Strings

inf, xrefs: 00007FF7FEC1E6D6
nan(ind), xrefs: 00007FF7FEC1E706
nan(snan), xrefs: 00007FF7FEC1E6F0
NAN(IND), xrefs: 00007FF7FEC1E6FB
NAN(SNAN), xrefs: 00007FF7FEC1E6E5
nan, xrefs: 00007FF7FEC1E6B8
NAN, xrefs: 00007FF7FEC1E6B1
INF, xrefs: 00007FF7FEC1E6C3

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: ca8329083cbd7a022b2adefca7a3bb58d0ae1dff90efa4c28dbe4d3f14657870
Instruction ID: e1706da7d7fa09bb26ab41d5fd27ff27082b1539d3a912e9ee042bb76f0f2561
Opcode Fuzzy Hash: ca8329083cbd7a022b2adefca7a3bb58d0ae1dff90efa4c28dbe4d3f14657870
Instruction Fuzzy Hash: 0741C072A0AB4589F704EF25E8417ED73A4EB943A4F844536EE6C47B94DE3CD025C394

Function 00007FF7FEC0A440 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 257COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FEBE129C: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7FEBE1396

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0A72F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0A735
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0A73B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0A741
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0A747

Strings

GETPASSWORD1, xrefs: 00007FF7FEC0A773
Software\WinRAR SFX, xrefs: 00007FF7FEC0A52B, 00007FF7FEC0A53A

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID: GETPASSWORD1$Software\WinRAR SFX
API String ID: 3936042273-1315819833
Opcode ID: cbdb2342dbc27246140afa92192789482b4dc38f3de2603255fba98438e470aa
Instruction ID: 5bc85ddcdfe9609182bdda440b167b72ff645e07cac144355b69940f89c5a8f2
Opcode Fuzzy Hash: cbdb2342dbc27246140afa92192789482b4dc38f3de2603255fba98438e470aa
Instruction Fuzzy Hash: 92B1B263F1974285FB00EB65D4442BCA372ABC57A4F804235EB6C67ADAEE3CE445C390

Function 00007FF7FEBFB9B4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7FEBFBA12
GetProcAddress.KERNEL32 ref: 00007FF7FEBFBA2D
GetCurrentProcessId.KERNEL32 ref: 00007FF7FEBFBACA

Part of subcall function 00007FF7FEBFDFD0: GetSystemDirectoryW.KERNEL32 ref: 00007FF7FEBFDDDF

Strings

Crypt32.dll, xrefs: 00007FF7FEBFB9F0
CryptUnprotectMemory, xrefs: 00007FF7FEBFBA1F
CryptProtectMemory failed, xrefs: 00007FF7FEBFBA80
CryptProtectMemory, xrefs: 00007FF7FEBFBA08
CryptUnprotectMemory failed, xrefs: 00007FF7FEBFBAC1

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: AddressProc$CurrentDirectoryProcessSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 2915667086-2207617598
Opcode ID: d2e93635ec338890dfe438c4789fcaf7e26687fbfe6c7ce53d5981307f2d6baa
Instruction ID: ced828571d7bf27749e942e396811c63df0e67a6ee037bda1d4578a9179cf00c
Opcode Fuzzy Hash: d2e93635ec338890dfe438c4789fcaf7e26687fbfe6c7ce53d5981307f2d6baa
Instruction Fuzzy Hash: 11314924A0EB8280FB14AF56E898975A7A1AFC4B90FC45135E97E037E4DE3CE541C3E0

Function 00007FF7FEC087D8 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 415COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC08DB6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC08DC2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC08DCE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC08DDA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC08DE0

Strings

, xrefs: 00007FF7FEC088BE
, xrefs: 00007FF7FEC08A55

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: $
API String ID: 3668304517-227171996
Opcode ID: 56fe83ab7fc023708ab0dc9b9006e7019537d41578a3ace6a3dce8fe456965a2
Instruction ID: d558784a2890e74ac9114ecd7e6cea37663af0de7e2bfb06da3a36706eead382
Opcode Fuzzy Hash: 56fe83ab7fc023708ab0dc9b9006e7019537d41578a3ace6a3dce8fe456965a2
Instruction Fuzzy Hash: 7EF1AD63F15B4680EF04AB65D4441BCA361AB94BA8FD09231EB7D57BD5DE7CE180C3A0

Function 00007FF7FEC0AE90 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

LICENSEDLG, xrefs: 00007FF7FEC0AEAE

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: Item$ParentText
String ID: LICENSEDLG
API String ID: 1247523477-2177901306
Opcode ID: c9866e54caf27f8de0546440d051b205f4abbef2781f57b8390c33b5ac276555
Instruction ID: c721f0205efba7bfab090411852370e000596bc2ab6f48e7a76221032539d4a3
Opcode Fuzzy Hash: c9866e54caf27f8de0546440d051b205f4abbef2781f57b8390c33b5ac276555
Instruction Fuzzy Hash: C6419272A0C65286FB14BB11A8147B9A361AFC4F85F844134FA2E47BD5CF3CE545C3A0

Function 00007FF7FEC0F390 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

GetWindow.USER32 ref: 00007FF7FEC0F3CF
GetClassNameW.USER32 ref: 00007FF7FEC0F3FC
IsDlgButtonChecked.USER32 ref: 00007FF7FEC0F437
GetObjectW.GDI32 ref: 00007FF7FEC0F452
IsDlgButtonChecked.USER32 ref: 00007FF7FEC0F487
GetWindow.USER32 ref: 00007FF7FEC0F49E

Strings

STATIC, xrefs: 00007FF7FEC0F402

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: ButtonCheckedWindow$ClassNameObject
String ID: STATIC
API String ID: 1224570422-1882779555
Opcode ID: 028936735c5caa7e1c5955390d3996a5d13f8d6e72d7f98742e6e6c768b0ab82
Instruction ID: ae4e0b1c9ef42d703736b44cf5e6682e03eb1aa2cd41789ed99aa806c883d76d
Opcode Fuzzy Hash: 028936735c5caa7e1c5955390d3996a5d13f8d6e72d7f98742e6e6c768b0ab82
Instruction Fuzzy Hash: B931A425B0C64246FB60BB51A9547B9A392BFC8B90F814030FE6D47BD5DE3CD445C7A0

Function 00007FF7FEBEEF10 Relevance: 11.0, APIs: 7, Instructions: 453COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBEF542
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBEF548
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBEF554
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBEF55A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBEF560
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBEF56C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBEF572

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 32efafbb7390ebf5100f4cf43a7682da9a470af0ab71aec0b6d9d1dbc8d7c03a
Instruction ID: e0bcd8297d109db0e0783809942639d4a019141b11eadf23c0218da5363aaa36
Opcode Fuzzy Hash: 32efafbb7390ebf5100f4cf43a7682da9a470af0ab71aec0b6d9d1dbc8d7c03a
Instruction Fuzzy Hash: AA12C262F18B4284EB10EB65D4446ADB371EBC57A8FD00232EA6C17AE9DF3CD585C391

Function 00007FF7FEC157EC Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF7FEC1598A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7FEC15CAD
abort.LIBCMT ref: 00007FF7FEC15CE1

Strings

csm, xrefs: 00007FF7FEC159B1
csm, xrefs: 00007FF7FEC15933
csm, xrefs: 00007FF7FEC158D1

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: Is_bad_exception_allowedabortstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 2940173790-393685449
Opcode ID: 65edb01f61f21fff02eaccc9a46b43a233fa456fccf40e480b66f774ee54b1a7
Instruction ID: e802aafc79ad4aeb607e658083aa4bae2b8e7556568bd149879644ba718969e8
Opcode Fuzzy Hash: 65edb01f61f21fff02eaccc9a46b43a233fa456fccf40e480b66f774ee54b1a7
Instruction Fuzzy Hash: 75E1A373A087828AE710AF64D4803ADB7A0FB85768F944135EAAD477E5CF3CE485C791

Function 00007FF7FEBF4F38 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 158COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FEBF4E24: SysAllocString.OLEAUT32 ref: 00007FF7FEBF4E5F

VariantClear.OLEAUT32 ref: 00007FF7FEBF5125

Strings

SELECT * FROM Win32_OperatingSystem, xrefs: 00007FF7FEBF5017
WQL, xrefs: 00007FF7FEBF502A
Windows 10, xrefs: 00007FF7FEBF510A
ROOT\CIMV2, xrefs: 00007FF7FEBF4F7B
Name, xrefs: 00007FF7FEBF50F9

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: AllocClearStringVariant
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 1959693985-3505469590
Opcode ID: a8b35b7bcd37d82ee4aaa20c3b876beaab518b1de9e1ce59ea14af8b32f1fe8d
Instruction ID: 505080988bb5fc34b5e7eabac3ddafa5b043d9625a7757fcbf2eebee10f5a54a
Opcode Fuzzy Hash: a8b35b7bcd37d82ee4aaa20c3b876beaab518b1de9e1ce59ea14af8b32f1fe8d
Instruction Fuzzy Hash: 97715D36A19B4585EB10EF65E8805ADB7B4FBC8B98B801132EE6D43BA4CF3CD544C390

Function 00007FF7FEC172EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00007FF7FEC174F3,?,?,?,00007FF7FEC1525E,?,?,?,00007FF7FEC15219), ref: 00007FF7FEC17371
GetLastError.KERNEL32(?,?,00000000,00007FF7FEC174F3,?,?,?,00007FF7FEC1525E,?,?,?,00007FF7FEC15219), ref: 00007FF7FEC1737F
LoadLibraryExW.KERNEL32(?,?,00000000,00007FF7FEC174F3,?,?,?,00007FF7FEC1525E,?,?,?,00007FF7FEC15219), ref: 00007FF7FEC173A9
FreeLibrary.KERNEL32(?,?,00000000,00007FF7FEC174F3,?,?,?,00007FF7FEC1525E,?,?,?,00007FF7FEC15219), ref: 00007FF7FEC173EF
GetProcAddress.KERNEL32(?,?,00000000,00007FF7FEC174F3,?,?,?,00007FF7FEC1525E,?,?,?,00007FF7FEC15219), ref: 00007FF7FEC173FB

Strings

api-ms-, xrefs: 00007FF7FEC17391

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: eedfc97f7024c66fbeb39a7219499b253e22696fd1fdab2c5f769bf1fd383016
Instruction ID: b9edfc784ed9de627c98f216f69272ab3b14c850e274b27a58fc7438b1fdcbf1
Opcode Fuzzy Hash: eedfc97f7024c66fbeb39a7219499b253e22696fd1fdab2c5f769bf1fd383016
Instruction Fuzzy Hash: EF31A122A1B64281EF11BB06A800579A295FF8ABB0FD94935ED3D4B3C1DF3CE050C7A0

Function 00007FF7FEC11604 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,00007FF7FEC11573,?,?,?,00007FF7FEC1192A), ref: 00007FF7FEC1162B
GetProcAddress.KERNEL32(?,?,?,00007FF7FEC11573,?,?,?,00007FF7FEC1192A), ref: 00007FF7FEC11648
GetProcAddress.KERNEL32(?,?,?,00007FF7FEC11573,?,?,?,00007FF7FEC1192A), ref: 00007FF7FEC11664

Strings

KERNEL32.DLL, xrefs: 00007FF7FEC11624
ReleaseSRWLockExclusive, xrefs: 00007FF7FEC11653
AcquireSRWLockExclusive, xrefs: 00007FF7FEC1163E

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 4fe35f58cd4175722fa2f4edd42b7d77b08fa8d78ae8e9bf73ccac7c2071e7f8
Instruction ID: f876e4240e6483113f8c1709a9d6f480eb33983fc1b086180497af451caf607e
Opcode Fuzzy Hash: 4fe35f58cd4175722fa2f4edd42b7d77b08fa8d78ae8e9bf73ccac7c2071e7f8
Instruction Fuzzy Hash: 0A11FA21A1DB4685FF65AB00A94027C92A5AF88BE4FC85436F93D0A3D1EE3DA444D6A0

Function 00007FF7FEBFED24 Relevance: 9.1, APIs: 6, Instructions: 120timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FEBF51A4: GetVersionExW.KERNEL32 ref: 00007FF7FEBF51D5

FileTimeToLocalFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF7FEBE5AB4), ref: 00007FF7FEBFED8C
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF7FEBE5AB4), ref: 00007FF7FEBFED98
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF7FEBE5AB4), ref: 00007FF7FEBFEDA8
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF7FEBE5AB4), ref: 00007FF7FEBFEDB6
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF7FEBE5AB4), ref: 00007FF7FEBFEDC4
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001,00007FF7FEBE5AB4), ref: 00007FF7FEBFEE05

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 197518eb8103cda2bd6b54f1f5e99fa721289ee203340eaf45d2c62117a67569
Instruction ID: 8b8ae27a9762d8c1c1f603d4dbb517c22b4ebe65fe539d2c6a9aa834a07d57b2
Opcode Fuzzy Hash: 197518eb8103cda2bd6b54f1f5e99fa721289ee203340eaf45d2c62117a67569
Instruction Fuzzy Hash: 065190B2B106518BEB04DFB8E8404AC77B1F788798BA04036EE2D67B98DF38D555C750

Function 00007FF7FEBFF010 Relevance: 9.1, APIs: 6, Instructions: 80timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32 ref: 00007FF7FEBFF074

Part of subcall function 00007FF7FEBF51A4: GetVersionExW.KERNEL32 ref: 00007FF7FEBF51D5

LocalFileTimeToFileTime.KERNEL32 ref: 00007FF7FEBFF096
FileTimeToSystemTime.KERNEL32 ref: 00007FF7FEBFF0A2
TzSpecificLocalTimeToSystemTime.KERNEL32 ref: 00007FF7FEBFF0B2
SystemTimeToFileTime.KERNEL32 ref: 00007FF7FEBFF0C0
SystemTimeToFileTime.KERNEL32 ref: 00007FF7FEBFF0CE

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 93bf5fe4be91675a5f4cba4a2df0f2c5ed0bd126a165fd4d88c3e7d5e64543a6
Instruction ID: 5487f6433f04380a1b9f48a2bdafd25433ac990143c9e2c9fc557688fcd25a9a
Opcode Fuzzy Hash: 93bf5fe4be91675a5f4cba4a2df0f2c5ed0bd126a165fd4d88c3e7d5e64543a6
Instruction Fuzzy Hash: 2D314963B10A518DEB00DFB5D8801AC7370FB48758B94503AEE2DA3A98EF38D995C350

Function 00007FF7FEBF7918 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 233COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF7C8C

Strings

.rar, xrefs: 00007FF7FEBF7969, 00007FF7FEBF7978
sfx, xrefs: 00007FF7FEBF79F3, 00007FF7FEBF7A02
rar, xrefs: 00007FF7FEBF7A9B, 00007FF7FEBF7AAA, 00007FF7FEBF7B67, 00007FF7FEBF7B7C
exe, xrefs: 00007FF7FEBF79AF, 00007FF7FEBF79BE

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: .rar$exe$rar$sfx
API String ID: 3668304517-630704357
Opcode ID: d24effea9e783ff427ac553708fed51da51d2c01aea1787dc637bfdbc21b400f
Instruction ID: e25307924a60e64c182ef896bb289745d7cc2a7ad09db7a9f8a0397abf6997f5
Opcode Fuzzy Hash: d24effea9e783ff427ac553708fed51da51d2c01aea1787dc637bfdbc21b400f
Instruction Fuzzy Hash: 95A1F326A25A9640EB00AF65D8546BCA361BFC5BA8FD01231DD3D076EACF3CE541C3E0

Function 00007FF7FEC15CE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF7FEC15D58

Part of subcall function 00007FF7FEC15210: abort.LIBCMT ref: 00007FF7FEC15223

_CallSETranslator.LIBVCRUNTIME ref: 00007FF7FEC15DA3
abort.LIBCMT ref: 00007FF7FEC15FD1

Strings

RCC, xrefs: 00007FF7FEC15D74
MOC, xrefs: 00007FF7FEC15D6C

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 0f4c2d06ef2d655583c55900dbb020dcf620b12558a4295111afe460be181df6
Instruction ID: 3e1dbd196e233605fe539a3d80f772f86cbd53321210b67e28f5f6abc33b4aa7
Opcode Fuzzy Hash: 0f4c2d06ef2d655583c55900dbb020dcf620b12558a4295111afe460be181df6
Instruction Fuzzy Hash: EC91B173A08B818AE710EB64E4802ADBBA0FB85798F504139FE9D177A5DF3CD195C740

Function 00007FF7FEC14F80 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7FEC14FAB
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF7FEC15040
RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FF7FEC12F5E), ref: 00007FF7FEC1508F

Strings

f, xrefs: 00007FF7FEC14FBE
csm, xrefs: 00007FF7FEC15026

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: a7c39da158025e753bf36dfb1e051fd0b17def11f5f8def40396cbfe1c046983
Instruction ID: a7c2a492056dbd96504d5830aa11bf8c398c029ee3b1df066f9db803ceeedfca
Opcode Fuzzy Hash: a7c39da158025e753bf36dfb1e051fd0b17def11f5f8def40396cbfe1c046983
Instruction Fuzzy Hash: 74519332B1960286DB15EB15E444A2DA756FB85BA4FA08034FE3E477D8DF7CE841C790

Function 00007FF7FEBECEE0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7FEBED03D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBED0D1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBED0D7

Part of subcall function 00007FF7FEBEDE04: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7FEBECF4B), ref: 00007FF7FEBEDE27
Part of subcall function 00007FF7FEBEDE04: GetLastError.KERNEL32 ref: 00007FF7FEBEDE88
Part of subcall function 00007FF7FEBEDE04: CloseHandle.KERNEL32 ref: 00007FF7FEBEDE9B

Strings

SeRestorePrivilege, xrefs: 00007FF7FEBECF5E
SeSecurityPrivilege, xrefs: 00007FF7FEBECF3F

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: ErrorLast_invalid_parameter_noinfo_noreturn$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 2102711378-639343689
Opcode ID: 4ad8962ae40659baaf1511d456c0931157e13c4a94880edc0a22eb1ae19da66a
Instruction ID: b26cf53ceb763b0cf5e0dcef18cd2e9f96dffe5c2de4cb3e77314dfad5b04f02
Opcode Fuzzy Hash: 4ad8962ae40659baaf1511d456c0931157e13c4a94880edc0a22eb1ae19da66a
Instruction Fuzzy Hash: 6651CC62E0864285FB11FB749851ABDB361AFD47A4FC40130EE3D176D6DE3CA885C3A2

Function 00007FF7FEC0FD0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32 ref: 00007FF7FEC0FD43
SetEnvironmentVariableW.KERNEL32 ref: 00007FF7FEC0FDBC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0FE1B

Strings

sfxpar, xrefs: 00007FF7FEC0FDB5
sfxcmd, xrefs: 00007FF7FEC0FD3C

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: EnvironmentVariable$_invalid_parameter_noinfo_noreturn
String ID: sfxcmd$sfxpar
API String ID: 3540648995-3493335439
Opcode ID: f7f09a535254ba7702706040489ea7439e58d63b661cc729fc85acc9afefde13
Instruction ID: 7610c3c5c67796f1c8efd182d3e3ef1a10652c90e331d58174151ced5a5fc105
Opcode Fuzzy Hash: f7f09a535254ba7702706040489ea7439e58d63b661cc729fc85acc9afefde13
Instruction Fuzzy Hash: B6315232A18B5684EB04AF65E8841ACB371FBC4B98F940531EF6D577E9DE38D085C3A4

Function 00007FF7FEC0FED4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 00007FF7FEC0FF60
REPLACEFILEDLG, xrefs: 00007FF7FEC0FF34, 00007FF7FEC0FF99

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 98f895654b64cd1d2f90e97d30244ed9b67d31cc2014a88c355cd353264df31a
Instruction ID: aefd0e7a3abc3c89f768d944880f7b9efda0a0bff08372bebecee8b214978b10
Opcode Fuzzy Hash: 98f895654b64cd1d2f90e97d30244ed9b67d31cc2014a88c355cd353264df31a
Instruction Fuzzy Hash: 9E21EB2191DB8780FB10EB15B8441B4A3A2EFC9B84F940436FA6D873E4DE3CE195C7A0

Function 00007FF7FEC1BFB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF7FEC1BFD0
GetProcAddress.KERNEL32 ref: 00007FF7FEC1BFE6
FreeLibrary.KERNEL32 ref: 00007FF7FEC1C00B

Strings

CorExitProcess, xrefs: 00007FF7FEC1BFDF
mscoree.dll, xrefs: 00007FF7FEC1BFC7

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 42a4ca90c7c49dddb16080121233970ff8583544d2054868cb5f0899d871e2db
Instruction ID: 9eb0aaeeea2bf0095cc936c5487e5734fd34edf65463e3275122adca588cd63f
Opcode Fuzzy Hash: 42a4ca90c7c49dddb16080121233970ff8583544d2054868cb5f0899d871e2db
Instruction Fuzzy Hash: 2AF06222A19A4281EF48AB51F85077DA360EFC87D0F941039FA6F466E4DE3CE484C7A1

Function 00007FF7FEC245C0 Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FEC24605

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: cf462e6f26ae3af6f96c078c51b53c82231ed120809331cf2f591469c69a5a17
Instruction ID: 23ff9ee297c49f6c996a1c3e0b8a1f6f7370ef4b048430ddbab36acc664f2c59
Opcode Fuzzy Hash: cf462e6f26ae3af6f96c078c51b53c82231ed120809331cf2f591469c69a5a17
Instruction Fuzzy Hash: 3681D362F2865286FB10BB6598406BDA6A1BBC5B98F804135FE2E537D5CF3CA441C7A0

Function 00007FF7FEBF3AF8 Relevance: 7.7, APIs: 5, Instructions: 164filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF7FEBF3BBB
CreateFileW.KERNEL32 ref: 00007FF7FEBF3C24
SetFileTime.KERNEL32 ref: 00007FF7FEBF3CEC
CloseHandle.KERNEL32 ref: 00007FF7FEBF3CF6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF3D2C

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: File$Create$CloseHandleTime_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2398171386-0
Opcode ID: 42f25852ea0a3013a87b1866b8aa603ec7d7e54c19cf150e3c062246af700ff7
Instruction ID: 85e68e70c643394fd04ce5e66dc12f2c61fb8f50ff562998ed522b38f0da56ee
Opcode Fuzzy Hash: 42f25852ea0a3013a87b1866b8aa603ec7d7e54c19cf150e3c062246af700ff7
Instruction Fuzzy Hash: 2F51E522B04B8259FB50EBB5E8506BDA371ABC87A8FC04635DE3D4A7D9DE3C9445C390

Function 00007FF7FEC23F34 Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FF7FEC24767), ref: 00007FF7FEC23F91
WideCharToMultiByte.KERNEL32 ref: 00007FF7FEC2406D
WriteFile.KERNEL32 ref: 00007FF7FEC24093
WriteFile.KERNEL32 ref: 00007FF7FEC240D2
GetLastError.KERNEL32 ref: 00007FF7FEC2410A

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 8f90b3f8899b92826fb288bc35eb601c263b89b4fb676f823db5d062d6f6b41f
Instruction ID: 6f0f5c9e49d5ae08f6301924281381473808cb9c0f892afa6f6c0578fbedf0ef
Opcode Fuzzy Hash: 8f90b3f8899b92826fb288bc35eb601c263b89b4fb676f823db5d062d6f6b41f
Instruction Fuzzy Hash: 0D51B032A14A518AE710DB65E8403ACBBB1FB84798F848135EF6E5BBD8DF38D145C760

Function 00007FF7FEC11E00 Relevance: 7.6, APIs: 5, Instructions: 137memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF7FEBF4DF4), ref: 00007FF7FEC11E87
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF7FEBF4DF4), ref: 00007FF7FEC11F09
SysAllocString.OLEAUT32 ref: 00007FF7FEC11F16

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: 78e2e37474c2608188e0610e2bf8cd52de6089622287df06285a14f25de4e8db
Instruction ID: da6c315a323a671ae9da7e832a60ea712277812927e676faea99df02fddecb90
Opcode Fuzzy Hash: 78e2e37474c2608188e0610e2bf8cd52de6089622287df06285a14f25de4e8db
Instruction Fuzzy Hash: EA41D532A0968689EB14AF6198443BCA291EF84FB4F944636FA7D477D5DF3CD142C3A0

Function 00007FF7FEC1F414 Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF7FEC1F536

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: d8da239e760e4119be076ce5ae60c5d71a4e7276355522d8061e2664917ecd9d
Instruction ID: 057f781954d8d4276ded4b37478c7c8513d87cffd0b24f40fa734a0f188e04cd
Opcode Fuzzy Hash: d8da239e760e4119be076ce5ae60c5d71a4e7276355522d8061e2664917ecd9d
Instruction Fuzzy Hash: 7741B662B09A8285FB15AF56A810679A395BF94BF0F894535FD3D4B7C4EE3CE440C3A0

Function 00007FF7FEC256D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF7FEC256FF
_set_statfp.LIBCMT ref: 00007FF7FEC2571A
_set_statfp.LIBCMT ref: 00007FF7FEC25736
_set_statfp.LIBCMT ref: 00007FF7FEC25772

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction ID: c5972af55e6e299254974d442958f17955293704049cea4414a77cd25ac838b6
Opcode Fuzzy Hash: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction Fuzzy Hash: 1C119436EACB0785FB543924E54137B91417FD5BA0FC84234FA7D065E6DE6CA440C1A7

Function 00007FF7FEC0FE24 Relevance: 7.5, APIs: 5, Instructions: 29windowsynchronizationCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 00007FF7FEC0FE41
GetMessageW.USER32 ref: 00007FF7FEC0FE58
TranslateMessage.USER32 ref: 00007FF7FEC0FE63
DispatchMessageW.USER32 ref: 00007FF7FEC0FE6E
WaitForSingleObject.KERNEL32 ref: 00007FF7FEC0FE7C

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: Message$DispatchObjectPeekSingleTranslateWait
String ID:
API String ID: 3621893840-0
Opcode ID: eb57a341668d454e4e6cd52f39bb1811463ddcab187ea95c48cb89abc8d18535
Instruction ID: 9106993514c5b239639e62482c16b8dd30892d314c9afe08b1c532538471bcad
Opcode Fuzzy Hash: eb57a341668d454e4e6cd52f39bb1811463ddcab187ea95c48cb89abc8d18535
Instruction Fuzzy Hash: 89F06262B3C58682FB50A720E854F36A222FFE4B05FC41030FA6E859D5DE2CD149C760

Function 00007FF7FEC1625C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7FEC16286
abort.LIBCMT ref: 00007FF7FEC164EA

Strings

csm, xrefs: 00007FF7FEC162AB
csm, xrefs: 00007FF7FEC1641A

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: __except_validate_context_recordabort
String ID: csm$csm
API String ID: 746414643-3733052814
Opcode ID: 91fc108a1c492767e4bb41002f60c2920875b1ec76e01922ab372504797a4c8e
Instruction ID: d7aee4e1289983071a5bf9a4ca0a13812c2a154673f1d0b886090454a60a4198
Opcode Fuzzy Hash: 91fc108a1c492767e4bb41002f60c2920875b1ec76e01922ab372504797a4c8e
Instruction Fuzzy Hash: B971C0726086918AD760AF25D05077DFBA0FB85BA8F848135EEAC47BC9CB3CD491C791

Function 00007FF7FEC180F4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FEC1811B
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FEC182ED

Strings

, xrefs: 00007FF7FEC18276
*, xrefs: 00007FF7FEC18221

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 42643a1ee39b50d27a50b926b179a62c0cdc4d381fe14b17104e750277292b9f
Instruction ID: 7b0f3c1768620b5ee64344683a0f14f1b7240214182a8f208bbc77a552b8cd6e
Opcode Fuzzy Hash: 42643a1ee39b50d27a50b926b179a62c0cdc4d381fe14b17104e750277292b9f
Instruction Fuzzy Hash: 13519A7390C6428AF766AF38844437C7BA1FB86B28F941135F66A412D9CF3CD481C7A6

Function 00007FF7FEC21758 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7FEC217CB
MultiByteToWideChar.KERNEL32 ref: 00007FF7FEC21894
GetStringTypeW.KERNEL32 ref: 00007FF7FEC218AE

Strings

$%s, xrefs: 00007FF7FEC2175A

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: ByteCharMultiWide$StringType
String ID: $%s
API String ID: 3586891840-3791308623
Opcode ID: 8174e861c2faa6f2f7f5292a0ee7474812abc1109b8acb2517e9a7bc716d8d39
Instruction ID: f964250578a507bc2c96a00bb718244bc6596d5c0cb0c5b25ff01580f19ec48b
Opcode Fuzzy Hash: 8174e861c2faa6f2f7f5292a0ee7474812abc1109b8acb2517e9a7bc716d8d39
Instruction Fuzzy Hash: 37419922B1578149EB619F25D8402A9A395FB84FA8F850276FE2D477C5DF3CE541C390

Function 00007FF7FEC166A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FEC15210: abort.LIBCMT ref: 00007FF7FEC15223

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF7FEC1674A
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF7FEC16776

Strings

csm, xrefs: 00007FF7FEC16876

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_recordabort
String ID: csm
API String ID: 2466640111-1018135373
Opcode ID: ef48871438151390fa300b301edbe87f2aaf35895cd4fd9de5e2d21b12dcaab2
Instruction ID: ad81bc8b41b06904b037faf46e1ad5cfa9f28a332bf0b902a6052875af48c1d8
Opcode Fuzzy Hash: ef48871438151390fa300b301edbe87f2aaf35895cd4fd9de5e2d21b12dcaab2
Instruction Fuzzy Hash: DD515E7362974187E720AB56E04026EB7A4FBC9BA0F940534EB9D07B95CF3CE451CB91

Function 00007FF7FEC24360 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF7FEC24446
WriteFile.KERNEL32 ref: 00007FF7FEC24479
GetLastError.KERNEL32 ref: 00007FF7FEC2449B

Strings

U, xrefs: 00007FF7FEC24424

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: a3c4996b5397ae7c68c43f4944c85cd830f0b958292ccb38960a62bfe152ddee
Instruction ID: c0511ac7d3a06d58335d24735088176a05b89e3456968082f538a4ae699799dc
Opcode Fuzzy Hash: a3c4996b5397ae7c68c43f4944c85cd830f0b958292ccb38960a62bfe152ddee
Instruction Fuzzy Hash: CD41A022A19A8182EB20EF25E8443BAB7A1FBC8794F844131FE5D87798DF7CD441C790

Function 00007FF7FEC090B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7FEC090D9
GetObjectW.GDI32 ref: 00007FF7FEC09107
ReleaseDC.USER32 ref: 00007FF7FEC091BB

Strings

, xrefs: 00007FF7FEC09153

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: ObjectRelease
String ID:
API String ID: 1429681911-3916222277
Opcode ID: 0b5772d91688d342ea342be5c9c3c9ea07a5ad9e93d570546deb1a9808731c40
Instruction ID: 2bdc857572170327e3eef989f5bdb20c9c8d40872af3dae834f5e608a74a9c61
Opcode Fuzzy Hash: 0b5772d91688d342ea342be5c9c3c9ea07a5ad9e93d570546deb1a9808731c40
Instruction Fuzzy Hash: 75314E356087418AEB18AF12BC1862AB761F789FD1F814435ED6A47B94CE3CD449CB50

Function 00007FF7FEBFE870 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,?,?,00007FF7FEC0317F,?,?,00001000,00007FF7FEBEE51D), ref: 00007FF7FEBFE8BB
CreateSemaphoreW.KERNEL32(?,?,?,00007FF7FEC0317F,?,?,00001000,00007FF7FEBEE51D), ref: 00007FF7FEBFE8CB
CreateEventW.KERNEL32(?,?,?,00007FF7FEC0317F,?,?,00001000,00007FF7FEBEE51D), ref: 00007FF7FEBFE8E4

Strings

Thread pool initialization failed., xrefs: 00007FF7FEBFE900

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 6610cce2f1ff4f40d78c24fcbab0d777ace7136147ab701da82aad1b7a389e44
Instruction ID: ce4308aa69eb0c2b1d306c9e4729d9b2cda2ac1b4fa1ec192cab4ba5d208e824
Opcode Fuzzy Hash: 6610cce2f1ff4f40d78c24fcbab0d777ace7136147ab701da82aad1b7a389e44
Instruction Fuzzy Hash: D1210632E1968186F710AF64D8447BD72A2FBD8B0CF988034DA2D0A2D5CF7E9445C7E4

Function 00007FF7FEC07778 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32 ref: 00007FF7FEC077C1
RegisterClassExW.USER32 ref: 00007FF7FEC077EC

Strings

RarHtmlClassName, xrefs: 00007FF7FEC077DC
P, xrefs: 00007FF7FEC077B3

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: ClassCursorLoadRegister
String ID: P$RarHtmlClassName
API String ID: 1693014935-552670043
Opcode ID: 66395fa0630a1625fd954670e03c4fb124a2b76a3b71242d49b815316c9f43a1
Instruction ID: d09d91f2277007dfe0055d549619fb823d24d277a4a9f0f2b2c1e5fb329d0e25
Opcode Fuzzy Hash: 66395fa0630a1625fd954670e03c4fb124a2b76a3b71242d49b815316c9f43a1
Instruction Fuzzy Hash: 32013932E04B41DEF7009FA0E8443AD73B4F748758F644238EE981AA58DF788155CB90

Function 00007FF7FEC085E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7FEC085EC
GetDeviceCaps.GDI32 ref: 00007FF7FEC085FD
ReleaseDC.USER32 ref: 00007FF7FEC0860A

Strings

, xrefs: 00007FF7FEC08610

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: CapsDeviceRelease
String ID:
API String ID: 127614599-3916222277
Opcode ID: a42f7bf34e2550c06df92b4c4441a28b155cc5d7cfc3f2a0da00e80f490195b4
Instruction ID: 2269a0f4ba63dc69b39b05e2a22b9ebc944461e8b6e289923de9848442d9dc8c
Opcode Fuzzy Hash: a42f7bf34e2550c06df92b4c4441a28b155cc5d7cfc3f2a0da00e80f490195b4
Instruction Fuzzy Hash: 44E0CD20B0C64186FB186775B98903A9362978CBD0F564035EA3F477D4CD3CC4C4C310

Function 00007FF7FEBED1A8 Relevance: 6.2, APIs: 4, Instructions: 238timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNEL32 ref: 00007FF7FEBED46C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBED554
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBED55A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBED560

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$FileTime
String ID:
API String ID: 1137671866-0
Opcode ID: 9c21b1f25fbccd14be34930bd084bba422da6d7fe28c10e58640f4972f681cfd
Instruction ID: 862a5e77e5eb1a28a57d90687886a7b505d5ec34ae67c01d93956cbecfe5181f
Opcode Fuzzy Hash: 9c21b1f25fbccd14be34930bd084bba422da6d7fe28c10e58640f4972f681cfd
Instruction Fuzzy Hash: 4DA1D362A18B8281EB10EB65E8405ADB371FFC5794FC05231EAAD07AE9DF7CE544C391

Function 00007FF7FEBF2CE0 Relevance: 6.1, APIs: 4, Instructions: 136fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(00007FF7FEBF8C9A), ref: 00007FF7FEBF2D22
WriteFile.KERNEL32 ref: 00007FF7FEBF2D6C
WriteFile.KERNEL32 ref: 00007FF7FEBF2D9A

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 36bd0183a846d9ba9312903715bf2ef21d1db3e0abb52a3d50b28083c89a0b57
Instruction ID: 635160412a458a31a38604ebeaf895697db53eeac2074400e4b3845a802810f5
Opcode Fuzzy Hash: 36bd0183a846d9ba9312903715bf2ef21d1db3e0abb52a3d50b28083c89a0b57
Instruction Fuzzy Hash: C551E622A1968292FB10AB65E854B7AE350FFC5B90FD40131EA7D06AD0DF3CE485C7A0

Function 00007FF7FEC00548 Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7FEC005FC
SetLastError.KERNEL32 ref: 00007FF7FEC00697

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: cfa26c4a097f1d9774ca1d21d3052aab459b5d34ed3f4bd27b06be766575ef65
Instruction ID: 3c84c9b8e547b8ba85e49f260a0af0d31752fcafd4581a35350f126dd17bf424
Opcode Fuzzy Hash: cfa26c4a097f1d9774ca1d21d3052aab459b5d34ed3f4bd27b06be766575ef65
Instruction Fuzzy Hash: 9051B162B14A4685FB00BB65D4452FCA322EBC5B98FC14532EA6C57BDADE2CD144C3E4

Function 00007FF7FEC09D90 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7FEC09DBC
GetLastError.KERNEL32 ref: 00007FF7FEC09E08
CreateDirectoryW.KERNEL32 ref: 00007FF7FEC09F10
LocalFree.KERNEL32 ref: 00007FF7FEC09F20

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: CreateCurrentDirectoryErrorFreeLastLocalProcess
String ID:
API String ID: 1077098981-0
Opcode ID: 3b698565756ad25c4425689a1d29b855ba2ab6589ff95071d83f0d5ba0ad07f7
Instruction ID: 697bfbd9ebf4e0185f24eb20d407f854fa1c6d33b2e4f1e49893ed0da7d10a56
Opcode Fuzzy Hash: 3b698565756ad25c4425689a1d29b855ba2ab6589ff95071d83f0d5ba0ad07f7
Instruction Fuzzy Hash: 6F515F32618B4286E7509F21E8447ADB375FBC4B84F901036FA6D97AA4DF3CD405CB90

Function 00007FF7FEC1DB5C Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FEC1DBAF
WideCharToMultiByte.KERNEL32 ref: 00007FF7FEC1DC81
GetLastError.KERNEL32 ref: 00007FF7FEC1DCA4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FEC1DCD6

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: fdb879c7c344a6dcddabd48f24568e2f5e84c2dc3f6ceef9c32cec135b3ccbbf
Instruction ID: 7fe587895c139691a57702d13beb239eec98a0d3678f27460e8c911030585012
Opcode Fuzzy Hash: fdb879c7c344a6dcddabd48f24568e2f5e84c2dc3f6ceef9c32cec135b3ccbbf
Instruction Fuzzy Hash: 3041B232A0C78246FB65AE14905037DEB90EFC0BB1F948531FA6D46AC9CF6CD841C7A0

Function 00007FF7FEBF3980 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32 ref: 00007FF7FEBF39BD
MoveFileW.KERNEL32 ref: 00007FF7FEBF3A34
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF3AEB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF3AF1

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: FileMove_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3823481717-0
Opcode ID: 9a9a58264430c11791c0c606b390f78d08ba3037c1fa37d6a31b7cedc8df9908
Instruction ID: 9f601dde5a89bfa303f4ef56636bc9245c37bdd6ce480999454d4029f8e1611d
Opcode Fuzzy Hash: 9a9a58264430c11791c0c606b390f78d08ba3037c1fa37d6a31b7cedc8df9908
Instruction Fuzzy Hash: E241B162F14B9184FB00EBB6E8455ACA371BF84BA4B805231EE7D1BAD9DF38D045C390

Function 00007FF7FEBF3684 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF7FEBF309D), ref: 00007FF7FEBF36CE
CreateDirectoryW.KERNEL32 ref: 00007FF7FEBF3733
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF7FEBF309D), ref: 00007FF7FEBF3791
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF37CE

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2359106489-0
Opcode ID: c4315f6e237c344fce324f4f2bddc8a7628f12fda2cf81b11bf7f20b6059f8a8
Instruction ID: 4d91e273b84b239550fb5cee598948790f3f75ba4b41477951625def84ec3d93
Opcode Fuzzy Hash: c4315f6e237c344fce324f4f2bddc8a7628f12fda2cf81b11bf7f20b6059f8a8
Instruction Fuzzy Hash: A731A262E0C6C281EB20BB65A444A7DE351BFC87A0FD40231EEBD4A6D5DF3CD44587A0

Function 00007FF7FEC20B78 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF7FEC1C45B), ref: 00007FF7FEC20B91
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF7FEC1C45B), ref: 00007FF7FEC20BF3
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF7FEC1C45B), ref: 00007FF7FEC20C2D
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF7FEC1C45B), ref: 00007FF7FEC20C57

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 23704c5f87cc5d65a6a85ab0da0438508b9fc27f2b888927c3d6011bf25654c1
Instruction ID: ddc4be8835df4a438a6cd3c876aebd7e6a88d94ec939ba423864f0864796d236
Opcode Fuzzy Hash: 23704c5f87cc5d65a6a85ab0da0438508b9fc27f2b888927c3d6011bf25654c1
Instruction Fuzzy Hash: 6E21A531F18B9181E724AF12A841029F6A5FBD4BD0B894135EEAE23BE4DF3CE452C350

Function 00007FF7FEC1D440 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7FEC17F28,?,?,?,00007FF7FEC19D35), ref: 00007FF7FEC1D44A
SetLastError.KERNEL32(?,?,?,00007FF7FEC17F28,?,?,?,00007FF7FEC19D35), ref: 00007FF7FEC1D4B2
SetLastError.KERNEL32(?,?,?,00007FF7FEC17F28,?,?,?,00007FF7FEC19D35), ref: 00007FF7FEC1D4C8
abort.LIBCMT ref: 00007FF7FEC1D4CE

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: df247b5a3948333368795c339682862bf84e23f7c025c70b8dad3e7beb060077
Instruction ID: a334eb97698032f6aa57191cda95dfa70c2d2a8b5b0fd9545456cef840c5aa70
Opcode Fuzzy Hash: df247b5a3948333368795c339682862bf84e23f7c025c70b8dad3e7beb060077
Instruction Fuzzy Hash: 61018822B0864242FB58B765AA5513C95A15FC47B1F840838FD3F067D6ED2CF841C2B1

Function 00007FF7FEBFE948 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FEBFECD8: ResetEvent.KERNEL32 ref: 00007FF7FEBFECF1
Part of subcall function 00007FF7FEBFECD8: ReleaseSemaphore.KERNEL32 ref: 00007FF7FEBFED07

ReleaseSemaphore.KERNEL32 ref: 00007FF7FEBFE974
CloseHandle.KERNEL32 ref: 00007FF7FEBFE993
DeleteCriticalSection.KERNEL32 ref: 00007FF7FEBFE9AA
CloseHandle.KERNEL32 ref: 00007FF7FEBFE9B7

Part of subcall function 00007FF7FEBFEA5C: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FEBFE95F,?,?,?,00007FF7FEBF463A,?,?,?), ref: 00007FF7FEBFEA63
Part of subcall function 00007FF7FEBFEA5C: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FEBFE95F,?,?,?,00007FF7FEBF463A,?,?,?), ref: 00007FF7FEBFEA6E

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: CloseHandleReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 502429940-0
Opcode ID: 7c4c69b688bb09167c3d8ec6f4195a818a409db0987586a56ae23aa503e7e0cd
Instruction ID: 537a00d7fd4269ed1c7488c7b461c8d3a716907a4fef9d0e11c8760723b91522
Opcode Fuzzy Hash: 7c4c69b688bb09167c3d8ec6f4195a818a409db0987586a56ae23aa503e7e0cd
Instruction Fuzzy Hash: 2001ED37A14A9192E758AB21E98466DE321FBC4B90F804031EB7D076A5CF39E4B5C794

Function 00007FF7FEC08590 Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF7FEC08598
GetDeviceCaps.GDI32 ref: 00007FF7FEC085AE
GetDeviceCaps.GDI32 ref: 00007FF7FEC085C2
ReleaseDC.USER32 ref: 00007FF7FEC085D3

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: de15d0a72ac65e47349a1b4cc9ca260558533dfe27db70e7b1e031f833f09c6c
Instruction ID: 11d9a22671d8346d243a918f6c3f62754b47cb47f64b4b49aae56ce4fccde6cb
Opcode Fuzzy Hash: de15d0a72ac65e47349a1b4cc9ca260558533dfe27db70e7b1e031f833f09c6c
Instruction Fuzzy Hash: C6E01260E0D70286FF297B766C59136A292AF88741F898439E93F4A3D0DD3CA085C760

Function 00007FF7FEBEE34C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBEE549

Strings

DXGIDebug.dll, xrefs: 00007FF7FEBEE35A

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: DXGIDebug.dll
API String ID: 3668304517-540382549
Opcode ID: e7651ac11b2f684bb7122a8860872b45a6cc5eba0690d4c353d0561425072845
Instruction ID: 48d91af4a571181fb379a6755f57c6ec407af23a4f8f9d84a4148c322cb3a204
Opcode Fuzzy Hash: e7651ac11b2f684bb7122a8860872b45a6cc5eba0690d4c353d0561425072845
Instruction Fuzzy Hash: 7571CD72A14B8186EB14DB65E8407ADB3A8FB94794F804236DBAD07B95DF7CE061C390

Function 00007FF7FEC1E1F4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FEC1E237

Strings

e+000, xrefs: 00007FF7FEC1E2DF
gfff, xrefs: 00007FF7FEC1E362

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: ffbcb58cc87a1110f60409a8afde5d08377aab6ce8cf060c3284a5669936e3c2
Instruction ID: 80ceeed0d174a981cf953f1f5fcd74b2878b2960f160750c5d48792511c8946c
Opcode Fuzzy Hash: ffbcb58cc87a1110f60409a8afde5d08377aab6ce8cf060c3284a5669936e3c2
Instruction Fuzzy Hash: 61513A62B187C14AE725AF35984036DAB91EBC1BA0F888231E7BC87BD6CF2CD444C751

Function 00007FF7FEBF9408 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FEBF95A8: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7FEBF95E6

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF959C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEBF95A2

Strings

SIZE, xrefs: 00007FF7FEBF9443

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$swprintf
String ID: SIZE
API String ID: 449872665-3243624926
Opcode ID: 95182320ee7b3a48c420107a4992996f84afbbac13f0d5532198c1d22c251322
Instruction ID: 57ddc3ef416d38541107d3768f5e32f90fbe4c9afcfba0bae9f71b2c7c54e07d
Opcode Fuzzy Hash: 95182320ee7b3a48c420107a4992996f84afbbac13f0d5532198c1d22c251322
Instruction Fuzzy Hash: DB41C162A1878685EF10AB95E4417BDE350EFC57A0FD04232FABD466EAEE3CD540C790

Function 00007FF7FEC1C2C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FEC1C2EA
GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FF7FEC12CD5), ref: 00007FF7FEC1C30B

Strings

C:\Users\user\Desktop\68#U2591.exe, xrefs: 00007FF7FEC1C2F9

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\68#U2591.exe
API String ID: 3307058713-1388781261
Opcode ID: 2b307fc7043d57580c2760bc14d10e66149d3294dbd6a1f00798eb6953a6f573
Instruction ID: a1d929be008d87566c4882c1e2ecbaf3fcd0d4655adda25d633038d34aa2e08c
Opcode Fuzzy Hash: 2b307fc7043d57580c2760bc14d10e66149d3294dbd6a1f00798eb6953a6f573
Instruction Fuzzy Hash: 4C417032A0865286EB18EF25A4404FCA795EBC4BA4BD44036FA6D47BD5DE3DE441C3A1

Function 00007FF7FEBF9638 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7FEBF96EA

Part of subcall function 00007FF7FEC00F68: WideCharToMultiByte.KERNEL32 ref: 00007FF7FEC00F99

Strings

@%s, xrefs: 00007FF7FEBF96CE
$%s, xrefs: 00007FF7FEBF96D7

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: ByteCharMultiWide_snwprintf
String ID: $%s$@%s
API String ID: 2650857296-834177443
Opcode ID: 68d6d98aec82f67e7f26d78b4367655257a27e60e60eb814561ac576190adeba
Instruction ID: d26445db5d44bb195ba31dc48584a24f7fd66efca0e80cbe3b09394eeca5c1a6
Opcode Fuzzy Hash: 68d6d98aec82f67e7f26d78b4367655257a27e60e60eb814561ac576190adeba
Instruction Fuzzy Hash: 4431C672B18A8655EB10AFA6D4406E9A3A0FB84784FC01032EE7D077E9DF3DE505D790

Function 00007FF7FEC0FA80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7FEC0FBD3

Strings

c:\, xrefs: 00007FF7FEC0FADD
Software\WinRAR SFX, xrefs: 00007FF7FEC0FB12

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: Software\WinRAR SFX$c:\
API String ID: 3668304517-2538208311
Opcode ID: 9720fa09b182028469021de2c29ba7ab9608411a5fa033cd0cb0118181a87e38
Instruction ID: 251375b5f2b3f87eeb8f440b4b1b46756c196001d5a1b4a82c90da7a5256cdc0
Opcode Fuzzy Hash: 9720fa09b182028469021de2c29ba7ab9608411a5fa033cd0cb0118181a87e38
Instruction Fuzzy Hash: 4B414172608A4189EB10EF25E8546A9B3A5FBC8798F801631FA6C43AD8DF7CD195C750

Function 00007FF7FEC1EB04 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF7FEC1EB76
GetFileType.KERNEL32 ref: 00007FF7FEC1EB8C

Strings

@, xrefs: 00007FF7FEC1EBB7

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: 01c4e23626c5bd34e0d32a71787dfe5976e9b76bf070a7e2fa99837352baeece
Instruction ID: 9b8ae988b1876151032dc255967159edf86f1106e3962faa2c86e3b4320f2bbf
Opcode Fuzzy Hash: 01c4e23626c5bd34e0d32a71787dfe5976e9b76bf070a7e2fa99837352baeece
Instruction Fuzzy Hash: 82219322E08A8285EB64AB25989013DA651EBC5774F681336E67F477D4CE3CD881C3A5

Function 00007FF7FEC14078 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7FEC11D3E), ref: 00007FF7FEC140BC
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7FEC11D3E), ref: 00007FF7FEC14102

Strings

csm, xrefs: 00007FF7FEC140EF

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 995ce70781ed1107fbe35a2df86b6ab92d82f2488d4e31342cdb9a65d606da21
Instruction ID: 7b4e7c7d2e37bc17456d77b816b18b7d27529b4f28278d1d1faa582bb6e570a2
Opcode Fuzzy Hash: 995ce70781ed1107fbe35a2df86b6ab92d82f2488d4e31342cdb9a65d606da21
Instruction Fuzzy Hash: F6114F32608B4182EB209F15E840269B7E1FB88B94F584235EFAD07798DF3CD955CB40

Function 00007FF7FEBFEAA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 00007FF7FEBFEAE0
SetThreadPriority.KERNEL32 ref: 00007FF7FEBFEB36

Strings

CreateThread failed, xrefs: 00007FF7FEBFEAEE

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: Thread$CreatePriority
String ID: CreateThread failed
API String ID: 2610526550-3849766595
Opcode ID: cf4f3858e1c5421656891f758a667cd72a6f2059ba57d4f8d940dbc9b5e0f540
Instruction ID: 6827863ee19b92db10cf67510e3406026b20f5e21b1639c1df9967a853bbef6c
Opcode Fuzzy Hash: cf4f3858e1c5421656891f758a667cd72a6f2059ba57d4f8d940dbc9b5e0f540
Instruction Fuzzy Hash: 04118231A08A8291EB10EF50E881579F361FBC4794FD44135E66D026E9DF3CE551C7E0

Function 00007FF7FEBFEA5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FEBFE95F,?,?,?,00007FF7FEBF463A,?,?,?), ref: 00007FF7FEBFEA63
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00007FF7FEBFE95F,?,?,?,00007FF7FEBF463A,?,?,?), ref: 00007FF7FEBFEA6E

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00007FF7FEBFEA78

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1211598281-2248577382
Opcode ID: 98ce5a6e9b01a49333d4d7b683bb298ff4a8e953ba0927a3bf2f7aa8eb90df55
Instruction ID: 33a3e0b4132b00e6da78c1a2574f4b9dcaa4b82556b95a77bda58ebbbb71bba7
Opcode Fuzzy Hash: 98ce5a6e9b01a49333d4d7b683bb298ff4a8e953ba0927a3bf2f7aa8eb90df55
Instruction Fuzzy Hash: FBE01A22E1984291F710B7609C82878A2127FE1770FD00330E03E415F59E2CA945C3E2

Function 00007FF7FEBFA43C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7FEBFA447
FindResourceW.KERNEL32 ref: 00007FF7FEBFA45D

Strings

RTL, xrefs: 00007FF7FEBFA453

Memory Dump Source

Source File: 00000000.00000002.3248834239.00007FF7FEBE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FEBE0000, based on PE: true

Associated: 00000000.00000002.3248820422.00007FF7FEBE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248861968.00007FF7FEC28000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC3B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248880662.00007FF7FEC40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3248911008.00007FF7FEC4E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7febe0000_68#U2591.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: e39cf6139d6c3c808756c827088780cb49cd2dd94430b396554b51375d39015a
Instruction ID: 3c5f27e7fd3774f735f0afee6a8d15c939075c4bf170eac25da272fbd7c4fa45
Opcode Fuzzy Hash: e39cf6139d6c3c808756c827088780cb49cd2dd94430b396554b51375d39015a
Instruction Fuzzy Hash: 5ED05B51F0964541FF196775584573452505F5CF41FC44038DC6D063D4DE2CD084C7A0

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 68#U2591.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: 68#U2591.exePID: 6576, Parent PID: 1028

General

Chronological Activities

Disassembly

Analysis Process: 68#U2591.exePID: 6576, Parent PID: 1028COMMON

Execution Graph

Graph

Executed Functions

Function 00007FF7FEC0B190 Relevance: 111.7, APIs: 52, Strings: 11, Instructions: 1421windowfilesleepCOMMON

Function 00007FF7FEC0CE88 Relevance: 65.0, APIs: 25, Strings: 11, Instructions: 1963fileCOMMON

Function 00007FF7FEC10754 Relevance: 42.4, APIs: 19, Strings: 5, Instructions: 380filesleeptimeCOMMON

Control-flow Graph

Function 00007FF7FEBFA4AC Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 250COMMON

Windows Analysis Report
68#U2591.exe

Function 00007FF7FEC10754 Relevance: 42.4, APIs: 19, Strings: 5, Instructions: 380
filesleeptimeCOMMON

Function 00007FF7FEBFA4AC Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 250
COMMON

Function 00007FF7FEC08624 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 101
memorywindowCOMMON

Function 00007FF7FEBFDFD0 Relevance: 143.9, APIs: 16, Strings: 66, Instructions: 440
libraryfileloaderCOMMON

Function 00007FF7FEC11900 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 195
libraryCOMMONLIBRARYCODE

Function 00007FF7FEC07B28 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 122
COMMON

Function 00007FF7FEC06E80 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 204
memoryCOMMON

Function 00007FF7FEBF24C0 Relevance: 9.2, APIs: 6, Instructions: 164
filetimeCOMMON

Function 00007FF7FEC0AE1C Relevance: 7.5, APIs: 5, Instructions: 27
windowCOMMON

Function 00007FF7FEC091E8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33
COMMON

Function 00007FF7FEC12D6C Relevance: 6.1, APIs: 4, Instructions: 94
COMMON

Function 00007FF7FEBF2320 Relevance: 6.1, APIs: 4, Instructions: 58
fileCOMMON

Function 00007FF7FEC0B014 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54
windowCOMMON

Function 00007FF7FEBE1EC4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Function 00007FF7FEC0946C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26
comCOMMON